python-nova: run services as nova user instead of root

With this change we now run both the nova controller services and compute
node agents as the dedicated "nova" user.

Changes to configuration were made to relocated locks and logs to nova
writeable directories. Wherever possible configuration files and directories
have been changed to nova instead of root (with the notable exception of
rootwrap configuration).

nova has also been granted sudo privileges to run rootwrap commands.

And finally, a libvirt system group has been created and nova added to
that group. This allows the compute agent to communicate with libvirtd
via the "libvirt" group while keeping permissions tight.

Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/meta-openstack/recipes-devtools/python/python-nova/nova.init b/meta-openstack/recipes-devtools/python/python-nova/nova.init
index 3a2bbac..c2882b6 100644
--- a/meta-openstack/recipes-devtools/python/python-nova/nova.init
+++ b/meta-openstack/recipes-devtools/python/python-nova/nova.init
@@ -30,7 +30,8 @@ start ()
 
     echo -n "Starting $DESC..."
 
-    start-stop-daemon --start --quiet --background \
+    sudo -u nova \
+        start-stop-daemon --start --quiet --background \
         --pidfile ${PIDFILE} --make-pidfile --exec ${DAEMON}
 
     if [ $? -eq 0 ]; then