Allow ovs-ctl to take --user=USER[:GROUP] option. When this option
is specified, they will be parsed and set into shell variables
$OVS_USER and $OVS_GROUP, which will be used by other shell functions,
such as start_daemon() to run OVS daemons under the specified user.
Signed-off-by: Andy Zhou <az...@ovn.org>
Acked-by: Ben Pfaff <b...@ovn.org>
v1->v2: fix ovs-ctl manpage format, added more content
---
utilities/ovs-ctl.8 | 5 +++++
utilities/ovs-ctl.in | 6 ++++++
utilities/ovs-lib.in | 22 ++++++++++++++++++++++
3 files changed, 33 insertions(+)
diff --git a/utilities/ovs-ctl.8 b/utilities/ovs-ctl.8
index 6a9a544..7e3c870 100644
--- a/utilities/ovs-ctl.8
+++ b/utilities/ovs-ctl.8
@@ -123,6 +123,11 @@ another string is specified \fBovs\-ctl\fR uses it
literally.
The following options should be specified if the defaults are not
suitable:
.
+.IP "\fB\-\-user=\fIuser\fR[\fB:\fIgroup\fR]"
+Run OVS daemons as the user specified. When this options is specified, OVS
+daemons will run with the least privileges necessary, and switch the
+deemon process's real and effective user and group to the ones specified.
+.
.IP "\fB\-\-system\-type=\fItype\fR"
.IQ "\fB\-\-system\-version=\fIversion\fR"
Sets the value to store in the \fBsystem-type\fR and
diff --git a/utilities/ovs-ctl.in b/utilities/ovs-ctl.in
index c9d75df..e128889 100755
--- a/utilities/ovs-ctl.in
+++ b/utilities/ovs-ctl.in
@@ -535,6 +535,8 @@ set_defaults () {
SYSTEM_TYPE=unknown
SYSTEM_VERSION=unknown
fi
+
+ USER="root:root"
}
usage () {
@@ -573,6 +575,7 @@ Less important options for "start", "restart" and
"force-reload-kmod":
--daemon-cwd=DIR set working dir for OVS daemons (default:
$DAEMON_CWD)
--no-force-corefiles do not force on core dumps for OVS daemons
--no-mlockall do not lock all of ovs-vswitchd into memory
+ --user=USER[:GROUP] run ovs daemons as the root user of ovs user
(default: $OVS_USER:$OVS_GROUP)
--ovsdb-server-priority=NICE set ovsdb-server's niceness (default:
$OVSDB_SERVER_PRIORITY)
--ovs-vswitchd-priority=NICE set ovs-vswitchd's niceness (default:
$OVS_VSWITCHD_PRIORITY)
@@ -685,6 +688,9 @@ do
;;
esac
done
+
+set_ovs_user_group $USER
+
case $command in
start)
start_ovsdb || exit 1
diff --git a/utilities/ovs-lib.in b/utilities/ovs-lib.in
index 34e2041..ad223c0 100644
--- a/utilities/ovs-lib.in
+++ b/utilities/ovs-lib.in
@@ -128,6 +128,28 @@ pid_exists () {
test -d /proc/"$1"
}
+set_ovs_user_group() {
+ value=$1 # user spec (e.g. ovs:ovs)
+
+ case $value in
+ [a-z]*:*)
+ OVS_USER=`expr X"$value" : 'X\(.*\):.*'`
+ OVS_GROUP=`expr X"$value" : 'X[^:]*:\(.*\)'`
+ if test X"$OVS_GROUP" = X; then
+ OVS_GROUP=$OVS_USER
+ fi
+ ;;
+ [a-z]*)
+ OVS_USER=`expr X"$value" : 'X\(.*\)'`
+ OVS_GROUP=$OVS_USER
+ ;;
+ *)
+ OVS_USER=root
+ OVS_GROUP=root
+ ;;
+ esac
+}
+
pid_comm_check () {
[ "$1" = "`cat /proc/$2/comm`" ]
}
--
1.8.3.1
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
