openstack/ansible-collection-kolla
Code Issues Proposed changes

Fix Apparmor libvirt profile removal

Browse Source 
The apparmor_parser actually doesn't remove the file or doesn't create
the symlink in '/etc/apparmor.d/disable' itself so the next run of the
baremetal role will fail with the error "Unable to remove "libvirtd".
Even more after reboot, the profile is still active. We need to
disable the profile completly ourselves. This change fixes the
idempotents of the baremetal role.

Closes-Bug: #1960302
Change-Id: I162e417387393e806886b1c9ea8053b89778b4d1
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
(cherry picked from commit 75f55d13ad9060b7821a6e7702a347debd785ee9)
This commit is contained in:
Maksim Malchuk 2022-01-13 14:28:13 +03:00 committed by Mark Goddard
parent 24652ab2aa
commit e1392b7aa8
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
releasenotes/notes/fix-apparmor-libvirt-profile-removal-01db6ca6dd66879f.yaml Normal file
View File

@ -0,0 +1,7 @@
---
fixes:
- |
Fixes the baremetal role to avoid an error "Unable to remove "libvirtd".
Now the symlink /etc/apparmor.d/disable/usr.sbin.libvirtd is created by
the role.
`LP#1960302 <https://bugs.launchpad.net/kolla-ansible/+bug/1960302>`__

6
roles/baremetal/tasks/post-install.yml
View File

@ -201,7 +201,11 @@
when: ansible_facts.distribution == "Ubuntu"
- name: Remove apparmor profile for libvirt
command: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd
shell: |
apparmor_parser -v -R /etc/apparmor.d/usr.sbin.libvirtd && \
ln -vsf /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable
args:
executable: /bin/bash
become: True
when:
- ansible_facts.distribution == "Ubuntu"