From 4b19093d0f5140fee2caa8d066c2529c79e8be21 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 16 Jun 2026 14:11:28 +0200 Subject: [PATCH 1/5] Enforce SELinux on EL and Enable Apparmor in Ubuntu/Debian/SUSE --- .../roles/cloudstack-manager/tasks/centos.yml | 7 +------ .../roles/cloudstack-manager/tasks/centos8.yml | 7 +------ .../roles/cloudstack-manager/tasks/debian.yml | 2 ++ Ansible/roles/cloudstack-manager/tasks/el9.yml | 7 +------ .../roles/cloudstack-manager/tasks/suse.yml | 9 +-------- .../roles/cloudstack-manager/tasks/ubuntu.yml | 2 ++ Ansible/roles/kvm/tasks/centos.yml | 9 +-------- Ansible/roles/kvm/tasks/centos8.yml | 9 +-------- Ansible/roles/kvm/tasks/debian.yml | 14 +------------- Ansible/roles/kvm/tasks/el9.yml | 9 +-------- Ansible/roles/kvm/tasks/suse.yml | 11 +---------- Ansible/roles/kvm/tasks/ubuntu.yml | 14 +------------- Ansible/roles/marvin/tasks/main.yml | 8 +------- Ansible/roles/mysql/tasks/centos.yml | 10 ++++------ Ansible/roles/mysql/tasks/centos8.yml | 12 +----------- Ansible/roles/mysql/tasks/el9.yml | 12 +----------- Ansible/roles/mysql/tasks/suse.yml | 11 +---------- Ansible/tasks/configure_apparmor.yml | 14 ++++++++++++++ Ansible/tasks/configure_selinux.yml | 18 ++++++++++++++++++ 19 files changed, 54 insertions(+), 131 deletions(-) create mode 100644 Ansible/tasks/configure_apparmor.yml create mode 100644 Ansible/tasks/configure_selinux.yml diff --git a/Ansible/roles/cloudstack-manager/tasks/centos.yml b/Ansible/roles/cloudstack-manager/tasks/centos.yml index 0ea349206b4..e2d392b281d 100644 --- a/Ansible/roles/cloudstack-manager/tasks/centos.yml +++ b/Ansible/roles/cloudstack-manager/tasks/centos.yml @@ -12,12 +12,7 @@ - name: Clear all yum cache command: yum clean all -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml - name: Ensure CA Certs are latest yum: name=ca-certificates state=latest enablerepo=base diff --git a/Ansible/roles/cloudstack-manager/tasks/centos8.yml b/Ansible/roles/cloudstack-manager/tasks/centos8.yml index 537ed576648..fd812c5cccf 100644 --- a/Ansible/roles/cloudstack-manager/tasks/centos8.yml +++ b/Ansible/roles/cloudstack-manager/tasks/centos8.yml @@ -19,12 +19,7 @@ file: path=/etc/hostname state=absent when: ansible_distribution_major_version == "7" -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml - name: get name of eth0 connection shell: nmcli device show eth0 | grep 'GENERAL.CONNECTION' | awk -F ':' '{print $2}' | sed 's/^ *//' diff --git a/Ansible/roles/cloudstack-manager/tasks/debian.yml b/Ansible/roles/cloudstack-manager/tasks/debian.yml index ca4460e4cfa..44d59c754fd 100644 --- a/Ansible/roles/cloudstack-manager/tasks/debian.yml +++ b/Ansible/roles/cloudstack-manager/tasks/debian.yml @@ -123,6 +123,8 @@ - name: Ensure vhd-util is present get_url: url="{{ vhdutil_url }}" dest=/usr/share/cloudstack-common/scripts/vm/hypervisor/xenserver/vhd-util mode=0755 +- include: ../../../tasks/configure_apparmor.yml + - include: ./setupdb.yml - name: Ensure CloudStack packages are installed (now that mgmt server "db.properties" and "key" files are present) diff --git a/Ansible/roles/cloudstack-manager/tasks/el9.yml b/Ansible/roles/cloudstack-manager/tasks/el9.yml index 6ab8700d930..462c6bcced3 100644 --- a/Ansible/roles/cloudstack-manager/tasks/el9.yml +++ b/Ansible/roles/cloudstack-manager/tasks/el9.yml @@ -29,12 +29,7 @@ state: present tags: services -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml - name: get name of eth0 connection shell: nmcli device show eth0 | grep 'GENERAL.CONNECTION' | awk -F ':' '{print $2}' | sed 's/^ *//' diff --git a/Ansible/roles/cloudstack-manager/tasks/suse.yml b/Ansible/roles/cloudstack-manager/tasks/suse.yml index 304cb3cf9ac..d386f04b004 100644 --- a/Ansible/roles/cloudstack-manager/tasks/suse.yml +++ b/Ansible/roles/cloudstack-manager/tasks/suse.yml @@ -21,14 +21,7 @@ shell: "zypper install -y python3-selinux" ignore_errors: yes -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - ignore_errors: yes - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive - ignore_errors: yes +- include: ../../../tasks/configure_apparmor.yml - name: Allow connections on management server required ports with firewall shell: "firewall-cmd --zone=public --add-port={{ item }}/tcp --permanent" diff --git a/Ansible/roles/cloudstack-manager/tasks/ubuntu.yml b/Ansible/roles/cloudstack-manager/tasks/ubuntu.yml index 0fef592322f..222726e2a51 100644 --- a/Ansible/roles/cloudstack-manager/tasks/ubuntu.yml +++ b/Ansible/roles/cloudstack-manager/tasks/ubuntu.yml @@ -119,6 +119,8 @@ - name: Ensure vhd-util is present get_url: url="{{ vhdutil_url }}" dest=/usr/share/cloudstack-common/scripts/vm/hypervisor/xenserver/vhd-util mode=0755 +- include: ../../../tasks/configure_apparmor.yml + - include: ./setupdb.yml - name: Ensure CloudStack packages are installed (now that mgmt server "db.properties" and "key" files are present) diff --git a/Ansible/roles/kvm/tasks/centos.yml b/Ansible/roles/kvm/tasks/centos.yml index c362edb7524..924c6d7b946 100644 --- a/Ansible/roles/kvm/tasks/centos.yml +++ b/Ansible/roles/kvm/tasks/centos.yml @@ -15,14 +15,7 @@ tags: - kvm -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - tags: - - kvm - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml tags: - kvm diff --git a/Ansible/roles/kvm/tasks/centos8.yml b/Ansible/roles/kvm/tasks/centos8.yml index 1d7941555c0..46df61f348b 100644 --- a/Ansible/roles/kvm/tasks/centos8.yml +++ b/Ansible/roles/kvm/tasks/centos8.yml @@ -16,14 +16,7 @@ tags: - kvm -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - tags: - - kvm - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml tags: - kvm diff --git a/Ansible/roles/kvm/tasks/debian.yml b/Ansible/roles/kvm/tasks/debian.yml index f85bebf2053..043799fa8ed 100644 --- a/Ansible/roles/kvm/tasks/debian.yml +++ b/Ansible/roles/kvm/tasks/debian.yml @@ -287,19 +287,7 @@ - name: update /etc/libvirt/qemu.conf lineinfile: dest=/etc/libvirt/qemu.conf regexp='#vnc_listen = "0.0.0.0"' line='vnc_listen = "0.0.0.0"' -- name: Symlink to disable - file: src=/etc/apparmor.d/usr.sbin.libvirtd dest=/etc/apparmor.d/disable/usr.sbin.libvirtd state=link - -- name: Symlink to disable - file: src=/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper dest=/etc/apparmor.d/disable/usr.lib.libvirt.virt-aa-helper state=link - -- name: Apparmor parser libvirt - shell: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd - ignore_errors: yes - -- name: Apparmor parser libvirt helper - shell: apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper - ignore_errors: yes +- include: ../../../tasks/configure_apparmor.yml - name: Delete DHCP leases file - bionic onwards file: path={{ item }} state=absent diff --git a/Ansible/roles/kvm/tasks/el9.yml b/Ansible/roles/kvm/tasks/el9.yml index 72e1282948a..16c194e9363 100644 --- a/Ansible/roles/kvm/tasks/el9.yml +++ b/Ansible/roles/kvm/tasks/el9.yml @@ -30,14 +30,7 @@ tags: - kvm -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - tags: - - kvm - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml tags: - kvm diff --git a/Ansible/roles/kvm/tasks/suse.yml b/Ansible/roles/kvm/tasks/suse.yml index f92cbd84f27..dc7280155cc 100644 --- a/Ansible/roles/kvm/tasks/suse.yml +++ b/Ansible/roles/kvm/tasks/suse.yml @@ -30,18 +30,9 @@ shell: "zypper install -y net-tools-deprecated" ignore_errors: yes # This package is deprecated. ignoring errors for older distros -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false +- include: ../../../tasks/configure_apparmor.yml tags: - kvm - ignore_errors: yes - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive - tags: - - kvm - ignore_errors: yes - include: ./kvm_networking_bridge8.yml when: (not use_phys_hosts) and (kvm_network_mode == "bridge") diff --git a/Ansible/roles/kvm/tasks/ubuntu.yml b/Ansible/roles/kvm/tasks/ubuntu.yml index 3ebc66c3b08..796a406d30e 100644 --- a/Ansible/roles/kvm/tasks/ubuntu.yml +++ b/Ansible/roles/kvm/tasks/ubuntu.yml @@ -361,19 +361,7 @@ - name: update /etc/libvirt/qemu.conf lineinfile: dest=/etc/libvirt/qemu.conf regexp='#vnc_listen = "0.0.0.0"' line='vnc_listen = "0.0.0.0"' -- name: Symlink to disable - file: src=/etc/apparmor.d/usr.sbin.libvirtd dest=/etc/apparmor.d/disable/usr.sbin.libvirtd state=link - -- name: Symlink to disable - file: src=/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper dest=/etc/apparmor.d/disable/usr.lib.libvirt.virt-aa-helper state=link - -- name: Apparmor parser libvirt - shell: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd - ignore_errors: yes - -- name: Apparmor parser libvirt helper - shell: apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper - ignore_errors: yes +- include: ../../../tasks/configure_apparmor.yml - name: Delete DHCP leases file - bionic onwards file: path={{ item }} state=absent diff --git a/Ansible/roles/marvin/tasks/main.yml b/Ansible/roles/marvin/tasks/main.yml index 0ca6aa708fe..7abee68c736 100644 --- a/Ansible/roles/marvin/tasks/main.yml +++ b/Ansible/roles/marvin/tasks/main.yml @@ -28,13 +28,7 @@ - name: Ensure sshpass is installed dnf: name=sshpass state=present -- name: Put SELinux in permissive mode, logging actions that would be blocked. - selinux: - policy: targeted - state: permissive - -- name: set live selinux - command: setenforce permissive +- include: ../../../tasks/configure_selinux.yml - name: sync time with mgmt server shell: date --set=`sshpass -p 'P@ssword123' ssh -o StrictHostKeyChecking=no root@{{ hostvars[groups['primary_cs_manager'][0]]['ansible_ssh_host'] }} 'date --iso-8601=seconds'` diff --git a/Ansible/roles/mysql/tasks/centos.yml b/Ansible/roles/mysql/tasks/centos.yml index e89174c68b1..eed974bea0e 100644 --- a/Ansible/roles/mysql/tasks/centos.yml +++ b/Ansible/roles/mysql/tasks/centos.yml @@ -30,12 +30,10 @@ yum: name=MySQL-python state=present tags: services -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive +- include: ../../../tasks/configure_selinux.yml + tags: + - mysql + - mysqlconf - name: Ensure mysql server is installed (centos/rhel6) yum: name=mysql-server state=present diff --git a/Ansible/roles/mysql/tasks/centos8.yml b/Ansible/roles/mysql/tasks/centos8.yml index a3183f539a9..45cb4e1e692 100644 --- a/Ansible/roles/mysql/tasks/centos8.yml +++ b/Ansible/roles/mysql/tasks/centos8.yml @@ -37,17 +37,7 @@ - mysql - mysqlconf -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - tags: - - mysql - - mysqlconf - -- name: Ensure selinux is set permanently - selinux: - policy: targeted - state: permissive +- include: ../../../tasks/configure_selinux.yml tags: - mysql - mysqlconf diff --git a/Ansible/roles/mysql/tasks/el9.yml b/Ansible/roles/mysql/tasks/el9.yml index 52c89c5cec3..ead205a1b90 100644 --- a/Ansible/roles/mysql/tasks/el9.yml +++ b/Ansible/roles/mysql/tasks/el9.yml @@ -37,17 +37,7 @@ - mysql - mysqlconf -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false - tags: - - mysql - - mysqlconf - -- name: Ensure selinux is set permanently - selinux: - policy: targeted - state: permissive +- include: ../../../tasks/configure_selinux.yml tags: - mysql - mysqlconf diff --git a/Ansible/roles/mysql/tasks/suse.yml b/Ansible/roles/mysql/tasks/suse.yml index fe05665a8ea..4bdbee31afe 100644 --- a/Ansible/roles/mysql/tasks/suse.yml +++ b/Ansible/roles/mysql/tasks/suse.yml @@ -46,19 +46,10 @@ - mysqlconf ignore_errors: