This is an automated email from the ASF dual-hosted git repository.
weizhouapache pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
The following commit(s) were added to refs/heads/main by this push:
new 2d886b61918 cloudutils: Do not configure selinux/apparmor and
security_driver when setup cloudstack agent (#13281)
2d886b61918 is described below
commit 2d886b6191863ffc4e1b6ffdac1af7f19184e6e9
Author: Wei Zhou <[email protected]>
AuthorDate: Thu Nov 5 09:31:29 2026 +0100
cloudutils: Do not configure selinux/apparmor and security_driver when
setup cloudstack agent (#13281)
* Do not configure selinux/apparmor when setup cloudstack agent
* do not restore as well
* test: set security_driver to selinux or apparmor
* libvirt: do not set security_driver to none in qemu.conf
* cloudutils: remove securityPolicyConfigUbuntu and
securityPolicyConfigRedHat
---
python/lib/cloudutils/serviceConfig.py | 72 -------
python/lib/cloudutils/syscfg.py | 6 -
scripts/vm/hypervisor/kvm/setup_agent.sh | 228 ---------------------
.../kvm/discoverer/LibvirtServerDiscoverer.java | 2 -
4 files changed, 308 deletions(-)
diff --git a/python/lib/cloudutils/serviceConfig.py
b/python/lib/cloudutils/serviceConfig.py
index 0b4820dd7b6..0c1344e6963 100755
--- a/python/lib/cloudutils/serviceConfig.py
+++ b/python/lib/cloudutils/serviceConfig.py
@@ -519,75 +519,6 @@ class hostConfig(serviceCfgBase):
logging.debug(e)
return False
-class securityPolicyConfigUbuntu(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigUbuntu, self).__init__(syscfg)
- self.serviceName = "Apparmor"
-
- def config(self):
- try:
- cmd = bash("service apparmor status")
- if not cmd.isSuccess() or cmd.getStdout() == "":
- self.spRunning = False
- return True
-
- if not bash("apparmor_status |grep libvirt").isSuccess():
- return True
-
- bash("ln -s /etc/apparmor.d/usr.sbin.libvirtd
/etc/apparmor.d/disable/")
- bash("ln -s /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper
/etc/apparmor.d/disable/")
- bash("apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd")
- bash("apparmor_parser -R
/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper")
-
- return True
- except:
- raise CloudRuntimeException("Failed to configure apparmor, please
see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before
starting myCloud")
-
- def restore(self):
- try:
- self.syscfg.svo.enableService("apparmor")
- self.syscfg.svo.startService("apparmor")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigRedhat(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigRedhat, self).__init__(syscfg)
- self.serviceName = "SElinux"
-
- def config(self):
- selinuxEnabled = True
-
- if not bash("selinuxenabled").isSuccess():
- selinuxEnabled = False
-
- if selinuxEnabled:
- try:
- bash("setenforce 0")
- cfo = configFileOps("/etc/selinux/config", self)
- cfo.replace_line("SELINUX=", "SELINUX=permissive")
- return True
- except:
- raise CloudRuntimeException("Failed to configure selinux,
please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it
before starting myCloud")
- else:
- return True
-
- def restore(self):
- try:
- bash("setenforce 1")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigSUSE(securityPolicyConfigRedhat):
- pass
-
-
def configure_libvirt_tls(tls_enabled=False, cfo=None):
save = False
if not cfo:
@@ -652,7 +583,6 @@ class libvirtConfigRedhat(serviceCfgBase):
filename = "/etc/libvirt/qemu.conf"
cfo = configFileOps(filename, self)
- cfo.addEntry("security_driver", "\"none\"")
cfo.addEntry("user", "\"root\"")
cfo.addEntry("group", "\"root\"")
cfo.addEntry("vnc_listen", "\"0.0.0.0\"")
