andrijapanicsb commented on PR #662:
URL:
https://github.com/apache/cloudstack-documentation/pull/662#issuecomment-5527520271
The general direction looks good. I suggest a few documentation improvements:
1. Please include Debian in the AppArmor section title:
Configure AppArmor (Ubuntu, Debian, SUSE)
2. `aa-enforce /etc/apparmor.d/*` is too broad and may affect unrelated
profiles and directories. It should target only the libvirt profiles:
aa-enforce /usr/sbin/libvirtd
aa-enforce /usr/lib/libvirt/virt-aa-helper
3. The documentation should explain that AppArmor enforcement and
`security_driver="none"` control different security layers. The AppArmor
profile still protects the libvirtd process, while `security_driver="none"`
disables dynamic per-VM AppArmor/sVirt confinement. This keeps basic host
protection while avoiding possible compatibility problems with CloudStack
VM and storage operations.
4. The `aa-enforce` step is mainly needed for existing hosts where previous
CloudStack versions disabled these profiles. On fresh hosts, the libvirt
profiles are normally already enabled. Existing hosts may also already have
`security_driver="none"`, while fresh hosts must now configure it manually.
5. The introduction still says that AppArmor and SELinux must be disabled.
This conflicts with the new instructions and should be updated.
Apart from these points, the documentation change looks good to me
@weizhouapache cc @vishesh92
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
