Skip to content

Commit 845ff8b

Browse files
committed
fix(sudoers): grant lvremove of regular (non-migrate) snapshot LVs
delete-snapshot-vm and terminate's snapshot cleanup remove the snapshot LV with 'lvremove -f atlas/atlas-snap-<name>', but the name is a random Frappe doc id, not a UUID, so it can't be spelled out — and the allow-list only granted the '-migrate'-suffixed migration snapshots and the wildcard lvcreate. So terminating a VM that still has a snapshot failed with 'sudo: command not allowed'. Grant the wildcard lvremove for atlas-snap-* / atlas-datasnap-*, matching the wildcard the lvcreate already uses (bounded to the snapshot prefix; base images and VM disks have different prefixes).
1 parent 1eca5a8 commit 845ff8b

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

sudoers.d/boat

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -810,6 +810,8 @@ Cmnd_Alias BOAT_MIGRATION_LVM = \
810810
/usr/sbin/lvcreate --type thin --thinpool atlas/pool0 -V [0-9]*G -n atlas-* atlas, \
811811
/usr/sbin/lvcreate -s atlas/* -n atlas-snap-*, \
812812
/usr/sbin/lvcreate -s atlas/* -n atlas-datasnap-*, \
813+
/usr/sbin/lvremove -f atlas/atlas-snap-*, \
814+
/usr/sbin/lvremove -f atlas/atlas-datasnap-*, \
813815
/usr/sbin/lvremove -f atlas/atlas-snap-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]-migrate, \
814816
/usr/sbin/lvremove -f atlas/atlas-datasnap-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]-migrate, \
815817
/usr/sbin/lvremove -f atlas/atlas-clonemeta-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f], \

0 commit comments

Comments
 (0)