@@ -690,7 +620,6 @@ class libvirtConfigSUSE(serviceCfgBase):
filename = "/etc/libvirt/qemu.conf"
cfo = configFileOps(filename, self)
- cfo.addEntry("security_driver", "\"none\"")
cfo.addEntry("user", "\"root\"")
cfo.addEntry("group", "\"root\"")
cfo.addEntry("vnc_listen", "\"0.0.0.0\"")
@@ -745,7 +674,6 @@ class libvirtConfigUbuntu(serviceCfgBase):
filename = "/etc/libvirt/qemu.conf"
cfo = configFileOps(filename, self)
- cfo.addEntry("security_driver", "\"none\"")
cfo.addEntry("user", "\"root\"")
cfo.addEntry("group", "\"root\"")
configure_libvirt_tls(self.syscfg.env.secure, cfo)
diff --git a/python/lib/cloudutils/syscfg.py b/python/lib/cloudutils/syscfg.py
index 78cd58bfbd4..3e52cd960e9 100755
--- a/python/lib/cloudutils/syscfg.py
+++ b/python/lib/cloudutils/syscfg.py
@@ -167,7 +167,6 @@ class sysConfigAgentUbuntu(sysConfigAgent):
self.svo = serviceOpsUbuntu()
self.services = [hostConfig(self),
- securityPolicyConfigUbuntu(self),
networkConfigUbuntu(self),
libvirtConfigUbuntu(self),
firewallConfigUbuntu(self),
@@ -179,7 +178,6 @@ class sysConfigEL5(sysConfigAgentRedhatBase):
def __init__(self, glbEnv):
super(sysConfigEL5, self).__init__(glbEnv)
self.services = [hostConfig(self),
- securityPolicyConfigRedhat(self),
networkConfigRedhat(self),
libvirtConfigRedhat(self),
firewallConfigAgent(self),
@@ -192,7 +190,6 @@ class sysConfigEL6(sysConfigAgentRedhatBase):
super(sysConfigEL6, self).__init__(glbEnv)
self.services = [hostConfig(self),
cgroupConfig(self),
- securityPolicyConfigRedhat(self),
networkConfigRedhat(self),
libvirtConfigRedhat(self),
firewallConfigAgent(self),
@@ -204,7 +201,6 @@ class sysConfigEL7(sysConfigAgentRedhat7Base):
def __init__(self, glbEnv):
super(sysConfigEL7, self).__init__(glbEnv)
self.services = [hostConfig(self),
- securityPolicyConfigRedhat(self),
networkConfigRedhat(self),
libvirtConfigRedhat(self),
firewallConfigAgent(self),
@@ -216,7 +212,6 @@ class sysConfigEL(sysConfigAgentELBase):
def __init__(self, glbEnv):
super(sysConfigEL, self).__init__(glbEnv)
self.services = [hostConfig(self),
- securityPolicyConfigRedhat(self),
networkConfigRedhat(self),
libvirtConfigRedhat(self),
firewallConfigAgent(self),
@@ -227,7 +222,6 @@ class sysConfigSUSE(sysConfigAgentSUSE):
def __init__(self, glbEnv):
super(sysConfigSUSE, self).__init__(glbEnv)
self.services = [hostConfig(self),
- securityPolicyConfigSUSE(self),
networkConfigSUSE(self),
libvirtConfigSUSE(self),
firewallConfigAgent(self),
diff --git a/scripts/vm/hypervisor/kvm/setup_agent.sh
b/scripts/vm/hypervisor/kvm/setup_agent.sh
deleted file mode 100755
index 492e7ef8fac..00000000000
--- a/scripts/vm/hypervisor/kvm/setup_agent.sh
+++ /dev/null
@@ -1,228 +0,0 @@
-#!/bin/bash
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-
-
-
-# Did cloudstack-agent installed
-#set -x
-install_cloud_agent() {
- local dev=$1
- local retry=10
- which cloudstack-setup-agent
- if [ $? -gt 0 ]
- then
- # download the repo
- which wget
- if [ $? -gt 0 ]
- then
- yum install wget -y
- if [ $? -gt 0 ]
- then
- printf "failed to install wget"
- exit 1
- fi
- fi
- wget -N -P /etc/yum.repos.d/
http://download.cloudstack.org/foss/fedora/cloud.repo
- if [ $? -gt 0 ]
- then
- printf "Failed to download repo"
- exit 1
- fi
- if [ "$dev" == "1" ]
- then
- sed -i
's/\(baseurl\)\(.*\)/\1=http:\/\/yumrepo.lab.vmops.com\/repositories\/fedora\/vmdev\/oss\//'
/etc/yum.repos.d/cloud.repo
- fi
- while [ "$retry" -gt "0" ]
- do
- yum clean all
- yum install cloudstack-agent -y
- if [ $? -gt 0 ]
- then
- let retry=retry-1
- else
- break
- fi
- done
- else
- # is there update?
