rootwrap needs to be extensible

I understand the need. It's a bit tricky to get the security model for this right, though.

The current model is to allow sudo to run "/usr/bin/nova-rootwrap", which loads nova.rootwrap.wrapper from a pristine sys.path, which then tries to load a number of predetermined FILTERS_MODULES files. Adding more dynamic loading capabilities (like loading all files present under nova.rootwrap.filters) weakens this model a bit, but is probably still safe. You would then just package a nova.rootwrap.filters.myownextension together with your extension.

Alternatively we could allow sudo to run "/usr/bin/nova-rootwrap --config /etc/nova/rootwrap.conf" which would point to a list of files to load... but it makes in-branch testing a bit more difficult, and is also more error-prone (you have to replicate the config file location in the root_wrapper config option).

I'll add this to my Folsom improvements list.

https://review.openstack.org/#/c/8747/