cloudutils: Do not configure selinux/apparmor when setup cloudstack agent#13281
Draft
weizhouapache wants to merge 6 commits into
Draft
cloudutils: Do not configure selinux/apparmor when setup cloudstack agent#13281weizhouapache wants to merge 6 commits into
weizhouapache wants to merge 6 commits into
Conversation
Member
Author
|
@blueorangutan package |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13281 +/- ##
======================================
Coverage 3.53% 3.53%
======================================
Files 464 464
Lines 40196 40196
Branches 7560 7560
======================================
Hits 1421 1421
Misses 38585 38585
Partials 190 190
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Member
Author
|
@blueorangutan package |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR stops CloudStack KVM agent setup from actively disabling host security policy mechanisms during setup, leaving SELinux/AppArmor posture to operators.
Changes:
- Makes AppArmor and SELinux setup configuration methods return without modifying host policy.
- Removes the legacy
setup_agent.shscript that also forced SELinux permissive mode. - Removes stale Java comments referencing the deleted setup script.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
python/lib/cloudutils/serviceConfig.py |
No-ops AppArmor/SELinux configuration during agent setup. |
scripts/vm/hypervisor/kvm/setup_agent.sh |
Deletes obsolete KVM agent setup helper script. |
server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java |
Removes stale commented reference to setup_agent.sh. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
Author
|
@blueorangutan package |
Member
Author
|
@DaanHoogland |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18086 |
|
[SF] Trillian Build Failed (tid-16221) |
|
[SF] Trillian Build Failed (tid-16225) |
Member
Author
|
with the changes ubuntu 24 debian12 oraclelinux 8 suse15 oraclelinux 9 |
Member
Author
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18093 |
|
[SF] Trillian test result (tid-16220)
|
|
[SF] Trillian test result (tid-16222)
|
|
[SF] Trillian test result (tid-16224)
|
|
[SF] Trillian test result (tid-16223)
|
|
[SF] Trillian test result (tid-16227)
|
|
[SF] Trillian test result (tid-16228)
|
|
[SF] Trillian Build Failed (tid-16233) |
Member
Author
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18112 |
|
[SF] Trillian Build Failed (tid-16236) |
|
[SF] Trillian test result (tid-16232)
|
Member
Author
|
@blueorangutan help |
|
@weizhouapache [SL] I understand these words: "help", "hello", "thanks", "package", "test" Blessed contributors for kicking Trillian test jobs: ['rohityadavcloud', 'shwstppr', 'Damans227', 'vishesh92', 'Pearl1594', 'harikrishna-patnala', 'nvazquez', 'DaanHoogland', 'weizhouapache', 'borisstoyanov', 'vladimirpetrov', 'kiranchavala', 'andrijapanicsb', 'NuxRo', 'rajujith', 'sureshanaparti', 'abh1sar', 'sudo87', 'RosiKyu'] |
weizhouapache
force-pushed
the
4.23-not-config-selinux-apparmor
branch
from
9458007 to
1325b34
Compare
Member
Author
|
@blueorangutan package |
weizhouapache
changed the title
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18182 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR disables security configurations during CloudStack agent setup:
However, users have different security and hardening requirements, and these decisions should not be enforced by the agent setup. For example:
Some environments may require SELinux/AppArmor to remain in enforcing mode for stronger security hardening, and the system should still support such configurations.
Some users may prefer to explicitly configure the libvirt security driver in
/etc/libvirt/qemu.conf, replacingsecurity_driver="none"with:Note that this configuration may not be compatible with certain VM or volume features and could require additional changes. If so, those cases are outside the scope of this PR and can be addressed in future improvements.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?