mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
a6c3c1cc91
`security-apparmor-teardown` ran `aa-teardown`, which unloads every profile including dockerd's in-memory `docker-default`. dockerd only loads that profile when it starts, so every container start afterwards that requests it fails until dockerd restarts. Since #1067 runs the teardown on the GitHub runners, BuildKit failed each RUN of the swarm node image three times (run 39332343490, 39 of 40 swarm jobs): runc run failed: unable to start container process: error during container init: unable to apply apparmor profile: apparmor failed to apply profile: write .../attr/apparmor/exec: no such file or directory The teardown now removes each loaded profile by name through securityfs and skips `docker-default` and child profiles, which leave with their parent. Dev hosts gain the same: no dockerd restart is needed after `make environment-bootstrap`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
33 lines
1.1 KiB
Bash
Executable File
33 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=scripts/system/apparmor/common.sh
|
|
source "${SCRIPT_DIR}/common.sh"
|
|
|
|
echo "[apparmor] tearing down (dev mode)"
|
|
|
|
if ! apparmor_should_manage; then
|
|
echo "[apparmor] skipping teardown: $(apparmor_skip_reason)"
|
|
exit 0
|
|
fi
|
|
|
|
if apparmor_service_exists; then
|
|
systemctl stop apparmor || true # nocheck: shell-or-true -- grandfathered: worked in practice; TODO: sharpen to catch only the exact tolerated error
|
|
else
|
|
echo "[apparmor] apparmor.service not available or systemd inactive; skipping service stop"
|
|
fi
|
|
|
|
APPARMOR_FS=/sys/kernel/security/apparmor
|
|
if [[ -w "${APPARMOR_FS}/.remove" ]]; then
|
|
mapfile -t profiles < <(apparmor_removable_profiles <"${APPARMOR_FS}/profiles")
|
|
for profile in "${profiles[@]}"; do
|
|
printf '%s' "${profile}" >"${APPARMOR_FS}/.remove"
|
|
done
|
|
echo "[apparmor] unloaded ${#profiles[@]} profile(s); docker-default stays loaded"
|
|
else
|
|
echo "[apparmor] ${APPARMOR_FS}/.remove is not writable; skipping profile unload"
|
|
fi
|
|
|
|
echo "[apparmor] teardown complete"
|