mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 22:07:24 +00:00
CyberMind-FR
6b7d7f8607
Systemic clobber: the scaffold boilerplate (install -d -m 750 /var/lib/secubox, /run/secubox) put restrictive modes on SHARED parents in ~56 module postinsts, reverting them to 0750 on every install/upgrade and breaking traversal for non-secubox daemons (kbin/toolbox 500). Empirically confirmed install -d -m only modes the final component, so /parent/leaf forms are harmless — only bare-parent targets were rewritten. Multi-arg lines (incl. ones making /var/lib world-writable 1777) split per-parent: /run/secubox=1777 root:root, /var/lib|cache|etc=0755 secubox:secubox; module-private leaves keep 0750. Scaffold + PATTERNS.md fixed so new packages don't reintroduce it.
43 lines
1.7 KiB
Bash
Executable File
43 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
case "$1" in
|
|
configure)
|
|
id -u secubox >/dev/null 2>&1 || \
|
|
adduser --system --group --no-create-home --home /var/lib/secubox --shell /usr/sbin/nologin secubox
|
|
# Shared parents stay 0755 (traversable by every secubox-* daemon — setting
|
|
# them 0750 here broke kbin/toolbox by blocking traversal, #626). Only the
|
|
# haproxy-private leaves are restricted.
|
|
install -d -o root -g root -m 1777 /run/secubox
|
|
install -d -o secubox -g secubox -m 755 /var/lib/secubox
|
|
install -d -o secubox -g secubox -m 750 /var/lib/secubox/haproxy /var/lib/secubox/haproxy/config_backups
|
|
chmod 0755 /var/lib/secubox /run/secubox 2>/dev/null || true
|
|
# Create /etc/haproxy if not present (haproxy is Recommends, not Depends)
|
|
# Required for systemd namespace setup
|
|
install -d -m 755 /etc/haproxy
|
|
systemctl daemon-reload
|
|
systemctl enable secubox-haproxy.service
|
|
systemctl start secubox-haproxy.service || true
|
|
;;
|
|
triggered)
|
|
for trig in $2; do
|
|
case "$trig" in
|
|
secubox-defaults-changed)
|
|
echo "secubox-haproxy: refreshing for $trig"
|
|
# Best-effort refresh + render
|
|
curl -fsS -X POST --unix-socket /run/secubox/haproxy.sock \
|
|
http://localhost/webui/refresh 2>/dev/null || true
|
|
if [ -x /usr/local/bin/secubox-render-nginx-webui ]; then
|
|
/usr/local/bin/secubox-render-nginx-webui || \
|
|
echo "secubox-haproxy: render failed (non-fatal)" >&2
|
|
fi
|
|
if [ -x /usr/local/bin/secubox-haproxy-regen-safe ]; then
|
|
/usr/local/bin/secubox-haproxy-regen-safe || \
|
|
echo "secubox-haproxy: regen-safe failed (non-fatal)" >&2
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
;;
|
|
esac
|
|
#DEBHELPER#
|