mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 09:14:33 +00:00
Shared-directory ownership race: secubox-toolbox + secubox-mesh created /var/log/secubox at 0750 with their own module owner, secubox-admin at 750 root:secubox, while ~10 other packages use the correct 0755 secubox:secubox. Whichever postinst ran last won — and when toolbox or mesh won, the aggregator (user secubox) lost traversal and the /waf/ + /soc/ dashboards went blank (regressed on gk2 2026-06-10). - secubox-toolbox/debian/postinst:47 0750 -> 0755 (+ guard comment) - secubox-mesh/debian/postinst:23 0750 -> 0755 - secubox-admin/debian/postinst:11 750 -> 0755 Mode 0755 makes the shared parent world-traversable regardless of which package's owner wins. Per-module log files + subdirs inside keep their own restricted perms. Same class as the /etc/secubox traversal constraint + the /usr/share/secubox/www chmod (#507). |
||
|---|---|---|
| .. | ||
| conf | ||
| debian | ||
| menu.d | ||
| sbin | ||
| scripts | ||
| secubox_mesh | ||
| systemd | ||
| udev | ||
| www/mesh | ||
| CLAUDE.md | ||
| pyproject.toml | ||