You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "weizhouapache (via GitHub)" <gi...@apache.org> on 2026/05/29 07:33:38 UTC
[PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
weizhouapache opened a new pull request, #13281:
URL: https://github.com/apache/cloudstack/pull/13281
### Description
This PR disables security configurations during CloudStack agent setup:
- On Ubuntu, it disables AppArmor restrictions for libvirt
- On EL-based systems, it sets SELinux to permissive mode
However, users have different security and hardening requirements, and these decisions should not be enforced by the agent setup. For example:
- Some environments may require SELinux/AppArmor to remain in enforcing mode for stronger security hardening, and the system should still support such configurations.
- Some users may prefer to explicitly configure the libvirt security driver in `/etc/libvirt/qemu.conf`, replacing `security_driver="none"` with:
```
security_driver="selinux"
security_driver="apparmor"
```
Note that this configuration may not be compatible with certain VM or volume features and could require additional changes. If so, those cases are outside the scope of this PR and can be addressed in future improvements.
<!--- Describe your changes in DETAIL - And how has behaviour functionally changed. -->
<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. -->
<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->
<!--- ******************************************************************************* -->
<!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!--- ******************************************************************************* -->
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [ ] Minor
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [ ] Minor
- [ ] Trivial
### Screenshots (if appropriate):
### How Has This Been Tested?
<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran to -->
#### How did you try to break this feature and the system with this change?
<!-- see how your change affects other areas of the code, etc. -->
<!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md) document -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4725583655
<b>[SF] Trillian test result (tid-16330)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 50203 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16330-kvm-ol8.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4592519039
<b>[SF] Trillian Build Failed (tid-16236)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6055299389
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6036164605
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19441
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4216508326
##########
client/pom.xml:
##########
@@ -979,6 +979,10 @@
<exclude>org.bouncycastle:bcprov-jdk18on</exclude>
<exclude>org.bouncycastle:bcpkix-jdk18on</exclude>
<exclude>org.bouncycastle:bctls-jdk18on</exclude>
+ <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
+ <exclude>org.bouncycastle:bcpkix-jdk15on</exclude>
+ <exclude>org.bouncycastle:bctls-jdk15on</exclude>
+ <exclude>org.bouncycastle:bcutil-jdk15on</exclude>
Review Comment:
These exclusions change the management-server runtime classpath, but the PR is scoped and described only as changing agent SELinux/AppArmor setup. Please remove this unrelated packaging change from this PR or split it into a separately explained and verified change so its Bouncy Castle compatibility impact can be reviewed independently.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6068553456
<b>[SF] Trillian Build Failed (tid-17112)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6412220339
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4574143440
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18086
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323302808
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -525,6 +525,8 @@ def __init__(self, syscfg):
self.serviceName = "Apparmor"
def config(self):
+ return True
Review Comment:
This no-ops the AppArmor service step, but agent setup still unconditionally writes `security_driver="none"` to `/etc/libvirt/qemu.conf` in `libvirtConfigUbuntu` (serviceConfig.py:756). That means setup continues to disable libvirt's AppArmor integration and will overwrite a user's `security_driver="apparmor"` choice on reruns, so the PR does not fully stop enforcing AppArmor-related security policy during setup.
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -559,6 +563,8 @@ def __init__(self, syscfg):
self.serviceName = "SElinux"
def config(self):
+ return True
Review Comment:
This no-ops the SELinux service step, but agent setup still unconditionally writes `security_driver="none"` to `/etc/libvirt/qemu.conf` in the Red Hat and SUSE libvirt config paths (serviceConfig.py:663 and :701). On reruns, that will keep disabling libvirt's SELinux integration and overwrite a user's `security_driver="selinux"` choice, so the setup flow still enforces a SELinux-related security decision.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4720452437
<b>[SF] Trillian Build Failed (tid-16336)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4729184060
<b>[SF] Trillian test result (tid-16338)</b>
Environment: kvm-debian12 (x2), zone: Advanced Networking with Mgmt server d12
Total time taken: 66586 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16338-kvm-debian12.zip
Smoke tests completed. 127 look OK, 24 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 2.48 | test_dynamicroles.py
test_query_async_job_result | `Error` | 93.49 | test_async_job.py
test_revoke_certificate | `Error` | 0.05 | test_certauthority_root.py
test_configure_ha_provider_invalid | `Error` | 0.04 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.03 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.03 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.04 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.04 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.03 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.17 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.17 | test_host_ping.py
test_01_browser_migrate_template | `Error` | 15.51 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 247.85 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 258.05 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 270.35 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 249.48 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 250.63 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 253.67 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 376.04 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 266.01 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 65.79 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 372.29 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 0.21 | test_kubernetes_supported_versions.py
login_test_saml_user | `Error` | 4.53 | test_login.py
test_01_deployVMInSharedNetwork | `Error` | 55.99 | test_network.py
test_03_destroySharedNetwork | `Failure` | 1.09 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 2.21 | test_network.py
test_01_deployVMInSharedNetwork | `Failure` | 808.98 | test_network.py
test_oobm_issue_power_cycle | `Error` | 1.40 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 3.44 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 3.47 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 2.45 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 1.39 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 2.37 | test_outofbandmanagement_nestedplugin.py
test_oobm_background_powerstate_sync | `Failure` | 20.84 | test_outofbandmanagement.py
test_oobm_background_powerstate_sync | `Error` | 20.84 | test_outofbandmanagement.py
test_oobm_configure_default_driver | `Error` | 0.11 | test_outofbandmanagement.py
test_oobm_configure_invalid_driver | `Error` | 0.09 | test_outofbandmanagement.py
test_oobm_disable_feature_invalid | `Error` | 0.09 | test_outofbandmanagement.py
test_oobm_disable_feature_valid | `Error` | 0.18 | test_outofbandmanagement.py
test_oobm_enable_feature_invalid | `Error` | 0.08 | test_outofbandmanagement.py
test_oobm_enable_feature_valid | `Error` | 0.16 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | `Error` | 2.94 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | `Error` | 2.94 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | `Error` | 1.40 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | `Error` | 1.40 | test_outofbandmanagement.py
test_oobm_issue_power_off | `Error` | 0.36 | test_outofbandmanagement.py
test_oobm_issue_power_off | `Error` | 0.36 | test_outofbandmanagement.py
test_oobm_issue_power_on | `Error` | 0.35 | test_outofbandmanagement.py
test_oobm_issue_power_on | `Error` | 0.35 | test_outofbandmanagement.py
test_oobm_issue_power_reset | `Error` | 1.38 | test_outofbandmanagement.py
test_oobm_issue_power_reset | `Error` | 1.38 | test_outofbandmanagement.py
test_oobm_issue_power_soft | `Error` | 1.37 | test_outofbandmanagement.py
test_oobm_issue_power_soft | `Error` | 1.37 | test_outofbandmanagement.py
test_oobm_issue_power_status | `Error` | 0.35 | test_outofbandmanagement.py
test_oobm_issue_power_status | `Error` | 0.35 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | `Error` | 0.23 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | `Error` | 0.23 | test_outofbandmanagement.py
test_oobm_zchange_password | `Error` | 0.24 | test_outofbandmanagement.py
test_oobm_zchange_password | `Error` | 0.24 | test_outofbandmanagement.py
test_02_edit_primary_storage_tags | `Error` | 0.04 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.12 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 0.07 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.05 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 0.05 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 63.78 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 165.77 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 172.37 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 337.24 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 28.69 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 18.56 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 17.88 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 19.43 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 247.31 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 380.01 | test_purge_expunged_vms.py
test_01_snapshot_root_disk | `Error` | 3.46 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 30.33 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.21 | test_templates.py
test_01_positive_tests_usage | `Error` | 12.02 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.14 | test_usage.py
test_01_lb_usage | `Error` | 6.42 | test_usage.py
test_01_nat_usage | `Error` | 10.53 | test_usage.py
test_01_public_ip_usage | `Error` | 1.13 | test_usage.py
test_01_snapshot_usage | `Error` | 19.81 | test_usage.py
test_01_template_usage | `Error` | 15.43 | test_usage.py
test_01_vm_usage | `Error` | 141.21 | test_usage.py
test_01_volume_usage | `Error` | 129.09 | test_usage.py
test_01_vpn_usage | `Error` | 10.72 | test_usage.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 12.82 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.13 | test_vm_schedule.py
test_hostha_enable_ha_when_host_disabled | `Error` | 1.28 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 301.10 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4740985987
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "andrijapanicsb (via GitHub)" <gi...@apache.org>.
andrijapanicsb commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-5527392241
It really did shut up, hahahahahhahaa..... 😁
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6014689386
thanks @andrijapanicsb @prashanthr2 for the review, good suggestions !
I will address
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6079969679
<b>[SF] Trillian test result (tid-17108)</b>
Environment: kvm-ubuntu24 (x2), zone: Advanced Networking with Mgmt server u24
Total time taken: 60193 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17108-kvm-ubuntu24.zip
Smoke tests completed. 156 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6412240765
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4582183353
<b>[SF] Trillian test result (tid-16227)</b>
Environment: kvm-ol9 (x2), zone: Advanced Networking with Mgmt server ol9
Total time taken: 58836 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16227-kvm-ol9.zip
Smoke tests completed. 149 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_04_rvpc_privategw_static_routes | `Failure` | 864.04 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 864.09 | test_privategw_acl.py
test_01_vpn_usage | `Error` | 0.06 | test_usage.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323131443
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -559,6 +561,8 @@ def __init__(self, syscfg):
self.serviceName = "SElinux"
def config(self):
+ return True
Review Comment:
Making SELinux configuration a no-op here leaves `restore()` active. On a failed setup after this step, rollback will still run `setenforce 1`, so a host that was intentionally permissive before setup can be switched to enforcing even though setup no longer changed it. Please make the SELinux restore path a no-op too, or remove this service from the agent service list.
