mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 12:47:04 +00:00
kevinveenbirkenbachandClaude Opus 5.5
623c6e8c12
restore.sh returned at apparmor_should_manage before it reached apparmor_reinstate_unconfined_restriction. When AppArmor userspace is removed or disabled after teardown, the kernel sysctl still exists, so make environment-teardown left the restriction lifted. The reinstate now runs first; it is a no-op without a recorded value, and the guard still protects the service and profile restore. Reported by CodeRabbit on #1371. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AppArmor Administration 🛡️
This directory contains the AppArmor-facing maintenance layer for the local and CI development experience.
The focus here is not feature work, but control and safety: development workflows sometimes need a softer security posture, while cleanup paths must leave the system in a predictable state again. That makes this area less about convenience and more about trust, reversibility, and clear operational boundaries. 🔒
When changing anything in this area, prefer behavior that is:
- explicit rather than magical
- reversible rather than destructive
- capability-aware rather than assumption-driven
- quiet on unsupported systems, but loud when real integrity risks appear
In short: these files exist to help development move quickly without teaching the project to be careless around host security controls. ⚙️
For the canonical Make target index that invokes these helpers, see make.md.