Merge lp:~pwlars/charms/trusty/adt-cloud-worker/acw-charm-exec-user into lp:~canonical-ci-engineering/charms/trusty/adt-cloud-worker/trunk

[Paul Larson]

Run the worker as a normal user, rather than the user that was used to install the code.

Use a different user to run the worker than the user that was used to install the code, so that there's no risk anything in the worker can be used to modify itself.

[Celso Providelo (cprov)]

Paul,

Well done and great timing!

It will only work after https://code.launchpad.net/~cprov/charms/trusty/adt-cloud-worker/uci-nova/+merge/252769 lands, moving the security setup (specifically the ssh-keygen) to adt-run, which will run as the worker user, instead of "root".

[]

review: Approve

[Ubuntu CI Bot (uci-bot)]

Attempt to merge into lp:~canonical-ci-engineering/charms/trusty/adt-cloud-worker/trunk failed due to conflicts:

text conflict in hooks/actions.py
text conflict in hooks/services.py

[lp:~pwlars/charms/trusty/adt-cloud-worker/acw-charm-exec-user]

13. By Paul Larson on 2015-03-12

merge

14. By Paul Larson on 2015-03-12

whitespace

[Celso Providelo (cprov)]

Paul,

Thanks for fixing the conflicts and investigating if there isn't anything better than "sudo -u xxx" for running jobs as a different user. We will have to wait for upstart 1.4+ ...

review: Approve

[Paul Larson (pwlars)]

review: Needs Resubmitting

[Celso Providelo (cprov)]

review: Approve

=== modified file 'hooks/actions.py'
--- hooks/actions.py	2015-03-12 15:33:33 +0000
+++ hooks/actions.py	2015-03-12 18:32:51 +0000
@@ -5,6 +5,7 @@
 
 from charmhelpers import fetch
 from charmhelpers.core import hookenv
+from charmhelpers.core.host import adduser
 
 from charmhelpers.payload.archive import extract_tarfile
 
@@ -43,6 +44,10 @@
         f.write(config_content)
 
 
+def create_user(service_name):
+    adduser('acw-worker')
+
+
 def install_adt_uci_nova(service_name):
     hookenv.log('Attempting to install "uci-nova" autopkgtest ssh-setup ...')
     shutil.copy2(

=== modified file 'hooks/services.py'
--- hooks/services.py	2015-03-12 15:33:33 +0000
+++ hooks/services.py	2015-03-12 18:32:51 +0000
@@ -18,6 +18,7 @@
                 actions.get_cloud_worker_from_tarball,
                 actions.install_python_packages,
                 actions.get_config_file,
+                actions.create_user,
                 actions.install_adt_uci_nova,
                 helpers.render_template(
                     source='upstart.conf',

=== modified file 'templates/upstart.conf'
--- templates/upstart.conf	2015-03-05 01:09:53 +0000
+++ templates/upstart.conf	2015-03-12 18:32:51 +0000
@@ -15,8 +15,8 @@
 
 script
 
-  mkdir -p ${SERVICE_DIR}/logs
+  install -d -o acw-worker ${SERVICE_DIR}/logs
   chdir ${SERVICE_DIR}
-  exec ./ve/bin/python3 adt-cloud-worker.py >> logs/adt-cloud-worker.log 2>&1
+  exec sudo -u acw-worker sh -c "./ve/bin/python3 adt-cloud-worker.py >> logs/adt-cloud-worker.log 2>&1"
 
 end script