openstack/kolla-ansible
Code Issues Proposed changes

Fix Apparmor libvirt profile removal

Browse Source 
The apparmor_parser actually doesn't remove the file or doesn't create
the symlink in '/etc/apparmor.d/disable' itself so the next run of the
baremetal role will fail with the error "Unable to remove "libvirtd".
Even more after reboot, the profile is still active. We need to
disable the profile completly ourselves. This change fixes the
idempotents of the baremetal role.

Closes-Bug: #1960302
Change-Id: I162e417387393e806886b1c9ea8053b89778b4d1
Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
This commit is contained in:
Maksim Malchuk 2022-01-13 14:28:13 +03:00
parent 9449bcfb70
commit 75f55d13ad
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ansible/roles/baremetal/tasks/post-install.yml
View File

@ -201,7 +201,11 @@
when: ansible_facts.distribution == "Ubuntu"
- name: Remove apparmor profile for libvirt
command: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd
shell: |
apparmor_parser -v -R /etc/apparmor.d/usr.sbin.libvirtd && \
ln -vsf /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable
args:
executable: /bin/bash
become: True
when:
- ansible_facts.distribution == "Ubuntu"

7
releasenotes/notes/fix-apparmor-libvirt-profile-removal-01db6ca6dd66879f.yaml Normal file
View File

@ -0,0 +1,7 @@
---
fixes:
- |
Fixes the baremetal role to avoid an error "Unable to remove "libvirtd".
Now the symlink /etc/apparmor.d/disable/usr.sbin.libvirtd is created by
the role.
`LP#1960302 <https://bugs.launchpad.net/kolla-ansible/+bug/1960302>`__