yes -- name: Set selinux to permissive - command: setenforce permissive - changed_when: false +- include: ../../../tasks/configure_apparmor.yml tags: - mysql - mysqlconf - ignore_errors: yes - -- name: Ensure selinux is set permanently - selinux: policy=targeted state=permissive - tags: - - kvm - ignore_errors: yes - name: Check if mysql server is installed shell: rpm -q mysql-server diff --git a/Ansible/tasks/configure_apparmor.yml b/Ansible/tasks/configure_apparmor.yml new file mode 100644 index 00000000000..cdfbf50abc6 --- /dev/null +++ b/Ansible/tasks/configure_apparmor.yml @@ -0,0 +1,14 @@ +--- +- name: Install apparmor-utils + apt: + pkg: apparmor-utils + state: latest + update_cache: yes + ignore_errors: true + +- name: Enable Apparmor enforce mode + shell: aa-enforce /etc/apparmor.d/* + +- name: Check Apparmor status + shell: aa-status + ignore_errors: true diff --git a/Ansible/tasks/configure_selinux.yml b/Ansible/tasks/configure_selinux.yml new file mode 100644 index 00000000000..38fd3552738 --- /dev/null +++ b/Ansible/tasks/configure_selinux.yml @@ -0,0 +1,18 @@ +--- + +- name: Get current SELinux mode + shell: getenforce || true + register: selinux_mode + +- name: Set selinux to enforcing + command: setenforce enforcing + changed_when: false + when: selinux_mode.stdout != "Enforcing" + +- name: Ensure selinux is set permanently + selinux: policy=targeted state=enforcing + when: selinux_mode.stdout != "Enforcing" + +- name: Check SELinux status + shell: sestatus + ignore_errors: true From 70e354ab33a96c356f4dff8433ebceb0482aae9f Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 16 Jun 2026 16:30:17 +0200 Subject: [PATCH 2/5] Update as suggested by Copilot --- Ansible/tasks/configure_apparmor.yml | 20 ++++++++++++++------ Ansible/tasks/configure_selinux.yml | 27 ++++++++++++++++++--------- 2 files changed, 32 insertions(+), 15 deletions(-) diff --git a/Ansible/tasks/configure_apparmor.yml b/Ansible/tasks/configure_apparmor.yml index cdfbf50abc6..38a5834c46d 100644 --- a/Ansible/tasks/configure_apparmor.yml +++ b/Ansible/tasks/configure_apparmor.yml @@ -1,14 +1,22 @@ --- -- name: Install apparmor-utils +- name: Install apparmor-utils (Debian/Ubuntu) apt: pkg: apparmor-utils - state: latest + state: present update_cache: yes - ignore_errors: true + when: ansible_distribution in ['Ubuntu', 'Debian'] + +- name: Install apparmor-utils (SUSE) + package: + name: apparmor-utils + state: present + when: ansible_distribution == 'SUSE' - name: Enable Apparmor enforce mode shell: aa-enforce /etc/apparmor.d/* + changed_when: false -- name: Check Apparmor status - shell: aa-status - ignore_errors: true +- name: Check Apparmor status + command: aa-status + failed_when: false + changed_when: false diff --git a/Ansible/tasks/configure_selinux.yml b/Ansible/tasks/configure_selinux.yml index 38fd3552738..003dda6b177 100644 --- a/Ansible/tasks/configure_selinux.yml +++ b/Ansible/tasks/configure_selinux.yml @@ -1,18 +1,27 @@ --- - name: Get current SELinux mode - shell: getenforce || true + command: getenforce register: selinux_mode + failed_when: false + changed_when: false -- name: Set selinux to enforcing - command: setenforce enforcing +- name: Set SELinux to enforcing + command: setenforce Enforcing changed_when: false - when: selinux_mode.stdout != "Enforcing" + when: + - selinux_mode.rc == 0 + - selinux_mode.stdout not in ['Enforcing', 'Disabled'] -- name: Ensure selinux is set permanently - selinux: policy=targeted state=enforcing - when: selinux_mode.stdout != "Enforcing" +- name: Ensure SELinux is set permanently + selinux: + policy: targeted + state: enforcing + when: + - selinux_mode.rc == 0 + - selinux_mode.stdout != 'Disabled' - name: Check SELinux status - shell: sestatus - ignore_errors: true + command: sestatus + failed_when: false + changed_when: false From b4329e7cb20e52fcfe858cdf889597975c53fdf3 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Tue, 16 Jun 2026 17:51:49 +0200 Subject: [PATCH 3/5] Ubuntu/Debian: update security_driver to none in /etc/libvirt/qemu.conf --- Ansible/roles/kvm/tasks/debian.yml | 3 +++ Ansible/roles/kvm/tasks/ubuntu.