Apparmor denies /usr/bin/nova-compute access to /proc/loadavg on openstack hypervisor show

[Drew Freiberger]

On Xenial-Queens cloud, I'm seeing failure with nova-compute 17.0.5-0ubuntu1~cloud0 package unable to run uptime due to a failure to read /proc/loadavg.

Kernel log entries:

[4726259.738185] audit: type=1400 audit(1537977315.312:59959): apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/proc/loadavg" pid=1958757 comm="uptime" requested_mask="r" denied_mask="r" fsuid=64060 ouid=0
[4726265.862186] audit: type=1400 audit(1537977321.436:59960): apparmor="DENIED" operation="open" profile="/usr/bin/nova-compute" name="/proc/loadavg" pid=1959961 comm="uptime" requested_mask="r" denied_mask="r" fsuid=64060 ouid=0

This happens when running "openstack hypervisor show <hostname>" with AppArmor in enforce mode.

this read access to /proc/loadavg should be added to apparmor profiles for the nova-compute package.

[Drew Freiberger (afreiberger)]

Added charm-nova-compute, as this seems to be an apparmor file dropped by the charm

[Drew Freiberger (afreiberger)]

provided fix for review here: https://review.openstack.org/#/c/605822/

[Drew Freiberger (afreiberger)]

Additional note, this seems to be on Xenial when running HWE (4.15) kernel.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/611567

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/611567
Committed: https://git.openstack.org/cgit/openstack/charm-nova-compute/commit/?id=88c45e0fc70d7cd867f694f7abd7525a291fdf5b
Submitter: Zuul
Branch: master

commit 88c45e0fc70d7cd867f694f7abd7525a291fdf5b
Author: James Page <email address hidden>
Date: Thu Oct 18 11:40:23 2018 +0100

    apparmor: add read permission on /proc/loadavg

    Later OpenStack releases need access to this part; update apparmor
    profile to permit read access.

    Change-Id: Id4d8dace86b22a194a996232d4f50cef4c098c13
    Closes-Bug: 1794564

[OpenStack Infra (hudson-openstack)]

Change abandoned by Drew Freiberger (<email address hidden>) on branch: master
Review: https://review.openstack.org/605822