From 6b7d7f860712bd3b82f8128f28e2714635bd1b9b Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Thu, 18 Jun 2026 10:32:58 +0200 Subject: [PATCH 1/2] fix(#623): shared /run|/var/lib|/var/cache|/etc/secubox parents stay 1777/0755 in all postinsts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Systemic clobber: the scaffold boilerplate (install -d -m 750 /var/lib/secubox, /run/secubox) put restrictive modes on SHARED parents in ~56 module postinsts, reverting them to 0750 on every install/upgrade and breaking traversal for non-secubox daemons (kbin/toolbox 500). Empirically confirmed install -d -m only modes the final component, so /parent/leaf forms are harmless — only bare-parent targets were rewritten. Multi-arg lines (incl. ones making /var/lib world-writable 1777) split per-parent: /run/secubox=1777 root:root, /var/lib|cache|etc=0755 secubox:secubox; module-private leaves keep 0750. Scaffold + PATTERNS.md fixed so new packages don't reintroduce it. --- .claude/PATTERNS.md | 10 +++++++--- packages/secubox-admin/debian/postinst | 4 ++-- packages/secubox-ai-insights/debian/postinst | 4 ++-- packages/secubox-auth/debian/postinst | 4 ++-- packages/secubox-authelia/debian/postinst | 2 +- packages/secubox-avatar/debian/postinst | 4 ++-- packages/secubox-cdn/debian/postinst | 4 ++-- packages/secubox-certs/debian/postinst | 3 ++- packages/secubox-crowdsec/debian/postinst | 4 ++-- packages/secubox-domoticz/debian/postinst | 4 ++-- packages/secubox-dpi/debian/postinst | 4 ++-- packages/secubox-droplet/debian/postinst | 4 ++-- packages/secubox-fmrelay/debian/postinst | 2 +- packages/secubox-glances/debian/postinst | 4 ++-- packages/secubox-gotosocial/debian/postinst | 4 ++-- packages/secubox-grafana/debian/postinst | 2 +- packages/secubox-haproxy/debian/postinst | 3 ++- packages/secubox-health-doctor/debian/postinst | 2 +- packages/secubox-hexo/debian/postinst | 4 ++-- packages/secubox-homeassistant/debian/postinst | 4 ++-- packages/secubox-hub/debian/postinst | 4 ++-- packages/secubox-jellyfin/debian/postinst | 4 ++-- packages/secubox-jitsi/debian/postinst | 4 ++-- packages/secubox-ksm/debian/postinst | 4 ++-- packages/secubox-localai/debian/postinst | 4 ++-- packages/secubox-lyrion/debian/postinst | 2 +- packages/secubox-mac-guard/debian/postinst | 4 ++-- packages/secubox-mediaflow/debian/postinst | 4 ++-- packages/secubox-metabolizer/debian/postinst | 6 +++--- packages/secubox-metacatalog/debian/postinst | 4 ++-- packages/secubox-mirror/debian/postinst | 4 ++-- packages/secubox-mqtt/debian/postinst | 2 +- packages/secubox-nac/debian/postinst | 4 ++-- packages/secubox-netdata/debian/postinst | 4 ++-- packages/secubox-netdiag/debian/postinst | 4 ++-- packages/secubox-netifyd/debian/postinst | 4 ++-- packages/secubox-netmodes/debian/postinst | 4 ++-- packages/secubox-nettweak/debian/postinst | 4 ++-- packages/secubox-newsbin/debian/postinst | 4 ++-- packages/secubox-ollama/debian/postinst | 4 ++-- packages/secubox-peertube/debian/postinst | 5 +++-- packages/secubox-photoprism/debian/postinst | 6 +++--- packages/secubox-picobrew/debian/postinst | 4 ++-- packages/secubox-portal/debian/postinst | 4 ++-- packages/secubox-qos/debian/postinst | 4 ++-- packages/secubox-rbs-sensor/debian/postinst | 2 +- packages/secubox-reporter/debian/postinst | 6 +++--- packages/secubox-routes/debian/postinst | 4 ++-- packages/secubox-rustdesk/debian/postinst | 2 +- packages/secubox-saas-relay/debian/postinst | 4 +++- packages/secubox-sentinelle-gsm/debian/postinst | 2 +- packages/secubox-smtp-relay/debian/postinst | 6 +++--- packages/secubox-streamforge/debian/postinst | 3 ++- packages/secubox-streamlit/debian/postinst | 3 ++- packages/secubox-system/debian/postinst | 4 ++-- packages/secubox-torrent/debian/postinst | 4 ++-- packages/secubox-users/debian/postinst | 2 +- packages/secubox-vhost/debian/postinst | 4 ++-- packages/secubox-voip/debian/postinst | 4 ++-- packages/secubox-webradio/debian/postinst | 4 ++-- packages/secubox-yacy/debian/postinst | 2 +- packages/secubox-zigbee/debian/postinst | 2 +- scripts/new-package.sh | 12 +++++++++--- 63 files changed, 132 insertions(+), 115 deletions(-) diff --git a/.claude/PATTERNS.md b/.claude/PATTERNS.md index af569729..2e8bbc13 100644 --- a/.claude/PATTERNS.md +++ b/.claude/PATTERNS.md @@ -383,9 +383,13 @@ case "$1" in adduser --system --group --no-create-home --home /var/lib/secubox secubox fi - # Répertoires runtime - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + # Répertoires runtime — SHARED parents, NE JAMAIS les passer en 0750/0700 + # (#623 : casse la traversée pour les daemons non-secubox → kbin/toolbox 500). + # /run/secubox reste 1777 (sticky world-writable, sockets de tous les services, + # #471) ; /var/lib/secubox reste 0755. Les leaves privées + # (/var/lib/secubox/) peuvent être 0750. + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Activer et démarrer le service systemctl daemon-reload diff --git a/packages/secubox-admin/debian/postinst b/packages/secubox-admin/debian/postinst index d2096ec3..cda62e17 100755 --- a/packages/secubox-admin/debian/postinst +++ b/packages/secubox-admin/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/admin install -d -o root -g secubox -m 0755 /var/log/secubox systemctl daemon-reload diff --git a/packages/secubox-ai-insights/debian/postinst b/packages/secubox-ai-insights/debian/postinst index 515b00f8..67ca7f7d 100755 --- a/packages/secubox-ai-insights/debian/postinst +++ b/packages/secubox-ai-insights/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/ai-insights install -d -o secubox -g secubox -m 750 /var/lib/secubox/ai-insights/models install -d -o secubox -g secubox -m 750 /var/cache/secubox/ai-insights diff --git a/packages/secubox-auth/debian/postinst b/packages/secubox-auth/debian/postinst index 0158df02..b5147734 100755 --- a/packages/secubox-auth/debian/postinst +++ b/packages/secubox-auth/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-auth.service systemctl start secubox-auth.service || true diff --git a/packages/secubox-authelia/debian/postinst b/packages/secubox-authelia/debian/postinst index d6caeb88..c6c9c4ff 100755 --- a/packages/secubox-authelia/debian/postinst +++ b/packages/secubox-authelia/debian/postinst @@ -9,7 +9,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/authelia install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-avatar/debian/postinst b/packages/secubox-avatar/debian/postinst index c8c831f7..5121ad03 100755 --- a/packages/secubox-avatar/debian/postinst +++ b/packages/secubox-avatar/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/avatar install -d -o secubox -g secubox -m 750 /var/lib/secubox/avatar/images systemctl daemon-reload diff --git a/packages/secubox-cdn/debian/postinst b/packages/secubox-cdn/debian/postinst index d3df8467..d9f816c0 100755 --- a/packages/secubox-cdn/debian/postinst +++ b/packages/secubox-cdn/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-cdn.service systemctl start secubox-cdn.service || true diff --git a/packages/secubox-certs/debian/postinst b/packages/secubox-certs/debian/postinst index fd21da46..c5389c73 100755 --- a/packages/secubox-certs/debian/postinst +++ b/packages/secubox-certs/debian/postinst @@ -1,7 +1,8 @@ #!/bin/sh set -e if [ "$1" = "configure" ]; then - install -d -m 0755 /run/secubox /var/cache/secubox/certs + install -d -o root -g root -m 1777 /run/secubox + install -d -m 0755 /var/cache/secubox/certs systemctl daemon-reload || true systemctl enable --now secubox-certs.service || true fi diff --git a/packages/secubox-crowdsec/debian/postinst b/packages/secubox-crowdsec/debian/postinst index 40a18733..b5ae1057 100755 --- a/packages/secubox-crowdsec/debian/postinst +++ b/packages/secubox-crowdsec/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-crowdsec.service systemctl start secubox-crowdsec.service || true diff --git a/packages/secubox-domoticz/debian/postinst b/packages/secubox-domoticz/debian/postinst index a9b7a514..18446d7a 100755 --- a/packages/secubox-domoticz/debian/postinst +++ b/packages/secubox-domoticz/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create data directories install -d -m 755 /srv/domoticz install -d -m 755 /srv/domoticz/config diff --git a/packages/secubox-dpi/debian/postinst b/packages/secubox-dpi/debian/postinst index f929dcc9..0a5c924c 100755 --- a/packages/secubox-dpi/debian/postinst +++ b/packages/secubox-dpi/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-dpi.service systemctl start secubox-dpi.service || true diff --git a/packages/secubox-droplet/debian/postinst b/packages/secubox-droplet/debian/postinst index c7db4cff..cd9f9fea 100755 --- a/packages/secubox-droplet/debian/postinst +++ b/packages/secubox-droplet/debian/postinst @@ -8,8 +8,8 @@ case "$1" in --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 755 /srv/droplet # Enable and start service diff --git a/packages/secubox-fmrelay/debian/postinst