secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-30 00:19:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(assist): postinst grants ctl traversal to the node signing key (0.2.1)

Browse Source 
The assist ctl runs as `secubox` (invoked by the API) and must read
/etc/secubox/secrets/annuaire/node.key to sign journal ops, but the shared
/etc/secubox/secrets parent is root:secubox-toolbox 0750 which secubox can't
traverse — so every mutating assist op (offer/request/session) failed with a
Permission denied the panel swallowed. postinst adds o+x (traversal-only) to
the parent; subdirs keep their 0700. Fixes the socle mutating path too.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
This commit is contained in:
CyberMind-FR 2026-07-26 07:01:29 +02:00
parent 6692a8c3cd
commit fd8a68fc4c
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
packages/secubox-assist/debian/changelog
View File

@ -1,3 +1,16 @@
secubox-assist (0.2.1-1~bookworm1) bookworm; urgency=medium
* Marketplace UX: action-oriented labels (Proposer/Demander/Partager) with
emoji + inline hints so the offer/open-request/join-link verbs are
discoverable; success/error feedback banner on every marketplace POST
(was silent — a backend error or missing JWT showed nothing).
* postinst: chmod o+x /etc/secubox/secrets (traversal-only) so the ctl,
running as `secubox` via the API, can reach the node signing key to sign
journal ops (offer/request/session) — the shared parent's root:secubox-toolbox
0750 blocked it. Never chowns/tightens the parent; subdirs keep 0700.
-- Gerald KERMA <devel@cybermind.fr> Sat, 26 Jul 2026 06:00:00 +0200
secubox-assist (0.2.0-1~bookworm1) bookworm; urgency=medium
* feat: decentralized help-request marketplace — assist/rendezvous.py

9
packages/secubox-assist/debian/postinst
View File

@ -26,6 +26,15 @@ fi
touch /var/log/secubox/audit.log 2>/dev/null || true
chgrp secubox-assist /var/log/secubox/audit.log 2>/dev/null || true
chmod 0664 /var/log/secubox/audit.log 2>/dev/null || true
# The assist ctl runs as `secubox` (invoked by the API) and must reach the box
# signing key at /etc/secubox/secrets/annuaire/node.key to sign journal ops
# (offer/request/session). The shared /etc/secubox/secrets parent may be
# root:secubox-toolbox 0750, which `secubox` cannot traverse. Add o+x
# (traversal-ONLY, no read/list — the secret subdirs keep their own 0700) so
# secubox can pass through to its own annuaire/ subdir. NEVER chown/tighten it.
if [ -d /etc/secubox/secrets ]; then
chmod o+x /etc/secubox/secrets 2>/dev/null || true
fi
# Ephemeral WG range (10.11.0.0/24, iface wg-ephemeral) for the escalate
# flow's session-scoped peers (see assist/escalate.py — EscalateError is
# fail-closed until a peer can actually be added). secubox-p2p does not yet