Home Improving How OpenStack Nova Runs Privileged Commands

Improving How OpenStack Nova Runs Privileged Commands

OpenStack release manager Thierry Carrez examines OpenStack Nova’s current privilege model and how it’s being improved with the root_helper option.

Right now, OpenStack uses sudo to escalate privileges when it needs to run a root command. The problem with this, says Thierry, is that sudo doesn’t provide a way to efficiently filter commands, which could be used to exploit systems.

“As an example, the current nova_sudoers file contains commands like chown, kill, dd or tee, which are more than enough to compromise a target system completely,” says Thierry.

To fix this, Thierry worked on a filter that gives Nova a configurable “root helper.” By default, this is still sudo but it could be something else. The “something else” is what Thierry is working on now, and taking feedback as well.

The primary goals are:

  • Provide a command filter that checks arguments as well as commands run.
  • Provide a way to run as users other than root when root privileges aren’t necessary.
  • Separate filters by the type of node running Nova, as not all nodes need to run root commands at all.

Thierry is working on a Python based implementation of this, and looking for feedback on other necessary features. Any other features that Thierry should be looking at?

About ReadWrite’s Editorial Process

The ReadWrite Editorial policy involves closely monitoring the tech industry for major developments, new product launches, AI breakthroughs, video game releases and other newsworthy events. Editors assign relevant stories to staff writers or freelance contributors with expertise in each particular topic area. Before publication, articles go through a rigorous round of editing for accuracy, clarity, and to ensure adherence to ReadWrite's style guidelines.

Get the biggest tech headlines of the day delivered to your inbox

    By signing up, you agree to our Terms and Privacy Policy. Unsubscribe anytime.

    Tech News

    Explore the latest in tech with our Tech News. We cut through the noise for concise, relevant updates, keeping you informed about the rapidly evolving tech landscape with curated content that separates signal from noise.

    In-Depth Tech Stories

    Explore tech impact in In-Depth Stories. Narrative data journalism offers comprehensive analyses, revealing stories behind data. Understand industry trends for a deeper perspective on tech's intricate relationships with society.

    Expert Reviews

    Empower decisions with Expert Reviews, merging industry expertise and insightful analysis. Delve into tech intricacies, get the best deals, and stay ahead with our trustworthy guide to navigating the ever-changing tech market.