[Bug 1864922] Re: ussuri libvirt missing access to /var/lib/nova/instances/

[Corey Bryant]

The o+x can be explained by nova/virt/libvirt/driver.py:

 2384             with utils.tempdir(dir=snapshot_directory) as tmpdir:
 2385                 try:
 2386                     out_path = os.path.join(tmpdir, snapshot_name)
 2387                     if live_snapshot:
 2388                         # NOTE(xqueralt): libvirt needs o+x in the tempdir
 2389                         os.chmod(tmpdir, 0o701)
 2390                         self._live_snapshot(context, instance, guest,
 2391                                             disk_path, out_path, source_format,
 2392                                             image_format, instance.image_meta)
 2393                     else:
 2394                         root_disk.snapshot_extract(out_path, image_format)
 2395                     LOG.info("Snapshot extracted, beginning image upload",
 2396                              instance=instance)

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to nova in Ubuntu.
https://bugs.launchpad.net/bugs/1864922

Title:
  ussuri libvirt missing access to /var/lib/nova/instances/

Status in nova package in Ubuntu:
  Fix Released

Bug description:
  focal/ussuri has an updated pkgos-gen-systemd-unit (openstack-pkg-
  tools) which sets the UMask to 0027, preventing other users from any
  access to files created by the service. In this case, the nova-compute
  service creates instance files at run-time that libvirt needs access
  to.

  ussuri:
  drwxr-x---  2 nova nova  /var/lib/nova/instances/1726e122-2d91-44c1-939b-dd4638df06ed

  train:
  drwxr-xr-x  2 nova nova  /var/lib/nova/instances/da355106-e7f0-4d23-8b4c-91defbfdd696

  It seems like the best solution is to use the default UMask of 0022
  for the nova-compute systemd unit file.

  Note that nova-common.postinst already sets /var/log/nova permissions
  to 0750, preventing other users from reading logs, which was the
  original intent of having pkgos-gen-systemd-unit set UMask to 0027.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nova/+bug/1864922/+subscriptions