secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 18:36:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #648 from CyberMind-FR/fix/623-postinst-systemic-var-lib-log-cache-secu

Browse Source 
postinst: systemic /var/{lib,log,cache}/secubox parent-mode clobber across ~12 packages (board-wide traversal breakage)
This commit is contained in:
CyberMind 2026-06-18 10:41:52 +02:00 committed by GitHub
commit 9950e9ec3e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
68 changed files with 157 additions and 118 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
.claude/PATTERNS.md
View File

@ -383,9 +383,13 @@ case "$1" in
adduser --system --group --no-create-home --home /var/lib/secubox secubox
fi
# Répertoires runtime
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
# Répertoires runtime — SHARED parents, NE JAMAIS les passer en 0750/0700
# (#623 : casse la traversée pour les daemons non-secubox → kbin/toolbox 500).
# /run/secubox reste 1777 (sticky world-writable, sockets de tous les services,
# #471) ; /var/lib/secubox reste 0755. Les leaves privées
# (/var/lib/secubox/<module>) peuvent être 0750.
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Activer et démarrer le service
systemctl daemon-reload

4
packages/secubox-admin/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/admin
install -d -o root -g secubox -m 0755 /var/log/secubox
systemctl daemon-reload

4
packages/secubox-ai-insights/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/ai-insights
install -d -o secubox -g secubox -m 750 /var/lib/secubox/ai-insights/models
install -d -o secubox -g secubox -m 750 /var/cache/secubox/ai-insights

4
packages/secubox-auth/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-auth.service
systemctl start secubox-auth.service || true

2
packages/secubox-authelia/debian/postinst
View File

@ -9,7 +9,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/authelia
install -d -m 0755 -o secubox -g secubox /var/log/secubox

4
packages/secubox-avatar/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/avatar
install -d -o secubox -g secubox -m 750 /var/lib/secubox/avatar/images
systemctl daemon-reload

4
packages/secubox-cdn/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-cdn.service
systemctl start secubox-cdn.service || true

3
packages/secubox-certs/debian/postinst
View File

@ -1,7 +1,8 @@
#!/bin/sh
set -e
if [ "$1" = "configure" ]; then
install -d -m 0755 /run/secubox /var/cache/secubox/certs
install -d -o root -g root -m 1777 /run/secubox
install -d -m 0755 /var/cache/secubox/certs
systemctl daemon-reload || true
systemctl enable --now secubox-certs.service || true
fi

12
packages/secubox-core/debian/changelog
View File

@ -1,3 +1,15 @@
secubox-core (1.1.8-1~bookworm1) bookworm; urgency=medium
* fix(#623): tmpfiles.d now declares all shared secubox parents
(/var/lib, /var/log, /var/cache, /etc, /usr/share /secubox) at 0755
(mode-only, owner-agnostic), in addition to /run/secubox 1777 — boot +
install-time defense-in-depth that self-heals a momentary 0750 clobber
before the next secubox-dirs-guard.timer tick. Pairs with the source-wide
postinst sweep that stopped ~56 module postinsts from clobbering those
parents.
-- Gerald Kerma <devel@cybermind.fr> Thu, 18 Jun 2026 13:00:00 +0200
secubox-core (1.1.7-1~bookworm1) bookworm; urgency=medium
* fix(postinst): /var/lib/secubox + /usr/share/secubox/www were set 0750,

10
packages/secubox-core/tmpfiles.d/secubox.conf
View File

@ -1 +1,11 @@
d /run/secubox 1777 root root -
# #623 — defense-in-depth: guarantee the SHARED secubox parents stay traversable
# (0755) at boot and on every `systemd-tmpfiles --create`, so if a module postinst
# momentarily re-clobbers one to 0750 it self-heals before the next
# secubox-dirs-guard.timer tick. Mode-only (owner `-`) to mirror the owner-agnostic
# dirs-guard and never fight secubox-core's / a module's own ownership.
d /var/lib/secubox 0755 - - -
d /var/log/secubox 0755 - - -
d /var/cache/secubox 0755 - - -
d /etc/secubox 0755 - - -
d /usr/share/secubox 0755 - - -

4
packages/secubox-crowdsec/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-crowdsec.service
systemctl start secubox-crowdsec.service || true

4
packages/secubox-domoticz/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create data directories
install -d -m 755 /srv/domoticz
install -d -m 755 /srv/domoticz/config

4
packages/secubox-dpi/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-dpi.service
systemctl start secubox-dpi.service || true

4
packages/secubox-droplet/debian/postinst
View File

@ -8,8 +8,8 @@ case "$1" in
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 755 /srv/droplet
# Enable and start service

