Add filters for quantum-debug

only allows ping command here.
Fixes bug 1071110

Change-Id: I38f24e40de048845f01dbc07c79bb02acf92da31

diff --git a/etc/quantum/rootwrap.d/debug.filters b/etc/quantum/rootwrap.d/debug.filters
new file mode 100644 (file)
index 0000000..6dbb4d7
--- /dev/null
+++ b/etc/quantum/rootwrap.d/debug.filters
@@ -0,0 +1,14 @@
+# quantum-rootwrap command filters for nodes on which quantum is
+# expected to control network
+#
+# This file should be owned by (and only-writeable by) the root user
+
+# format seems to be
+# cmd-name: filter-name, raw-command, user, args
+
+[Filters]
+
+# This is needed because we should ping
+# from inside a namespace which requires root
+ping: RegExpFilter, /bin/ping, root, ping, -w, \d+, -c, \d+, [0-9\.]+
+ping6: RegExpFilter, /bin/ping6, root, ping6, -w, \d+, -c, \d+, [0-9A-Fa-f:]+