andrijapanicsb commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-5527438833
I agree with the main idea of this PR. CloudStack Agent setup should not
automatically change the AppArmor or SELinux configuration of the host.
I think we should clarify one important point in the documentation. This PR
only prevents CloudStack from making these changes in the future. It does not
revert changes already made on existing hosts. For example, existing hosts
may
still have SELinux in permissive mode, disabled AppArmor profiles, or
security_driver="none". The administrator must change these settings manually
if needed.
The test results shared in this PR show security_driver="none" on all tested
hosts. This confirms the manually preconfigured scenario, but it does not
test
a new host where security_driver is not configured. In that case, libvirt may
automatically use AppArmor or SELinux for QEMU processes. I think this
difference should be clearly explained in the documentation.
# # # # # #
The related documentation PR apache/cloudstack-documentation#662 should be
updated and merged together with this change.
The AppArmor section title should also include Debian, because Debian uses
the
same AppArmor configuration approach in this case. I suggest changing:
Configure AppArmor (Ubuntu, SUSE)
to:
Configure AppArmor (Ubuntu, Debian, SUSE)
The package installation commands may still need separate examples for
Ubuntu/Debian and SUSE.
I do not think the following command should be recommended:
aa-enforce /etc/apparmor.d/*
It may affect unrelated AppArmor profiles and directories. If it is necessary
to re-enable the libvirt profiles, the commands should target only these
profiles:
aa-enforce /usr/sbin/libvirtd
aa-enforce /usr/lib/libvirt/virt-aa-helper
The current documentation also says that AppArmor and SELinux must be
disabled. This text should be updated because it conflicts with the purpose
of this PR.
The unrelated log message change in test_vpc_redundant.py could also be
removed from this PR, but this is not a blocker.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
