tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nodes): restrict Certbot loader to current mounted core revision
Some checks failed
Docker Build and Publish / build (push) Has been cancelled
Details

Browse Source
This commit is contained in:
hellcat 2026-10-17 17:50:02 +08:00
parent 44d1c79bef
commit 6b0ac99d19
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
scripts/node-onboarding/dpl-certbot-apparmor.service
View File

@ -1,6 +1,7 @@
[Unit] [Unit]
Description=Load existing Certbot AppArmor profiles for DPL certificate operations Description=Load existing Certbot AppArmor profiles for DPL certificate operations
After=local-fs.target After=local-fs.target
RequiresMountsFor=/snap/core/current /snap/certbot/current /var/lib/snapd/apparmor/profiles
Before=snap.certbot.renew.service Before=snap.certbot.renew.service
ConditionPathExists=/var/lib/snapd/apparmor/profiles/snap.certbot.certbot ConditionPathExists=/var/lib/snapd/apparmor/profiles/snap.certbot.certbot

5
scripts/node-onboarding/load-certbot-apparmor.sh
View File

@ -11,7 +11,10 @@ directory=/var/lib/snapd/apparmor/profiles
[[ -z $(find "$directory" -maxdepth 0 -perm /022 -print) ]] || exit 4 [[ -z $(find "$directory" -maxdepth 0 -perm /022 -print) ]] || exit 4
[[ -f $directory/snap.certbot.certbot && -f $directory/snap.certbot.renew ]] || exit 5 [[ -f $directory/snap.certbot.certbot && -f $directory/snap.certbot.renew ]] || exit 5
shopt -s nullglob shopt -s nullglob
profiles=("$directory"/snap.certbot.* "$directory"/snap-update-ns.certbot "$directory"/snap-confine.core.*) core=$(readlink -f /snap/core/current)
[[ $core =~ ^/(var/lib/snapd/)?snap/core/([0-9]+)$ ]] || exit 5
revision=${BASH_REMATCH[2]}
profiles=("$directory"/snap.certbot.* "$directory"/snap-update-ns.certbot "$directory/snap-confine.core.$revision")
(( ${#profiles[@]} >= 4 )) || exit 5 (( ${#profiles[@]} >= 4 )) || exit 5
# Validate every input before loading any profile. Never use complain/disable flags. # Validate every input before loading any profile. Never use complain/disable flags.
for profile in "${profiles[@]}"; do for profile in "${profiles[@]}"; do