---
name: "nova-rootwrap"
section: "1"
platform: "linux"
package: "nova-common"
version: "2:31.0.0-6+deb13u2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/nova-rootwrap"
---

# nova-rootwrap(1)

Root wrapper daemon for the OpenStack Compute service.

## NAME

nova-rootwrap - Root wrapper daemon for the OpenStack Compute service.

## SYNOPSIS

```
nova-rootwrap CONFIG_FILE COMMAND
```

## DESCRIPTION

**nova-rootwrap** is an application that filters which commands nova is allowed to run as another user.

To use this, you should set the following in **nova.conf**:

```
rootwrap_config=/etc/nova/rootwrap.conf
```

You also need to let the nova user run **nova-rootwrap** as root in **sudoers**:

```
nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap /etc/nova/rootwrap.conf *
```

To make allowed commands node-specific, your packaging should only install **{compute,network}.filters** respectively on compute and network nodes, i.e. **nova-api** nodes should not have any of those files installed.

**NOTE:**

**nova-rootwrap** is being slowly deprecated and replaced by **oslo.privsep**, and will eventually be removed.

## FILES

- •

  **/etc/nova/nova.conf**

- •

  **/etc/nova/rootwrap.conf**

- •

  **/etc/nova/rootwrap.d/**

## SEE ALSO

*[nova-compute(1)](/nova-compute/1.md)*

## BUGS

- •

  Nova bugs are managed at *Launchpad*

## AUTHOR

openstack@lists.openstack.org

## COPYRIGHT

2010-present, OpenStack Foundation