b/packages/secubox-fmrelay/debian/postinst index b5994037..9d6131b1 100755 --- a/packages/secubox-fmrelay/debian/postinst +++ b/packages/secubox-fmrelay/debian/postinst @@ -13,7 +13,7 @@ case "$1" in # the device with). usermod -aG plugdev secubox 2>/dev/null || true - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/fmrelay install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-glances/debian/postinst b/packages/secubox-glances/debian/postinst index cf4b47a4..74b457d8 100755 --- a/packages/secubox-glances/debian/postinst +++ b/packages/secubox-glances/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/glances systemctl daemon-reload systemctl enable secubox-glances.service diff --git a/packages/secubox-gotosocial/debian/postinst b/packages/secubox-gotosocial/debian/postinst index 42a0c05e..157e0ade 100755 --- a/packages/secubox-gotosocial/debian/postinst +++ b/packages/secubox-gotosocial/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create data directory for GoToSocial install -d -o root -g root -m 755 /srv/gotosocial install -d -o root -g root -m 755 /srv/gotosocial/storage diff --git a/packages/secubox-grafana/debian/postinst b/packages/secubox-grafana/debian/postinst index 5f3226b0..c805ef4a 100755 --- a/packages/secubox-grafana/debian/postinst +++ b/packages/secubox-grafana/debian/postinst @@ -9,7 +9,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/grafana install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-haproxy/debian/postinst b/packages/secubox-haproxy/debian/postinst index f72f11a9..bea368c4 100755 --- a/packages/secubox-haproxy/debian/postinst +++ b/packages/secubox-haproxy/debian/postinst @@ -7,7 +7,8 @@ case "$1" in # Shared parents stay 0755 (traversable by every secubox-* daemon — setting # them 0750 here broke kbin/toolbox by blocking traversal, #626). Only the # haproxy-private leaves are restricted. - install -d -o secubox -g secubox -m 755 /run/secubox /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/haproxy /var/lib/secubox/haproxy/config_backups chmod 0755 /var/lib/secubox /run/secubox 2>/dev/null || true # Create /etc/haproxy if not present (haproxy is Recommends, not Depends) diff --git a/packages/secubox-health-doctor/debian/postinst b/packages/secubox-health-doctor/debian/postinst index 01a8f67c..c8cc537c 100755 --- a/packages/secubox-health-doctor/debian/postinst +++ b/packages/secubox-health-doctor/debian/postinst @@ -3,7 +3,7 @@ set -e case "$1" in configure) - install -d -o secubox -g secubox -m 750 /var/cache/secubox + install -d -o secubox -g secubox -m 755 /var/cache/secubox systemctl daemon-reload # API daemon + periodic timer systemctl enable --now secubox-health-doctor.service || true diff --git a/packages/secubox-hexo/debian/postinst b/packages/secubox-hexo/debian/postinst index f1b73bf0..6b3d7fc0 100755 --- a/packages/secubox-hexo/debian/postinst +++ b/packages/secubox-hexo/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create hexo data directory install -d -o root -g root -m 755 /srv/hexo/blogs # Ensure nginx secubox.d directory exists diff --git a/packages/secubox-homeassistant/debian/postinst b/packages/secubox-homeassistant/debian/postinst index 635ac995..5a25abf8 100755 --- a/packages/secubox-homeassistant/debian/postinst +++ b/packages/secubox-homeassistant/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create data directories install -d -m 755 /srv/homeassistant install -d -m 755 /srv/homeassistant/config diff --git a/packages/secubox-hub/debian/postinst b/packages/secubox-hub/debian/postinst index dc96abf3..1cd738aa 100755 --- a/packages/secubox-hub/debian/postinst +++ b/packages/secubox-hub/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-hub.service systemctl start secubox-hub.service || true diff --git a/packages/secubox-jellyfin/debian/postinst b/packages/secubox-jellyfin/debian/postinst index 22d64b3b..2d54c630 100755 --- a/packages/secubox-jellyfin/debian/postinst +++ b/packages/secubox-jellyfin/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Ensure nginx secubox.d directory exists install -d -m 755 /etc/nginx/secubox.d # Enable and start service diff --git a/packages/secubox-jitsi/debian/postinst b/packages/secubox-jitsi/debian/postinst index 7f86ab3b..e4e235ac 100755 --- a/packages/secubox-jitsi/debian/postinst +++ b/packages/secubox-jitsi/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create Jitsi data directory install -d -o root -g root -m 755 /srv/jitsi install -d -o root -g root -m 755 /srv/jitsi/recordings diff --git a/packages/secubox-ksm/debian/postinst b/packages/secubox-ksm/debian/postinst index d1d08efd..29883513 100755 --- a/packages/secubox-ksm/debian/postinst +++ b/packages/secubox-ksm/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/ksm systemctl daemon-reload systemctl enable secubox-ksm.service diff --git a/packages/secubox-localai/debian/postinst b/packages/secubox-localai/debian/postinst index 285808a5..5432f108 100755 --- a/packages/secubox-localai/debian/postinst +++ b/packages/secubox-localai/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create data directories install -d -m 755 /srv/localai install -d -m 755 /srv/localai/models diff --git a/packages/secubox-lyrion/debian/postinst b/packages/secubox-lyrion/debian/postinst index e77d7c37..f8f0786f 100755 --- a/packages/secubox-lyrion/debian/postinst +++ b/packages/secubox-lyrion/debian/postinst @@ -9,7 +9,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/lyrion install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-mac-guard/debian/postinst b/packages/secubox-mac-guard/debian/postinst index e657cb9d..4853e991 100755 --- a/packages/secubox-mac-guard/debian/postinst +++ b/packages/secubox-mac-guard/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/mac-guard systemctl daemon-reload systemctl enable secubox-mac-guard.service diff --git a/packages/secubox-mediaflow/debian/postinst b/packages/secubox-mediaflow/debian/postinst index 0b37837f..27dc048a 100755 --- a/packages/secubox-mediaflow/debian/postinst +++ b/packages/secubox-mediaflow/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-mediaflow.service systemctl start secubox-mediaflow.service || true diff --git a/packages/secubox-metabolizer/debian/postinst b/packages/secubox-metabolizer/debian/postinst index ff4ab51a..9c5b2ec9 100755 --- a/packages/secubox-metabolizer/debian/postinst +++ b/packages/secubox-metabolizer/debian/postinst @@ -5,10 +5,10 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/cache/secubox/metabolizer - install -d -o secubox -g secubox -m 750 /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox systemctl daemon-reload systemctl enable secubox-metabolizer.service systemctl start secubox-metabolizer.service || true diff --git a/packages/secubox-metacatalog/debian/postinst b/packages/secubox-metacatalog/debian/postinst index 0e96fe1e..55d8900e 100755 --- a/packages/secubox-metacatalog/debian/postinst +++ b/packages/secubox-metacatalog/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/cache/secubox/metacatalog systemctl daemon-reload systemctl enable secubox-metacatalog.service diff --git a/packages/secubox-mirror/debian/postinst b/packages/secubox-mirror/debian/postinst index 6dd5a079..ab29ad1c 100755 --- a/packages/secubox-mirror/debian/postinst +++ b/packages/secubox-mirror/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/mirrors install -d -o secubox -g secubox -m 750 /var/cache/secubox-mirror install -d -o secubox -g secubox -m 750 /etc/nginx/secubox-mirror.d diff --git a/packages/secubox-mqtt/debian/postinst b/packages/secubox-mqtt/debian/postinst index ceb2b016..a4a4bedf 100755 --- a/packages/secubox-mqtt/debian/postinst +++ b/packages/secubox-mqtt/debian/postinst @@ -9,7 +9,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0750 -o root -g secubox /etc/secubox/secrets install -d -m 0755 -o secubox -g secubox /var/lib/secubox/mqtt install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-nac/debian/postinst b/packages/secubox-nac/debian/postinst index ca36df20..e3c68620 100755 --- a/packages/secubox-nac/debian/postinst +++ b/packages/secubox-nac/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-nac.service systemctl start secubox-nac.service || true diff --git a/packages/secubox-netdata/debian/postinst b/packages/secubox-netdata/debian/postinst index 4ded5789..eb6caa8e 100755 --- a/packages/secubox-netdata/debian/postinst +++ b/packages/secubox-netdata/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-netdata.service systemctl start secubox-netdata.service || true diff --git a/packages/secubox-netdiag/debian/postinst b/packages/secubox-netdiag/debian/postinst index 95c7f033..dae5e810 100755 --- a/packages/secubox-netdiag/debian/postinst +++ b/packages/secubox-netdiag/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/cache/secubox/netdiag systemctl daemon-reload systemctl enable secubox-netdiag.service diff --git