Merge lp:~james-page/nova/fix-lxc-and-primary-group into lp:~ubuntu-server-dev/nova/diablo

[James Page]

Fixup issues with primary group ownership of new files for upgraded nova installations
Ensure that ownership of files in LXC mounted volumes under /var/lib/nova do not get updated to nova:nova

[Scott Moser (smoser)]

A couple thoughts on this
 - I was initially confused about $(groups | awk '{print 3}) , as '3' seemed strange. groups does seem to output the primary group of a user as the first field, but I think that 'id -gn <user>' more explicitly requests that. I will admit to wishing the documentation for 'id' said "primary group" rather than just "effective group", but I looked at source and it does: 'rgid = egid = pwd->pw_gid;'.
    I know this is nitpick.

 - I'm concerned about the '-mount' argument to 'find'.
   If the user has done something like:
   mount --bind /some/large/filesystem /var/lib/nova/instances
   or even:
   mount /dev/sdb1 /var/lib/nova/instances

   I think that we'd avoid changing ownership of those files. I don't know how serious this is.
   One quick fix I had would be to do this:
   # change ownership of files under /var/lib/nova/ except rootfs (LP: #861260)
   find /var/lib/nova/ -name 'rootfs' -prune -o -exec chown nova:nova {} \;

[lp:~james-page/nova/fix-lxc-and-primary-group]

210. By James Page on 2011-09-28

Exclude mounted LXC rootfs filesystems within /var/lib/nova from
user/group ownership changes (LP: #861260).

211. By James Page on 2011-09-28

tabs to spaces

[Scott Moser (smoser)]

For reference, James and I had a long-ish conversation in ubuntu-server over this. It begins around 13:08.
http://irclogs.ubuntu.com/2011/09/28/%23ubuntu-server.html#t13:08

[Dave Walker (davewalker)]

smoser / james: Did this progress?

Thanks

[Chuck Short (zulcss)]

Any update on this?

[lp:~james-page/nova/fix-lxc-and-primary-group]

212. By James Page on 2011-09-29

Updated to only run /var/lib/nova chown pre 0ubuntu4

213. By James Page on 2011-09-29

[James Page]
[Ante Karamatic]
* Add /usr/sbin/ietadm to sudoers (LP: #861547)
* debian/control: Fix typo in Vcs-Bzr
[Chuck Short]
* debian/patches/backport-libvirt-console-pipe.patch:
  Move console.log to a ringbuffer so that the console.log
  keeps filling up. (LP: #832507)
* debian/patches/backport-lxc-container-console-fix.patch:
  Make euca-get-console-output usable for LXC containers.
  (LP: #832159)
* debian/patches/backport-snapshot-cleanup.patch:

214. By James Page on 2011-09-29

Added quote to ensure works OK on first install

=== modified file 'debian/changelog'
--- debian/changelog	2011-09-29 18:57:57 +0000
+++ debian/changelog	2011-09-29 20:55:27 +0000
@@ -1,4 +1,11 @@
-nova (2011.3-0ubuntu4) UNRELEASED; urgency=low
+nova (2011.3-0ubuntu4) oneiric; urgency=low
+
+  [James Page]
+  * debian/nova-common.postinst:
+    - Exclude mounted LXC rootfs filesystems within /var/lib/nova from 
+      user/group ownership changes (LP: #861260).
+    - Ensure that primary group for 'nova' user is 'nova' so that files
+      created by this user have the correct group ownership.
 
   [Ante Karamatic]
   * Add /usr/sbin/ietadm to sudoers (LP: #861547)
@@ -13,7 +20,7 @@
     (LP: #832159)
   * debian/patches/backport-snapshot-cleanup.patch:
 
- -- Chuck Short <[e-mail]>  Thu, 29 Sep 2011 13:00:07 -0400
+ -- James Page <[e-mail]>  Thu, 29 Sep 2011 21:48:44 +0100
 
 nova (2011.3-0ubuntu3) oneiric; urgency=low
 
 
=== modified file 'debian/nova-common.postinst'
--- debian/nova-common.postinst	2011-09-27 01:38:20 +0000
+++ debian/nova-common.postinst	2011-09-29 20:55:27 +0000
@@ -7,7 +7,17 @@
     if ! getent passwd nova > /dev/null 2>&1; then
         adduser --system --home /var/lib/nova --ingroup nova --no-create-home --shell /bin/bash nova
     fi
-    chown -R nova:nova /var/lib/nova/ /var/log/nova/ /etc/nova/nova.conf
+    if [ "$(id -gn nova)"  = "nogroup" ]; then
+        usermod -g nova nova
+    fi
+    chown -R nova:nova /var/log/nova/ /etc/nova/nova.conf
+    if dpkg --compare-versions "$2" lt "2011.3-0ubuntu4"; then
+        # Make sure the LXC rootfs mount points are excluded
+        find /var/lib/nova/ -name 'rootfs' -prune -o \
+           -group root -a -user nova -exec chown nova:nova {} \;
+        find /var/lib/nova/ -name 'rootfs' -prune -o \
+           -group nogroup -a -user nova -exec chown nova:nova {} \;
+    fi
     chmod 600 /etc/nova/nova.conf
     chmod 0440 /etc/sudoers.d/nova_sudoers
     if ! grep -q sql_connection /etc/nova/nova.conf