lvmdevices: always create devices file

Create empty devices file even if no lvm
volumes are found with
`vdsm-tool config-lvm-filter`.

Otherwise configuring LVM to use a devices
file without the file allows lvm commands
to see all volumes, with the associated risk.

Bug-Url: https://bugzilla.redhat.com/2125290
Signed-off-by: Albert Esteve <[email protected]>

lib/vdsm/storage/lvmdevices.py

@@ -14,13 +14,15 @@
 vdsm-tool.
 """
 
+import datetime
 import logging
 import os
 import subprocess
 
 from vdsm import constants
 from vdsm.common import cmdutils
 from vdsm.common import commands
+from vdsm.storage import fileUtils
 from vdsm.storage import lvmconf
 from vdsm.storage import lvmfilter
 
@@ -79,14 +81,18 @@ def _devices_file_exists():
     exists, lvm disables whole devices file functionality.
     """
     try:
-        devicesfile = lvmconf.configured_value("devices", "devicesfile")
+        devices_file = _get_devices_file_path()
     except (cmdutils.Error, lvmconf.UnexpectedLvmConfigOutput):
         return False
 
-    devices_file = os.path.join(_LVM_DEVICES_DIR, devicesfile)
     return os.path.exists(devices_file)
 
 
+def _get_devices_file_path():
+    devicesfile = lvmconf.configured_value("devices", "devicesfile")
+    return os.path.join(_LVM_DEVICES_DIR, devicesfile)
+
+
 def _configure_devices_file(enable=True):
     """
     Configure lvm to use devices file or disable it.
@@ -101,8 +107,17 @@ def _create_system_devices(vgs):
     """
     Import devices of provided VGs into LVM devices file.
     """
-    for vg in vgs:
-        _run_vgimportdevices(vg)
+    if not vgs:
+        # Create empty devices file if no VGs are provided.
+        devices_file = _get_devices_file_path()
+        now = datetime.datetime.now()
+        data = (f"# Created by Vdsm pid {os.getpid()} at "
+                f"{now.strftime('%a %b %d %H:%M:%S %Y')}\n")
+
+        fileUtils.atomic_write(devices_file, data.encode("utf-8"))
+    else:
+        for vg in vgs:
+            _run_vgimportdevices(vg)
 
 
 def _run_vgimportdevices(vg):