Toolbox: PVE9 apparmor via lxc.conf, runtime tracefs/debugfs mounts (#826)

- PVE 9 dropped 'pct set --raw.lxc': lxc.apparmor.profile goes straight
  into /etc/pve/lxc/<vmid>.conf and PVE::LXC honors it over the generated
  profile (verified: /proc/self/attr/current = unconfined)
- pct skips virtual-fs bind sources (mp /proc,/sys/kernel/* landed empty):
  keep cgroupfs + /var/log binds, wrapper mounts tracefs/debugfs at start
- bpftrace PROVEN against host kernel (2689 tracepoints, live syscall
  counts showing host pvestatd/vgs); bcc-tools -> bpfcc-tools (bookworm)
- smartctl on SAT devices needs -d sat (recipes updated)

Redmine: https://projects.knownelement.com/issues/826

monitoring/toolbox/lxc-toolbox.sh

@@ -3,9 +3,10 @@
 # STOPS to zero footprint; started only when a human/agent runs a workload.
 #   lxc-toolbox.sh [--vmid N] {--create|--upgrade|--remove|--facts}
 # Why privileged + apparmor unconfined: bpftrace/perf need host kernel BPF,
-# tracefs and host /proc. Bind mounts: /host/proc, /host/cgroup, host debugfs
-# + tracing, /host/var/log (ro) for offline sar analysis, block devs for
-# smart/nvme. Package list lives in toolbox-pkgs.txt next to this script.
+# tracefs and debugfs (pct skips virtual-fs bind sources, so the knelperf-toolbox
+# wrapper mounts tracefs/debugfs at runtime). Binds: /host/cgroup, /host/var/log
+# (ro, offline sar analysis), block devs for smart/nvme. Package list lives in
+# toolbox-pkgs.txt next to this script.
 # Docs: https://community.turnsys.com/t/328
 set -euo pipefail
 [ "$(id -u)" = 0 ] || { echo "run as root" >&2; exit 1; }
@@ -31,31 +32,33 @@ case "${1:-}" in
 esac
 
 if [ "$action" = --create ]; then
-  if pct status "$VMID" >/dev/null 2>&1; then
-    echo "vmid $VMID already present — use --upgrade" >&2; exit 1
+  if ! pct status "$VMID" >/dev/null 2>&1; then
+    pveam list local 2>/dev/null | grep -q "$TPL" || pveam download local "$TPL"
+    # block-device passthrough for smartctl/nvme (first 8 devices)
+    dev_args=()
+    for d in /dev/nvme[0-9]n1 /dev/sd[a-z]; do
+      [ -b "$d" ] || continue
+      [ "${#dev_args[@]}" -ge 16 ] && break
+      dev_args+=("--dev$(( ${#dev_args[@]} / 2 ))" "$d")
+    done
+    pct create "$VMID" "local:vztmpl/$TPL" \
+      --hostname knelperf-toolbox \
+      --ostype debian \
+      --cores 2 --memory 2048 --swap 512 \
+      --rootfs local-lvm:8 \
+      --net0 name=eth0,bridge=vmbr0,ip=dhcp \
+      --unprivileged 0 --onboot 0 \
+      --mp3 /sys/fs/cgroup,mp=/host/cgroup \
+      --mp4 /var/log,mp=/host/var/log,ro=1 \
+      "${dev_args[@]}"
+  fi
+  # apparmor unconfined for host-kernel BPF/tracing access. PVE 9 dropped
+  # `pct set --raw.lxc`; lxc.* keys go straight into the config file and
+  # PVE::LXC honors an explicit profile over its generated one.
+  if ! grep -q '^lxc.apparmor.profile:' /etc/pve/lxc/"$VMID".conf; then
+    echo 'lxc.apparmor.profile: unconfined' >> /etc/pve/lxc/"$VMID".conf
+    pct status "$VMID" 2>/dev/null | grep -q running && pct reboot "$VMID"
   fi
-  pveam list local 2>/dev/null | grep -q "$TPL" || pveam download local "$TPL"
-  # block-device passthrough for smartctl/nvme (first 8 devices)
-  dev_args=()
-  for d in /dev/nvme[0-9]n1 /dev/sd[a-z]; do
-    [ -b "$d" ] || continue
-    [ "${#dev_args[@]}" -ge 16 ] && break
-    dev_args+=("--dev$(( ${#dev_args[@]} / 2 ))" "$d")
-  done
-  pct create "$VMID" "local:vztmpl/$TPL" \
-    --hostname knelperf-toolbox \
-    --ostype debian \
-    --cores 2 --memory 2048 --swap 512 \
-    --rootfs local-lvm:8 \
-    --net0 name=eth0,bridge=vmbr0,ip=dhcp \
-    --unprivileged 0 --onboot 0 \
-    --mp0 /proc,mp=/host/proc \
-    --mp1 /sys/kernel/debug,mp=/sys/kernel/debug \
-    --mp2 /sys/kernel/tracing,mp=/sys/kernel/tracing \
-    --mp3 /sys/fs/cgroup,mp=/host/cgroup \
-    --mp4 /var/log,mp=/host/var/log,ro=1 \
-    "${dev_args[@]}"
-  pct set "$VMID" --raw.lxc 'lxc.apparmor.profile=unconfined'
 fi
 
 # --create continues here; --upgrade rejoins an existing container