mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
a6c3c1cc91
`security-apparmor-teardown` ran `aa-teardown`, which unloads every profile including dockerd's in-memory `docker-default`. dockerd only loads that profile when it starts, so every container start afterwards that requests it fails until dockerd restarts. Since #1067 runs the teardown on the GitHub runners, BuildKit failed each RUN of the swarm node image three times (run 39332343490, 39 of 40 swarm jobs): runc run failed: unable to start container process: error during container init: unable to apply apparmor profile: apparmor failed to apply profile: write .../attr/apparmor/exec: no such file or directory The teardown now removes each loaded profile by name through securityfs and skips `docker-default` and child profiles, which leave with their parent. Dev hosts gain the same: no dockerd restart is needed after `make environment-bootstrap`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
58 lines
1.3 KiB
Bash
Executable File
58 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
apparmor_log() {
|
|
printf '%s\n' "$*"
|
|
}
|
|
|
|
apparmor_warn() {
|
|
printf '%s\n' "$*" >&2
|
|
}
|
|
|
|
apparmor_is_installed() {
|
|
command -v apparmor_parser >/dev/null 2>&1 ||
|
|
command -v aa-status >/dev/null 2>&1 ||
|
|
command -v aa-enabled >/dev/null 2>&1 ||
|
|
[[ -d /etc/apparmor.d ]]
|
|
}
|
|
|
|
apparmor_is_enabled() {
|
|
if command -v aa-enabled >/dev/null 2>&1; then
|
|
aa-enabled >/dev/null 2>&1 && return 0
|
|
fi
|
|
|
|
if [[ -r /sys/module/apparmor/parameters/enabled ]]; then
|
|
local enabled=""
|
|
enabled="$(tr -d '[:space:]' </sys/module/apparmor/parameters/enabled 2>/dev/null || true)"
|
|
[[ "${enabled}" =~ ^[Yy1]$ ]] && return 0
|
|
fi
|
|
|
|
return 1
|
|
}
|
|
|
|
apparmor_skip_reason() {
|
|
if ! apparmor_is_installed; then
|
|
printf 'AppArmor userspace is not installed.'
|
|
elif ! apparmor_is_enabled; then
|
|
printf 'AppArmor is not enabled.'
|
|
else
|
|
printf ''
|
|
fi
|
|
}
|
|
|
|
apparmor_should_manage() {
|
|
apparmor_is_installed && apparmor_is_enabled
|
|
}
|
|
|
|
apparmor_removable_profiles() {
|
|
sed -E 's/ \([a-z]+\)$//' | grep -v -E '//|^docker-default$'
|
|
}
|
|
|
|
systemd_is_operational() {
|
|
command -v systemctl >/dev/null 2>&1 && [[ -d /run/systemd/system ]]
|
|
}
|
|
|
|
apparmor_service_exists() {
|
|
systemd_is_operational || return 1
|
|
systemctl list-unit-files apparmor.service --no-legend 2>/dev/null | grep -q '^apparmor\.service'
|
|
}
|