Extrinsics ensured by root in our node

[Janislav]

Sudo extrinsic

In our node, we use different modules which using ensure_root. If we remove the sudo pallet, we will not able to call them anymore. We should check before if there is anything critical for us.

List of sudo extrinsic in our node

Extrinsic	Pallet	Description	Required
fill_block	system	Fills the block weight up to the given ratio	No
remark	system	Make some on-chain remark	?
set_heap_pages	system	Set the number of pages in the WebAssembly environment's heap	?
set_code	system	Set the new runtime code	Yes, but we will provide our own call for this
set_code_without_checks	system	Set the new runtime code without doing any checks of the given code	No
set_changes_trie_config	system	Set the new changes trie configuration	?
set_storage	system	Set some items of storage	No
kill_storage	system	Kill some items from storage	No
kill_prefix	system	Kill all storage items with a key that starts with the given prefix	No
set_blocks_for_epoch	cf-validator	Sets the number of blocks an epoch should run for	Replace with governance
set_auction_size_range	cf-auction	Sets the size of our auction range	Replace with governance
note_stalled	grandpa	Trigger a forced authority set change at the beginning of the next session	?

[andyjsbell]

Would this be better as an issue and hence a work item?

set_storage and kill_storage maybe useful in migrations

[Janislav]

Good catch with set_storage and kill_storage. I think currently it's pretty unclear what we need, just wanted to start the discussion on this topic. It also depends if we enable sudo_calls secured by governance, if yes, this is obsolete anyway.

[dandanlen]

Thanks for this Jan. Some of these look like they might (?) be useful for emergency interventions (like directly accessing storage via set or kill...)

I don't see any downsides to allowing governance to dispatch sudo calls - anyone else?

[dandanlen]

Hmm.. Can we not just import the standard RawOrigin from frame_system and use that? We can have a look at this together if you want.

[Janislav]

Yes, but it's not possible to parse the RootOrigin then (.into()) - which you have to, to dispatch a call. But when you fix the Origin to match, the governance origin stuff is not working anymore.

[dandanlen]

Did you try adding this constraint in the Config?

type Origin: From<RawOrigin> + From<frame_system::RawOrigin>;

[Janislav]

Something like this, yes. But I will try it with this example, maybe it works...

[Janislav]

Okay...

type Origin: From<RawOrigin> + From<frame_system::RawOrigin<<Self as frame_system::Config>::AccountId>>;

did the trick... Thanks for the hint :).