2
packages/secubox-fmrelay/debian/postinst
View File

@ -13,7 +13,7 @@ case "$1" in
# the device with).
usermod -aG plugdev secubox 2>/dev/null || true
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/fmrelay
install -d -m 0755 -o secubox -g secubox /var/log/secubox

4
packages/secubox-glances/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/glances
systemctl daemon-reload
systemctl enable secubox-glances.service

4
packages/secubox-gotosocial/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create data directory for GoToSocial
install -d -o root -g root -m 755 /srv/gotosocial
install -d -o root -g root -m 755 /srv/gotosocial/storage

2
packages/secubox-grafana/debian/postinst
View File

@ -9,7 +9,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/grafana
install -d -m 0755 -o secubox -g secubox /var/log/secubox

3
packages/secubox-haproxy/debian/postinst
View File

@ -7,7 +7,8 @@ case "$1" in
# Shared parents stay 0755 (traversable by every secubox-* daemon — setting
# them 0750 here broke kbin/toolbox by blocking traversal, #626). Only the
# haproxy-private leaves are restricted.
install -d -o secubox -g secubox -m 755 /run/secubox /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/haproxy /var/lib/secubox/haproxy/config_backups
chmod 0755 /var/lib/secubox /run/secubox 2>/dev/null || true
# Create /etc/haproxy if not present (haproxy is Recommends, not Depends)

2
packages/secubox-health-doctor/debian/postinst
View File

@ -3,7 +3,7 @@ set -e
case "$1" in
configure)
install -d -o secubox -g secubox -m 750 /var/cache/secubox
install -d -o secubox -g secubox -m 755 /var/cache/secubox
systemctl daemon-reload
# API daemon + periodic timer
systemctl enable --now secubox-health-doctor.service || true

4
packages/secubox-hexo/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create hexo data directory
install -d -o root -g root -m 755 /srv/hexo/blogs
# Ensure nginx secubox.d directory exists

4
packages/secubox-homeassistant/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create data directories
install -d -m 755 /srv/homeassistant
install -d -m 755 /srv/homeassistant/config

4
packages/secubox-hub/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-hub.service
systemctl start secubox-hub.service || true

4
packages/secubox-jellyfin/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Ensure nginx secubox.d directory exists
install -d -m 755 /etc/nginx/secubox.d
# Enable and start service

4
packages/secubox-jitsi/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create Jitsi data directory
install -d -o root -g root -m 755 /srv/jitsi
install -d -o root -g root -m 755 /srv/jitsi/recordings

4
packages/secubox-ksm/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/ksm
systemctl daemon-reload
systemctl enable secubox-ksm.service

4
packages/secubox-localai/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create data directories
install -d -m 755 /srv/localai
install -d -m 755 /srv/localai/models

2
packages/secubox-lyrion/debian/postinst
View File

@ -9,7 +9,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/lyrion
install -d -m 0755 -o secubox -g secubox /var/log/secubox

4
packages/secubox-mac-guard/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/mac-guard
systemctl daemon-reload
systemctl enable secubox-mac-guard.service

4
packages/secubox-mediaflow/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-mediaflow.service
systemctl start secubox-mediaflow.service || true

6
packages/secubox-metabolizer/debian/postinst
View File

@ -5,10 +5,10 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/cache/secubox/metabolizer
install -d -o secubox -g secubox -m 750 /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
systemctl daemon-reload
systemctl enable secubox-metabolizer.service
systemctl start secubox-metabolizer.service || true

4
packages/secubox-metacatalog/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/cache/secubox/metacatalog
systemctl daemon-reload
systemctl enable secubox-metacatalog.service

4
packages/secubox-mirror/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/mirrors
install -d -o secubox -g secubox -m 750 /var/cache/secubox-mirror
install -d -o secubox -g secubox -m 750 /etc/nginx/secubox-mirror.d

2
packages/secubox-mqtt/debian/postinst
View File

@ -9,7 +9,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0750 -o root -g secubox /etc/secubox/secrets
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/mqtt
install -d -m 0755 -o secubox -g secubox /var/log/secubox

4
packages/secubox-nac/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-nac.service
systemctl start secubox-nac.service || true

4
packages/secubox-netdata/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-netdata.service
systemctl start secubox-netdata.service || true

4
packages/secubox-netdiag/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/cache/secubox/netdiag
systemctl daemon-reload
systemctl enable secubox-netdiag.service

4
packages/secubox-netifyd/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/netifyd
systemctl daemon-reload
systemctl enable secubox-netifyd.service

4
packages/secubox-netmodes/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o root -g root -m 755 /var/lib/secubox/netmodes-backup
install -d -o root -g root -m 755 /etc/secubox/netmodes
systemctl daemon-reload

4
packages/secubox-nettweak/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/nettweak
install -d -o root -g root -m 755 /etc/sysctl.d
systemctl daemon-reload

4
packages/secubox-newsbin/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o root -g root -m 755 /srv/newsbin
install -d -o root -g root -m 755 /srv/downloads/usenet
install -d -o root -g root -m 755 /srv/downloads/usenet/complete

4
packages/secubox-ollama/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Ensure nginx secubox.d directory exists
install -d -m 755 /etc/nginx/secubox.d
# Enable and start service

5
packages/secubox-peertube/debian/postinst
View File

@ -8,11 +8,12 @@ if [ "$1" = "configure" ]; then
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Runtime + state directories
install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Do NOT reset /etc/secubox — secubox-core owns it as secubox:secubox 0750
# (the users-engine needs dir-write for atomic users.json saves / TOTP).
# Only create as a fallback if it's somehow missing.
[ -d /etc/secubox ] || install -d -o secubox -g secubox -m 750 /etc/secubox
[ -d /etc/secubox ] || install -d -o secubox -g secubox -m 755 /etc/secubox
# nginx snippet directory (peertube.conf shipped by the package lands here)
install -d -m 755 /etc/nginx/secubox.d

6
packages/secubox-photoprism/debian/postinst
View File

@ -7,12 +7,12 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Do NOT reset /etc/secubox — secubox-core owns it as secubox:secubox 0750
# (the users-engine needs dir-write for atomic users.json saves / TOTP).
# Only create as a fallback if it's somehow missing.
[ -d /etc/secubox ] || install -d -o secubox -g secubox -m 750 /etc/secubox
[ -d /etc/secubox ] || install -d -o secubox -g secubox -m 755 /etc/secubox
# #319 /data migration: move legacy /srv/photoprism → /data/photoprism and
# leave a back-compat symlink. Idempotent.

4
packages/secubox-picobrew/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create data directories for picobrew
install -d -o secubox -g secubox -m 755 /var/lib/secubox/picobrew
install -d -o secubox -g secubox -m 755 /var/lib/secubox/picobrew/sensors

4
packages/secubox-portal/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-portal.service
systemctl start secubox-portal.service || true

4
packages/secubox-qos/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-qos.service
systemctl start secubox-qos.service || true

2
packages/secubox-rbs-sensor/debian/postinst
View File

@ -10,7 +10,7 @@ case "$1" in
# dialout: needed for /dev/ttyUSB* access when the EP06 enumerates
usermod -aG dialout secubox 2>/dev/null || true
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/rbs-sensor
install -d -m 0755 -o secubox -g secubox /var/log/secubox

6
packages/secubox-reporter/debian/postinst
View File

@ -5,11 +5,11 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/reports
install -d -o secubox -g secubox -m 750 /var/cache/secubox/reporter
install -d -o secubox -g secubox -m 750 /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
systemctl daemon-reload
systemctl enable secubox-reporter.service
systemctl start secubox-reporter.service || true

4
packages/secubox-routes/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-routes.service
systemctl start secubox-routes.service || true

2
packages/secubox-rustdesk/debian/postinst
View File

@ -6,7 +6,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/rustdesk
install -d -m 0755 -o secubox -g secubox /var/log/secubox

4
packages/secubox-saas-relay/debian/postinst
View File

@ -4,7 +4,9 @@ case "$1" in
configure)
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox /var/lib/secubox/saas-relay
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox/saas-relay
install -d -o secubox -g secubox -m 700 /etc/secubox/secrets
install -d -o secubox -g secubox -m 750 /var/cache/secubox/saas-relay
systemctl daemon-reload

2
packages/secubox-sentinelle-gsm/debian/postinst
View File

@ -12,7 +12,7 @@ case "$1" in
# daemon can claim the USB device when v0.2 wires the SDR I/O.
usermod -aG plugdev secubox 2>/dev/null || true
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0750 -o root -g secubox /etc/secubox/secrets
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/sentinelle-gsm
install -d -m 0755 -o secubox -g secubox /var/log/secubox

6
packages/secubox-smtp-relay/debian/postinst
View File

@ -5,9 +5,9 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /etc/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
systemctl daemon-reload
systemctl enable secubox-smtp-relay.service
systemctl start secubox-smtp-relay.service || true