a/packages/secubox-netifyd/debian/postinst b/packages/secubox-netifyd/debian/postinst index b617accc..407a1da9 100755 --- a/packages/secubox-netifyd/debian/postinst +++ b/packages/secubox-netifyd/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/netifyd systemctl daemon-reload systemctl enable secubox-netifyd.service diff --git a/packages/secubox-netmodes/debian/postinst b/packages/secubox-netmodes/debian/postinst index 3a8e58a2..3209fbb5 100755 --- a/packages/secubox-netmodes/debian/postinst +++ b/packages/secubox-netmodes/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o root -g root -m 755 /var/lib/secubox/netmodes-backup install -d -o root -g root -m 755 /etc/secubox/netmodes systemctl daemon-reload diff --git a/packages/secubox-nettweak/debian/postinst b/packages/secubox-nettweak/debian/postinst index 2707b9d5..2b112692 100755 --- a/packages/secubox-nettweak/debian/postinst +++ b/packages/secubox-nettweak/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/nettweak install -d -o root -g root -m 755 /etc/sysctl.d systemctl daemon-reload diff --git a/packages/secubox-newsbin/debian/postinst b/packages/secubox-newsbin/debian/postinst index a02d57e4..5fe5971f 100755 --- a/packages/secubox-newsbin/debian/postinst +++ b/packages/secubox-newsbin/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o root -g root -m 755 /srv/newsbin install -d -o root -g root -m 755 /srv/downloads/usenet install -d -o root -g root -m 755 /srv/downloads/usenet/complete diff --git a/packages/secubox-ollama/debian/postinst b/packages/secubox-ollama/debian/postinst index c1221d5b..48ff007e 100755 --- a/packages/secubox-ollama/debian/postinst +++ b/packages/secubox-ollama/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Ensure nginx secubox.d directory exists install -d -m 755 /etc/nginx/secubox.d # Enable and start service diff --git a/packages/secubox-peertube/debian/postinst b/packages/secubox-peertube/debian/postinst index 14e0d67f..034b3ea1 100755 --- a/packages/secubox-peertube/debian/postinst +++ b/packages/secubox-peertube/debian/postinst @@ -8,11 +8,12 @@ if [ "$1" = "configure" ]; then --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Runtime + state directories - install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Do NOT reset /etc/secubox — secubox-core owns it as secubox:secubox 0750 # (the users-engine needs dir-write for atomic users.json saves / TOTP). # Only create as a fallback if it's somehow missing. - [ -d /etc/secubox ] || install -d -o secubox -g secubox -m 750 /etc/secubox + [ -d /etc/secubox ] || install -d -o secubox -g secubox -m 755 /etc/secubox # nginx snippet directory (peertube.conf shipped by the package lands here) install -d -m 755 /etc/nginx/secubox.d diff --git a/packages/secubox-photoprism/debian/postinst b/packages/secubox-photoprism/debian/postinst index 9696c569..5c0128c9 100755 --- a/packages/secubox-photoprism/debian/postinst +++ b/packages/secubox-photoprism/debian/postinst @@ -7,12 +7,12 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Do NOT reset /etc/secubox — secubox-core owns it as secubox:secubox 0750 # (the users-engine needs dir-write for atomic users.json saves / TOTP). # Only create as a fallback if it's somehow missing. - [ -d /etc/secubox ] || install -d -o secubox -g secubox -m 750 /etc/secubox + [ -d /etc/secubox ] || install -d -o secubox -g secubox -m 755 /etc/secubox # #319 /data migration: move legacy /srv/photoprism → /data/photoprism and # leave a back-compat symlink. Idempotent. diff --git a/packages/secubox-picobrew/debian/postinst b/packages/secubox-picobrew/debian/postinst index 2123f774..d533167b 100644 --- a/packages/secubox-picobrew/debian/postinst +++ b/packages/secubox-picobrew/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create data directories for picobrew install -d -o secubox -g secubox -m 755 /var/lib/secubox/picobrew install -d -o secubox -g secubox -m 755 /var/lib/secubox/picobrew/sensors diff --git a/packages/secubox-portal/debian/postinst b/packages/secubox-portal/debian/postinst index b806334b..62e50cc0 100755 --- a/packages/secubox-portal/debian/postinst +++ b/packages/secubox-portal/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-portal.service systemctl start secubox-portal.service || true diff --git a/packages/secubox-qos/debian/postinst b/packages/secubox-qos/debian/postinst index 6abc5782..f56d6da4 100755 --- a/packages/secubox-qos/debian/postinst +++ b/packages/secubox-qos/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-qos.service systemctl start secubox-qos.service || true diff --git a/packages/secubox-rbs-sensor/debian/postinst b/packages/secubox-rbs-sensor/debian/postinst index 14d9efac..b24e29b1 100644 --- a/packages/secubox-rbs-sensor/debian/postinst +++ b/packages/secubox-rbs-sensor/debian/postinst @@ -10,7 +10,7 @@ case "$1" in # dialout: needed for /dev/ttyUSB* access when the EP06 enumerates usermod -aG dialout secubox 2>/dev/null || true - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/rbs-sensor install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-reporter/debian/postinst b/packages/secubox-reporter/debian/postinst index 7b846d7b..4ad06262 100755 --- a/packages/secubox-reporter/debian/postinst +++ b/packages/secubox-reporter/debian/postinst @@ -5,11 +5,11 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/lib/secubox/reports install -d -o secubox -g secubox -m 750 /var/cache/secubox/reporter - install -d -o secubox -g secubox -m 750 /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox systemctl daemon-reload systemctl enable secubox-reporter.service systemctl start secubox-reporter.service || true diff --git a/packages/secubox-routes/debian/postinst b/packages/secubox-routes/debian/postinst index 3910ee2d..ab1a888f 100755 --- a/packages/secubox-routes/debian/postinst +++ b/packages/secubox-routes/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-routes.service systemctl start secubox-routes.service || true diff --git a/packages/secubox-rustdesk/debian/postinst b/packages/secubox-rustdesk/debian/postinst index 5da133b6..6ae811d7 100755 --- a/packages/secubox-rustdesk/debian/postinst +++ b/packages/secubox-rustdesk/debian/postinst @@ -6,7 +6,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/rustdesk install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-saas-relay/debian/postinst b/packages/secubox-saas-relay/debian/postinst index 85063088..f2242f25 100755 --- a/packages/secubox-saas-relay/debian/postinst +++ b/packages/secubox-saas-relay/debian/postinst @@ -4,7 +4,9 @@ case "$1" in configure) id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox /var/lib/secubox/saas-relay + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox + install -d -o secubox -g secubox -m 750 /var/lib/secubox/saas-relay install -d -o secubox -g secubox -m 700 /etc/secubox/secrets install -d -o secubox -g secubox -m 750 /var/cache/secubox/saas-relay systemctl daemon-reload diff --git a/packages/secubox-sentinelle-gsm/debian/postinst b/packages/secubox-sentinelle-gsm/debian/postinst index 4109f3d0..31d8284e 100644 --- a/packages/secubox-sentinelle-gsm/debian/postinst +++ b/packages/secubox-sentinelle-gsm/debian/postinst @@ -12,7 +12,7 @@ case "$1" in # daemon can claim the USB device when v0.2 wires the SDR I/O. usermod -aG plugdev secubox 2>/dev/null || true - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0750 -o root -g secubox /etc/secubox/secrets install -d -m 0755 -o secubox -g secubox /var/lib/secubox/sentinelle-gsm install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-smtp-relay/debian/postinst b/packages/secubox-smtp-relay/debian/postinst index 185f7245..e49f1322 100755 --- a/packages/secubox-smtp-relay/debian/postinst +++ b/packages/secubox-smtp-relay/debian/postinst @@ -5,9 +5,9 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox - install -d -o secubox -g secubox -m 750 /etc/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox systemctl daemon-reload systemctl enable secubox-smtp-relay.service systemctl start secubox-smtp-relay.service || true diff --git a/packages/secubox-streamforge/debian/postinst b/packages/secubox-streamforge/debian/postinst index 6bbc0322..b5f9375f 100755 --- a/packages/secubox-streamforge/debian/postinst +++ b/packages/secubox-streamforge/debian/postinst @@ -4,7 +4,8 @@ case "$1" in configure) id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 755 /srv/streamlit/apps systemctl daemon-reload systemctl enable secubox-streamforge.service diff --git a/packages/secubox-streamlit/debian/postinst b/packages/secubox-streamlit/debian/postinst index b6443669..bc96afc7 100755 --- a/packages/secubox-streamlit/debian/postinst +++ b/packages/secubox-streamlit/debian/postinst @@ -4,7 +4,8 @@ case "$1" in configure) id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 755 /srv/streamlit/apps /srv/streamlit/logs install -d -o secubox -g secubox -m 755 /var/log/secubox install -d -o root -g root -m 755 /etc/secubox diff --git a/packages/secubox-system/debian/postinst b/packages/secubox-system/debian/postinst index 36a36683..4ef1d8db 100755 --- a/packages/secubox-system/debian/postinst +++ b/packages/secubox-system/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-system.service systemctl start secubox-system.service || true diff --git a/packages/secubox-torrent/debian/postinst b/packages/secubox-torrent/debian/postinst index 59458b26..2ff65538 100755 --- a/packages/secubox-torrent/debian/postinst +++ b/packages/secubox-torrent/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /var/cache/secubox/torrent # Create data directories install -d -m 755 /srv/torrent/config diff --git a/packages/secubox-users/debian/postinst b/packages/secubox-users/debian/postinst index 5e97383d..6078ecff 100755 --- a/packages/secubox-users/debian/postinst +++ b/packages/secubox-users/debian/postinst @@ -7,7 +7,7 @@ case "$1" in getent group secubox >/dev/null || groupadd --system secubox getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox # Run v1 → v2 migration (idempotent) python3 - <<'PYEOF' || echo 'WARN: migration step failed — investigate /etc/secubox/users.json' diff --git a/packages/secubox-vhost/debian/postinst b/packages/secubox-vhost/debian/postinst index 27860301..28191fac 100755 --- a/packages/secubox-vhost/debian/postinst +++ b/packages/secubox-vhost/debian/postinst @@ -5,8 +5,8 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox systemctl daemon-reload systemctl enable secubox-vhost.service systemctl start secubox-vhost.service || true diff --git a/packages/secubox-voip/debian/postinst b/packages/secubox-voip/debian/postinst index 3953aa32..cfa04667 100755 --- a/packages/secubox-voip/debian/postinst +++ b/packages/secubox-voip/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox install -d -o secubox -g secubox -m 750 /srv/voip # Ensure nginx secubox.d directory exists install -d -m 755 /etc/nginx/secubox.d diff --git a/packages/secubox-webradio/debian/postinst b/packages/secubox-webradio/debian/postinst index 7e752a58..c7f316e6 100755 --- a/packages/secubox-webradio/debian/postinst +++ b/packages/secubox-webradio/debian/postinst @@ -7,8 +7,8 @@ case "$1" in adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Create data directories install -d -o secubox -g secubox -m 755 /var/lib/secubox/webradio install -d -o secubox -g secubox -m 755 /var/lib/secubox/webradio/recordings diff --git a/packages/secubox-yacy/debian/postinst b/packages/secubox-yacy/debian/postinst index 93b3259e..55add6cd 100755 --- a/packages/secubox-yacy/debian/postinst +++ b/packages/secubox-yacy/debian/postinst @@ -8,7 +8,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0755 -o secubox -g secubox /var/lib/secubox/yacy install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/packages/secubox-zigbee/debian/postinst b/packages/secubox-zigbee/debian/postinst index d17254d1..274eb3a1 100755 --- a/packages/secubox-zigbee/debian/postinst +++ b/packages/secubox-zigbee/debian/postinst @@ -9,7 +9,7 @@ case "$1" in getent passwd secubox >/dev/null || useradd --system --gid secubox \ --home /var/lib/secubox --no-create-home --shell /usr/sbin/nologin secubox - install -d -m 0770 -o root -g secubox /etc/secubox + install -d -o secubox -g secubox -m 755 /etc/secubox install -d -m 0750 -o root -g secubox /etc/secubox/secrets install -d -m 0755 -o secubox -g secubox /var/lib/secubox/zigbee install -d -m 0755 -o secubox -g secubox /var/log/secubox diff --git a/scripts/new-package.sh b/scripts/new-package.sh index fb533990..8f562b93 100755 --- a/scripts/new-package.sh +++ b/scripts/new-package.sh @@ -201,9 +201,15 @@ case "$1" in id -u secubox >/dev/null 2>&1 || \ adduser --system --group --no-create-home \ --home /var/lib/secubox --shell /usr/sbin/nologin secubox - # Create runtime directories - install -d -o secubox -g secubox -m 750 /run/secubox - install -d -o secubox -g secubox -m 750 /var/lib/secubox + # Create runtime directories. + # NOTE (#623): these are SHARED parents — keep them traversable for every + # secubox-* daemon. /run/secubox MUST stay 1777 (world-writable sticky, all + # services drop sockets there, ref #471); /var/lib/secubox MUST stay 0755. + # NEVER set a shared parent to 0750/0700 — it breaks traversal for non-secubox + # users (kbin/toolbox 500). Module-private leaves (/var/lib/secubox/PKGNAME) + # may be 0750. Re-asserting 0755/1777 here is idempotent + self-healing. + install -d -o root -g root -m 1777 /run/secubox + install -d -o secubox -g secubox -m 755 /var/lib/secubox # Ensure nginx secubox.d directory exists install -d -m 755 /etc/nginx/secubox.d # Enable and start service From 951af764fbc87024a33c32e299249df2c82105cc Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Thu, 18 Jun 2026 10:39:52 +0200 Subject: [PATCH 2/2] =?UTF-8?q?fix(#623):=20close=20review=20gaps=20?