Rsync capability issue

Rsync when not run as root user, it needs group id and user id setter capability.
  cap_setgid
  cap_setuid

Change-Id: I396e0f4868492f8bb55f77229658e4dc6e05fcdc
Signed-off-by: Balazs Szekeres <balazs.szekeres@nokia.com>

diff --git a/SPECS/swift.spec b/SPECS/swift.spec
index fd35728..c26c8f4 100644 (file)
--- a/SPECS/swift.spec
+++ b/SPECS/swift.spec
@@ -15,7 +15,7 @@
 %define COMPONENT swift
 %define RPM_NAME caas-%{COMPONENT}
 %define RPM_MAJOR_VERSION 2.22.0
-%define RPM_MINOR_VERSION 0
+%define RPM_MINOR_VERSION 1
 %define IMAGE_TAG %{RPM_MAJOR_VERSION}-%{RPM_MINOR_VERSION}
 Name:           %{RPM_NAME}
 Version:        %{RPM_MAJOR_VERSION}

diff --git a/ansible/roles/swift/templates/main/swift_main.yml b/ansible/roles/swift/templates/main/swift_main.yml
index 7953160..a5560f4 100644 (file)
--- a/ansible/roles/swift/templates/main/swift_main.yml
+++ b/ansible/roles/swift/templates/main/swift_main.yml
@@ -40,7 +40,7 @@ spec:
           image: {{ container_image_names | select('search', '/swift') | list | last }}
           securityContext:
             capabilities:
-              add: ["NET_BIND_SERVICE"]
+              add: ["NET_BIND_SERVICE", "SETGID", "SETUID"]
           args:
             - BACKEND
           resources:

diff --git a/ansible/roles/swift/templates/update/swift_update.yml b/ansible/roles/swift/templates/update/swift_update.yml
index cffc531..a98a5b9 100644 (file)
--- a/ansible/roles/swift/templates/update/swift_update.yml
+++ b/ansible/roles/swift/templates/update/swift_update.yml
@@ -40,7 +40,7 @@ spec:
           image: {{ container_image_names | select('search', '/swift') | list | last }}
           securityContext:
             capabilities:
-              add: ["NET_BIND_SERVICE"]
+              add: ["NET_BIND_SERVICE", "SETGID", "SETUID"]
           args:
             - BACKEND
           resources:

diff --git a/docker-build/swift/Dockerfile b/docker-build/swift/Dockerfile
index 4233618..2ff94a9 100644 (file)
--- a/docker-build/swift/Dockerfile
+++ b/docker-build/swift/Dockerfile
@@ -156,6 +156,6 @@ python-lxml python-chardet python-requests \
 &&  yum clean all \
 &&  rm -rf /etc/yum.repos.d/luxembourg.repo \
 &&  rm -rf ${GOPATH} \
-&&  setcap 'cap_net_bind_service=+ep' /usr/bin/rsync
+&&  setcap 'cap_setgid,cap_setuid,cap_net_bind_service=+ep' /usr/bin/rsync
 
 ENTRYPOINT ["/usr/bin/mainstart.sh"]