115c34fadd
A patch was introduced [0] "..which sets the backup gateway device link down by default. When the VRRP sets the master state in one host, the L3 agent state change procedure will do link up action for the gate$way device.". This change causes an issue when using keepalived 2.X (focal+) which is fixed by patch [1] which adds a new 'no_track' option to all VIPs and routes in keepalived's config file. Patch [1] which fixed keepalived 2.X broke keepalived 1.X (<focal). So patch [2] was added which adds a keepalived_use_no_track config option which is set to True control whether the 'no_track' option is added to the keepalived config. Finally, patchset [3] introduces automatic detection of the keepalived version by adding a call to `keepalived --version` but this is denied by the packages apparmor rules. [0] https://review.opendev.org/c/openstack/neutron/+/707406 [1] https://review.opendev.org/c/openstack/neutron/+/721799 [2] https://review.opendev.org/c/openstack/neutron/+/745641 [3] https://review.opendev.org/c/openstack/neutron/+/757620 Change-Id: I3eb1ef3fe29a8c4e5e26953844f303c8e985248a
66 lines
1.5 KiB
Plaintext
66 lines
1.5 KiB
Plaintext
# Last Modified: Fri Apr 1 16:26:34 2016
|
|
# Mode: {{aa_profile_mode}}
|
|
#include <tunables/global>
|
|
|
|
/usr/bin/neutron-l3-agent {
|
|
#include <abstractions/base>
|
|
#include <abstractions/python>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/bash>
|
|
|
|
/usr/bin/neutron-l3-agent r,
|
|
|
|
/usr/sbin/keepalived rix,
|
|
|
|
/sbin/ldconfig* rix,
|
|
|
|
/{,usr/}bin/ r,
|
|
/{,usr/}bin/** rix,
|
|
|
|
/etc/neutron/** r,
|
|
/etc/magic r,
|
|
/etc/mime.types r,
|
|
/var/lib/neutron/** rwk,
|
|
/var/log/neutron/** rwk,
|
|
/{,var/}run/neutron/** rwk,
|
|
/{,var/}run/lock/neutron/** rwk,
|
|
/run/uuidd/request rw,
|
|
|
|
/usr/share/file/magic.mgc r,
|
|
/usr/share/file/magic/ r,
|
|
|
|
# Allow unconfined sudo to support oslo.rootwrap
|
|
# profile makes no attempt to restrict this as this
|
|
# is limited by the appropriate rootwrap configuration.
|
|
/usr/bin/sudo Ux,
|
|
|
|
# Allow ip to run unrestricted for unpriviledged commands
|
|
/{,s}bin/ip Ux,
|
|
|
|
/tmp/* rw,
|
|
/tmp/** rw,
|
|
/var/tmp/* a,
|
|
|
|
# Required for parsing of managed process cmdline arguments
|
|
/proc/*/cmdline r,
|
|
|
|
# Required for assessment of current state of networking
|
|
/proc/sys/net/** r,
|
|
|
|
/proc/version r,
|
|
|
|
# neutron-dhcp-agent needs to keep track of ns-metadata-proxy processes
|
|
/proc/*/stat r,
|
|
|
|
{% if ubuntu_release <= '12.04' %}
|
|
/proc/*/mounts r,
|
|
/proc/*/status r,
|
|
/proc/*/ns/net r,
|
|
{% else %}
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
owner @{PROC}/@{pid}/status r,
|
|
owner @{PROC}/@{pid}/stat r,
|
|
owner @{PROC}/@{pid}/ns/net r,
|
|
{% endif %}
|
|
}
|