From patchwork Thu Nov 19 20:58:39 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Zhou X-Patchwork-Id: 547124 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from archives.nicira.com (li376-54.members.linode.com [96.126.127.54]) by ozlabs.org (Postfix) with ESMTP id DA4C1140307 for ; Sat, 21 Nov 2015 13:17:24 +1100 (AEDT) Received: from archives.nicira.com (localhost [127.0.0.1]) by archives.nicira.com (Postfix) with ESMTP id 1576010890; Fri, 20 Nov 2015 18:17:07 -0800 (PST) X-Original-To: dev@openvswitch.com Delivered-To: dev@openvswitch.com Received: from mail-pa0-f44.google.com (mail-pa0-f44.google.com [209.85.220.44]) by archives.nicira.com (Postfix) with ESMTPS id C956410885 for ; Fri, 20 Nov 2015 18:17:05 -0800 (PST) Received: by pacdm15 with SMTP id dm15so133307333pac.3 for ; Fri, 20 Nov 2015 18:17:05 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=IT8yelfsu/jI5ouhOtW2+2r0R34IX7TJw5+xp0CjLhU=; b=STaSsaz2WttTE+W/LPr3BAYUct6hSDf9qLjitA0zkL0enNWZAVcsODqsN9EMlr8xar +C5duI2px/AlNjIhCB85z9JXZfe2h+kMOSahMgsAmwbUf1uns6/o9CNa1DSVlyY7iyWG /V9a+/r9jRrPjbw+G+fW2iP+hj7MYPJ5xXjr6+GgusVX4/Zd3DqbUklkYrwbB+ai/g0P UwXTuzc6DrSHLfWkjI2ks1C/WzlWPGQ3o+0+chhcqC8mdDSVYEEUF5eAo4y1ghIGTI4U Sd0AMQUDbPiCyFw4RiBSTu9gDBHTgTeFRNh4YIctXq1CmKlLA2AeLSOyfufGC8A+QfDg a/Xw== X-Received: by 10.98.87.16 with SMTP id l16mr2936217pfb.80.1448072225237; Fri, 20 Nov 2015 18:17:05 -0800 (PST) Received: from htb-1n-eng-dhcp295.eng.vmware.com ([208.91.1.34]) by smtp.gmail.com with ESMTPSA id tp6sm1309858pbc.81.2015.11.20.18.17.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 Nov 2015 18:17:04 -0800 (PST) From: Andy Zhou To: dev@openvswitch.com Date: Thu, 19 Nov 2015 12:58:39 -0800 Message-Id: <1447966722-18204-4-git-send-email-azhou@ovn.org> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1447966722-18204-1-git-send-email-azhou@ovn.org> References: <1447966722-18204-1-git-send-email-azhou@ovn.org> Subject: [ovs-dev] [rhel --user 4/7] utilities: add --user option to ovs-ctl X-BeenThere: dev@openvswitch.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dev-bounces@openvswitch.org Sender: "dev" Allow ovs-ctl to take --user=USER option. When this option is specified 'USER' will be parsed in the format of 'user:group" and be set into shell variables $OVS_USER and $OVS_GROUP, which will be used by shell functions, such as start_daemon() to run OVS daemons under the specified user. Signed-off-by: Andy Zhou Acked-by: Ben Pfaff --- utilities/ovs-ctl.8 | 4 ++++ utilities/ovs-ctl.in | 4 ++++ utilities/ovs-lib.in | 22 ++++++++++++++++++++++ 3 files changed, 30 insertions(+) diff --git a/utilities/ovs-ctl.8 b/utilities/ovs-ctl.8 index 6a9a544..50e3118 100644 --- a/utilities/ovs-ctl.8 +++ b/utilities/ovs-ctl.8 @@ -123,6 +123,10 @@ another string is specified \fBovs\-ctl\fR uses it literally. The following options should be specified if the defaults are not suitable: . +.IP "\fB\-\-user=\fIuser[:group]\fR" +Run OVS daemons as the user specified. When this options is specified, OVS +daemons will run with the least privileges necessary. +. .IP "\fB\-\-system\-type=\fItype\fR" .IQ "\fB\-\-system\-version=\fIversion\fR" Sets the value to store in the \fBsystem-type\fR and diff --git a/utilities/ovs-ctl.in b/utilities/ovs-ctl.in index c9d75df..4162add 100755 --- a/utilities/ovs-ctl.in +++ b/utilities/ovs-ctl.in @@ -573,6 +573,7 @@ Less important options for "start", "restart" and "force-reload-kmod": --daemon-cwd=DIR set working dir for OVS daemons (default: $DAEMON_CWD) --no-force-corefiles do not force on core dumps for OVS daemons --no-mlockall do not lock all of ovs-vswitchd into memory + --user=USER run ovs daemons as the root user of ovs user (default: $OVS_USER:$OVS_GROUP) --ovsdb-server-priority=NICE set ovsdb-server's niceness (default: $OVSDB_SERVER_PRIORITY) --ovs-vswitchd-priority=NICE set ovs-vswitchd's niceness (default: $OVS_VSWITCHD_PRIORITY) @@ -685,6 +686,9 @@ do ;; esac done + +set_ovs_user_group $USER + case $command in start) start_ovsdb || exit 1 diff --git a/utilities/ovs-lib.in b/utilities/ovs-lib.in index 3fbc2f5..38b9905 100644 --- a/utilities/ovs-lib.in +++ b/utilities/ovs-lib.in @@ -128,6 +128,28 @@ pid_exists () { test -d /proc/"$1" } +set_ovs_user_group() { + value=$1 # user spec (e.g. ovs:ovs) + + case $value in + [a-z]*:*) + OVS_USER=`expr X"$value" : 'X\(.*\):.*'` + OVS_GROUP=`expr X"$value" : 'X[^:]*:\(.*\)'` + if test X"$OVS_GROUP" = X; then + OVS_GROUP=$OVS_USER + fi + ;; + [a-z]*) + OVS_USER=`expr X"$value" : 'X\(.*\)'` + OVS_GROUP=$OVS_USER + ;; + *) + OVS_USER=root + OVS_GROUP=root + ;; + esac +} + pid_comm_check () { [ "$1" = "`cat /proc/$2/comm`" ] }