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -525,6 +525,8 @@ def __init__(self, syscfg):
self.serviceName = "Apparmor"
def config(self):
+ return True
Review Comment:
Making AppArmor configuration a no-op here leaves `restore()` active. If a later setup step fails, `cloud-setup-agent` calls `syscfg.restore()`, and this service will start/enable AppArmor even though setup no longer disabled it, which can unexpectedly change an operator-managed host policy. Please make the AppArmor restore path a no-op as well, or remove this service from the agent service list entirely.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4727192874
<b>[SF] Trillian Build Failed (tid-16341)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6067374196
<b>[SF] Trillian Build Failed (tid-17111)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6091798802
<b>[SF] Trillian test result (tid-17114)</b>
Environment: kvm-ubuntu24 (x2), zone: Advanced Networking with Mgmt server u24
Total time taken: 62621 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17114-kvm-ubuntu24.zip
Smoke tests completed. 155 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_02_list_cpvm_vm | `Failure` | 0.06 | test_ssvm.py
test_04_cpvm_internals | `Failure` | 0.06 | test_ssvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6144650816
@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "prashanthr2 (via GitHub)" <gi...@apache.org>.
prashanthr2 commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6014539532
LGTM overall, this is the right direction.
+1 to @andrijapanicsb's points, all four are correct.
On the first one, it's worth being specific about what a host set up by the old code is left holding, because that code wrote persistent on-disk state, not just runtime state:
- securityPolicyConfigUbuntu.config() symlinked both libvirt profiles into /etc/apparmor.d/disable/ and ran apparmor_parser -R. restore() only re-enables the apparmor service. It never removes those symlinks, so the profiles stay disabled across reboots.
- securityPolicyConfigRedhat.config() ran setenforce 0 and rewrote /etc/selinux/config to SELINUX=permissive. restore() only runs setenforce 1, which is lost at the next boot.
This PR is right not to undo any of that automatically , re-enforcing a host's security policy behind the operator's back would be as bad as disabling it was. The consequence is just that an existing host carries on with SELinux permissive / AppArmor disabled, and nothing surfaces that. Anyone who wants it back has to do it by hand: remove the two _/etc/apparmor.d/disable/ symlinks_ and re-parse the profiles, or set _SELINUX=enforcing_ and relabel, plus unset _security_driver_ in _/etc/libvirt/qemu.conf._ That procedure should be in the **release notes**, not only the docs , release notes reach the operator before they upgrade; docs only reach whoever goes looking afterwards. Worth remembering the agent packages are upgraded per host, manually, well after the management server, so a zone will sit with both behaviours for a while.
The other three: agreed that on fresh installs libvirt may apply AppArmor/SELinux to QEMU automatically so post-install behaviour genuinely differs from before and should be stated plainly; AppArmor section titles should mention Debian, not just Ubuntu; and a blanket aa-enforce /etc/apparmor.d/* should be avoided since it enforces profiles unrelated to libvirt/QEMU.
**Suggestion (nice-to-have, not a blocker):** have agent setup detect and report the current state rather than change it. The detection calls already exist in the code being deleted _bash("selinuxenabled")_ in _securityPolicyConfigRedhat.config()_, _bash("service apparmor status") / bash("apparmor_status | grep libvirt")_ in _securityPolicyConfigUbuntu.config()_ so keeping just the read half is close to zero risk. The value is diagnostic: when a policy blocks QEMU, the symptom in agent.log is a generic libvirt permission error while the real cause is an AVC denial in audit.log, a different layer entirely. One line at setup ("SELinux: enforcing", "AppArmor: libvirtd profile enforcing") shortens that path a lot, and it makes the leftover state on older hosts visible.
Relatedly, Requires: (selinux-tools if selinux-tools) in the agent subpackage of both packaging/el8/cloud.spec and packaging/suse15/cloud.spec , still wanted once setup no longer touches SELinux?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6123100109
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6037442923
<b>[SF] Trillian Build Failed (tid-17088)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6041674506
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19453
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4647224415
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4749407039
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4755534084
<b>[SF] Trillian test result (tid-16372)</b>
Environment: kvm-suse15 (x2), zone: Advanced Networking with Mgmt server s15
Total time taken: 54270 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16372-kvm-suse15.zip
Smoke tests completed. 149 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_01_deploy_vm_from_iso_uefi_secure | `Error` | 62.10 | test_deploy_vm_iso_uefi.py
test_02_deploy_vm_from_iso_uefi_legacy | `Error` | 13.66 | test_deploy_vm_iso_uefi.py
test_03_deploy_windows_vm_from_iso_uefi_legacy | `Error` | 11.50 | test_deploy_vm_iso_uefi.py
test_04_deploy_windows_vm_from_iso_uefi_secure | `Error` | 12.58 | test_deploy_vm_iso_uefi.py
test_uservm_host_control_state | `Failure` | 17.32 | test_host_control_state.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4572890683
@DaanHoogland
yes, they are dead code.
I am running some tests, they will be removed after verification
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4581993108
<b>[SF] Trillian test result (tid-16224)</b>
Environment: kvm-suse15 (x2), zone: Advanced Networking with Mgmt server s15
Total time taken: 64937 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16224-kvm-suse15.zip
Smoke tests completed. 126 look OK, 25 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 1.63 | test_dynamicroles.py
test_query_async_job_result | `Error` | 104.85 | test_async_job.py
test_revoke_certificate | `Error` | 0.01 | test_certauthority_root.py
test_configure_ha_provider_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.01 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.01 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.01 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.06 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.07 | test_host_ping.py
test_01_deploy_vm_from_iso_uefi_secure | `Error` | 67.83 | test_deploy_vm_iso_uefi.py
test_02_deploy_vm_from_iso_uefi_legacy | `Error` | 11.44 | test_deploy_vm_iso_uefi.py
test_03_deploy_windows_vm_from_iso_uefi_legacy | `Error` | 12.45 | test_deploy_vm_iso_uefi.py
test_04_deploy_windows_vm_from_iso_uefi_secure | `Error` | 11.42 | test_deploy_vm_iso_uefi.py
test_01_browser_migrate_template | `Error` | 15.30 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 290.31 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 249.44 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 253.67 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 221.94 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 226.27 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 236.54 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 305.83 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 228.29 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 76.22 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 240.40 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 0.13 | test_kubernetes_supported_versions.py
login_test_saml_user | `Error` | 2.01 | test_login.py
test_01_deployVMInSharedNetwork | `Error` | 54.43 | test_network.py
test_03_destroySharedNetwork | `Failure` | 1.08 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 2.17 | test_network.py
test_oobm_issue_power_cycle | `Error` | 3.30 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 2.27 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 3.26 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 3.28 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 3.26 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 1.18 | test_outofbandmanagement_nestedplugin.py
test_02_edit_primary_storage_tags | `Error` | 0.02 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.07 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 0.02 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.02 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 0.02 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 51.54 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 192.03 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 160.18 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 317.64 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 20.27 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 13.43 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 11.40 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 13.42 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 239.28 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 340.55 | test_purge_expunged_vms.py
test_01_RVR_Network_FW_PF_SSH_default_routes_egress_true | `Failure` | 541.13 | test_routers_network_ops.py
test_01_snapshot_root_disk | `Error` | 4.33 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 24.85 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.31 | test_templates.py
test_01_positive_tests_usage | `Error` | 12.75 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.09 | test_usage.py
test_01_lb_usage | `Error` | 4.22 | test_usage.py
test_01_nat_usage | `Error` | 8.31 | test_usage.py
test_01_public_ip_usage | `Error` | 1.06 | test_usage.py
test_01_snapshot_usage | `Error` | 18.52 | test_usage.py
test_01_template_usage | `Error` | 21.04 | test_usage.py
test_01_vm_usage | `Error` | 141.21 | test_usage.py
test_01_volume_usage | `Error` | 129.94 | test_usage.py
test_01_vpn_usage | `Error` | 8.44 | test_usage.py
test_02_unsecure_vm_migration | `Failure` | 276.15 | test_vm_life_cycle.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 15.58 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.09 | test_vm_schedule.py
test_disable_oobm_ha_state_ineligible | `Error` | 0.06 | test_hostha_kvm.py
test_hostha_configure_default_driver | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disabled | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disconected | `Error` | 0.03 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_degraded | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_fencing | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_recovering | `Error` | 0.03 | test_hostha_kvm.py
test_remove_ha_provider_not_possible | `Error` | 0.05 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4582046683
<b>[SF] Trillian test result (tid-16223)</b>
Environment: kvm-debian12 (x2), zone: Advanced Networking with Mgmt server d12
Total time taken: 66932 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16223-kvm-debian12.zip
Smoke tests completed. 125 look OK, 26 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 2.54 | test_dynamicroles.py
test_query_async_job_result | `Error` | 88.02 | test_async_job.py
test_revoke_certificate | `Error` | 0.04 | test_certauthority_root.py
login_test_saml_user | `Error` | 4.73 | test_login.py
ContextSuite context=TestClusterDRS>:setup | `Error` | 0.00 | test_cluster_drs.py
