Registry / devops / oslo-privsep

oslo-privsep

JSON →
library3.11.0pypypi✓ verified 84d ago

OpenStack library for privilege separation. Provides a framework for running sensitive operations in a separate privileged process. Current version is 3.10.1, released as part of OpenStack Dalmatian. Released on a 6-month cadence aligned with OpenStack releases.

pip install oslo-privsep
INSTALL
IMPORT
SIG · OSLO-PRIVSEP
O
oslo-privsep
devopspythonv3.11.0
Install
5.3s avg
Import
732ms
Disk
52MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v3.11.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.95 runs
installs and imports cleanly · install 0.0s · import 0.754s · 46.1MB
glibc
py 3.103.95 runs
installs and imports cleanly · install 5.3s · import 0.710s · 48MB
52MB installed
● package 52MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

priv_context
from oslo_privsep import priv_context
from oslo.privsep import priv_context
Package uses underscores, not dots, in the import path (PEP 8 style).
daemon
from oslo_privsep import daemon
import oslo_privsep.daemon
Submodules are not automatically imported; import directly.

Initialize a daemon principal with root privileges and call a function that runs as root.

import os from oslo_privsep import priv_context from oslo_privsep import capabilities # Define a privileged context priv_context.init( priv_context.DaemonPrincipal( user='root', group='root', ), resource_limits=[ priv_context.ResourceLimit( resource=capabilities.RLIMIT_AS, soft=1024 * 1024 * 500, # 500 MB hard=1024 * 1024 * 500, ), ], ) # Expose a function to run as privileged @priv_context.entrypoint def run_as_root(): # This runs with escalated privileges import subprocess return subprocess.check_output(['whoami']).strip() if __name__ == '__main__': print(run_as_root())
Debug
Known issues
breakingIn version 3.0.0, the package name changed from oslo-privsep to oslo_privsep for imports. All underscores must be used in Python code.
fix
Use from oslo_privsep import priv_context instead of from oslo.privsep.
affects: >=3.0.0
deprecatedThe `capabilities` module is deprecated and will be removed in a future release. Use `resource` module directly with `oslo_privsep.prctl` if needed.
fix
Replace capabilities imports with direct resource constants (e.g., oslo_privsep.prctl.RLIMIT_AS).
affects: >=3.5.0
gotchaThe privileged process runs as a separate daemon; ensure the daemon is started before calling privileged functions. If using eventlet, monkey-patching must be done before daemon start.
fix
Initialize the daemon at module load time and avoid lazy initialization in request handlers.
affects: all
Errors
Common errors & fixes
ModuleNotFoundError: No module named 'oslo.privsep'
Using period instead of underscore in import path.
fix
Use `from oslo_privsep import priv_context` instead.
PermissionError: [Errno 13] Permission denied
The daemon principal user/group does not have sufficient privileges for the requested operation.
fix
Check that the `user` and `group` parameters in DaemonPrincipal are correct and that the system allows privilege escalation.
Upgrade
Version history
3.11.0latest on PyPI · released Apr 30, 2026
Audit
Dependencies
oslo.configrequiredRequired for configuration loading
oslo.i18nrequiredTranslation support
oslo.logrequiredLogging utilities
eventletrequiredAsync networking, used in daemon mode
greenletrequiredCo-routines used by eventlet
Agent activity
15 hits · last 30 days
node
14
OpenAI (training)
1
Resources
oslo-privsep — pip install oslo-privsep · libregistry