Skip to content

Run lxc commands as non root by default#56

Merged
lucasmoura merged 2 commits into
canonical:masterfrom
lucasmoura:lxd-run-as-non-root
Nov 26, 2020
Merged

Run lxc commands as non root by default#56
lucasmoura merged 2 commits into
canonical:masterfrom
lucasmoura:lxd-run-as-non-root

Conversation

@lucasmoura
Copy link
Copy Markdown

@lucasmoura lucasmoura commented Nov 18, 2020

In ubuntu-advantage-tools, we require some LXD commands to be run as non-root. This PR changes the default behavior of LXD to run exec commands as non-root.

This will impact some cloud-init tests, but we already have a PR to handle that

@TheRealFalcon
Copy link
Copy Markdown
Contributor

Actually...lxd is the exception for us as all other clouds already execute non-root. This may actually simplify things for us 🙂

Copy link
Copy Markdown
Contributor

@TheRealFalcon TheRealFalcon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Travis is failing as this will break cloud-init tests, but once canonical/cloud-init#664 lands it should be a one-line fix. Since we've pinned our pycloudlib version, I'm not concerned these failures.

Copy link
Copy Markdown
Collaborator

@blackboxsw blackboxsw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once canonical/cloud-init#694 lands, this looks good to land

Copy link
Copy Markdown
Contributor

@OddBloke OddBloke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The conclusion we came to in canonical/cloud-init#664 was that pycloudlib should consistently execute commands as an unprivileged user by default. This aligns LXD with the other clouds in pycloudlib which use SSH.

Copy link
Copy Markdown
Contributor

@OddBloke OddBloke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per canonical/cloud-init#694 (comment), running commands as UID 1000 is not the same as running commands as self.username. I believe this will need modification to look up the UID of self.username before running lxc exec for the first time.

@lucasmoura
Copy link
Copy Markdown
Author

@OddBloke I have updated the code to get the user id before running any lxc exec commands.

The solution I have is to retry the id -u command until the user was created. With that solution, I think we can drop from LXD the call for _wait_for_execute, since the user_id property is kind of covering that already

Comment thread pycloudlib/lxd/instance.py Outdated
Copy link
Copy Markdown
Contributor

@OddBloke OddBloke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@lucasmoura lucasmoura merged commit 7532404 into canonical:master Nov 26, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants