From 92f5520766af195aab83408009f235bad56688a8 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 19 Jun 2026 12:45:47 +0000 Subject: [PATCH 1/3] Add AppArmor profiles to add-ons that lacked one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - netbird-server: new profile `netbird-server_addon` (includes capability sys_chroot) - netalertx_fa: symlink apparmor.txt to base netalertx profile, matching the repo's existing _fa convention (e.g. scrutiny_fa -> scrutiny) - signalk intentionally left without a profile (config sets apparmor: false) No version bumps — profiles apply on each add-on's next update. Co-Authored-By: Claude --- netalertx_fa/apparmor.txt | 1 + netbird-server/apparmor.txt | 49 +++++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 120000 netalertx_fa/apparmor.txt create mode 100644 netbird-server/apparmor.txt diff --git a/netalertx_fa/apparmor.txt b/netalertx_fa/apparmor.txt new file mode 120000 index 0000000000..c3c9b710bd --- /dev/null +++ b/netalertx_fa/apparmor.txt @@ -0,0 +1 @@ +../netalertx/apparmor.txt \ No newline at end of file diff --git a/netbird-server/apparmor.txt b/netbird-server/apparmor.txt new file mode 100644 index 0000000000..32498ec5bb --- /dev/null +++ b/netbird-server/apparmor.txt @@ -0,0 +1,49 @@ +#include + +profile netbird-server_addon flags=(attach_disconnected,mediate_deleted) { + #include + + capability chown, + capability dac_override, + capability fowner, + capability net_bind_service, + capability setgid, + capability setuid, + capability sys_chroot, + file, + signal, + mount, + umount, + remount, + network udp, + network tcp, + network dgram, + network stream, + network inet, + network inet6, + network netlink raw, + network unix dgram, + + /init ix, + /run/{s6,s6-rc*,service}/** ix, + /package/** ix, + /command/** ix, + /bin/** ix, + /usr/bin/** ix, + /usr/lib/bashio/** ix, + /etc/s6/** rix, + /run/s6/** rix, + /etc/services.d/** rwix, + /etc/cont-init.d/** rwix, + /etc/cont-finish.d/** rwix, + + # Data access + /data/** rw, + + # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container + ptrace (trace,read) peer=docker-default, + + # docker daemon confinement requires explict allow rule for signal + signal (receive) set=(kill,term) peer=/usr/bin/docker, + +} From 68fd970fc61d8e0498cbf3c31012c39f3378faf4 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 19 Jun 2026 13:58:42 +0000 Subject: [PATCH 2/3] netalertx: suppress misleading upstream capabilities-audit ALERT (#2454) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Under the Home Assistant Supervisor the required NET_RAW/NET_ADMIN capabilities are granted, but NetAlertX's upstream capabilities-audit script cannot read them and prints a "🚨 ALERT: capabilities are missing" banner. Users repeatedly mistook this informational message for the cause of unrelated issues. Neutralise the audit script at build time (kept in place as a no-op for the entrypoint runner) and bump version/changelog. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01WfZ5JKAR2NHP1KjoAGyBBD --- netalertx/CHANGELOG.md | 3 +++ netalertx/Dockerfile | 12 ++++++++++++ netalertx/config.yaml | 2 +- 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/netalertx/CHANGELOG.md b/netalertx/CHANGELOG.md index cac8e32e55..b2298fa7c8 100644 --- a/netalertx/CHANGELOG.md +++ b/netalertx/CHANGELOG.md @@ -1,3 +1,6 @@ +## 26.6.3-1 (2026-06-19) +- Suppress the misleading upstream "capabilities audit" ALERT (NET_RAW/NET_ADMIN reported as missing). Under the Home Assistant Supervisor these capabilities are granted but the upstream audit cannot read them, which alarmed users (#2454). + ## 26.6.3 (2026-06-05) - Update to latest version from jokob-sk/NetAlertX (changelog : https://github.com/jokob-sk/NetAlertX/releases) diff --git a/netalertx/Dockerfile b/netalertx/Dockerfile index a0f0d5b82b..a3b166495b 100644 --- a/netalertx/Dockerfile +++ b/netalertx/Dockerfile @@ -58,6 +58,18 @@ USER 0 COPY rootfs/ / RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \; +# Neutralise the upstream capabilities-audit step. +# Under the Home Assistant Supervisor the required NET_RAW/NET_ADMIN capabilities +# are granted, but the upstream audit cannot read them and prints a misleading +# "🚨 ALERT: capabilities are missing" banner that users mistake for the cause of +# unrelated issues (see issue #2454). The script is informational only, so we +# replace its body with a no-op while keeping the file in place for the runner. +RUN set -eux; \ + for f in $(find / -type f -name '*capabilities*audit*.sh' 2>/dev/null); do \ + printf '#!/usr/bin/env bash\n# Neutralised by the Home Assistant add-on: the required capabilities are\n# provided by the Supervisor but the upstream audit misreports them, which\n# alarmed users (issue #2454). This audit is informational only.\n:\n' > "$f"; \ + chmod +x "$f"; \ + done + # Bring in jq + gosu (and their libs). NO apk in final stage. COPY --from=ha_tools /out/ / diff --git a/netalertx/config.yaml b/netalertx/config.yaml index 8a7013dd7c..e87eff4f7a 100644 --- a/netalertx/config.yaml +++ b/netalertx/config.yaml @@ -42,4 +42,4 @@ slug: netalertx tmpfs: true udev: true url: https://github.com/alexbelgium/hassio-addons -version: "26.6.3" +version: "26.6.3-1" From 013e7ffd923b0c901f4db28cac8b6100c8f767ab Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 19 Jun 2026 17:40:23 +0000 Subject: [PATCH 3/3] netalertx_fa: bump to 26.6.3-1 to match netalertx capabilities-audit fix (#2454) Both variants share the same image; aligning the version ensures the Supervisor pulls the updated build that suppresses the misleading NET_RAW/NET_ADMIN alert for Full Access users. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01WfZ5JKAR2NHP1KjoAGyBBD --- netalertx_fa/CHANGELOG.md | 3 +++ netalertx_fa/config.yaml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/netalertx_fa/CHANGELOG.md b/netalertx_fa/CHANGELOG.md index bf2d1d975f..91241980a9 100644 --- a/netalertx_fa/CHANGELOG.md +++ b/netalertx_fa/CHANGELOG.md @@ -1,3 +1,6 @@ +## 26.6.3-1 (2026-06-19) +- Suppress the misleading upstream "capabilities audit" ALERT (NET_RAW/NET_ADMIN reported as missing). Under the Home Assistant Supervisor these capabilities are granted but the upstream audit cannot read them, which alarmed users (#2454). + ## 26.6.3 (2026-06-05) - Update to latest version from jokob-sk/NetAlertX (changelog : https://github.com/jokob-sk/NetAlertX/releases) diff --git a/netalertx_fa/config.yaml b/netalertx_fa/config.yaml index 0920208d0a..18378c294f 100644 --- a/netalertx_fa/config.yaml +++ b/netalertx_fa/config.yaml @@ -43,4 +43,4 @@ slug: netalertx_fa tmpfs: true udev: true url: https://github.com/alexbelgium/hassio-addons -version: "26.6.3" +version: "26.6.3-1"