Update settings for SELinux and Apparmor

[weizhouapache]

Doc for apache/cloudstack#13281

• Enable SELinux enforcing mode on RHEL/CentOS
• Enable Apparmor enforcing mode on Ubuntu/Debian/SUSE
• Set "security_driver" to "none" in qemu.conf on KVM host

---

📚 Documentation preview 📚: https://cloudstack-documentation--662.org.readthedocs.build/en/662/

[andrijapanicsb]

The general direction looks good. I suggest a few documentation improvements:

1. Please include Debian in the AppArmor section title:

   Configure AppArmor (Ubuntu, Debian, SUSE)

2. aa-enforce /etc/apparmor.d/* is too broad and may affect unrelated
   profiles and directories. It should target only the libvirt profiles:

   aa-enforce /usr/sbin/libvirtd
   aa-enforce /usr/lib/libvirt/virt-aa-helper

3. The documentation should explain that AppArmor enforcement and
   security_driver="none" control different security layers. The AppArmor
   profile still protects the libvirtd process, while security_driver="none"
   disables dynamic per-VM AppArmor/sVirt confinement. This keeps basic host
   protection while avoiding possible compatibility problems with CloudStack
   VM and storage operations.

4. The aa-enforce step is mainly needed for existing hosts where previous
   CloudStack versions disabled these profiles. On fresh hosts, the libvirt
   profiles are normally already enabled. Existing hosts may also already have
   security_driver="none", while fresh hosts must now configure it manually.

5. The introduction still says that AppArmor and SELinux must be disabled.
   This conflicts with the new instructions and should be updated.

Apart from these points, the documentation change looks good to me @weizhouapache cc @vishesh92