byrsapty
d98a63c0f1
Adds bootstrap-host.sh (one-time, run as root on a fresh Proxmox host) and fix-lxc-apparmor.sh, the fixed-content script it installs. The sudoers rule it wires up only ever invokes that one root-owned script with a VMID argument - deliberately not a broader rule like `tee -a <conf>` or `sh -c '...'`, since those only restrict the command's own argv, not stdin/heredoc content, letting the caller write arbitrary lines to any 200-299 container's config instead of just this one fixed line. create-graylog-lxc.sh now tries `sudo -n fix-lxc-apparmor.sh` first and falls back to the existing manual instructions if that sudoers rule isn't present yet - fully backward compatible with hosts that haven't run bootstrap-host.sh. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
24 lines
933 B
Bash
24 lines
933 B
Bash
#!/bin/bash
|
|
# Installed by bootstrap-host.sh to /usr/local/sbin/fix-lxc-apparmor.sh,
|
|
# owned by root, NOT writable by claude-deploy - only invocable via the
|
|
# narrow sudoers rule bootstrap-host.sh also installs.
|
|
#
|
|
# Idempotently enables lxc.apparmor.profile=unconfined for one LXC container
|
|
# (needed for Docker to run inside an unprivileged container - see the
|
|
# "AppArmor" quirk in README.md) and reboots it if a change was actually
|
|
# made. The VMID range is enforced by the sudoers rule that invokes this
|
|
# script, not by this script itself.
|
|
set -euo pipefail
|
|
VMID="${1:?Usage: fix-lxc-apparmor.sh <vmid>}"
|
|
CONF="/etc/pve/lxc/${VMID}.conf"
|
|
|
|
[ -f "$CONF" ] || { echo "No such container config: $CONF" >&2; exit 1; }
|
|
|
|
if grep -qx "lxc.apparmor.profile: unconfined" "$CONF"; then
|
|
echo "already set, nothing to do"
|
|
exit 0
|
|
fi
|
|
|
|
echo "lxc.apparmor.profile: unconfined" >> "$CONF"
|
|
pct reboot "$VMID"
|
|
echo "applied and rebooted $VMID"
|