Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4229296502
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -519,75 +519,6 @@ def config(self):
logging.debug(e)
return False
-class securityPolicyConfigUbuntu(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigUbuntu, self).__init__(syscfg)
- self.serviceName = "Apparmor"
-
- def config(self):
- try:
- cmd = bash("service apparmor status")
- if not cmd.isSuccess() or cmd.getStdout() == "":
- self.spRunning = False
- return True
-
- if not bash("apparmor_status |grep libvirt").isSuccess():
- return True
-
- bash("ln -s /etc/apparmor.d/usr.sbin.libvirtd
/etc/apparmor.d/disable/")
- bash("ln -s /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper
/etc/apparmor.d/disable/")
- bash("apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd")
- bash("apparmor_parser -R
/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper")
-
- return True
- except:
- raise CloudRuntimeException("Failed to configure apparmor, please
see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before
starting myCloud")
-
- def restore(self):
- try:
- self.syscfg.svo.enableService("apparmor")
- self.syscfg.svo.startService("apparmor")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigRedhat(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigRedhat, self).__init__(syscfg)
- self.serviceName = "SElinux"
-
- def config(self):
- selinuxEnabled = True
-
- if not bash("selinuxenabled").isSuccess():
- selinuxEnabled = False
-
- if selinuxEnabled:
- try:
- bash("setenforce 0")
- cfo = configFileOps("/etc/selinux/config", self)
- cfo.replace_line("SELINUX=", "SELINUX=permissive")
- return True
- except:
- raise CloudRuntimeException("Failed to configure selinux,
please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it
before starting myCloud")
- else:
- return True
-
- def restore(self):
- try:
- bash("setenforce 1")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigSUSE(securityPolicyConfigRedhat):
- pass
-
-
def configure_libvirt_tls(tls_enabled=False, cfo=None):
save = False
if not cfo:
Review Comment:
This PR removes the `securityPolicyConfigUbuntu`,
`securityPolicyConfigRedhat`, and `securityPolicyConfigSUSE` classes entirely.
If any out-of-tree tooling/plugins import and invoke these classes directly
(even if the in-tree pipeline no longer uses them), this becomes a breaking
change at the Python module API level. Consider keeping no-op/deprecated stubs
(e.g., classes that log a warning and return True) for one or more releases to
preserve backward compatibility while still achieving the goal of not enforcing
security policy changes.
##########
server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java:
##########
@@ -378,8 +378,6 @@ private HostVO waitForHostConnect(long dcId, long podId,
long clusterId, String
@Override
public boolean configure(String name, Map<String, Object> params) throws
ConfigurationException {
- // _setupAgentPath = Script.findScript(getPatchPath(),
- // "setup_agent.sh");
_kvmPrivateNic = _configDao.getValue(Config.KvmPrivateNetwork.key());
if (_kvmPrivateNic == null) {
_kvmPrivateNic = "cloudbr0";
Review Comment:
The PR description focuses on disabling SELinux/AppArmor and libvirt
`security_driver` configuration, but this change set also deletes the legacy
`scripts/vm/hypervisor/kvm/setup_agent.sh` script entirely. That’s a broader
behavioral/support change (external automation may still call this script), so
the PR description (and/or upgrade/release notes) should explicitly call out
the script removal and the expected alternative path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
