devstack gate should remove /etc/sudoers.d/50_stack_sh before testing

As an example, the tests on https://review.openstack.org/#/c/8747/ should have failed until https://review.openstack.org/#/c/8842/1 was merged... but they passed :)

Devstack-gate runs as the jenkins user, which itself has sudo permissions on the devstack jenkins slaves. Those are needed before and after the script to do things like reset and collect syslog files. Because devstack-gate runs devstack as jenkins, with sudo, devstack does _not_ create a 'stack' user and install the 50_stack_sh file.

Instead, I think we could do the following:

Have devstack-gate run devstack as root to allow it to set up the stack user and sudoers file. Then run devstack as 'stack' ("sudo -u devstack ./stack.sh"). Then remove the 50_stack_sh. Then run tests as stack.

That still may not close all the holes. For each service, devstack runs a lot of commands that require sudo before launching the service. That means that the initial startup of each service is able to run with full sudo capability, even if we remove the sudo file later on. The configuration and starting of services is interleaved, so it wouldn't even be straightforward to find a place in devstack to remove the sudoers file. Further fun: it looks like the quantum agent is started with sudo.

But I don't know if you're concerned about nova having sudo access during startup vs. just ongoing operation.

Most run_as_root stuff runs at createserver/createvolume time, although I /think/ a number of network setup stuff runs at start-time.

I agree that still leaves a few corner cases, but at least that would allow us to catch the most blatant issues. Like not having installed the required filter files at all.

Worth a try, at least.

Fix proposed to branch: master
Review: https://review.openstack.org/8884

Reviewed: https://review.openstack.org/8884
Committed: http://github.com/openstack-ci/devstack-gate/commit/2a4390d13e5f46e81d898a29987385a0fe29569e
Submitter: Jenkins
Branch: master

commit 2a4390d13e5f46e81d898a29987385a0fe29569e
Author: James E. Blair <email address hidden>
Date: Fri Jun 22 16:42:08 2012 -0700

    Run devstack as stack instead of jenkins.

    So that sudo permissions may be revoked after they aren't needed.
    Fixes bug #1016567.

    Change-Id: Ib8b287e8252397a168fbe23672b2822509511d59