Project

General

Profile

Actions

Feature #5954

closed

teuthology implicitly depends on /etc/security changes; could be more friendly if it didn't

Added by Dan Mick over 10 years ago. Updated over 10 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
-
Target version:
% Done:

0%

Source:
other
Tags:
Backport:
Reviewed:
Affected Versions:

Description

Loïc discovered that teuthology (specifically the task runners) depend on changes to /etc/security to
allow adjust-ulimits to run and set unlimited core and 16K open files. These are currently hacked by
our ceph-qa-chef code: https://github.com/ceph/ceph-qa-chef/blob/f1c0aa840f26a9c1dbdbe9a7a07bcc34202ca900/cookbooks/ceph-qa/recipes/default.rb#L13 which sets up:

    ubuntu hard nofile 16384

and

fedora, centos, redhat edit /etc/security/limits.conf to allow soft coresize limits:

sed -i 's/^#\*.*soft.*core.*0/\*                soft    core            unlimited/g' /etc/security/limits.conf

as well as

    sed -i 's/ requiretty/ !requiretty/g' /etc/sudoers
    sed -i 's/ !visiblepw/ visiblepw/g' /etc/sudoers

and also set up /etc/security/limits.d/remote.conf to contain

*   hard    core   unlimited

(and actually those last two seem redundant, or at least weird that they exist in two
totally different places).

It seems like it would be cleaner if we just require the test user to be passwordless-sudo
(which I think we already do) and add appropriate sudo calls in the right places. Sage thinks
this might involve separating the ulimit calls in adjust-ulimits to "those that need unl core"
and "those that need nofile". Should probably also straighten out who needs the hard vs soft
core limit.

Actions #1

Updated by Dan Mick over 10 years ago

  • Description updated (diff)
Actions #2

Updated by Loïc Dachary over 10 years ago

  • Description updated (diff)
Actions #3

Updated by Sage Weil over 10 years ago

  • Tracker changed from Bug to Feature
Actions #4

Updated by Sage Weil over 10 years ago

  • Target version set to v0.68 - continued
Actions #5

Updated by Sage Weil over 10 years ago

  • Translation missing: en.field_story_points set to 3.00
Actions #6

Updated by Ian Colle over 10 years ago

  • Assignee set to Zack Cerza
Actions #7

Updated by Dan Mick over 10 years ago

  • Description updated (diff)
Actions #8

Updated by Ian Colle over 10 years ago

  • Target version changed from v0.68 - continued to v0.69
Actions #9

Updated by Zack Cerza over 10 years ago

I am implementing this as an internal.limits subtask.

Actions #10

Updated by Zack Cerza over 10 years ago

  • Status changed from New to In Progress
Actions #11

Updated by Zack Cerza over 10 years ago

  • Status changed from In Progress to Fix Under Review
Actions #12

Updated by Zack Cerza over 10 years ago

  • Status changed from Fix Under Review to In Progress

Back to the drawing board

Actions #13

Updated by Zack Cerza over 10 years ago

Consensus seems to be that we should implement this by splitting the one helper into two. It also seems like chef doesn't actually need to be modifying limits.conf.

Actions #14

Updated by Zack Cerza over 10 years ago

  • Status changed from In Progress to Fix Under Review

This changeset modifies adjust-ulimits so that it only sets nofiles if running as root. It also updates all the callers of adjust-ulimits that were using sudo to ensure that they are putting sudo before adjust-ulimits.

https://github.com/ceph/teuthology/pull/73

Actions #15

Updated by Zack Cerza over 10 years ago

  • Status changed from Fix Under Review to Resolved
Actions #16

Updated by Zack Cerza over 10 years ago

  • Status changed from Resolved to Fix Under Review

This changeset reverts our modifications to /etc/sudoers when we're done.

https://github.com/ceph/teuthology/pull/76

Actions #17

Updated by Zack Cerza over 10 years ago

  • Status changed from Fix Under Review to Resolved
Actions

Also available in: Atom PDF