openvnet
openvnet copied to clipboard
Use groups instead of users for WebAPI and VNMGR
This is related to issue https://github.com/axsh/openvnet/issues/28.
Problem
In https://github.com/axsh/openvnet/pull/299 we changed WebAPI and VNMGR to run as their own user. After a discussion with @akry, it was decided that it is better to use groups. All users in the groups should be able to start their respective services.
Solution
- Create 2 groups.
vnet-webapiandvnet-vnmgr. - Keep the users created in https://github.com/axsh/openvnet/pull/299 but add them to their respective groups.
- In the upstart job, check for the correct group.
- If part of the correct group, start the process.
- if root, start the process as the default user. (the one set as
VNET_USERin the/etc/defaultfiles.) - if a non-root user from another group tries to start the process, fail with a proper error saying they do not have permission to do such things as those.