aa-profile enforce mode break libvirt-image-backend=rbd

[Edward Hope-Morley]

If i deploy nova-compute to use the RBDImageBackend with aa-profile-mode=enforce I am unable to boot instances and I get:

[ 8953.984025] audit: type=1400 audit(1510763812.222:50): apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/var/lib/charm/nova-compute/ceph.conf" pid=5781 comm="nova-compute" requested_mask="r" denied_mask="r" fsuid=113 ouid=0

So we need to allow nova-compute to access ceph.conf

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/520165

[Hua Zhang (zhhuabj)]

After adding the profile '/var/lib/charm/nova-compute/ceph.conf r,' into /etc/apparmor.d/usr.bin.nova-compute, we can continue to hit the following errors:

Nov 15 12:49:36 juju-864213-xenial-mitaka-ceph-11 kernel: [705198.766810] audit: type=1400 audit(1510750176.727:10140): apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/tmp/" pid=16922 comm="nova-compute" requested_mask="r" denied_mask="r" fsuid=113 ouid=0
Nov 15 12:49:36 juju-864213-xenial-mitaka-ceph-11 kernel: [705198.766828] audit: type=1400 audit(1510750176.727:10141): apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/var/tmp/" pid=16922 comm="nova-compute" requested_mask="r" denied_mask="r" fsuid=113 ouid=0
Nov 15 12:49:36 juju-864213-xenial-mitaka-ceph-11 kernel: [705198.779201] audit: type=1400 audit(1510750176.739:10142): apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/etc/ceph/ceph.client.nova-compute.keyring" pid=16922 comm="nova-compute" requested_mask="r" denied_mask="r" fsuid=113 ouid=113

So I think the following profiles are required:

/var/lib/charm/nova-compute/ceph.conf r,
/etc/ceph/ceph.client.nova-compute.keyring r,
/tmp/ r,
/var/tmp/ r,

[Edward Hope-Morley (hopem)]

@zhhuabj i've now fixed this in the patch and there are no more denials fro /tmp and /var/tmp

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/520165
Committed: https://git.openstack.org/cgit/openstack/charm-nova-compute/commit/?id=0423eae1dfd1e4d4f232cf5a2f58553a64f4b257
Submitter: Zuul
Branch: master

commit 0423eae1dfd1e4d4f232cf5a2f58553a64f4b257
Author: Edward Hope-Morley <email address hidden>
Date: Wed Nov 15 18:04:00 2017 +0000

    Add ceph paths to usr.bin.nova-compute aa profile

    The current profile does not include ceph paths
    which breaks nova-compute if
    libvirt-image-backend=rbd when in enforce mode.
    Also fix access to /tmp and /var/tmp.

    Change-Id: Ie03a43ef73ca5f97f4f9e5edcefd261a0e36abf9
    Closes-Bug: 1732492