byrsapty
2510bba21c
Mirrors bootstrap-host.sh in reverse: removes the sudoers rule and the fix-lxc-apparmor.sh script it installed, so the elevated grant only stands for the duration of an active deployment instead of indefinitely. create-graylog-lxc.sh already degrades cleanly to its manual fallback when the automation isn't present, so this is a safe no-op-adjacent revoke. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
19 lines
881 B
Bash
19 lines
881 B
Bash
#!/bin/bash
|
|
# Run as root after deployment is done - reverses bootstrap-host.sh by
|
|
# removing the temporary AppArmor-fix automation (sudoers rule + script).
|
|
# Keeps the elevated grant's lifetime scoped to "while actively deploying"
|
|
# rather than standing indefinitely.
|
|
#
|
|
# Safe to run even if bootstrap-host.sh was never run (both rm -f calls are
|
|
# no-ops on missing files). After this, create-graylog-lxc.sh falls back to
|
|
# printing the manual AppArmor fix instructions again, same as before
|
|
# bootstrap-host.sh existed - re-run bootstrap-host.sh whenever you need the
|
|
# automated path again (e.g. before recreating a container from scratch).
|
|
set -euo pipefail
|
|
|
|
[ "$(id -u)" -eq 0 ] || { echo "Must run as root." >&2; exit 1; }
|
|
|
|
rm -f /etc/sudoers.d/claude-deploy-apparmor
|
|
rm -f /usr/local/sbin/fix-lxc-apparmor.sh
|
|
|
|
echo "Removed AppArmor-fix automation (sudoers rule + script)."
|