test_configure_ha_provider_invalid | `Error` | 0.04 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.03 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.03 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.03 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.16 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.17 | test_host_ping.py
test_01_browser_migrate_template | `Error` | 15.53 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 271.86 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 270.69 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 283.76 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 289.20 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 244.39 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 223.10 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 396.79 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 286.29 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 70.87 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 261.27 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 2.11 | test_kubernetes_supported_versions.py
test_01_deployVMInSharedNetwork | `Error` | 67.33 | test_network.py
test_03_destroySharedNetwork | `Failure` | 1.12 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 2.25 | test_network.py
test_oobm_issue_power_cycle | `Error` | 2.41 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 2.40 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 2.42 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 2.42 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 2.44 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 2.35 | test_outofbandmanagement_nestedplugin.py
test_oobm_background_powerstate_sync | `Failure` | 20.89 | test_outofbandmanagement.py
test_oobm_background_powerstate_sync | `Error` | 20.90 | test_outofbandmanagement.py
test_oobm_configure_default_driver | `Error` | 0.11 | test_outofbandmanagement.py
test_oobm_configure_invalid_driver | `Error` | 0.09 | test_outofbandmanagement.py
test_oobm_disable_feature_invalid | `Error` | 0.09 | test_outofbandmanagement.py
test_oobm_disable_feature_valid | `Error` | 0.21 | test_outofbandmanagement.py
test_oobm_enable_feature_invalid | `Error` | 0.08 | test_outofbandmanagement.py
test_oobm_enable_feature_valid | `Error` | 0.18 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | `Error` | 2.98 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | `Error` | 2.98 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | `Error` | 1.43 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | `Error` | 1.43 | test_outofbandmanagement.py
test_oobm_issue_power_off | `Error` | 0.39 | test_outofbandmanagement.py
test_oobm_issue_power_off | `Error` | 0.40 | test_outofbandmanagement.py
test_oobm_issue_power_on | `Error` | 2.44 | test_outofbandmanagement.py
test_oobm_issue_power_on | `Error` | 2.44 | test_outofbandmanagement.py
test_oobm_issue_power_reset | `Error` | 1.40 | test_outofbandmanagement.py
test_oobm_issue_power_reset | `Error` | 1.40 | test_outofbandmanagement.py
test_oobm_issue_power_soft | `Error` | 1.41 | test_outofbandmanagement.py
test_oobm_issue_power_soft | `Error` | 1.41 | test_outofbandmanagement.py
test_oobm_issue_power_status | `Error` | 1.42 | test_outofbandmanagement.py
test_oobm_issue_power_status | `Error` | 1.42 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | `Error` | 0.24 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | `Error` | 0.25 | test_outofbandmanagement.py
test_oobm_zchange_password | `Error` | 0.25 | test_outofbandmanagement.py
test_oobm_zchange_password | `Error` | 0.25 | test_outofbandmanagement.py
test_02_edit_primary_storage_tags | `Error` | 0.05 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.11 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 0.06 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.05 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 0.05 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 55.85 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 191.54 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 162.19 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 313.14 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 27.01 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 18.24 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 20.59 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 18.31 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 239.87 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 389.88 | test_purge_expunged_vms.py
test_router_dhcphosts | `Failure` | 33.03 | test_router_dhcphosts.py
test_01_snapshot_root_disk | `Error` | 3.42 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 19.06 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.23 | test_templates.py
test_01_positive_tests_usage | `Error` | 9.96 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.19 | test_usage.py
test_01_lb_usage | `Error` | 6.40 | test_usage.py
test_01_nat_usage | `Error` | 10.60 | test_usage.py
test_01_public_ip_usage | `Error` | 1.14 | test_usage.py
test_01_snapshot_usage | `Error` | 29.20 | test_usage.py
test_01_template_usage | `Error` | 17.01 | test_usage.py
test_01_vm_usage | `Error` | 134.21 | test_usage.py
test_01_volume_usage | `Error` | 126.08 | test_usage.py
test_01_vpn_usage | `Error` | 8.68 | test_usage.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 11.84 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.14 | test_vm_schedule.py
test_disable_oobm_ha_state_ineligible | `Error` | 0.12 | test_hostha_kvm.py
test_hostha_configure_default_driver | `Error` | 0.10 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disabled | `Error` | 0.10 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disconected | `Error` | 0.10 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 0.11 | test_hostha_kvm.py
test_hostha_kvm_host_degraded | `Error` | 0.10 | test_hostha_kvm.py
test_hostha_kvm_host_fencing | `Error` | 0.15 | test_hostha_kvm.py
test_hostha_kvm_host_recovering | `Error` | 0.10 | test_hostha_kvm.py
test_remove_ha_provider_not_possible | `Error` | 0.09 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4597720203
<b>[SF] Trillian test result (tid-16232)</b>
Environment: kvm-ol9 (x2), zone: Advanced Networking with Mgmt server ol9
Total time taken: 57074 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16232-kvm-ol9.zip
Smoke tests completed. 150 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
ContextSuite context=TestClusterDRS>:setup | `Error` | 0.00 | test_cluster_drs.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4726914120
<b>[SF] Trillian test result (tid-16339)</b>
Environment: kvm-ubuntu24 (x2), zone: Advanced Networking with Mgmt server u24
Total time taken: 51830 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16339-kvm-ubuntu24.zip
Smoke tests completed. 148 look OK, 3 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
ContextSuite context=TestClusterDRS>:setup | `Error` | 0.00 | test_cluster_drs.py
test_list_system_vms_metrics_history | `Failure` | 0.47 | test_metrics_api.py
test_01_ssl_offloading_isolated_network | `Failure` | 698.34 | test_ssl_offloading.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-5528569788
@bluorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4217041018
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -652,7 +583,6 @@ def config(self):
filename = "/etc/libvirt/qemu.conf"
cfo = configFileOps(filename, self)
- cfo.addEntry("security_driver", "\"none\"")
cfo.addEntry("user", "\"root\"")
cfo.addEntry("group", "\"root\"")
cfo.addEntry("vnc_listen", "\"0.0.0.0\"")
Review Comment:
we leave user to set the value
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6047568389
<b>[SF] Trillian Build Failed (tid-17094)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6040837996
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6144614037
@blueorangutan test
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4741339474
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18297
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4903113174
moving to 4.24.0 milestone
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4572562289
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4576026362
<b>[SF] Trillian Build Failed (tid-16225)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4578548070
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323250218
##########
python/lib/cloudutils/serviceConfig.py:
##########
Review Comment:
so this part is now dead code
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4575065924
<b>[SF] Trillian Build Failed (tid-16221)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4576639199
with the changes
u24
```
root@pr13281-t16222-kvm-ubuntu24-kvm1:~# aa-status
apparmor module is loaded.
113 profiles are loaded.
113 profiles are in enforce mode.
/usr/bin/man
/usr/lib/snapd/snap-confine
/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
/usr/sbin/chronyd
1password
Discord
MongoDB Compass
QtWebEngineProcess
balena-etcher
brave
buildah
cam
ch-checkns
ch-run
chrome
crun
devhelp
element-desktop
epiphany
evolution
firefox
flatpak
foliate
geary
github-desktop
goldendict
ipa_verify
kchmviewer
keybase
lc-compliance
libcamerify
libvirtd
libvirtd//qemu_bridge_helper
linux-sandbox
loupe
lsb_release
lxc-attach
lxc-create
lxc-destroy
lxc-execute
lxc-stop
lxc-unshare
lxc-usernsexec
man_filter
man_groff
mmdebstrap
msedge
notepadqq
nvidia_modprobe
nvidia_modprobe//kmod
obsidian
opam
opera
pageedit
plasmashell
plasmashell//QtWebEngineProcess
podman
polypane
privacybrowser
qcam
qmapshack
qutebrowser
rootlesskit
rpm
rssguard
rsyslogd
runc
sbuild
sbuild-abort
sbuild-adduser
sbuild-apt
sbuild-checkpackages
sbuild-clean
sbuild-createchroot
sbuild-destroychroot
sbuild-distupgrade
sbuild-hold
sbuild-shell
sbuild-unhold
sbuild-update
sbuild-upgrade
scide
signal-desktop
slack
slirp4netns
steam
stress-ng
surfshark
swtpm
systemd-coredump
tcpdump
thunderbird
toybox
transmission-cli
transmission-daemon
transmission-gtk
transmission-qt
trinity
tup
tuxedo-control-center
ubuntu_pro_apt_news
unix-chkpwd
unprivileged_userns
userbindmount
uwsgi-core
vdens
virt-aa-helper
virtiofsd
vivaldi-bin
vpnns
vscode
wike
wpcom
0 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
4 processes have profiles defined.
4 processes are in enforce mode.
/usr/sbin/chronyd (949)
/usr/sbin/chronyd (957)
/usr/sbin/libvirtd (13184) libvirtd
/usr/sbin/rsyslogd (927) rsyslogd
0 processes are in complain mode.
0 processes are in prompt mode.
0 processes are in kill mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
root@pr13281-t16222-kvm-ubuntu24-kvm1:~# grep ^security /etc/libvirt/qemu.conf
security_driver="none"
```
debian12
```
root@pr13281-t16223-kvm-debian12-kvm1:~# aa-status
apparmor module is loaded.
15 profiles are loaded.
15 profiles are in enforce mode.
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/usr/sbin/chronyd
/{,usr/}sbin/dhclient
libvirtd
libvirtd//qemu_bridge_helper
lsb_release
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
tcpdump
virt-aa-helper
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
3 processes have profiles defined.
3 processes are in enforce mode.
/usr/sbin/chronyd (1818)
/usr/sbin/chronyd (1819)
/usr/sbin/libvirtd (44766) libvirtd
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
root@pr13281-t16223-kvm-debian12-kvm1:~# grep ^security /etc/libvirt/qemu.conf
security_driver="none"
```
oraclelinux 8
```
[root@pr13281-t16220-kvm-ol8-kvm1 ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 31
[root@pr13281-t16220-kvm-ol8-kvm1 ~]# grep ^security /etc/libvirt/qemu.conf
security_driver="none"
```
suse15
```
pr13281-t16224-kvm-suse15-kvm1:~ # aa-status
apparmor module is loaded.
64 profiles are loaded.
64 profiles are in enforce mode.
