Keystone apparmor policy is not activated after controller deploy

[Denis Kostryukov]

Release: Mirantis OpenStack 9.2
Build number: 528

Keystone Apparmor policy is not activated during package install time.
When Keystone package installed on controller the apparmor service is not refreshed/updated correctly Only the manual restart forces the keystone policy to be activated.
When controller is rebooted the service apparmor comes up with including the earlier not applied keystone policy.

Before controller reboot:

root@cic-2:~# apparmor_status
apparmor module is loaded.
7 profiles are loaded.
7 profiles are in enforce mode.
   /sbin/dhclient
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/sbin/ntpd
   /usr/sbin/slapd
   /usr/sbin/tcpdump
   docker-default
0 profiles are in complain mode.
2 processes have profiles defined.
2 processes are in enforce mode.
   /usr/sbin/ntpd (4610)
   /usr/sbin/slapd (16102)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

After controller reboot:

root@cic-2:~# apparmor_status
apparmor module is loaded.
8 profiles are loaded.
7 profiles are in enforce mode.
   /sbin/dhclient
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/connman/scripts/dhclient-script
   /usr/sbin/ntpd
   /usr/sbin/slapd
   /usr/sbin/tcpdump
   docker-default
1 profiles are in complain mode.
   /usr/bin/keystone-all
2 processes have profiles defined.
2 processes are in enforce mode.
   /usr/sbin/ntpd (6269)
   /usr/sbin/slapd (8663)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

[Denis Kostryukov (dkostryukov)]

sla2 for 9.0-updates

[Alexey Stupnikov (astupnikov)]

This issue is cused by incorrect dh_apparmor syntax. Due to unspecified package in
dh_apparmor options, it adds the apparmor-related postinst script to python-keystone package,
which is likely installed before keystone. On the other hand, apparmor profiles are shipped
with keystone.

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 9.0/mitaka
Change author: Alexey Stupnikov <email address hidden>
Review: https://review.fuel-infra.org/36265

[Fuel Devops McRobotson (fuel-devops-robot)]

Reviewed: https://review.fuel-infra.org/36265
Submitter: Pkgs Jenkins <email address hidden>
Branch: 9.0/mitaka

Commit: 2cd73c6381e72be9b4938fafcb7040038cdee5e6
Author: Alexey Stupnikov <email address hidden>
Date: Wed Aug 23 14:50:21 2017

[MOS9][Mitaka] Fixed apparmor reload process

There was an issue caused by incorrect dh_apparmor syntax. Due
to unspecified package in dh_apparmor options, it adds the
apparmor-related postinst script to python-keystone package,
which is likely installed before keystone. On the other hand,
apparmor profiles are shipped with keystone.

Change-Id: I86abd5620f6e96d81081184362925d12d2109e76
Closes-bug: #1709012

[Vladimir Jigulin (vjigulin)]

Verified on 9.0-2017-09-01 snapshot

Without proposed: loaded profiles count on controller changed after reboot
With proposed: loaded profiles count on controller not changed after reboot