Move execs of tee to privsep.

Instead of calling tee to write to files as root, we should just
write to files as root.

Change-Id: Ic48087fdf283b3ba503294a944be91be0c338132

2 files changed, 33 insertions, 1 deletions

diff --git a/nova/privsep/__init__.py b/nova/privsep/__init__.py
index 608a040790..76029ad30b 100644
--- a/nova/privsep/__init__.py
+++ b/nova/privsep/__init__.py
@@ -15,13 +15,14 @@
 
 """Setup privsep decorator."""
 
+from oslo_privsep import capabilities
 from oslo_privsep import priv_context
 
 # NOTE(tonyb): DAC == Discriminatory Access Control.  Basically this context
 #              can bypass permissions checks in the file-system.
 dac_admin_pctxt = priv_context.PrivContext(
     'nova',
-    cfg_section='nova_privileged',
+    cfg_section='nova_dac_admin',
     pypath=__name__ + '.dac_admin_pctxt',
     # NOTE(tonyb): These map to CAP_CHOWN, CAP_DAC_OVERRIDE,
     #              CAP_DAC_READ_SEARCH  and CAP_FOWNER.  Some do not have
@@ -29,3 +30,12 @@ dac_admin_pctxt = priv_context.PrivContext(
     #              for more information
     capabilities=[0, 1, 2, 3],
 )
+
+
+# NOTE(mikal): DAC + CAP_NET_ADMIN, required for network sysfs changes
+dacnet_admin_pctxt = priv_context.PrivContext(
+    'nova',
+    cfg_section='nova_dacnet_admin',
+    pypath=__name__ + '.dacnet_admin_pctxt',
+    capabilities=[0, 1, 2, 3, capabilities.CAP_NET_ADMIN],
+)
diff --git a/nova/privsep/libvirt.py b/nova/privsep/libvirt.py
index d5dc6c8c84..6c2844f318 100644
--- a/nova/privsep/libvirt.py
+++ b/nova/privsep/libvirt.py
@@ -55,3 +55,25 @@ def _last_bytes_inner(file_like_object, num):
 
     remaining = file_like_object.tell()
     return (file_like_object.read(), remaining)
+
+
+@nova.privsep.dacnet_admin_pctxt.entrypoint
+def enable_hairpin(interface):
+    """Enable hairpin mode for a libvirt guest."""
+    with open('/sys/class/net/%s/brport/hairpin_mode' % interface, 'w') as f:
+        f.write('1')
+
+
+@nova.privsep.dacnet_admin_pctxt.entrypoint
+def disable_multicast_snooping(interface):
+    """Disable multicast snooping for a bridge."""
+    with open('/sys/class/net/%s/bridge/multicast_snooping' % interface,
+              'w') as f:
+        f.write('0')
+
+
+@nova.privsep.dacnet_admin_pctxt.entrypoint
+def disable_ipv6(interface):
+    """Disable ipv6 for a bridge."""
+    with open('/proc/sys/net/ipv6/conf/%s/disable_ipv' % interface, 'w') as f:
+        f.write('1')