/usr/bin/lessopen.sh
apache2
apache2//DEFAULT_URI
apache2//HANDLING_UNTRUSTED_INPUT
apache2//phpsysinfo
avahi-daemon
dnsmasq
dnsmasq//libvirt_leaseshelper
dovecot
dovecot-anvil
dovecot-auth
dovecot-config
dovecot-deliver
dovecot-dict
dovecot-director
dovecot-doveadm-server
dovecot-dovecot-auth
dovecot-dovecot-lda
dovecot-dovecot-lda//sendmail
dovecot-imap
dovecot-imap-login
dovecot-lmtp
dovecot-log
dovecot-managesieve
dovecot-managesieve-login
dovecot-pop3
dovecot-pop3-login
dovecot-replicator
dovecot-script-login
dovecot-ssl-params
dovecot-stats
identd
klogd
libvirtd
libvirtd//qemu_bridge_helper
lsb_release
mdnsd
nmbd
nscd
ntpd
nvidia_modprobe
nvidia_modprobe//kmod
php-fpm
ping
samba-bgqd
samba-dcerpcd
samba-rpcd
samba-rpcd-classic
samba-rpcd-spoolss
smbd
smbldap-useradd
smbldap-useradd///etc/init.d/nscd
syslog-ng
syslogd
traceroute
unix-chkpwd
virt-aa-helper
virtqemud
virtqemud//qemu_bridge_helper
virtxend
winbindd
zgrep
zgrep//helper
zgrep//sed
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
2 processes have profiles defined.
2 processes are in enforce mode.
/usr/sbin/libvirtd (8137) libvirtd
/usr/sbin/nscd (862) nscd
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
pr13281-t16224-kvm-suse15-kvm1:~ # grep ^security /etc/libvirt/qemu.conf
security_driver="none"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6040393941
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6034843249
> Relatedly, Requires: (selinux-tools if selinux-tools) in the agent subpackage of both packaging/el8/cloud.spec and packaging/suse15/cloud.spec , still wanted once setup no longer touches SELinux?
@prashanthr2
I think we can still install SELinux if we verify that the default SELinux settings or Enforcing mode work.
Similarly, AppArmor is installed automatically on KVM hosts (see debian/control).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6034859400
> Suggestion (nice-to-have, not a blocker): have agent setup detect and report the current state rather than change it. The detection calls already exist in the code being deleted bash("selinuxenabled") in securityPolicyConfigRedhat.config(), bash("service apparmor status") / bash("apparmor_status | grep libvirt") in securityPolicyConfigUbuntu.config() so keeping just the read half is close to zero risk. The value is diagnostic: when a policy blocks QEMU, the symptom in agent.log is a generic libvirt permission error while the real cause is an AVC denial in audit.log, a different layer entirely. One line at setup ("SELinux: enforcing", "AppArmor: libvirtd profile enforcing") shortens that path a lot, and it makes the leftover state on older hosts visible.
Added some a note and some commands for reference in doc PR: https://github.com/apache/cloudstack-documentation/pull/662
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4229865576
##########
server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java:
##########
@@ -378,8 +378,6 @@ private HostVO waitForHostConnect(long dcId, long podId, long clusterId, String
@Override
public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
- // _setupAgentPath = Script.findScript(getPatchPath(),
- // "setup_agent.sh");
_kvmPrivateNic = _configDao.getValue(Config.KvmPrivateNetwork.key());
if (_kvmPrivateNic == null) {
_kvmPrivateNic = "cloudbr0";
Review Comment:
it is fine, the file is useless
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6080501950
> can vms still live migrate between hosts set up before and after this change? old hosts keep security_driver none, so a vm started on a new host may carry a security label the old host cant load
user has to set security_driver to none in qemu.conf
supporting security_driver with selinux/apparmor, or mixed setting is not in the scope of this PR, although selinux works on ol8, and apparmor works with some additional changes on ubuntu24/debian12 in my testing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6160212866
<b>[SF] Trillian test result (tid-17128)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 53749 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17128-kvm-ol8.zip
Smoke tests completed. 157 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4591214015
<b>[SF] Trillian Build Failed (tid-16233)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4609883533
@weizhouapache [SL] I understand these words: "help", "hello", "thanks", "package", "test"
Test command usage: test [mgmt os] [hypervisor] [keepEnv] [qemuEv] [basicZone|securityGroups]
Mgmt OS options: ['suse15', 'alma10', 'ol10', 'rocky10', 'alma9', 'centos7', 'centos6', 'rocky9', 'alma8', 'ubuntu18', 'ol9', 'ol8', 'ubuntu22', 'debian12', 'ubuntu20', 'rocky8', 'ubuntu24']
Hypervisor options: ['kvm-centos6', 'kvm-centos7', 'kvm-rocky8', 'kvm-rocky9', 'kvm-rocky10', 'kvm-ol8', 'kvm-ol9', 'kvm-ol10', 'kvm-alma8', 'kvm-alma9', 'kvm-alma10', 'kvm-ubuntu18', 'kvm-ubuntu20', 'kvm-ubuntu22', 'kvm-ubuntu24', 'kvm-debian12', 'kvm-suse15', 'vmware-55u3', 'vmware-60u2', 'vmware-65u2', 'vmware-67u3', 'vmware-70u1', 'vmware-70u2', 'vmware-70u3', 'vmware-80', 'vmware-80u1', 'vmware-80u2', 'vmware-80u3', 'vmware-80u3e', 'xenserver-65sp1', 'xenserver-71', 'xenserver-74', 'xenserver-84', 'xcpng74', 'xcpng76', 'xcpng80', 'xcpng81', 'xcpng82', 'xcpng83']
Note: when keepEnv is passed, you need to specify mgmt server os and hypervisor or use the `matrix` command.
when qemuEv is passed, it will deploy KVM hyperviosr hosts with qemu-kvm-ev, else it will default to stock qemu.
When basicZone and/or securityGroups are passed it will create a zone of the last type specified (default is Advanced)
Package command usage: package [all(default value),kvm,xen,vmware,hyperv,ovm] - a comma separated list can be passed with package command to bundle the required hypervisor's systemVM templates. Not passing any argument will bundle all - kvm,xen and vmware templates.
Blessed contributors for kicking Trillian test jobs: ['rohityadavcloud', 'shwstppr', 'Damans227', 'vishesh92', 'Pearl1594', 'harikrishna-patnala', 'nvazquez', 'DaanHoogland', 'weizhouapache', 'borisstoyanov', 'vladimirpetrov', 'kiranchavala', 'andrijapanicsb', 'NuxRo', 'rajujith', 'sureshanaparti', 'abh1sar', 'sudo87', 'RosiKyu']
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4572092420
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323246088
##########
python/lib/cloudutils/serviceConfig.py:
##########
Review Comment:
so this is dead code
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4725745742
<b>[SF] Trillian test result (tid-16329)</b>
Environment: kvm-ol9 (x2), zone: Advanced Networking with Mgmt server ol9
Total time taken: 52424 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16329-kvm-ol9.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4736088459
<b>[SF] Trillian test result (tid-16340)</b>
Environment: kvm-ubuntu24 (x2), zone: Advanced Networking with Mgmt server u24
Total time taken: 52183 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16340-kvm-ubuntu24.zip
Smoke tests completed. 150 look OK, 0 have errors, 1 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
all_test_accounts | `Skipped` | --- | test_accounts.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4719376695
<b>[SF] Trillian Build Failed (tid-16333)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4741509297
<b>[SF] Trillian Build Failed (tid-16363)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6037018732
<b>[SF] Trillian Build Failed (tid-17086)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-5493022303
@blueorangutan shutup
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6077445818
<b>[SF] Trillian Build Failed (tid-17116)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6123106891
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6411055910
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4736697809
<b>[SF] Trillian test result (tid-16342)</b>
Environment: kvm-suse15 (x2), zone: Advanced Networking with Mgmt server s15
Total time taken: 57309 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16342-kvm-suse15.zip
Smoke tests completed. 122 look OK, 29 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 1.92 | test_dynamicroles.py
test_query_async_job_result | `Error` | 68.82 | test_async_job.py
test_revoke_certificate | `Error` | 0.01 | test_certauthority_root.py
test_configure_ha_provider_invalid | `Error` | 0.02 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.01 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.01 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.00 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.00 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.00 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.00 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.00 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.00 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.00 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.09 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.09 | test_host_ping.py
test_01_deploy_vm_from_iso_uefi_secure | `Error` | 55.74 | test_deploy_vm_iso_uefi.py
test_02_deploy_vm_from_iso_uefi_legacy | `Error` | 11.53 | test_deploy_vm_iso_uefi.py
test_03_deploy_windows_vm_from_iso_uefi_legacy | `Error` | 12.54 | test_deploy_vm_iso_uefi.py
test_04_deploy_windows_vm_from_iso_uefi_secure | `Error` | 12.51 | test_deploy_vm_iso_uefi.py
test_01_browser_migrate_template | `Error` | 5.29 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 219.12 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 273.93 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 244.50 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 213.77 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 223.62 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 221.95 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 350.72 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 222.48 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 62.41 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 250.28 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 0.15 | test_kubernetes_supported_versions.py
login_test_saml_user | `Error` | 2.87 | test_login.py
test_01_deployVMInSharedNetwork | `Error` | 56.75 | test_network.py
test_03_destroySharedNetwork | `Failure` | 1.08 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 2.19 | test_network.py
test_oobm_issue_power_cycle | `Error` | 3.35 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 2.31 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 3.37 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 3.32 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 3.33 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 2.24 | test_outofbandmanagement_nestedplugin.py
test_02_edit_primary_storage_tags | `Error` | 0.02 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.07 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 1.04 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.03 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 1.08 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 52.48 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 158.52 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 151.84 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 303.18 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 19.81 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 12.16 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 13.01 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 16.33 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 237.66 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 370.25 | test_purge_expunged_vms.py
ContextSuite context=TestRouterIpTablesPolicies>:setup | `Error` | 0.00 | test_routers_iptables_default_policy.py
ContextSuite context=TestVPCIpTablesPolicies>:setup | `Error` | 0.00 | test_routers_iptables_default_policy.py
test_01_isolate_network_FW_PF_default_routes_egress_true | `Error` | 0.29 | test_routers_network_ops.py
test_02_isolate_network_FW_PF_default_routes_egress_false | `Error` | 0.30 | test_routers_network_ops.py
ContextSuite context=TestRedundantIsolateNetworks>:setup | `Error` | 1.48 | test_routers_network_ops.py
ContextSuite context=TestRouterServices>:setup | `Error` | 0.00 | test_routers.py
ContextSuite context=TestCpuCapServiceOfferings>:setup | `Error` | 0.00 | test_service_offerings.py
ContextSuite context=TestServiceOfferings>:setup | `Error` | 0.32 | test_service_offerings.py
ContextSuite context=TestSetSourceNatIp>:setup | `Error` | 0.00 | test_set_sourcenat.py
test_01_snapshot_root_disk | `Error` | 7.43 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 25.99 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.16 | test_templates.py
