---
id: oslo-rootwrap
version: "7.10.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# oslo.rootwrap — Oslo Rootwrap

License: permissive · Maintenance: active · Downloads: 140.9K/mo

## What it is and what it does

oslo.rootwrap is an OpenStack library that sits between application code and the shell to enforce fine-grained permission policies on commands that need to run as root. Rather than granting blanket sudo access, it validates each command against a set of rules before allowing execution, reducing the attack surface when OpenStack services need elevated privileges.

The package is part of the OpenStack oslo namespace and is maintained as an active project. It has minimal dependencies (only debtcollector and pbr) and installs as a pure Python wheel, making it lightweight to integrate into OpenStack deployments or other systems that need controlled root command execution.

Use it for:

- Restrict which shell commands OpenStack services can execute as root, enforcing a whitelist-based policy.
- Audit and log elevated-privilege command invocations for compliance and security monitoring.
- Prevent privilege escalation attacks by validating command arguments before sudo execution.
- Integrate permission filtering into multi-tenant cloud environments where isolation is critical.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

oslo.rootwrap provides fine-grained filtering of shell commands to run as root from OpenStack services, enabling controlled escalation of permissions with minimal privilege exposure.

Yes, if you are deploying or extending OpenStack services that require controlled root command execution. The permissive Apache 2.0 license, active maintenance, low install friction, and zero known vulnerabilities make it a safe choice. If you need root command filtering outside OpenStack, verify that its policy model aligns with your requirements first.

## Install

pip install oslo-rootwrap
uv add oslo-rootwrap
poetry add oslo-rootwrap

## Installing oslo.rootwrap

Before you install: Active maintenance with a release 35 days ago. Low install friction: pure Python wheel with only two lightweight runtime dependencies (debtcollector and pbr). Supports current Python versions (3.11–3.14).

License in practice: Apache License 2.0 (permissive): you may use, modify, and distribute this package freely in commercial and private projects, provided you retain the license notice.

Quickstart:

pip install oslo.rootwrap

from oslo_rootwrap import cmd
# Configure and invoke rootwrap filtering on shell commands

Requires Python 3.11 or later. Designed for OpenStack deployments; standalone use outside that context requires understanding its command-filtering policy model.

Verify before relying:

- Specific API surface and filtering rule syntax are not detailed in the excerpt; consult documentation for integration patterns.
- Performance characteristics under high command volume are not documented in the fact sheet.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 140.9K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

root command filtering, privilege escalation control, openstack rootwrap, shell command authorization, sudo command filtering, permission escalation policy, openstack, privilege-escalation, command-filtering

[View on SkillFed](https://skillfed.io/packages/oslo-rootwrap) · [View on PyPI](https://pypi.org/project/oslo-rootwrap/)