mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
CyberMind-FR
6b7d7f8607
Systemic clobber: the scaffold boilerplate (install -d -m 750 /var/lib/secubox, /run/secubox) put restrictive modes on SHARED parents in ~56 module postinsts, reverting them to 0750 on every install/upgrade and breaking traversal for non-secubox daemons (kbin/toolbox 500). Empirically confirmed install -d -m only modes the final component, so /parent/leaf forms are harmless — only bare-parent targets were rewritten. Multi-arg lines (incl. ones making /var/lib world-writable 1777) split per-parent: /run/secubox=1777 root:root, /var/lib|cache|etc=0755 secubox:secubox; module-private leaves keep 0750. Scaffold + PATTERNS.md fixed so new packages don't reintroduce it.
18 lines
550 B
Bash
Executable File
18 lines
550 B
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
case "$1" in
|
|
configure)
|
|
id -u secubox >/dev/null 2>&1 || \
|
|
adduser --system --group --no-create-home \
|
|
--home /var/lib/secubox --shell /usr/sbin/nologin secubox
|
|
install -d -o root -g root -m 1777 /run/secubox
|
|
install -d -o secubox -g secubox -m 755 /var/lib/secubox
|
|
systemctl daemon-reload
|
|
systemctl enable secubox-portal.service
|
|
systemctl start secubox-portal.service || true
|
|
install -d -m 755 /etc/nginx/secubox.d
|
|
systemctl reload nginx 2>/dev/null || true
|
|
;;
|
|
esac
|
|
#DEBHELPER#
|