test_01_positive_tests_usage | `Error` | 10.49 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.08 | test_usage.py
test_01_lb_usage | `Error` | 5.27 | test_usage.py
test_01_nat_usage | `Error` | 7.34 | test_usage.py
test_01_public_ip_usage | `Error` | 1.08 | test_usage.py
test_01_snapshot_usage | `Error` | 25.83 | test_usage.py
test_01_template_usage | `Error` | 15.36 | test_usage.py
test_01_vm_usage | `Error` | 135.24 | test_usage.py
test_01_volume_usage | `Error` | 128.41 | test_usage.py
test_01_vpn_usage | `Error` | 10.57 | test_usage.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 13.68 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.11 | test_vm_schedule.py
test_disable_oobm_ha_state_ineligible | `Error` | 0.07 | test_hostha_kvm.py
test_hostha_configure_default_driver | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disabled | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disconected | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_degraded | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_fencing | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_recovering | `Error` | 0.04 | test_hostha_kvm.py
test_remove_ha_provider_not_possible | `Error` | 0.04 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4748662055
<b>[SF] Trillian test result (tid-16364)</b>
Environment: kvm-debian12 (x2), zone: Advanced Networking with Mgmt server d12
Total time taken: 62137 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16364-kvm-debian12.zip
Smoke tests completed. 126 look OK, 25 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 2.15 | test_dynamicroles.py
test_query_async_job_result | `Error` | 85.73 | test_async_job.py
test_revoke_certificate | `Error` | 0.03 | test_certauthority_root.py
login_test_saml_user | `Error` | 3.46 | test_login.py
ContextSuite context=TestClusterDRS>:setup | `Error` | 0.00 | test_cluster_drs.py
test_configure_ha_provider_invalid | `Error` | 0.04 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.02 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.02 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.02 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.02 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.02 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.03 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.03 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.03 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.02 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.14 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.14 | test_host_ping.py
test_01_browser_migrate_template | `Error` | 15.41 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 264.71 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 269.79 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 296.65 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 253.21 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 286.28 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 254.14 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 372.26 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 283.91 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 84.43 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 275.38 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 0.25 | test_kubernetes_supported_versions.py
test_01_deployVMInSharedNetwork | `Error` | 58.74 | test_network.py
test_03_destroySharedNetwork | `Failure` | 1.08 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 1.16 | test_network.py
test_oobm_issue_power_cycle | `Error` | 2.33 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 2.31 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 3.33 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 3.36 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 3.35 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 1.23 | test_outofbandmanagement_nestedplugin.py
test_oobm_background_powerstate_sync | `Failure` | 20.63 | test_outofbandmanagement.py
test_oobm_background_powerstate_sync | `Error` | 20.63 | test_outofbandmanagement.py
test_oobm_configure_default_driver | `Error` | 0.07 | test_outofbandmanagement.py
test_oobm_configure_invalid_driver | `Error` | 0.06 | test_outofbandmanagement.py
test_oobm_disable_feature_invalid | `Error` | 0.07 | test_outofbandmanagement.py
test_oobm_disable_feature_valid | `Error` | 0.13 | test_outofbandmanagement.py
test_oobm_enable_feature_invalid | `Error` | 0.06 | test_outofbandmanagement.py
test_oobm_enable_feature_valid | `Error` | 0.11 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | `Error` | 5.81 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | `Error` | 5.81 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | `Error` | 2.36 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | `Error` | 2.36 | test_outofbandmanagement.py
test_oobm_issue_power_off | `Error` | 1.33 | test_outofbandmanagement.py
test_oobm_issue_power_off | `Error` | 1.33 | test_outofbandmanagement.py
test_oobm_issue_power_on | `Error` | 2.34 | test_outofbandmanagement.py
test_oobm_issue_power_on | `Error` | 2.34 | test_outofbandmanagement.py
test_oobm_issue_power_reset | `Error` | 2.32 | test_outofbandmanagement.py
test_oobm_issue_power_reset | `Error` | 2.32 | test_outofbandmanagement.py
test_oobm_issue_power_soft | `Error` | 2.32 | test_outofbandmanagement.py
test_oobm_issue_power_soft | `Error` | 2.32 | test_outofbandmanagement.py
test_oobm_issue_power_status | `Error` | 1.30 | test_outofbandmanagement.py
test_oobm_issue_power_status | `Error` | 1.30 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | `Error` | 0.16 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | `Error` | 0.16 | test_outofbandmanagement.py
test_oobm_zchange_password | `Error` | 0.17 | test_outofbandmanagement.py
test_oobm_zchange_password | `Error` | 0.17 | test_outofbandmanagement.py
test_02_edit_primary_storage_tags | `Error` | 0.04 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.09 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 0.05 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.04 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 0.04 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 61.22 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 158.84 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 160.50 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 308.78 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 3.78 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 2.66 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 3.35 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 3.32 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 1.83 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 366.23 | test_purge_expunged_vms.py
test_01_snapshot_root_disk | `Error` | 4.34 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 22.88 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.18 | test_templates.py
test_01_positive_tests_usage | `Error` | 9.42 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.10 | test_usage.py
test_01_lb_usage | `Error` | 6.28 | test_usage.py
test_01_nat_usage | `Error` | 10.41 | test_usage.py
test_01_public_ip_usage | `Error` | 1.09 | test_usage.py
test_01_snapshot_usage | `Error` | 25.76 | test_usage.py
test_01_template_usage | `Error` | 36.74 | test_usage.py
test_01_vm_usage | `Error` | 134.12 | test_usage.py
test_01_volume_usage | `Error` | 129.15 | test_usage.py
test_01_vpn_usage | `Error` | 11.58 | test_usage.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 10.57 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.11 | test_vm_schedule.py
test_disable_oobm_ha_state_ineligible | `Error` | 0.08 | test_hostha_kvm.py
test_hostha_configure_default_driver | `Error` | 0.06 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disabled | `Error` | 0.07 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disconected | `Error` | 0.06 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 0.06 | test_hostha_kvm.py
test_hostha_kvm_host_degraded | `Error` | 0.07 | test_hostha_kvm.py
test_hostha_kvm_host_fencing | `Error` | 0.10 | test_hostha_kvm.py
test_hostha_kvm_host_recovering | `Error` | 0.06 | test_hostha_kvm.py
test_remove_ha_provider_not_possible | `Error` | 0.06 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4749402047
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4591715509
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18112
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4591269031
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4591261482
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4572172143
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/13281?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 3.51%. Comparing base ([`c0ce5b4`](https://app.codecov.io/gh/apache/cloudstack/commit/c0ce5b461f816bd6a6c1ceee8c1ee3104b3dbde7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`0e96e6f`](https://app.codecov.io/gh/apache/cloudstack/commit/0e96e6febc95b5e34833a97f644652a1af05bda9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
> :exclamation: There is a different number of reports uploaded between BASE (c0ce5b4) and HEAD (0e96e6f). Click for more details.
>
> <details><summary>HEAD has 2 uploads less than BASE</summary>
>
>| Flag | BASE (c0ce5b4) | HEAD (0e96e6f) |
>|------|------|------|
>|uitests|2|1|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #13281 +/- ##
=============================================
- Coverage 18.10% 3.51% -14.59%
=============================================
Files 6037 464 -5573
Lines 542796 40157 -502639
Branches 66456 7559 -58897
=============================================
- Hits 98268 1413 -96855
+ Misses 433492 38554 -394938
+ Partials 11036 190 -10846
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/13281/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/13281/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `3.51% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/13281/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/cloudstack/pull/13281?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323246088
##########
python/lib/cloudutils/serviceConfig.py:
##########
Review Comment:
so this is dead code
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4578943966
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18093
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4581768871
<b>[SF] Trillian test result (tid-16222)</b>
Environment: kvm-ubuntu24 (x2), zone: Advanced Networking with Mgmt server u24
Total time taken: 59843 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16222-kvm-ubuntu24.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "andrijapanicsb (via GitHub)" <gi...@apache.org>.
andrijapanicsb commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-5527438833
I agree with the main idea of this PR. CloudStack Agent setup should not
automatically change the AppArmor or SELinux configuration of the host.
I think we should clarify one important point in the documentation. This PR
only prevents CloudStack from making these changes in the future. It does not
revert changes already made on existing hosts. For example, existing hosts may
still have SELinux in permissive mode, disabled AppArmor profiles, or
security_driver="none". The administrator must change these settings manually
if needed.
The test results shared in this PR show security_driver="none" on all tested
hosts. This confirms the manually preconfigured scenario, but it does not test
a new host where security_driver is not configured. In that case, libvirt may
automatically use AppArmor or SELinux for QEMU processes. I think this
difference should be clearly explained in the documentation.
# # # # # #
The related documentation PR apache/cloudstack-documentation#662 should be
updated and merged together with this change.
The AppArmor section title should also include Debian, because Debian uses the
same AppArmor configuration approach in this case. I suggest changing:
Configure AppArmor (Ubuntu, SUSE)
to:
Configure AppArmor (Ubuntu, Debian, SUSE)
The package installation commands may still need separate examples for
Ubuntu/Debian and SUSE.
I do not think the following command should be recommended:
aa-enforce /etc/apparmor.d/*
It may affect unrelated AppArmor profiles and directories. If it is necessary
to re-enable the libvirt profiles, the commands should target only these
profiles:
aa-enforce /usr/sbin/libvirtd
aa-enforce /usr/lib/libvirt/virt-aa-helper
The current documentation also says that AppArmor and SELinux must be
disabled. This text should be updated because it conflicts with the purpose
of this PR.