2
packages/secubox-soc-agent/debian/postinst
View File

@ -17,7 +17,7 @@ case "$1" in
# Ensure log directory exists with correct permissions
mkdir -p /var/log/secubox
chown root:adm /var/log/secubox
chmod 750 /var/log/secubox
chmod 0755 /var/log/secubox
# Create config directory
mkdir -p /etc/secubox

2
packages/secubox-soc-gateway/debian/postinst
View File

@ -17,7 +17,7 @@ case "$1" in
# Ensure log directory exists with correct permissions
mkdir -p /var/log/secubox
chown root:adm /var/log/secubox
chmod 750 /var/log/secubox
chmod 0755 /var/log/secubox
# Create config directory
mkdir -p /etc/secubox

3
packages/secubox-streamforge/debian/postinst
View File

@ -4,7 +4,8 @@ case "$1" in
configure)
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 755 /srv/streamlit/apps
systemctl daemon-reload
systemctl enable secubox-streamforge.service

3
packages/secubox-streamlit/debian/postinst
View File

@ -4,7 +4,8 @@ case "$1" in
configure)
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 755 /srv/streamlit/apps /srv/streamlit/logs
install -d -o secubox -g secubox -m 755 /var/log/secubox
install -d -o root -g root -m 755 /etc/secubox

4
packages/secubox-system/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-system.service
systemctl start secubox-system.service || true

4
packages/secubox-torrent/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /var/cache/secubox/torrent
# Create data directories
install -d -m 755 /srv/torrent/config

2
packages/secubox-ui-manager/debian/postinst
View File

@ -15,7 +15,7 @@ case "$1" in
# Create log directory
mkdir -p /var/log/secubox
chmod 750 /var/log/secubox
chmod 0755 /var/log/secubox
# Create config directory
mkdir -p /etc/secubox/ui

2
packages/secubox-users/debian/postinst
View File

@ -7,7 +7,7 @@ case "$1" in
getent group secubox >/dev/null || groupadd --system secubox
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
# Run v1 → v2 migration (idempotent)
python3 - <<'PYEOF' || echo 'WARN: migration step failed — investigate /etc/secubox/users.json'

4
packages/secubox-vhost/debian/postinst
View File

@ -5,8 +5,8 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
systemctl daemon-reload
systemctl enable secubox-vhost.service
systemctl start secubox-vhost.service || true

4
packages/secubox-voip/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
install -d -o secubox -g secubox -m 750 /srv/voip
# Ensure nginx secubox.d directory exists
install -d -m 755 /etc/nginx/secubox.d

4
packages/secubox-webradio/debian/postinst
View File

@ -7,8 +7,8 @@ case "$1" in
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Create data directories
install -d -o secubox -g secubox -m 755 /var/lib/secubox/webradio
install -d -o secubox -g secubox -m 755 /var/lib/secubox/webradio/recordings

2
packages/secubox-yacy/debian/postinst
View File

@ -8,7 +8,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/yacy
install -d -m 0755 -o secubox -g secubox /var/log/secubox

2
packages/secubox-zigbee/debian/postinst
View File

@ -9,7 +9,7 @@ case "$1" in
getent passwd secubox >/dev/null || useradd --system --gid secubox \
--home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox
install -d -m 0770 -o root -g secubox /etc/secubox
install -d -o secubox -g secubox -m 755 /etc/secubox
install -d -m 0750 -o root -g secubox /etc/secubox/secrets
install -d -m 0755 -o secubox -g secubox /var/lib/secubox/zigbee
install -d -m 0755 -o secubox -g secubox /var/log/secubox

12
scripts/new-package.sh
View File

@ -201,9 +201,15 @@ case "$1" in
id -u secubox >/dev/null 2>&1 || \
adduser --system --group --no-create-home \
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
# Create runtime directories
install -d -o secubox -g secubox -m 750 /run/secubox
install -d -o secubox -g secubox -m 750 /var/lib/secubox
# Create runtime directories.
# NOTE (#623): these are SHARED parents — keep them traversable for every
# secubox-* daemon. /run/secubox MUST stay 1777 (world-writable sticky, all
# services drop sockets there, ref #471); /var/lib/secubox MUST stay 0755.
# NEVER set a shared parent to 0750/0700 — it breaks traversal for non-secubox
# users (kbin/toolbox 500). Module-private leaves (/var/lib/secubox/PKGNAME)
# may be 0750. Re-asserting 0755/1777 here is idempotent + self-healing.
install -d -o root -g root -m 1777 /run/secubox
install -d -o secubox -g secubox -m 755 /var/lib/secubox
# Ensure nginx secubox.d directory exists
install -d -m 755 /etc/nginx/secubox.d
# Enable and start service