= =?UTF-8?q?=E2=80=94=203=20chmod=20750=20/var/log=20clobbers=20+=20tmpfile?= =?UTF-8?q?s=20defense-in-depth?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review found two gaps the install-d sweep missed: - chmod-form clobber: soc-gateway/soc-agent/ui-manager did 'chmod 750 /var/log/secubox' (same #511 traversal class) -> now 0755. - secubox-core tmpfiles.d only declared /run/secubox; now declares all 5 shared parents at 0755 (mode-only, owner-agnostic) for boot/install-time self-heal. core 1.1.7 -> 1.1.8. --- packages/secubox-core/debian/changelog | 12 ++++++++++++ packages/secubox-core/tmpfiles.d/secubox.conf | 10 ++++++++++ packages/secubox-soc-agent/debian/postinst | 2 +- packages/secubox-soc-gateway/debian/postinst | 2 +- packages/secubox-ui-manager/debian/postinst | 2 +- 5 files changed, 25 insertions(+), 3 deletions(-) diff --git a/packages/secubox-core/debian/changelog b/packages/secubox-core/debian/changelog index 5d5cd2ba..19477d08 100644 --- a/packages/secubox-core/debian/changelog +++ b/packages/secubox-core/debian/changelog @@ -1,3 +1,15 @@ +secubox-core (1.1.8-1~bookworm1) bookworm; urgency=medium + + * fix(#623): tmpfiles.d now declares all shared secubox parents + (/var/lib, /var/log, /var/cache, /etc, /usr/share /secubox) at 0755 + (mode-only, owner-agnostic), in addition to /run/secubox 1777 — boot + + install-time defense-in-depth that self-heals a momentary 0750 clobber + before the next secubox-dirs-guard.timer tick. Pairs with the source-wide + postinst sweep that stopped ~56 module postinsts from clobbering those + parents. + + -- Gerald Kerma Thu, 18 Jun 2026 13:00:00 +0200 + secubox-core (1.1.7-1~bookworm1) bookworm; urgency=medium * fix(postinst): /var/lib/secubox + /usr/share/secubox/www were set 0750, diff --git a/packages/secubox-core/tmpfiles.d/secubox.conf b/packages/secubox-core/tmpfiles.d/secubox.conf index 31bb16f7..3b1863e1 100644 --- a/packages/secubox-core/tmpfiles.d/secubox.conf +++ b/packages/secubox-core/tmpfiles.d/secubox.conf @@ -1 +1,11 @@ d /run/secubox 1777 root root - +# #623 — defense-in-depth: guarantee the SHARED secubox parents stay traversable +# (0755) at boot and on every `systemd-tmpfiles --create`, so if a module postinst +# momentarily re-clobbers one to 0750 it self-heals before the next +# secubox-dirs-guard.timer tick. Mode-only (owner `-`) to mirror the owner-agnostic +# dirs-guard and never fight secubox-core's / a module's own ownership. +d /var/lib/secubox 0755 - - - +d /var/log/secubox 0755 - - - +d /var/cache/secubox 0755 - - - +d /etc/secubox 0755 - - - +d /usr/share/secubox 0755 - - - diff --git a/packages/secubox-soc-agent/debian/postinst b/packages/secubox-soc-agent/debian/postinst index 4a4552a5..366cfbb1 100755 --- a/packages/secubox-soc-agent/debian/postinst +++ b/packages/secubox-soc-agent/debian/postinst @@ -17,7 +17,7 @@ case "$1" in # Ensure log directory exists with correct permissions mkdir -p /var/log/secubox chown root:adm /var/log/secubox - chmod 750 /var/log/secubox + chmod 0755 /var/log/secubox # Create config directory mkdir -p /etc/secubox diff --git a/packages/secubox-soc-gateway/debian/postinst b/packages/secubox-soc-gateway/debian/postinst index f319cc6f..cd580f9d 100755 --- a/packages/secubox-soc-gateway/debian/postinst +++ b/packages/secubox-soc-gateway/debian/postinst @@ -17,7 +17,7 @@ case "$1" in # Ensure log directory exists with correct permissions mkdir -p /var/log/secubox chown root:adm /var/log/secubox - chmod 750 /var/log/secubox + chmod 0755 /var/log/secubox # Create config directory mkdir -p /etc/secubox diff --git a/packages/secubox-ui-manager/debian/postinst b/packages/secubox-ui-manager/debian/postinst index aff8ee7a..4e106761 100755 --- a/packages/secubox-ui-manager/debian/postinst +++ b/packages/secubox-ui-manager/debian/postinst @@ -15,7 +15,7 @@ case "$1" in # Create log directory mkdir -p /var/log/secubox - chmod 750 /var/log/secubox + chmod 0755 /var/log/secubox # Create config directory mkdir -p /etc/secubox/ui