The unrelated log message change in test_vpc_redundant.py could also be
removed from this PR, but this is not a blocker.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6064528897
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6287441460
@weizhouapache @prashanthr2 @andrijapanicsb does this need more testing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323331395
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -525,6 +525,8 @@ def __init__(self, syscfg):
self.serviceName = "Apparmor"
def config(self):
+ return True
Review Comment:
I think it is no needed
if security driver is not set, the default security driver is SELinux, which is not available on ubuntu, so this is same as
security_driver="none"
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323256447
##########
python/lib/cloudutils/serviceConfig.py:
##########
Review Comment:
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4748575443
<b>[SF] Trillian test result (tid-16367)</b>
Environment: kvm-ubuntu24 (x2), zone: Advanced Networking with Mgmt server u24
Total time taken: 59494 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16367-kvm-ubuntu24.zip
Smoke tests completed. 150 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_01_RVR_Network_FW_PF_SSH_default_routes_egress_true | `Failure` | 177.39 | test_routers_network_ops.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4727059795
<b>[SF] Trillian test result (tid-16331)</b>
Environment: kvm-suse15 (x2), zone: Advanced Networking with Mgmt server s15
Total time taken: 64521 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16331-kvm-suse15.zip
Smoke tests completed. 127 look OK, 24 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 1.62 | test_dynamicroles.py
test_query_async_job_result | `Error` | 65.82 | test_async_job.py
test_revoke_certificate | `Error` | 0.01 | test_certauthority_root.py
test_configure_ha_provider_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.00 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.00 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.00 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.00 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.00 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.00 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.00 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.00 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.00 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.00 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.06 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.06 | test_host_ping.py
test_01_deploy_vm_from_iso_uefi_secure | `Error` | 54.43 | test_deploy_vm_iso_uefi.py
test_02_deploy_vm_from_iso_uefi_legacy | `Error` | 16.52 | test_deploy_vm_iso_uefi.py
test_03_deploy_windows_vm_from_iso_uefi_legacy | `Error` | 11.40 | test_deploy_vm_iso_uefi.py
test_04_deploy_windows_vm_from_iso_uefi_secure | `Error` | 11.44 | test_deploy_vm_iso_uefi.py
test_01_browser_migrate_template | `Error` | 15.31 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 212.09 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 232.15 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 210.19 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 215.69 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 207.73 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 216.31 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 319.78 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 226.64 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 77.54 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 207.79 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 0.12 | test_kubernetes_supported_versions.py
login_test_saml_user | `Error` | 2.30 | test_login.py
test_01_deployVMInSharedNetwork | `Error` | 45.47 | test_network.py
test_03_destroySharedNetwork | `Failure` | 0.06 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 1.14 | test_network.py
test_01_deployVMInSharedNetwork | `Failure` | 420.61 | test_network.py
test_oobm_issue_power_cycle | `Error` | 3.29 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 3.29 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 3.33 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 3.30 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 3.41 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 1.21 | test_outofbandmanagement_nestedplugin.py
test_02_edit_primary_storage_tags | `Error` | 0.02 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.06 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 0.03 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.02 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 0.01 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 61.01 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 170.08 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 149.71 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 395.62 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 23.16 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 21.84 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 19.84 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 21.60 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 243.37 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 356.28 | test_purge_expunged_vms.py
test_01_snapshot_root_disk | `Error` | 3.32 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 26.82 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.27 | test_templates.py
test_01_positive_tests_usage | `Error` | 9.49 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.10 | test_usage.py
test_01_lb_usage | `Error` | 5.26 | test_usage.py
test_01_nat_usage | `Error` | 6.28 | test_usage.py
test_01_public_ip_usage | `Error` | 1.08 | test_usage.py
test_01_snapshot_usage | `Error` | 17.57 | test_usage.py
test_01_template_usage | `Error` | 27.56 | test_usage.py
test_01_vm_usage | `Error` | 132.72 | test_usage.py
test_01_volume_usage | `Error` | 127.73 | test_usage.py
test_01_vpn_usage | `Error` | 8.47 | test_usage.py
test_04_nonsecured_to_secured_vm_migration | `Error` | 187.66 | test_vm_life_cycle.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 10.55 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.09 | test_vm_schedule.py
test_disable_oobm_ha_state_ineligible | `Error` | 0.05 | test_hostha_kvm.py
test_hostha_configure_default_driver | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disabled | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disconected | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 0.03 | test_hostha_kvm.py
test_hostha_kvm_host_degraded | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_fencing | `Error` | 0.03 | test_hostha_kvm.py
test_hostha_kvm_host_recovering | `Error` | 0.03 | test_hostha_kvm.py
test_remove_ha_provider_not_possible | `Error` | 0.04 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4749681934
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✔️ suse15. SL-JID 18309
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4755953780
<b>[SF] Trillian test result (tid-16373)</b>
Environment: kvm-debian12 (x2), zone: Advanced Networking with Mgmt server d12
Total time taken: 57548 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16373-kvm-debian12.zip
Smoke tests completed. 150 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_hostha_enable_ha_when_host_disabled | `Error` | 2.79 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 307.77 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6052051232
<b>[SF] Trillian test result (tid-17085)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 57593 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17085-kvm-ol8.zip
Smoke tests completed. 155 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_01_ssl_offloading_isolated_network | `Failure` | 249.61 | test_ssl_offloading.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6092605959
<b>[SF] Trillian test result (tid-17117)</b>
Environment: kvm-debian12 (x2), zone: Advanced Networking with Mgmt server d12
Total time taken: 60610 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17117-kvm-debian12.zip
Smoke tests completed. 152 look OK, 4 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_vm_backup_lifecycle | `Error` | 4.24 | test_backup_recovery_kboss.py
test_vm_backup_lifecycle_with_compression | `Failure` | 0.04 | test_backup_recovery_kboss.py
test_vm_backup_lifecycle_with_validation | `Failure` | 0.04 | test_backup_recovery_kboss.py
ContextSuite context=TestKBOSSBackupAndRecovery>:teardown | `Error` | 4.27 | test_backup_recovery_kboss.py
test_05_list_volumes_isrecursive | `Failure` | 0.03 | test_list_volumes.py
test_07_list_volumes_listall | `Failure` | 0.04 | test_list_volumes.py
test_01_vpn_usage | `Error` | 1.12 | test_usage.py
test_hostha_enable_ha_when_host_disabled | `Error` | 3.08 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 303.17 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "Damans227 (via GitHub)" <gi...@apache.org>.
Damans227 commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6079962584
can vms still live migrate between hosts set up before and after this change? old hosts keep security_driver none, so a vm started on a new host may carry a security label the old host cant load
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6065455713
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19483
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4216878098
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -652,7 +583,6 @@ def config(self):
filename = "/etc/libvirt/qemu.conf"
cfo = configFileOps(filename, self)
- cfo.addEntry("security_driver", "\"none\"")
cfo.addEntry("user", "\"root\"")
cfo.addEntry("group", "\"root\"")
cfo.addEntry("vnc_listen", "\"0.0.0.0\"")
Review Comment:
Removing the explicit `security_driver` line changes libvirt behavior depending on distro defaults and existing config, and operators no longer have a CloudStack-managed way to set it intentionally. If the goal is “don’t enforce a choice,” an alternative is to support an explicit, opt-in agent/global setting (e.g., `libvirt.security_driver=none|selinux|apparmor|unset`) and only write `security_driver` when the operator sets it. This keeps the setup neutral by default while still providing a supported knob for controlled environments.
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -519,75 +519,6 @@ def config(self):
logging.debug(e)
return False
-class securityPolicyConfigUbuntu(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigUbuntu, self).__init__(syscfg)
- self.serviceName = "Apparmor"
-
- def config(self):
- try:
- cmd = bash("service apparmor status")
- if not cmd.isSuccess() or cmd.getStdout() == "":
- self.spRunning = False
- return True
-
- if not bash("apparmor_status |grep libvirt").isSuccess():
- return True
-
- bash("ln -s /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable/")
- bash("ln -s /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper /etc/apparmor.d/disable/")
- bash("apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd")
- bash("apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper")
-
- return True
- except:
- raise CloudRuntimeException("Failed to configure apparmor, please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before starting myCloud")
-
- def restore(self):
- try:
- self.syscfg.svo.enableService("apparmor")
- self.syscfg.svo.startService("apparmor")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigRedhat(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigRedhat, self).__init__(syscfg)
- self.serviceName = "SElinux"
-
- def config(self):
- selinuxEnabled = True
-
- if not bash("selinuxenabled").isSuccess():
- selinuxEnabled = False
-
- if selinuxEnabled:
- try:
- bash("setenforce 0")
- cfo = configFileOps("/etc/selinux/config", self)
- cfo.replace_line("SELINUX=", "SELINUX=permissive")
- return True
- except:
- raise CloudRuntimeException("Failed to configure selinux, please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before starting myCloud")
- else:
- return True
-
- def restore(self):
- try:
- bash("setenforce 1")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigSUSE(securityPolicyConfigRedhat):
- pass
-
-
def configure_libvirt_tls(tls_enabled=False, cfo=None):
save = False
if not cfo:
Review Comment:
The PR description focuses on disabling SELinux/AppArmor configuration during setup, but the PR also removes a previously CloudStack-applied libvirt setting (`security_driver=\"none\"`) and deletes a setup script. These are potentially breaking behavior changes for new installs/automations; please reflect this in the PR’s type/upgrade notes (e.g., mark as breaking change or document expected operator actions when hosts run with enforcing MAC policies).
