| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-10-04 | |||
| 08:57:17 | auniyal__ | while testing this test, when controls comes here - https://review.opendev.org/c/openstack/nova/+/791135/7/nova/compute/manager.py#9045 | |
| 08:57:35 | auniyal__ | context ctxt is set to None, | |
| 08:58:51 | auniyal__ | we need this to be nova.context.RequestContext, so we can get node_name | |
| 08:59:29 | auniyal__ | what changes I should make in unit test so context get set | |
| 09:00:07 | auniyal__ | this unit test is failing right now with this error - *** AttributeError: 'NoneType' object has no attribute '_enginefacade_context' | |
| 10:13:07 | opendevreview | Amit Uniyal proposed openstack/nova master: [compute] always set instnace.host in post_livemigration https://review.opendev.org/c/openstack/nova/+/791135 | |
| 10:51:06 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: compute: enhance compute evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858383 | |
| 10:51:06 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: api: extend evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858384 | |
| 11:19:01 | sean-k-mooney | bauzas: im just double checking the shas now but im going to approve the final release patch for nova/placment ectra if you have no objections | |
| 11:19:16 | sean-k-mooney | to my knoladage we do not have any issues that would require another RC correct | |
| 11:20:17 | sean-k-mooney | https://etherpad.opendev.org/p/nova-zed-rc-potential looks clean to me | |
| 11:22:23 | sean-k-mooney | oh just noticed you did it this morning i was going to ping you about it yesterday but it was too late when i tought of it | |
| 11:35:15 | gibi | auniyal__: you are passing None as ctx from the unit test right now https://review.opendev.org/c/openstack/nova/+/791135/7/nova/tests/unit/compute/test_compute_mgr.py#10223 so if you need a real context then pass one in. if you look at the tests around your test case you will see that there is self.context available to pass | |
| 11:38:35 | auniyal__ | ack gibi | |
| 11:39:27 | auniyal__ | I missed this, so I moved the retriving node_name, before calling this function and it passed | |
| 11:40:42 | auniyal__ | also regarding error, while retriving node name I changed the exception. I have added a comment in new change | |
| 12:55:52 | opendevreview | Amit Uniyal proposed openstack/nova master: [compute] always set instnace.host in post_livemigration https://review.opendev.org/c/openstack/nova/+/791135 | |
| 14:15:35 | auniyal__ | Hi sean-k-mooney | |
| 14:15:44 | auniyal__ | regarding adding functional test for VM snapshot | |
| 14:15:51 | auniyal__ | in continuation of older discussion | |
| 14:16:04 | auniyal__ | <sean-k-mooney> which makes me thing that the libvirt fixture is not currently in use | |
| 14:16:04 | auniyal__ | ||
| 14:16:04 | auniyal__ | <sean-k-mooney> the libvirt fixture shoudl be mockign this out | |
| 14:16:18 | auniyal__ | I was not sure, how to proceed further, so added fake_get_absolute_limit in fixtures.cinder | |
| 14:16:28 | auniyal__ | and then it failed at https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L3239 | |
| 14:16:28 | auniyal__ | here - https://github.com/openstack/nova/blob/master/nova/tests/fixtures/cinder.py | |
| 14:16:28 | auniyal__ | this - https://paste.opendev.org/show/bEV0xVXGyuWohgRHE9Vm/ | |
| 14:16:40 | auniyal__ | as the properties are not set with VOLUME which is used via fixture - | |
| 14:16:41 | auniyal__ | now this went further, but then again it failed at - https://github.com/openstack/nova/blob/master/nova/compute/api.py#L3511 | |
| 14:16:41 | auniyal__ | this - https://paste.opendev.org/show/bJgH2kLDa65iRCz9HuIt/ | |
| 14:16:41 | auniyal__ | So I added one more constant IMAGE_BACKED_VOL_QUIESCE | |
| 14:16:41 | auniyal__ | https://github.com/openstack/nova/blob/aad31e6ba489f720f5bdc765c132fd0f059a0329/nova/tests/fixtures/cinder.py#L154 | |
| 14:16:45 | auniyal__ | with same error which I was getting earlier | |
| 14:16:57 | auniyal__ | ===> keystoneauth1.exceptions.catalog.EmptyCatalog: The service catalog is empty. | |
| 14:36:18 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: api: extend evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858384 | |
| 14:36:18 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: compute: enhance compute evacuate instance to support target state https://review.opendev.org/c/openstack/nova/+/858383 | |
| 14:55:37 | artom | sahid, ohhai, long time no see | |
| 15:06:58 | bauzas | reminder: nova meeting in 54 mins | |
| 15:51:23 | bauzas | last reminder : nova meeting in 9 mins (and I have to update the agenda, oh man) | |
