Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[multi-asic] sudo not required explicitly as /bin/ip netns identify present in sudoers #16115

Merged
merged 1 commit into from
Aug 18, 2023

Conversation

judyjoseph
Copy link
Contributor

@judyjoseph judyjoseph commented Aug 11, 2023

Why I did it

Few commands in multiasic platforms when run with the "sudo ip netns exec asic0 " option was taking like 15 mins to get the o/p. This behavior of sudo getting hung was seen by just doing this

jujoseph@svcstr-server-2:~ sudo ip netns exec asic0 bash
jujoseph@svcstr-server-2:~ sudo ls

Work item tracking
  • Microsoft ADO (number only):

How I did it

The reason was found that when a show command is issued, there is an API to get the current namespace

def get_current_namespace(pid=None):
154     """
155     This API returns the network namespace in which it is
156     invoked. In case of global namepace the API returns None
157     """
158 
159     net_namespace = None
160     command = ['sudo', '/bin/ip', 'netns', 'identify', "{}".format(os.getpid() if not pid else pid)]
161     proc = subprocess.Popen(command,
162                             stdout=subprocess.PIPE,
163                             universal_newlines=True,
164                             stderr=subprocess.STDOUT)

and we were doing it with sufo prefixed. This was ok with usually show commands which is issued in linux host, but when issued with "sudo ip netns exec asic0" prefix ( i.e the command is executed in a linux network namespace ) sudo gets hung adding to overall delay to command o/p

Ideally sudo is not needed as we have /bin/ip netns identify present in /etc/sudoers file. Hence removing it

How to verify it

Verified with both RO and RW user in a multi-asic platform, confirmed the show commands work, and "sudo ip netns exec asic0 " command returns result quicker.

Which release branch to backport (provide reason below if selected)

  • 201811
  • 201911
  • 202006
  • 202012
  • 202106
  • 202111
  • 202205
  • 202211
  • 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

@judyjoseph
Copy link
Contributor Author

To add more details

Have tested this change with/without RW Jit, show commands are ok in multi-asic.

Checking why the sudo was added earlier : it was part of Pull Request #6100 -- related to process_checker and monit. I see that currently we don't use the process checker, we use the supervisorctl proc_listener to find a critical process exit.

@judyjoseph judyjoseph requested a review from rlhui August 17, 2023 23:03
@rlhui rlhui added the P0 Priority of the issue label Aug 18, 2023
@rlhui rlhui merged commit 0bd8c3b into sonic-net:master Aug 18, 2023
20 checks passed
@rlhui
Copy link
Contributor

rlhui commented Aug 18, 2023

@judyjoseph , please add ado, thanks.

@gechiang
Copy link
Collaborator

In the interest of time, I created the MAFT ADO...
MSFT ADO: 24914440

@gechiang
Copy link
Collaborator

@yxieca , @StormLiangMS please help cherry-pick to back port this fix to the corresponding releases.
Thanks!

@judyjoseph
Copy link
Contributor Author

24914440

Thank you @gechiang

@mssonicbld
Copy link
Collaborator

@judyjoseph PR conflicts with 202205 branch

mssonicbld pushed a commit to mssonicbld/sonic-buildimage that referenced this pull request Aug 23, 2023
…D_ONLY_CMDS in sudoers file (sonic-net#16115)

Why I did it
Few commands in multiasic platforms when run with the "sudo ip netns exec asic0 " option was taking like 15 mins to get the o/p. This behavior of sudo getting hung was seen by just doing this

jujoseph@svcstr-server-2:~ sudo ip netns exec asic0 bash
jujoseph@svcstr-server-2:~ sudo ls

deally sudo is not needed as we have /bin/ip netns identify present in /etc/sudoers file. Hence removing it
@mssonicbld
Copy link
Collaborator

Cherry-pick PR to 202211: #16255

@mssonicbld
Copy link
Collaborator

@judyjoseph cherry pick PR didn't pass PR checker. Please check!!! Auto cherry pick PR will be closed in 24 days.
#16255

@mssonicbld
Copy link
Collaborator

@judyjoseph cherry pick PR didn't pass PR checker. Please check!!! Auto cherry pick PR will be closed in 24 days.
#16255

1 similar comment
@mssonicbld
Copy link
Collaborator

@judyjoseph cherry pick PR didn't pass PR checker. Please check!!! Auto cherry pick PR will be closed in 24 days.
#16255

mssonicbld pushed a commit that referenced this pull request Aug 31, 2023
…D_ONLY_CMDS in sudoers file (#16115)

Why I did it
Few commands in multiasic platforms when run with the "sudo ip netns exec asic0 " option was taking like 15 mins to get the o/p. This behavior of sudo getting hung was seen by just doing this

jujoseph@svcstr-server-2:~ sudo ip netns exec asic0 bash
jujoseph@svcstr-server-2:~ sudo ls

deally sudo is not needed as we have /bin/ip netns identify present in /etc/sudoers file. Hence removing it
mssonicbld pushed a commit to mssonicbld/sonic-buildimage that referenced this pull request Sep 3, 2023
…D_ONLY_CMDS in sudoers file (sonic-net#16115)

Why I did it
Few commands in multiasic platforms when run with the "sudo ip netns exec asic0 " option was taking like 15 mins to get the o/p. This behavior of sudo getting hung was seen by just doing this

jujoseph@svcstr-server-2:~ sudo ip netns exec asic0 bash
jujoseph@svcstr-server-2:~ sudo ls

deally sudo is not needed as we have /bin/ip netns identify present in /etc/sudoers file. Hence removing it
@mssonicbld
Copy link
Collaborator

Cherry-pick PR to 202305: #16409

mssonicbld pushed a commit that referenced this pull request Sep 3, 2023
…D_ONLY_CMDS in sudoers file (#16115)

Why I did it
Few commands in multiasic platforms when run with the "sudo ip netns exec asic0 " option was taking like 15 mins to get the o/p. This behavior of sudo getting hung was seen by just doing this

jujoseph@svcstr-server-2:~ sudo ip netns exec asic0 bash
jujoseph@svcstr-server-2:~ sudo ls

deally sudo is not needed as we have /bin/ip netns identify present in /etc/sudoers file. Hence removing it
sonic-otn pushed a commit to sonic-otn/sonic-buildimage that referenced this pull request Sep 20, 2023
…D_ONLY_CMDS in sudoers file (sonic-net#16115)

Why I did it
Few commands in multiasic platforms when run with the "sudo ip netns exec asic0 " option was taking like 15 mins to get the o/p. This behavior of sudo getting hung was seen by just doing this

jujoseph@svcstr-server-2:~ sudo ip netns exec asic0 bash
jujoseph@svcstr-server-2:~ sudo ls

deally sudo is not needed as we have /bin/ip netns identify present in /etc/sudoers file. Hence removing it
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

8 participants