amadan
plan: readiness checks AppArmor and a debconf reconfigure round trip
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+7
−2
docs/superpowers/plans/2026-10-05-scanner-host-rollout.md+7 −2
diff --git a/docs/superpowers/plans/2026-10-05-scanner-host-rollout.md b/docs/superpowers/plans/2026-10-05-scanner-host-rollout.md| index 44cc34d7d..6fb745a12 100644 |
| --- a/docs/superpowers/plans/2026-10-05-scanner-host-rollout.md |
| +++ b/docs/superpowers/plans/2026-10-05-scanner-host-rollout.md |
| @@ -1319,8 +1319,13 @@ Expected: `SCANNER-HOST READY ClamAV 1.4.x/<sig>/<date>`, with the date today or |
| - [ ] **Step 6: Readiness.** |
| -Run: `"$TMPDIR/scanner-host/ssm-run.sh" keymail eu-west-1 <scanner-id> 'cloud-init status --wait; cat /var/lib/scanner-host/ready; systemctl is-active scanner-selftest.service scanner-tcp.socket; journalctl -u scanner-selftest.service --no-pager | tail -14'` |
| -Expected: `status: done`; the VERSION line; `active` twice; ten `pass` lines and `scanner-selftest: PASS`. |
| +Run: `"$TMPDIR/scanner-host/ssm-run.sh" keymail eu-west-1 <scanner-id> 'cloud-init status --wait; cat /var/lib/scanner-host/ready; systemctl is-active scanner-selftest.service scanner-tcp.socket; journalctl -u scanner-selftest.service --no-pager | tail -14; aa-status 2>/dev/null | grep -c usr.sbin.clamd; journalctl -k --no-pager | grep -c "apparmor=\"DENIED\".*clamd"'` |
| +Expected: `status: done`; the VERSION line; `active` twice; ten `pass` lines and `scanner-selftest: PASS`; then `1` or more (clamd's AppArmor profile is loaded) and `0` (it denied clamd nothing, so the `/var/tmp` local include took). |
| + |
| +Then prove a package reconfigure leaves `clamd.conf` alone (debconf is frozen off; with it on, the postinst would rewrite `StreamMaxLength`): |
| + |
| +Run: `... ssm-run.sh keymail eu-west-1 <scanner-id> 'debconf-show clamav-daemon | grep "clamav-daemon/debconf"; dpkg-reconfigure -fnoninteractive clamav-daemon; grep -E "^(StreamMaxLength|MaxFileSize|MaxScanSize|AlertExceedsMax|TemporaryDirectory) " /etc/clamav/clamd.conf; systemctl restart clamav-daemon.service; for i in $(seq 1 60); do [ "$(systemctl is-active scanner-tcp.socket)" = active ] && break; sleep 10; done; echo "after reconfigure: socket $(systemctl is-active scanner-tcp.socket), selftest $(systemctl is-active scanner-selftest.service), $(ss -ltnH "sport = :3310" | wc -l) listeners"'` |
| +Expected: a line ending `clamav-daemon/debconf: false`; the five lines `StreamMaxLength 25M`, `MaxFileSize 100M`, `MaxScanSize 100M`, `AlertExceedsMax yes`, `TemporaryDirectory /var/tmp` (in the file's order); then `after reconfigure: socket active, selftest active, 1 listeners`. The reconfigure moves Debian's `extend.conf` drop-in aside (postinst, debconf off), so the restart also proves clamd starts on the module's own drop-in. Anything else: stop, fix in Task 3, replace the box. |
| - [ ] **Step 7: Acceptance check, kill.** The port follows the test. |