| 16:00:15 | opendevmeet | The meeting name has been set to 'nova' | |
| 16:00:15 | bauzas | #startmeeting nova | |
| 16:00:15 | opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | |
| 16:00:15 | opendevmeet | Meeting started Tue Oct 4 16:00:15 2022 UTC and is due to finish in 60 minutes. The chair is bauzas. Information about MeetBot at http://wiki.debian.org/MeetBot. | |
| 16:00:21 | bauzas | hey stackers | |
| 16:00:29 | gibi | o/ | |
| 16:00:33 | bauzas | #link https://wiki.openstack.org/wiki/Meetings/Nova#Agenda_for_next_meeting | |
| 16:01:04 | elodilles | o/ | |
| 16:02:05 | bauzas | okay, let's start, hopefully people will join later | |
| 16:02:28 | bauzas | #topic Bugs (stuck/critical) | |
| 16:02:34 | bauzas | #info No Critical bug | |
| 16:02:39 | bauzas | #link https://bugs.launchpad.net/nova/+bugs?search=Search&field.status=New 4 new untriaged bugs (-1 since the last meeting) | |
| 16:02:43 | Uggla | o/ | |
| 16:02:51 | auniyal__ | O/ | |
| 16:02:59 | bauzas | the etherpad I created for this week's triage https://etherpad.opendev.org/p/nova-bug-triage-20220927 | |
| 16:03:38 | bauzas | and I have one security bug I'd like to discuss with the team, now we made it public | |
| 16:03:52 | bauzas | #link https://bugs.launchpad.net/nova/+bug/1989008 Security bug | |
| 16:04:16 | bauzas | I was consider it to close it as Wontfix | |
| 16:04:20 | bauzas | considering* | |
| 16:04:32 | JayF | o/ | |
| 16:05:19 | bauzas | tl;dr: depending on your sudoers rules, you can trick nova user | |
| 16:05:37 | bauzas | we could change our privsep rules to be more restrictive | |
| 16:05:45 | sean-k-mooney[m] | i filed a downstream backlog item to adress it properly | |
| 16:05:47 | bauzas | but we prefer deferring to the host config | |
| 16:05:58 | bauzas | about the permissions rights | |
| 16:06:01 | sean-k-mooney[m] | so longterm i think we shoudl rewirte how we use privesep | |
| 16:06:14 | bauzas | I don't disagree | |
| 16:06:19 | sean-k-mooney[m] | but i dont think we will have time in A | |
| 16:06:24 | bauzas | but this is a long-term effort | |
| 16:06:32 | bauzas | yeah and very tedious effort | |
| 16:06:53 | sean-k-mooney[m] | i personally would not mind tipping away at this over time | |
| 16:07:04 | bauzas | for that reason, I think this is valid to close this bug as Wontfix | |
| 16:07:05 | sean-k-mooney[m] | but not sure i can do it in A | |
| 16:07:17 | bauzas | as this is actually more a request for enhancement than a really butg | |
| 16:07:20 | bauzas | bug* | |
| 16:07:38 | sean-k-mooney[m] | i have no objection to that as its really a speless blueprint or spec in my view | |
| 16:07:57 | bauzas | of course, deployers and openstack distros need to properly care about this bug | |
| 16:08:08 | bauzas | and make sure the rights they give are correctly set | |
| 16:08:19 | sean-k-mooney[m] | its not quite an architectual change but it is a desgin pattern change | |
| 16:08:31 | bauzas | but from an upstream perspective, given no further effort can be simply made, we need to close it | |
| 16:08:42 | bauzas | sean-k-mooney: yeah a refactoring change | |
| 16:08:45 | bauzas | but, | |
| 16:08:51 | sean-k-mooney[m] | so currently it cannot lead to privladge escalation if you dont already have the ablity to spwan the privsep helper | |
| 16:08:57 | sean-k-mooney[m] | or have access to the unix socket of an exsiting one | |
| 16:08:58 | bauzas | sean-k-mooney: we correctly need to make it | |
| 16:09:09 | bauzas | sean-k-mooney: exactly my point | |
| 16:09:29 | bauzas | unless you fucked up with your sudo rights, you shouldn't hit this bug | |
| 16:09:39 | sean-k-mooney[m] | yep | |
| 16:10:02 | sean-k-mooney[m] | its kind of like exposing the docker socket to a container | |
| 16:10:10 | bauzas | so, agreed as Wontfix and leave a note saying we're not against modifying our privsep use, but this is deferred for now ? | |
| 16:10:29 | sean-k-mooney[m] | ok with me | |
| 16:10:40 | bauzas | no objections so far ? | |
| 16:11:03 | gibi | please explain in the bug (if not yet explained) that it cannot lead to escalation if you don't have the rights to spawn the privsep_helper | |
| 16:11:19 | bauzas | gibi: I explained it when I replied but I'll redo it | |
| 16:11:19 | gibi | or talkt to the socket | |
| 16:11:33 | gibi | bauzas: if it is there already then it is OK | |
| 16:11:55 | bauzas | gibi: quote from myself "I agree with all the above. Unless the user is accepted by sudoers to have root priviledges, it can't use privsep to get what they want from the kernel, so this isn't an exploit." | |
| 16:12:07 | gibi | cool then | |
| 16:12:08 | gibi | thanks | |
| 16:12:10 | bauzas | (comment #9) | |
| 16:12:16 | gibi | sorry I not read through the bug | |