officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revert: use chmod 770 instead of 775 for user directories

Browse Source 
770 (rwxrwx---) is more secure - only owner and group can access, excluding 'others'.

The service user can still access because it's added to the user's group via:
  usermod -aG shellUsername serviceUser

The real fix was wrapping chmodSync in try/catch in email-db.ts so it doesn't
crash when trying to chmod files owned by other users.
This commit is contained in:
pastilhas
2026-03-04 02:59:56 +00:00
parent e43f738a52
commit 3249378984
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/provision-existing-users.sh
+2 -2
View File
@@ -161,9 +161,9 @@ while IFS='|' read -r email username; do
sudo mkdir -p "$HOME_DIR/.pi/agent/sessions" sudo mkdir -p "$HOME_DIR/.pi/agent/sessions"
# Set ownership and permissions last # Set ownership and permissions last
# chmod 775 so the service user (in the user's group) can read/write for background jobs # chmod 770 so only owner and group can access (service user is added to group above)
sudo chown -R "$shell_user:$shell_user" "$USER_ROOT" sudo chown -R "$shell_user:$shell_user" "$USER_ROOT"
sudo chmod -R 775 "$USER_ROOT" sudo chmod -R 770 "$USER_ROOT"
# Add service user to this user's group so server jobs can access user data # Add service user to this user's group so server jobs can access user data
SERVICE_USER="${SUDO_USER:-$(whoami)}" SERVICE_USER="${SUDO_USER:-$(whoami)}"
src/servers/api/users/provision.ts
+3 -4
View File
@@ -48,10 +48,9 @@ export async function provisionLinuxUser(email: string, username: string): Promi
} }
// Set ownership and permissions on user data directory // Set ownership and permissions on user data directory
// chmod 775 so the service user (in the user's group) can read/write for background jobs // chmod 770 so only owner and group can access (service user is added to group below)
// The service user is added to the group below, so group permissions (rwx) are needed
run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]); run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]);
run(['sudo', 'chmod', '-R', '775', userRoot]); // Recursive chmod to fix all subdirectories run(['sudo', 'chmod', '-R', '770', userRoot]); // Recursive chmod to fix all subdirectories
// Add the service user to the new user's group so server jobs can access user data // Add the service user to the new user's group so server jobs can access user data
const serviceUser = process.env.USER ?? ''; const serviceUser = process.env.USER ?? '';
@@ -77,7 +76,7 @@ export async function provisionLinuxUser(email: string, username: string): Promi
// Fix ownership and permissions after seeding // Fix ownership and permissions after seeding
run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]); run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]);
run(['sudo', 'chmod', '-R', '775', userRoot]); run(['sudo', 'chmod', '-R', '770', userRoot]);
console.log(`[provision] provisioning complete for ${shellUsername}`); console.log(`[provision] provisioning complete for ${shellUsername}`);
return true; return true;