- while [ "$retry" -gt "0" ]
- do
- yum clean all
- yum update cloudstack-agent -y
- if [ $? -gt 0 ]
- then
- let retry=retry-1
- else
- break
- fi
-
- done
- fi
-
- if [ $? -gt 0 ]
- then
- printf "Failed to install agent"
- exit 2
- fi
-}
-
-install_cloud_consoleP() {
- local dev=$1
- local retry=10
- which cloud-setup-console-proxy
- if [ $? -gt 0 ]
- then
- # download the repo
- which wget
- if [ $? -gt 0 ]
- then
- yum install wget -y
- if [ $? -gt 0 ]
- then
- printf "failed to install wget"
- exit 1
- fi
- fi
- wget -N -P=/etc/yum.repos.d/
http://download.cloudstack.org/foss/fedora/cloud.repo
- if [ $? -gt 0 ]
- then
- printf "Failed to download repo"
- exit 1
- fi
- if [ "$dev" == "1" ]
- then
- sed -i
's/\(baseurl\)\(.*\)/\1=http:\/\/yumrepo.lab.vmops.com\/repositories\/fedora\/vmdev\/oss\//'
/etc/yum.repos.d/cloud.repo
- fi
- while [ "$retry" -gt "0" ]
- do
- yum clean all
- yum install cloud-console-proxy -y
- if [ $? -gt 0 ]
- then
- let retry=retry-1
- else
- break
- fi
- done
- else
- # is there update?
- while [ "$retry" -gt "0" ]
- do
- yum clean all
- yum update cloud-console-proxy -y
- if [ $? -gt 0 ]
- then
- let retry=retry-1
- else
- break
- fi
-
- done
- fi
-
- if [ $? -gt 0 ]
- then
- printf "Failed to install console"
- exit 2
- fi
-}
-cloud_agent_setup() {
- local host=$1
- local zone=$2
- local pod=$3
- local cluster=$4
- local guid=$5
- # disable selinux
- selenabled=`cat /selinux/enforce`
- if [ "$selenabled" == "1" ]
- then
- sed -i 's/\(SELINUX\)\(.*\)/\1=permissive/' /etc/selinux/config
- setenforce 0
- fi
- cloudstack-setup-agent --host=$host --zone=$zone --pod=$pod
--cluster=$cluster --guid=$guid -a > /dev/null
-}
-
-cloud_consoleP_setup() {
- local host=$1
- local zone=$2
- local pod=$3
- cloud-setup-console-proxy --host=$host --zone=$zone --pod=$pod -a >
/dev/null
-}
-
-host=
-zone=
-pod=
-cluster=
-guid=
-dflag=
-pubNic=
-prvNic=
-while getopts 'h:z:p:u:c:P:N:d' OPTION
-do
- case $OPTION in
- h)
- host="$OPTARG"
- ;;
- z)
- zone="$OPTARG"
- ;;
- p)
- pod="$OPTARG"
- ;;
- c)
- cluster="$OPTARG"
- ;;
- u)
- guid="$OPTARG"
- ;;
- d)
- dflag=1
- ;;
- P)
- pubNic="$OPTARG"
- ;;
- N)
- prvNic="$OPTARG"
- ;;
- *) ;;
- esac
-done
-
-#install_cloud_agent $dflag
-#install_cloud_consoleP $dflag
-parameters=
-if [ -n "$pubNic" ]
-then
- parameters=" --pubNic=$pubNic"
-fi
-
-if [ -n "$prvNic" ]
-then
- parameters=" --prvNic=$prvNic $parameters"
-fi
-
-selenabled=`cat /selinux/enforce`
-if [ "$selenabled" == "1" ]
-then
- sed -i 's/\(SELINUX\)\(.*\)/\1=permissive/' /etc/selinux/config
- setenforce 0
-fi
-
-cloudstack-setup-agent --host=$host --zone=$zone --pod=$pod --cluster=$cluster
--guid=$guid $parameters -a > /dev/null
-#cloud_consoleP_setup $host $zone $pod
diff --git
a/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
b/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
index b9fa3f0ebae..6c48811f9ad 100644
---
a/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
+++
b/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
@@ -378,8 +378,6 @@ public abstract class LibvirtServerDiscoverer extends
DiscovererBase implements
@Override
public boolean configure(String name, Map<String, Object> params) throws
ConfigurationException {
- // _setupAgentPath = Script.findScript(getPatchPath(),
- // "setup_agent.sh");
_kvmPrivateNic = _configDao.getValue(Config.KvmPrivateNetwork.key());
if (_kvmPrivateNic == null) {
_kvmPrivateNic = "cloudbr0";
