sysctl: don't modify /etc/sysctl.conf#776
Conversation
To configure firewall rules, CloudStack modifies `/etc/sysctl.conf` and
execute those modifications. This may be harmful for several reasons:
1. `/etc/sysctl.conf` may be managed by some configuration management
system. Such a system will constantly restore the previous version.
2. `/etc/sysctl.conf` may contain additional properties that have been
changed later by some system administrator (for example, once a
firewall has been configured, forwarding may have been activated
while it is disabled in `/etc/sysctl.conf`). Executing the file
again at a later time may disrupt the system.
3. Entries are added again and again. `/etc/sysctl.conf` will contain
the same directives repeated several times.
Using a configuration file is not needed as `sysctl` is able to directly
modify sysctl values with `-w` flag.
Signed-off-by: Vincent Bernat <Vincent.Bernat@exoscale.ch>
|
cloudstack-pull-rats #503 SUCCESS |
|
Salut Vincent I agree, but AFAIK there is a |
|
Use a cloud(stack).conf file under /etc/sysctl.d/ seems better and follow the distro philosophy. |
|
cloudstack-pull-analysis #436 SUCCESS |
|
@resmo Yes, it could be in |
|
+1 for /etc/sysctl.d/cloudStack.conf |
|
LGTM. We do not need a persistent file since this PY file will be called during runtime. |
|
While looks good, I'll wait for comments from @remibergsma @miguelaferreira Ian and others on it was done this way? |
|
If we do not need to persist a file, LGTM |
|
We have to LGTMs. Are we merging this? |
|
I prefer a persistent config (you know where to search for it) and not a dynamic one with hard coded values. If these would be dynamic, then it is clear to use the .py. but they are not so why not write them down? |
|
@resmo the only problem with shipping a |
|
@vincentbernat Agreed, if we want a persistent file we should fix it in the packaging and not in the Python code. Code should never create files in a dynamic way like this. |
|
@wido @vincentbernat agree |
|
I went through the file history and it has been like this since when it was pushed (back in 2012). The change makes sense and the explanations given about having or not a conf file were also instructive. In my opinion, this should be merged. 👍 Who will do the honours? :) Cheers, |
sysctl: don't modify /etc/sysctl.confTo configure firewall rules, CloudStack modifies `/etc/sysctl.conf` and
execute those modifications. This may be harmful for several reasons:
1. `/etc/sysctl.conf` may be managed by some configuration management
system. Such a system will constantly restore the previous version.
2. `/etc/sysctl.conf` may contain additional properties that have been
changed later by some system administrator (for example, once a
firewall has been configured, forwarding may have been activated
while it is disabled in `/etc/sysctl.conf`). Executing the file
again at a later time may disrupt the system.
3. Entries are added again and again. `/etc/sysctl.conf` will contain
the same directives repeated several times.
Using a configuration file is not needed as `sysctl` is able to directly
modify sysctl values with `-w` flag.
Signed-off-by: Vincent Bernat <Vincent.Bernat@exoscale.ch>
* pr/776:
sysctl: don't modify /etc/sysctl.conf
Signed-off-by: Wido den Hollander <wido@widodh.nl>
Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com> Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
9 participants
To configure firewall rules, CloudStack modifies
/etc/sysctl.confandexecute those modifications. This may be harmful for several reasons:
/etc/sysctl.confmay be managed by some configuration managementsystem. Such a system will constantly restore the previous version.
/etc/sysctl.confmay contain additional properties that have beenchanged later by some system administrator (for example, once a
firewall has been configured, forwarding may have been activated
while it is disabled in
/etc/sysctl.conf). Executing the fileagain at a later time may disrupt the system.
/etc/sysctl.confwill containthe same directives repeated several times.
Using a configuration file is not needed as
sysctlis able to directlymodify sysctl values with
-wflag.Signed-off-by: Vincent Bernat Vincent.Bernat@exoscale.ch