[Bug 1864922] Re: ussuri libvirt missing access to /var/lib/nova/instances/

[Corey Bryant]

Fixed in nova 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu3

** Changed in: nova (Ubuntu)
     Assignee: (unassigned) => Corey Bryant (corey.bryant)

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to nova in Ubuntu.
https://bugs.launchpad.net/bugs/1864922

Title:
  ussuri libvirt missing access to /var/lib/nova/instances/

Status in nova package in Ubuntu:
  New

Bug description:
  focal/ussuri has an updated pkgos-gen-systemd-unit (openstack-pkg-
  tools) which sets the UMask to 0027, preventing other users from any
  access to files created by the service. In this case, the nova-compute
  service creates instance files at run-time that libvirt needs access
  to.

  ussuri:
  drwxr-x---  2 nova nova  /var/lib/nova/instances/1726e122-2d91-44c1-939b-dd4638df06ed

  train:
  drwxr-xr-x  2 nova nova  /var/lib/nova/instances/da355106-e7f0-4d23-8b4c-91defbfdd696

  It seems like the best solution is to use the default UMask of 0022
  for the nova-compute systemd unit file.

  Note that nova-common.postinst already sets /var/log/nova permissions
  to 0750, preventing other users from reading logs, which was the
  original intent of having pkgos-gen-systemd-unit set UMask to 0027.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nova/+bug/1864922/+subscriptions