##########
python/lib/cloudutils/syscfg.py:
##########
@@ -167,7 +167,6 @@ def __init__(self, glbEnv):
self.svo = serviceOpsUbuntu()
self.services = [hostConfig(self),
- securityPolicyConfigUbuntu(self),
networkConfigUbuntu(self),
libvirtConfigUbuntu(self),
firewallConfigUbuntu(self),
Review Comment:
With the security policy configurators removed from the provisioning pipeline, hosts that rely on SELinux/AppArmor adjustments for CloudStack compatibility may now fail later in less-obvious ways (e.g., libvirt/QEMU denials). Consider adding explicit setup-time logging (or a preflight check) that detects enforcing SELinux/AppArmor + active libvirt confinement and clearly points operators to the expected manual configuration path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6053751966
<b>[SF] Trillian test result (tid-17084)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 65405 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17084-kvm-ol8.zip
Smoke tests completed. 156 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6036976135
<b>[SF] Trillian Build Failed (tid-17087)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6040236744
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6415258001
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✖️ suse15. SL-JID 19748
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4647217058
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4647844690
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18182
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4748666764
<b>[SF] Trillian test result (tid-16362)</b>
Environment: kvm-suse15 (x2), zone: Advanced Networking with Mgmt server s15
Total time taken: 62017 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16362-kvm-suse15.zip
Smoke tests completed. 126 look OK, 25 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_role_account_acls_multiple_mgmt_servers | `Error` | 1.59 | test_dynamicroles.py
test_query_async_job_result | `Error` | 80.75 | test_async_job.py
test_revoke_certificate | `Error` | 0.01 | test_certauthority_root.py
test_configure_ha_provider_invalid | `Error` | 0.02 | test_hostha_simulator.py
test_configure_ha_provider_valid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_configure_enabledisable_across_clusterzones | `Error` | 0.01 | test_hostha_simulator.py
test_ha_disable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_enable_feature_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_ha_list_providers | `Error` | 0.01 | test_hostha_simulator.py
test_ha_multiple_mgmt_server_ownership | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_available | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_degraded | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_fenced | `Error` | 0.01 | test_hostha_simulator.py
test_ha_verify_fsm_recovering | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_configure_default_driver | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_configure_invalid_provider | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_disable_feature_valid | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_enable_feature_valid | `Error` | 0.01 | test_hostha_simulator.py
test_hostha_enable_feature_without_setting_provider | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host_invalid | `Error` | 0.01 | test_hostha_simulator.py
test_list_ha_for_host_valid | `Error` | 0.01 | test_hostha_simulator.py
test_01_host_ping_on_alert | `Error` | 0.09 | test_host_ping.py
test_01_host_ping_on_alert | `Error` | 0.09 | test_host_ping.py
test_01_deploy_vm_from_iso_uefi_secure | `Error` | 69.52 | test_deploy_vm_iso_uefi.py
test_02_deploy_vm_from_iso_uefi_legacy | `Error` | 12.57 | test_deploy_vm_iso_uefi.py
test_03_deploy_windows_vm_from_iso_uefi_legacy | `Error` | 14.56 | test_deploy_vm_iso_uefi.py
test_04_deploy_windows_vm_from_iso_uefi_secure | `Error` | 12.55 | test_deploy_vm_iso_uefi.py
test_uservm_host_control_state | `Failure` | 17.24 | test_host_control_state.py
test_01_browser_migrate_template | `Error` | 15.31 | test_image_store_object_migration.py
test_01_invalid_upgrade_kubernetes_cluster | `Failure` | 256.25 | test_kubernetes_clusters.py
test_02_upgrade_kubernetes_cluster | `Failure` | 268.63 | test_kubernetes_clusters.py
test_03_deploy_and_scale_kubernetes_cluster | `Failure` | 277.43 | test_kubernetes_clusters.py
test_04_autoscale_kubernetes_cluster | `Failure` | 260.26 | test_kubernetes_clusters.py
test_05_basic_lifecycle_kubernetes_cluster | `Failure` | 250.20 | test_kubernetes_clusters.py
test_06_delete_kubernetes_cluster | `Failure` | 288.14 | test_kubernetes_clusters.py
test_08_upgrade_kubernetes_ha_cluster | `Failure` | 400.10 | test_kubernetes_clusters.py
test_10_vpc_tier_kubernetes_cluster | `Failure` | 302.56 | test_kubernetes_clusters.py
test_11_test_unmanaged_cluster_lifecycle | `Error` | 61.06 | test_kubernetes_clusters.py
test_12_test_deploy_cluster_different_offerings_per_node_type | `Failure` | 271.55 | test_kubernetes_clusters.py
test_01_add_delete_kubernetes_supported_version | `Error` | 0.19 | test_kubernetes_supported_versions.py
login_test_saml_user | `Error` | 2.14 | test_login.py
test_01_deployVMInSharedNetwork | `Error` | 54.72 | test_network.py
test_03_destroySharedNetwork | `Failure` | 0.07 | test_network.py
ContextSuite context=TestSharedNetwork>:teardown | `Error` | 1.18 | test_network.py
test_oobm_issue_power_cycle | `Error` | 3.34 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_off | `Error` | 3.32 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_on | `Error` | 3.33 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_reset | `Error` | 2.30 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_soft | `Error` | 3.36 | test_outofbandmanagement_nestedplugin.py
test_oobm_issue_power_status | `Error` | 1.21 | test_outofbandmanagement_nestedplugin.py
test_02_edit_primary_storage_tags | `Error` | 0.01 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.06 | test_primary_storage_scope.py
test_01_vpc_privategw_acl | `Error` | 0.03 | test_privategw_acl_ovs_gre.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 0.02 | test_privategw_acl_ovs_gre.py
test_05_vpc_privategw_check_interface | `Error` | 0.01 | test_privategw_acl_ovs_gre.py
test_01_vpc_privategw_acl | `Error` | 71.08 | test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Error` | 160.50 | test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Error` | 157.25 | test_privategw_acl.py
test_04_rvpc_privategw_static_routes | `Error` | 312.71 | test_privategw_acl.py
test_01_purge_expunged_api_vm_start_date | `Error` | 21.35 | test_purge_expunged_vms.py
test_02_purge_expunged_api_vm_end_date | `Error` | 13.62 | test_purge_expunged_vms.py
test_03_purge_expunged_api_vm_start_end_date | `Error` | 13.82 | test_purge_expunged_vms.py
test_04_purge_expunged_api_vm_no_date | `Error` | 14.75 | test_purge_expunged_vms.py
test_05_purge_expunged_vm_service_offering | `Error` | 238.55 | test_purge_expunged_vms.py
test_06_purge_expunged_vm_background_task | `Error` | 347.75 | test_purge_expunged_vms.py
test_01_snapshot_root_disk | `Error` | 4.33 | test_snapshots.py
test_CreateTemplateWithDuplicateName | `Error` | 39.15 | test_templates.py
test_01_register_template_direct_download_flag | `Error` | 0.15 | test_templates.py
test_01_positive_tests_usage | `Error` | 9.73 | test_usage_events.py
test_01_ISO_usage | `Error` | 1.08 | test_usage.py
test_01_lb_usage | `Error` | 4.24 | test_usage.py
test_01_nat_usage | `Error` | 8.32 | test_usage.py
test_01_public_ip_usage | `Error` | 1.08 | test_usage.py
test_01_snapshot_usage | `Error` | 38.05 | test_usage.py
test_01_template_usage | `Error` | 25.50 | test_usage.py
test_01_vm_usage | `Error` | 132.90 | test_usage.py
test_01_volume_usage | `Error` | 126.03 | test_usage.py
test_01_vpn_usage | `Error` | 9.50 | test_usage.py
test_12_start_vm_multiple_volumes_allocated | `Error` | 9.56 | test_vm_life_cycle.py
test_01_vmschedule_create | `Error` | 0.10 | test_vm_schedule.py
test_disable_oobm_ha_state_ineligible | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_configure_default_driver | `Error` | 0.03 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disabled | `Error` | 0.03 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_disconected | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_degraded | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_fencing | `Error` | 0.04 | test_hostha_kvm.py
test_hostha_kvm_host_recovering | `Error` | 0.04 | test_hostha_kvm.py
test_remove_ha_provider_not_possible | `Error` | 0.03 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4572880106
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323344710
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -559,6 +563,8 @@ def __init__(self, syscfg):
self.serviceName = "SElinux"
def config(self):
+ return True
Review Comment:
IMHO, this should work
```
setenforce 1 (enforcing mode)
security_driver="none"
```
I am not sure if it works when security_driver is not set, or set to "selinux"
if not, we need to document it, or set it to "none".
anyway, it is not good to set selinux to permissive mode globally.
