The l3-agent invokes 'route' within a namespace to set the default gateway within that namespace, for example, to reach the internet via a gateway on an external network. However, rootwrap does not have a filter for this, so the command is denied:
2012-09-21 04:32:45 DEBUG [quantum.agent.linux.utils] Running command: sudo /
usr/bin/quantum-rootwrap /etc/quantum/rootwrap.conf ip netns exec qrouter-60e80b
d6-3471-4bc6-8383-2cb39375ebc5 route add default gw 192.168.0.1
2012-09-21 04:32:45 DEBUG [quantum.agent.linux.utils]
Command: ['sudo', '/usr/bin/quantum-rootwrap', '/etc/quantum/rootwrap.conf', 'ip
', 'netns', 'exec', 'qrouter-60e80bd6-3471-4bc6-8383-2cb39375ebc5', 'route', 'ad
d', 'default', 'gw', '192.168.0.1']
Exit code: 99
Stdout: 'Unauthorized command: ip netns exec qrouter-60e80bd6-3471-4bc6-8383-2cb
39375ebc5 route add default gw 192.168.0.1\n'
Fix proposed to branch: master
Review: https:/