docs(agents): dhcpd AppArmor /etc/dhcp path constraint field lesson [#728]

2026-09-02 20:23:38 -05:00
parent 1dbf16c9df
commit 4de1457eaa
1 changed files with 4 additions and 0 deletions
@@ -301,6 +301,10 @@ Hard-won operational gotchas. One line each; keep them short and load-bearing.
  Pi-holes; use `tailscale status` peer IPs + the chokepoint env overrides
  (NETINFRA01_HOST/NETINFRA02_HOST, VM_IP) to reach hosts by Tailscale
  while names are unresolvable. Fix one node, verify, then the other.
+- **dhcpd + AppArmor:** on the netinfra pair, dhcpd can only read configs
+  under `/etc/dhcp/**` — staging a candidate config in /tmp fails dhcpd -t
+  with "Permission denied" even as root. Stage as /etc/dhcp/*.candidate,
+  test, then move into place.

 ## Questions (NON-NEGOTIABLE)