Hi,<br><br>that was a matter of debate during the development of LVM support in OpenNebula. We finally concluded that the best option was to use /sbin/<command name> directly, that way sysadmins can choose to permit to the oneadmin user sudo access only to a certain subset of LVM commands instead of all of them.<br>
<br>We listed in the sudoers file only the commands we used in the TM scripts:<br>oneadmin ALL=NOPASSWD: /sbin/lvcreate, /sbin/lvremove, /sbin/lvs, /bin/dd<br><br>If you are thinking of extending the TM scripts and require more lvm commands the alternative you suggest should work very nicely. You would need to modify the TM scripts to call lvm <command> instead of <command> directly, but that shouldn't be a problem.<br>
<br>regards,<br>Jaime<br><br><br><br><div class="gmail_quote">On Thu, Nov 5, 2009 at 5:52 PM, Shi Jin <span dir="ltr"><<a href="mailto:jinzishuai@gmail.com">jinzishuai@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi there,<br>
<br>
I think we have to enable the oneadmin user to run the lvm commands on<br>
the host using LVM, right?<br>
Currently, this works for me in the /etc/sudoer<br>
oneadmin ALL=(ALL) NOPASSWD: /sbin/lv* *<br>
However, this is not a very general case since there are other lvm<br>
commands such as vgdisplay.<br>
The fact that all those commands are aliases to the /sbin/lvm command<br>
make it easy.<br>
If we have<br>
oneadmin ALL=(ALL) NOPASSWD: /sbin/lvm *<br>
then we can run sudo lvm vgdisplay or any lvm command without password<br>
as oneadmin.<br>
However, this requires all the lvm commands executed in the format of<br>
/sbin/lvm <command name> instead of the /sbin/<command name> directly.<br>
<br>
Do you think this is a good way to setup the OpenNebula LVM code?<br>
Thanks.<br>
<font color="#888888">--<br>
Shi Jin, Ph.D.<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
</font></blockquote></div><br>