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/Ansible/roles/kvm/tasks/debian.yml b/Ansible/roles/kvm/tasks/debian.yml index 043799fa8ed..9664d95440c 100644 --- a/Ansible/roles/kvm/tasks/debian.yml +++ b/Ansible/roles/kvm/tasks/debian.yml @@ -287,6 +287,9 @@ - name: update /etc/libvirt/qemu.conf lineinfile: dest=/etc/libvirt/qemu.conf regexp='#vnc_listen = "0.0.0.0"' line='vnc_listen = "0.0.0.0"' +- name: update security_driver to none in /etc/libvirt/qemu.conf + lineinfile: dest=/etc/libvirt/qemu.conf regexp='#security_driver' line='security_driver = "none"' + - include: ../../../tasks/configure_apparmor.yml - name: Delete DHCP leases file - bionic onwards diff --git a/Ansible/roles/kvm/tasks/ubuntu.yml b/Ansible/roles/kvm/tasks/ubuntu.yml index 796a406d30e..2195899d5f0 100644 --- a/Ansible/roles/kvm/tasks/ubuntu.yml +++ b/Ansible/roles/kvm/tasks/ubuntu.yml @@ -361,6 +361,9 @@ - name: update /etc/libvirt/qemu.conf lineinfile: dest=/etc/libvirt/qemu.conf regexp='#vnc_listen = "0.0.0.0"' line='vnc_listen = "0.0.0.0"' +- name: update security_driver to none in /etc/libvirt/qemu.conf + lineinfile: dest=/etc/libvirt/qemu.conf regexp='#security_driver' line='security_driver = "none"' + - include: ../../../tasks/configure_apparmor.yml - name: Delete DHCP leases file - bionic onwards From d643c623f20796c1bd4c50069a7269f3bb1321a0 Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Wed, 17 Jun 2026 09:51:21 +0200 Subject: [PATCH 4/5] SUSE: fix apparmor-utils installation --- Ansible/tasks/configure_apparmor.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Ansible/tasks/configure_apparmor.yml b/Ansible/tasks/configure_apparmor.yml index 38a5834c46d..6fb1fd036ae 100644 --- a/Ansible/tasks/configure_apparmor.yml +++ b/Ansible/tasks/configure_apparmor.yml @@ -7,9 +7,8 @@ when: ansible_distribution in ['Ubuntu', 'Debian'] - name: Install apparmor-utils (SUSE) - package: - name: apparmor-utils - state: present + shell: | + rpm -q apparmor-utils || zypper --non-interactive install apparmor-utils when: ansible_distribution == 'SUSE' - name: Enable Apparmor enforce mode From f91758e05c7873d5de4d92b98a3ebf599a933b1e Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Fri, 19 Jun 2026 12:13:00 +0200 Subject: [PATCH 5/5] Marvin: Install mysql-connector-python 8.0.30 for Debian/SUSE To fix smoke test failures caused by error ``` import mysql.connector conn = mysql.connector.connect( host="10.0.35.28", port=3306, user="root", password="Pxxxxx", database="cloud", use_unicode=True, ) mysql.connector.errors.ProgrammingError: Character set 'utf8' unsupported ``` --- Ansible/roles/marvin/tasks/main.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Ansible/roles/marvin/tasks/main.yml b/Ansible/roles/marvin/tasks/main.yml index 7abee68c736..f426782c820 100644 --- a/Ansible/roles/marvin/tasks/main.yml +++ b/Ansible/roles/marvin/tasks/main.yml @@ -69,6 +69,14 @@ - marvin - marvin_cfg +- name: Install mysql-connector-python 8.0.30 for Debian/SUSE + pip: + name: mysql-connector-python==8.0.30 + when: mgmtsrv_template | lower is search("debian|suse") + tags: + - marvin + - marvin_cfg + - name: retrieve environment data env_db_manage: DBHOST={{ env_db_ip }} DBUSER={{ env_db_user }} DBPASS={{ env_db_password }} DBNAME={{ env_db_name }} ENV_UUID={{ env_uuid }} ENV_NAME={{ env_name_clean }} ENV_ZONETYPE={{ env_zonetype }} ENV_SECGROUPS={{ env_zone_secgroups }} ENV_ACTION=retrieve tags: