Do not configure selinux/apparmor when setup cloudstack agent#13281
Draft
weizhouapache wants to merge 3 commits into
Draft
Do not configure selinux/apparmor when setup cloudstack agent#13281weizhouapache wants to merge 3 commits into
weizhouapache wants to merge 3 commits into
Conversation
Member
Author
|
@blueorangutan package |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13281 +/- ##
=========================================
Coverage 18.10% 18.10%
- Complexity 16749 16752 +3
=========================================
Files 6037 6037
Lines 542796 542796
Branches 66456 66456
=========================================
+ Hits 98268 98291 +23
+ Misses 433492 433460 -32
- Partials 11036 11045 +9
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Member
Author
|
@blueorangutan package |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR stops CloudStack KVM agent setup from actively disabling host security policy mechanisms during setup, leaving SELinux/AppArmor posture to operators.
Changes:
- Makes AppArmor and SELinux setup configuration methods return without modifying host policy.
- Removes the legacy
setup_agent.shscript that also forced SELinux permissive mode. - Removes stale Java comments referencing the deleted setup script.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
python/lib/cloudutils/serviceConfig.py |
No-ops AppArmor/SELinux configuration during agent setup. |
scripts/vm/hypervisor/kvm/setup_agent.sh |
Deletes obsolete KVM agent setup helper script. |
server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java |
Removes stale commented reference to setup_agent.sh. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
Author
|
@blueorangutan package |
Member
Author
|
@DaanHoogland |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18086 |
|
[SF] Trillian Build Failed (tid-16221) |
|
[SF] Trillian Build Failed (tid-16225) |
Member
Author
|
with the changes ubuntu 24 debian12 oraclelinux 8 suse15 oraclelinux 9 |
Member
Author
|
@blueorangutan package |
|
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18093 |
|
[SF] Trillian test result (tid-16220)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR disables security configurations during CloudStack agent setup:
However, users have different security and hardening requirements, and these decisions should not be enforced by the agent setup. For example:
Some environments may require SELinux/AppArmor to remain in enforcing mode for stronger security hardening, and the system should still support such configurations.
Some users may prefer to explicitly configure the libvirt security driver in
/etc/libvirt/qemu.conf, replacingsecurity_driver="none"with:Note that this configuration may not be compatible with certain VM or volume features and could require additional changes. If so, those cases are outside the scope of this PR and can be addressed in future improvements.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?