bootstrap-servers doesn't consider disabled AppArmor profiles

Bug #1909874 reported by Victor Morales
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kolla-ansible
Fix Committed
Medium
Victor Morales
Wallaby
Fix Committed
Medium
Victor Morales

Bug Description

The task to remove the Libvirt AppArmor profile[1] doesn't consider the case where the profile exists but is disabled. That scenario raises the following error:

TASK [baremetal : Remove apparmor profile for libvirt] ******************************************************************************************************
fatal: [rasp4-node03]: FAILED! => {"changed": true, "cmd": ["apparmor_parser", "-R", "/etc/apparmor.d/usr.sbin.libvirtd"], "delta": "0:00:00.213067", "end": "2020-02-03 19:48:34.486978", "msg": "non-zero return code", "rc": 254, "start": "2020-02-03 19:48:34.273911", "stderr": "apparmor_parser: Unable to remove \"/usr/sbin/libvirtd\". Profile doesn't exist", "stderr_lines": ["apparmor_parser: Unable to remove \"/usr/sbin/libvirtd\". Profile doesn't exist"], "stdout": "", "stdout_lines": []}

This error can be avoided by adding an extra validation that checks the existence of a soft link on
`/etc/apparmor.d/disable/` folder

**Environment**:
* OS (e.g. from /etc/os-release):
NAME="Ubuntu"
VERSION="18.04.5 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

* Kernel (e.g. `uname -a`):
Linux rasp4-node03 5.3.0-1036-raspi2 #38-Ubuntu SMP Thu Oct 15 14:40:03 UTC 2020 aarch64 aarch64 aarch64 GNU/Linux

* Kolla-Ansible version (e.g. `git head or tag or stable branch` or pip package version if using release):
kolla-ansible @ git+https://github.com/openstack/kolla-ansible@41677e97a69757d67f489ad700df11163e538c9a

* Docker image Install type (source/binary):
binary

[1] https://github.com/openstack/kolla-ansible/blob/10.1.0/ansible/roles/baremetal/tasks/post-install.yml#L142-L147

Changed in kolla-ansible:
assignee: nobody → Victor Morales (electrocucaracha)
status: New → In Progress
Revision history for this message
Victor Morales (electrocucaracha) wrote :
Changed in kolla-ansible:
status: In Progress → Fix Committed
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/kolla-ansible 12.0.0.0rc1

This issue was fixed in the openstack/kolla-ansible 12.0.0.0rc1 release candidate.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on kolla-ansible (stable/train)

Change abandoned by "Mark Goddard <email address hidden>" on branch: stable/train
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/770511

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on kolla-ansible (stable/ussuri)

Change abandoned by "Mark Goddard <email address hidden>" on branch: stable/ussuri
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/770510

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla-ansible (stable/victoria)

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/770509
Committed: https://opendev.org/openstack/kolla-ansible/commit/f0294fb5b6df517ffa9b8c3edcd6664343c616da
Submitter: "Zuul (22348)"
Branch: stable/victoria

commit f0294fb5b6df517ffa9b8c3edcd6664343c616da
Author: Victor Morales <email address hidden>
Date: Sat Jan 2 11:55:12 2021 -0800

    Fix remove libvirt apparmor disabled profile

    The bootstrap process tries to removes existing apparmor profiles but
    doesn't consider the case where those are disabled. This change fixes
    the scenario where the libvirt profile exists but is disabled.

    Closes-Bug: 1909874
    Change-Id: Ied0f2acc420bd5cf1e092c8aee358cba35bd8d5d
    (cherry picked from commit 891ec51dd417af894f7dde0dfa68b2333f497dcf)

tags: added: in-stable-victoria
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/kolla-ansible 11.4.0

This issue was fixed in the openstack/kolla-ansible 11.4.0 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.