From 2bd15db0364f225b5af39e2b98e1c12cb75e52d4 Mon Sep 17 00:00:00 2001
From: cmart <cmart@cyverse.org>
Date: Thu, 30 Mar 2017 11:00:55 -0700
Subject: [PATCH] nova user can read kernel for libguestfs on Ubuntu

Problem: libvirt password/key injection uses libguestfs to mount the
guest filesystem. libguestfs uses a supermin appliance, and in order to
create this appliance, libguestfs (running as nova user) must read the
host's kernel. Unfortunately, Ubuntu sets file permissions which make
compressed kernels non-readable to non-root users, and this breaks
libvirt password/key injection on compute hosts running Ubuntu.

Solution: When compute hosts are running Ubuntu AND the deployer has
enabled libvirt password or SSH key injection, do the following:
- Run `dpkg-statoverride` to set file permissions on compressed
  kernel (/boot/vmlinuz-*), readable to group 'nova'
- Install a script which does same for each new kernel installed via
  system updates in the future

Related-Bug: #1507915
Change-Id: Ic96b69bb80ce11001b2ee5d63324a12b0f68456d
---
 defaults/main.yml                 |  3 +++
 files/nova_kernel_permissions.sh  | 20 ++++++++++++++++
 tasks/nova_compute_kvm.yml        |  6 +++++
 tasks/nova_kernel_permissions.yml | 39 +++++++++++++++++++++++++++++++
 4 files changed, 68 insertions(+)
 create mode 100644 files/nova_kernel_permissions.sh
 create mode 100644 tasks/nova_kernel_permissions.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index 28b3e603..2fa90f8c 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -288,6 +288,9 @@ nova_wsgi_processes: "{{ [[ansible_processor_vcpus|default(1), 1] | max * 2, nov
 nova_wsgi_buffer_size: 65535
 
 ## Nova libvirt
+# Warning: If nova_libvirt_inject_key or nova_libvirt_inject_password are enabled for Ubuntu compute hosts
+# then the kernel will be made readable to nova user (a requirement for libguestfs).
+# See Launchpad bugs 1507915 (Nova), 759725 (Ubuntu), and http://libguestfs.org/guestfs-faq.1.html
 nova_libvirt_inject_key: False
 # inject partition options:
 #  -2 => disable, -1 => inspect (libguestfs only), 0 => not partitioned, >0 => partition number
diff --git a/files/nova_kernel_permissions.sh b/files/nova_kernel_permissions.sh
new file mode 100644
index 00000000..00808715
--- /dev/null
+++ b/files/nova_kernel_permissions.sh
@@ -0,0 +1,20 @@
+#/bin/sh
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+version="$1"
+if [ -z "$version" ]; then
+  exit 0
+fi
+exec dpkg-statoverride --update --add root nova 0640 "/boot/vmlinuz-${version}"
diff --git a/tasks/nova_compute_kvm.yml b/tasks/nova_compute_kvm.yml
index efd1db56..594833e7 100644
--- a/tasks/nova_compute_kvm.yml
+++ b/tasks/nova_compute_kvm.yml
@@ -33,6 +33,12 @@
     - nova-config
     - nova-kvm
 
+- name: Set kernel permissions to enable libguestfs features (Ubuntu)
+  include: nova_kernel_permissions.yml
+  when:
+    - ansible_distribution == 'Ubuntu'
+    - nova_libvirt_inject_key | bool or nova_libvirt_inject_password | bool
+
 - name: Set libvirtd config
   template:
     src: libvirtd.conf.j2
diff --git a/tasks/nova_kernel_permissions.yml b/tasks/nova_kernel_permissions.yml
new file mode 100644
index 00000000..2cf5d9fe
--- /dev/null
+++ b/tasks/nova_kernel_permissions.yml
@@ -0,0 +1,39 @@
+---
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Find installed kernels
+  find:
+    paths: '/boot'
+    patterns: 'vmlinuz-*'
+  register: kernels
+
+- name: Determine latest installed kernel
+  set_fact:
+    latest_kernel: "{{ kernels.files | map(attribute='path') | sort(reverse=True) | first }}"
+
+- name: Latest kernel readable to nova group/user
+  command: 'dpkg-statoverride --update --add root nova 0640 {{ latest_kernel }}'
+  register: dpkg_statoverride_result
+  changed_when: >
+    'an override for \'{{ latest_kernel }}\' already exists; aborting'
+    not in dpkg_statoverride_result.stderr
+  failed_when: >
+    (dpkg_statoverride_result.rc != 0) and
+    ('an override for \'{{ latest_kernel }}\' already exists; aborting'
+    not in dpkg_statoverride_result.stderr)
+
+- name: Script installed to make future kernels readable to nova group/user
+  copy:
+    src: 'nova_kernel_permissions.sh'
+    dest: '/etc/kernel/postinst.d/nova_kernel_permissions.sh'
+    mode: '0755'