enforcing mode should be supported.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4579453505
<b>[SF] Trillian test result (tid-16220)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 26503 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16220-kvm-ol8.zip
Smoke tests completed. 110 look OK, 2 have errors, 39 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_01_primary_storage_nfs | `Error` | 0.25 | test_primary_storage.py
ContextSuite context=TestStorageTags>:setup | `Error` | 0.41 | test_primary_storage.py
test_01_primary_storage_scope_change | `Error` | 0.15 | test_primary_storage_scope.py
all_test_routers_iptables_default_policy | `Skipped` | --- | test_routers_iptables_default_policy.py
all_test_routers_network_ops | `Skipped` | --- | test_routers_network_ops.py
all_test_routers | `Skipped` | --- | test_routers.py
all_test_scale_vm | `Skipped` | --- | test_scale_vm.py
all_test_secondary_storage | `Skipped` | --- | test_secondary_storage.py
all_test_service_offerings | `Skipped` | --- | test_service_offerings.py
all_test_set_sourcenat | `Skipped` | --- | test_set_sourcenat.py
all_test_sharedfs_lifecycle | `Skipped` | --- | test_sharedfs_lifecycle.py
all_test_snapshots | `Skipped` | --- | test_snapshots.py
all_test_ssl_offloading | `Skipped` | --- | test_ssl_offloading.py
all_test_ssvm | `Skipped` | --- | test_ssvm.py
all_test_staticroles | `Skipped` | --- | test_staticroles.py
all_test_storage_policy | `Skipped` | --- | test_storage_policy.py
all_test_systemvm_userdata | `Skipped` | --- | test_systemvm_userdata.py
all_test_templates | `Skipped` | --- | test_templates.py
all_test_update_security_group | `Skipped` | --- | test_update_security_group.py
all_test_usage_events | `Skipped` | --- | test_usage_events.py
all_test_usage | `Skipped` | --- | test_usage.py
all_test_vm_autoscaling | `Skipped` | --- | test_vm_autoscaling.py
all_test_vm_deployment_planner | `Skipped` | --- | test_vm_deployment_planner.py
all_test_vm_life_cycle | `Skipped` | --- | test_vm_life_cycle.py
all_test_vm_lifecycle_unmanage_import | `Skipped` | --- | test_vm_lifecycle_unmanage_import.py
all_test_vm_lifecycle_unmanage_kvm_import | `Skipped` | --- | test_vm_lifecycle_unmanage_kvm_import.py
all_test_vm_lifecycle_with_snapshot_or_volume | `Skipped` | --- | test_vm_lifecycle_with_snapshot_or_volume.py
all_test_vm_schedule | `Skipped` | --- | test_vm_schedule.py
all_test_vm_snapshot_kvm | `Skipped` | --- | test_vm_snapshot_kvm.py
all_test_vm_snapshots | `Skipped` | --- | test_vm_snapshots.py
all_test_vm_strict_host_tags | `Skipped` | --- | test_vm_strict_host_tags.py
all_test_vnf_templates | `Skipped` | --- | test_vnf_templates.py
all_test_volumes | `Skipped` | --- | test_volumes.py
all_test_vpc_conserve_mode | `Skipped` | --- | test_vpc_conserve_mode.py
all_test_vpc_ipv6 | `Skipped` | --- | test_vpc_ipv6.py
all_test_vpc_redundant | `Skipped` | --- | test_vpc_redundant.py
all_test_vpc_router_nics | `Skipped` | --- | test_vpc_router_nics.py
all_test_vpc_vpn | `Skipped` | --- | test_vpc_vpn.py
all_test_webhook_delivery | `Skipped` | --- | test_webhook_delivery.py
all_test_webhook_lifecycle | `Skipped` | --- | test_webhook_lifecycle.py
all_test_host_maintenance | `Skipped` | --- | test_host_maintenance.py
all_test_hostha_kvm | `Skipped` | --- | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4582795757
<b>[SF] Trillian test result (tid-16228)</b>
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 50955 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t16228-kvm-ol8.zip
Smoke tests completed. 150 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
ContextSuite context=TestClusterDRS>:setup | `Error` | 0.00 | test_cluster_drs.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4609879551
@blueorangutan help
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4221758622
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -652,7 +583,6 @@ def config(self):
filename = "/etc/libvirt/qemu.conf"
cfo = configFileOps(filename, self)
- cfo.addEntry("security_driver", "\"none\"")
cfo.addEntry("user", "\"root\"")
cfo.addEntry("group", "\"root\"")
cfo.addEntry("vnc_listen", "\"0.0.0.0\"")
Review Comment:
With `security_driver=\"none\"` no longer being written, hosts that were previously configured by older versions may still retain an existing `security_driver=\"none\"` line in `/etc/libvirt/qemu.conf`, so upgrading/re-running setup won’t actually stop enforcing that prior choice. If the intent is to stop forcing libvirt security settings going forward, consider explicitly removing an existing `security_driver` entry when present (or introducing an explicit migration/flag) so existing installations move back to the distro/operator default without requiring manual cleanup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6067109077
<b>[SF] Trillian Build Failed (tid-17109)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6064471857
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6035334881
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6055314841
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6413329837
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r3323254357
##########
python/lib/cloudutils/serviceConfig.py:
##########
Review Comment:
```suggestion
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4578535969
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4719317114
<b>[SF] Trillian Build Failed (tid-16332)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4720483550
<b>[SF] Trillian Build Failed (tid-16335)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-4740975034
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-5493074391
@bluorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6040868666
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 19452
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6035382160
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4217056470
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -519,75 +519,6 @@ def config(self):
logging.debug(e)
return False
-class securityPolicyConfigUbuntu(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigUbuntu, self).__init__(syscfg)
- self.serviceName = "Apparmor"
-
- def config(self):
- try:
- cmd = bash("service apparmor status")
- if not cmd.isSuccess() or cmd.getStdout() == "":
- self.spRunning = False
- return True
-
- if not bash("apparmor_status |grep libvirt").isSuccess():
- return True
-
- bash("ln -s /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable/")
- bash("ln -s /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper /etc/apparmor.d/disable/")
- bash("apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd")
- bash("apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper")
-
- return True
- except:
- raise CloudRuntimeException("Failed to configure apparmor, please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before starting myCloud")
-
- def restore(self):
- try:
- self.syscfg.svo.enableService("apparmor")
- self.syscfg.svo.startService("apparmor")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigRedhat(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigRedhat, self).__init__(syscfg)
- self.serviceName = "SElinux"
-
- def config(self):
- selinuxEnabled = True
-
- if not bash("selinuxenabled").isSuccess():
- selinuxEnabled = False
-
- if selinuxEnabled:
- try:
- bash("setenforce 0")
- cfo = configFileOps("/etc/selinux/config", self)
- cfo.replace_line("SELINUX=", "SELINUX=permissive")
- return True
- except:
- raise CloudRuntimeException("Failed to configure selinux, please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before starting myCloud")
- else:
- return True
-
- def restore(self):
- try:
- bash("setenforce 1")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigSUSE(securityPolicyConfigRedhat):
- pass
-
-
def configure_libvirt_tls(tls_enabled=False, cfo=None):
save = False
if not cfo:
Review Comment:
title has been updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6056853448
<b>[SF] Trillian Build Failed (tid-17097)<b/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6123731549
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19522
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#discussion_r4229296502
##########
python/lib/cloudutils/serviceConfig.py:
##########
@@ -519,75 +519,6 @@ def config(self):
logging.debug(e)
return False
-class securityPolicyConfigUbuntu(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigUbuntu, self).__init__(syscfg)
- self.serviceName = "Apparmor"
-
- def config(self):
- try:
- cmd = bash("service apparmor status")
- if not cmd.isSuccess() or cmd.getStdout() == "":
- self.spRunning = False
- return True
-
- if not bash("apparmor_status |grep libvirt").isSuccess():
- return True
-
- bash("ln -s /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable/")
- bash("ln -s /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper /etc/apparmor.d/disable/")
- bash("apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd")
- bash("apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper")
-
- return True
- except:
- raise CloudRuntimeException("Failed to configure apparmor, please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before starting myCloud")
-
- def restore(self):
- try:
- self.syscfg.svo.enableService("apparmor")
- self.syscfg.svo.startService("apparmor")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigRedhat(serviceCfgBase):
- def __init__(self, syscfg):
- super(securityPolicyConfigRedhat, self).__init__(syscfg)
- self.serviceName = "SElinux"
-
- def config(self):
- selinuxEnabled = True
-
- if not bash("selinuxenabled").isSuccess():
- selinuxEnabled = False
-
- if selinuxEnabled:
- try:
- bash("setenforce 0")
- cfo = configFileOps("/etc/selinux/config", self)
- cfo.replace_line("SELINUX=", "SELINUX=permissive")
- return True
- except:
- raise CloudRuntimeException("Failed to configure selinux, please see the /var/log/cloudstack/agent/setup.log for detail, \
- or you can manually disable it before starting myCloud")
- else:
- return True
-
- def restore(self):
- try:
- bash("setenforce 1")
- return True
- except:
- logging.debug(formatExceptionInfo())
- return False
-
-class securityPolicyConfigSUSE(securityPolicyConfigRedhat):
- pass
-
-
def configure_libvirt_tls(tls_enabled=False, cfo=None):
save = False
if not cfo:
Review Comment:
This PR removes the `securityPolicyConfigUbuntu`, `securityPolicyConfigRedhat`, and `securityPolicyConfigSUSE` classes entirely. If any out-of-tree tooling/plugins import and invoke these classes directly (even if the in-tree pipeline no longer uses them), this becomes a breaking change at the Python module API level. Consider keeping no-op/deprecated stubs (e.g., classes that log a warning and return True) for one or more releases to preserve backward compatibility while still achieving the goal of not enforcing security policy changes.
##########
server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java:
##########
@@ -378,8 +378,6 @@ private HostVO waitForHostConnect(long dcId, long podId, long clusterId, String
@Override
public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
- // _setupAgentPath = Script.findScript(getPatchPath(),
- // "setup_agent.sh");
_kvmPrivateNic = _configDao.getValue(Config.KvmPrivateNetwork.key());
if (_kvmPrivateNic == null) {
_kvmPrivateNic = "cloudbr0";
Review Comment:
The PR description focuses on disabling SELinux/AppArmor and libvirt `security_driver` configuration, but this change set also deletes the legacy `scripts/vm/hypervisor/kvm/setup_agent.sh` script entirely. That’s a broader behavioral/support change (external automation may still call this script), so the PR description (and/or upgrade/release notes) should explicitly call out the script removal and the expected alternative path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6079996502
<b>[SF] Trillian test result (tid-17110)</b>
Environment: kvm-debian12 (x2), zone: Advanced Networking with Mgmt server d12
Total time taken: 60124 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13281-t17110-kvm-debian12.zip
Smoke tests completed. 154 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_05_isolated_network_full_lifecycle | `Failure` | 133.84 | test_network_extension_namespace.py
test_hostha_enable_ha_when_host_disabled | `Error` | 2.60 | test_hostha_kvm.py
test_hostha_enable_ha_when_host_in_maintenance | `Error` | 302.54 | test_hostha_kvm.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6413481451
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 19741
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cloudutils: Do not configure selinux/apparmor and security_driver when setup cloudstack agent [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #13281:
URL: https://github.com/apache/cloudstack/pull/13281#issuecomment-6413284131
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org