(cloudstack-documentation) branch main updated: Update docs related to selinux (#411)

[ro...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rohit pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudstack-documentation.git


The following commit(s) were added to refs/heads/main by this push:
     new 2f55443  Update docs related to selinux (#411)
2f55443 is described below

commit 2f554431b198525a6e7175512630fa4ca2d00e15
Author: Vishesh <vi...@gmail.com>
AuthorDate: Tue Oct 1 12:45:27 2024 +0530

    Update docs related to selinux (#411)
    
    * Update docs related to selinux
    
    * Adress comments
---
 source/developersguide/ansible.rst                  | 4 ++++
 source/installguide/hypervisor/kvm.rst              | 4 ++++
 source/installguide/hypervisor/lxc.rst              | 4 ++++
 source/installguide/management-server/_database.rst | 4 ++++
 source/quickinstallationguide/qig.rst               | 7 ++++---
 5 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/source/developersguide/ansible.rst b/source/developersguide/ansible.rst
index 81bb4dd..ed3232f 100644
--- a/source/developersguide/ansible.rst
+++ b/source/developersguide/ansible.rst
@@ -294,6 +294,10 @@ For the management server role we create a main.yml task like this:
 
 Save this as `/etc/ansible/roles/cloudstack-management/tasks/main.yml`
 
+.. note:: In a production environment, selinux should be set to enforcing
+   and the necessary selinux policies are created to allow the
+   services to run.
+
 Now we have some new elements to deal with. The Ansible Template module
 uses Jinja2 based templating.  As we’re doing a simplified example here,
 the Jinja Template for the cloudstack.repo won’t have any variables in
diff --git a/source/installguide/hypervisor/kvm.rst b/source/installguide/hypervisor/kvm.rst
index 3b2510c..f2f6871 100644
--- a/source/installguide/hypervisor/kvm.rst
+++ b/source/installguide/hypervisor/kvm.rst
@@ -529,6 +529,10 @@ ensure the Agent has all the required permissions.
 
          $ setenforce permissive
 
+.. note:: In a production environment, selinux should be set to enforcing
+   and the necessary selinux policies are created to allow the
+   services to run.
+
 #. Configure Apparmor (Ubuntu)
 
 
diff --git a/source/installguide/hypervisor/lxc.rst b/source/installguide/hypervisor/lxc.rst
index 03948bd..a0d8165 100644
--- a/source/installguide/hypervisor/lxc.rst
+++ b/source/installguide/hypervisor/lxc.rst
@@ -319,6 +319,10 @@ ensure the Agent has all the required permissions.
 
          $ setenforce permissive
 
+.. note:: In a production environment, selinux should be set to enforcing
+   and the necessary selinux policies are created to allow the
+   services to run.
+
 #. Configure Apparmor (Ubuntu)
 
    #. Check to see whether AppArmor is installed on your machine. If
diff --git a/source/installguide/management-server/_database.rst b/source/installguide/management-server/_database.rst
index 89e2f8c..004d25b 100644
--- a/source/installguide/management-server/_database.rst
+++ b/source/installguide/management-server/_database.rst
@@ -166,6 +166,10 @@ MySQL. See :ref:`install-database-on-separate-node`.
 
          setenforce permissive
 
+.. note:: In a production environment, selinux should be set to enforcing
+   and the necessary selinux policies are created to allow the
+   services to run.
+
 #. Set up the database.
 
    The cloudstack-setup-databases script is used for creating the cloudstack
diff --git a/source/quickinstallationguide/qig.rst b/source/quickinstallationguide/qig.rst
index f4ec572..be0ba6e 100644
--- a/source/quickinstallationguide/qig.rst
+++ b/source/quickinstallationguide/qig.rst
@@ -227,9 +227,10 @@ and ensure that it returns a FQDN response
 SELinux
 ^^^^^^^
 
-At the moment, for CloudStack to work properly SELinux must be set to 
-permissive or disabled. We want to both configure this for future boots and modify it in 
-the current running system.
+In an ideal environment, selinux should be set to enforcing and the necessary
+selinux policies are created to allow the services to run. For this guide,
+we will set selinux to permissive mode. This will allow us to install and
+configure the services without having to worry about selinux policies.
 
 To configure SELinux to be permissive in the running system we need to run the 
 following command: