mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5.5
a63cbcb1f7
Fork run 41911075483 (feature/store-i18n 2fd6c6d310) lost both workspace
jobs, debian:13 and ubuntu:26.04, in make security-apparmor-teardown:
common.sh: line 75: /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined: Read-only file system
Inside the workspace container /proc/sys is mounted read-only, and the
write that #1371 added ran under set -e. A sysctl that cannot be written
now leaves the restriction as it is with a log line instead of failing
the teardown, and only a successful write records the previous value.
Restore keeps its record when it cannot write the sysctl back.
The tests call the helpers under set -euo pipefail like teardown.sh and
use /proc/sys/kernel/ostype as a sysctl nobody can write; both new tests
fail against the previous common.sh.
| 🎯 Fix | 💥 Break | 🌱 Efficiency | ⚡ Speed | 🛡️ Security | 🏆 Score | Gate |
| --- | --- | --- | --- | --- | --- | --- |
| 95 % | 3 % | – | – | ~100 % | 92 | ✅ 90/5, efficiency and speed <= 100, security 100 % |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AppArmor Administration 🛡️
This directory contains the AppArmor-facing maintenance layer for the local and CI development experience.
The focus here is not feature work, but control and safety: development workflows sometimes need a softer security posture, while cleanup paths must leave the system in a predictable state again. That makes this area less about convenience and more about trust, reversibility, and clear operational boundaries. 🔒
When changing anything in this area, prefer behavior that is:
- explicit rather than magical
- reversible rather than destructive
- capability-aware rather than assumption-driven
- quiet on unsupported systems, but loud when real integrity risks appear
In short: these files exist to help development move quickly without teaching the project to be careless around host security controls. ⚙️
For the canonical Make target index that invokes these helpers, see make.md.