Webstar/LibrePortal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(desudo): run start.sh AS the manager (Model A flip) + fix exposed writes

Browse Source 
The CLI wrapper already runs as the manager (libreportal) but then did
'sudo ./start.sh', so the whole runtime executed as root — the reason
NOPASSWD:ALL was load-bearing. Drop that sudo so start.sh runs as the
manager; also drop the now-redundant sudo from the wrapper's own
manager-owned ops (config sed, /docker/configs + /docker/install
mkdir/cp/chown/rm, 'sudo -u libreportal' git clone, chmod). Only the
'cp -f init.sh /root/' copies stay root.

Running as the manager surfaced data-plane writes that only worked under
root; fixed to be owner-correct:
- webui_system_metrics: .metrics_{cpu,net}_prev state via runFileWrite
- atomicWriteWebUI: path-aware temp+chmod+mv (atomic same-dir rename as
  the path owner) instead of bare >/mv
- webui_app_config last_update trigger via runFileWrite

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>
This commit is contained in:
librelad 2026-05-24 18:09:20 +01:00
parent 99e3bde574
commit 78e7651ea0
4 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
init.sh
View File

@ -909,9 +909,9 @@ commandUpdateConfigOption() {
# Replace the value, preserving comment if it existed # Replace the value, preserving comment if it existed
if [[ -n "$comment_part" ]]; then if [[ -n "$comment_part" ]]; then
sudo sed -i "s|^$config_option=.*|$config_option=$escaped_value $comment_part|" "$config_file" sed -i "s|^$config_option=.*|$config_option=$escaped_value $comment_part|" "$config_file"
else else
sudo sed -i "s|^$config_option=.*|$config_option=$escaped_value|" "$config_file" sed -i "s|^$config_option=.*|$config_option=$escaped_value|" "$config_file"
fi fi
source "$config_file" source "$config_file"
return 0 return 0
@ -1051,13 +1051,13 @@ sync_configs_from_install() {
echo "ERROR: $src missing — clone broken." echo "ERROR: $src missing — clone broken."
return 1 return 1
fi fi
sudo mkdir -p "$dst" mkdir -p "$dst"
# No-clobber: preserve the user's live config values; only add new files. # No-clobber: preserve the user's live config values; only add new files.
if ! sudo cp -an "$src"/. "$dst"/; then if ! cp -an "$src"/. "$dst"/; then
echo "ERROR: Failed to sync configs from $src to $dst." echo "ERROR: Failed to sync configs from $src to $dst."
return 1 return 1
fi fi
sudo chown -R libreportal:libreportal "$dst" chown -R libreportal:libreportal "$dst"
if [ ! -f "$dst/general/general_install" ]; then if [ ! -f "$dst/general/general_install" ]; then
echo "ERROR: $dst/general/general_install missing after sync." echo "ERROR: $dst/general/general_install missing after sync."
return 1 return 1
@ -1070,11 +1070,11 @@ sync_configs_from_install() {
} }
clone_repo() { clone_repo() {
sudo rm -rf /docker/install rm -rf /docker/install
local clone_url local clone_url
if [ "$CFG_GIT_USER" != "empty" ]; then if [ "$CFG_GIT_USER" != "empty" ]; then
for clone_url in "$AUTH_HTTPS_REPO_URL" "$AUTH_HTTP_REPO_URL"; do for clone_url in "$AUTH_HTTPS_REPO_URL" "$AUTH_HTTP_REPO_URL"; do
if sudo -u libreportal git clone -q "$clone_url" "/docker/install" 2>/dev/null; then if git clone -q "$clone_url" "/docker/install" 2>/dev/null; then
sudo cp -f /docker/install/init.sh /root/ sudo cp -f /docker/install/init.sh /root/
sync_configs_from_install || return 1 sync_configs_from_install || return 1
echo "SUCCESS: Clone complete. Run 'libreportal run' to continue." echo "SUCCESS: Clone complete. Run 'libreportal run' to continue."
@ -1085,7 +1085,7 @@ clone_repo() {
return 1 return 1
fi fi
for clone_url in "https://${CLEAN_GIT_URL}.git" "http://${CLEAN_GIT_URL}.git"; do for clone_url in "https://${CLEAN_GIT_URL}.git" "http://${CLEAN_GIT_URL}.git"; do
if sudo -u libreportal git clone -q "$clone_url" "/docker/install" 2>/dev/null; then if git clone -q "$clone_url" "/docker/install" 2>/dev/null; then
sudo cp -f /docker/install/init.sh /root/ sudo cp -f /docker/install/init.sh /root/
sync_configs_from_install || return 1 sync_configs_from_install || return 1
echo "SUCCESS: Clone complete. Run 'libreportal run' to continue." echo "SUCCESS: Clone complete. Run 'libreportal run' to continue."
@ -1111,9 +1111,9 @@ cd /docker/
if [[ $command1 == "reset" ]]; then if [[ $command1 == "reset" ]]; then
clone_and_install clone_and_install
elif [ -f "/docker/install/start.sh" ]; then elif [ -f "/docker/install/start.sh" ]; then
sudo chmod 0755 /docker/install/* chmod 0755 /docker/install/*
cd /docker/install cd /docker/install
sudo ./start.sh "$command1" "$command2" "$command3" "$command4" "$command5" "$command6" "$command7" "$command8" "$command9" ./start.sh "$command1" "$command2" "$command3" "$command4" "$command5" "$command6" "$command7" "$command8" "$command9"
else else
clone_and_install clone_and_install
fi fi

2
scripts/webui/data/generators/apps/webui_app_config.sh
View File

@ -21,7 +21,7 @@ updateAppConfig() {
# Trigger web UI refresh if needed # Trigger web UI refresh if needed
if [ -f "$containers_dir/frontend/data/last_update" ]; then if [ -f "$containers_dir/frontend/data/last_update" ]; then
date -Iseconds > "$containers_dir/frontend/data/last_update" date -Iseconds | runFileWrite "$containers_dir/frontend/data/last_update"
fi fi
else else
echo "❌ Failed to update config for $app_name" echo "❌ Failed to update config for $app_name"

4
scripts/webui/data/generators/system/webui_system_metrics.sh
View File

@ -51,7 +51,7 @@ webuiSystemMetrics() {
'BEGIN { dt = t - pt; di = i - pi; if (dt <= 0) { print "0.0" } else { printf "%.1f", (1 - di/dt) * 100 } }') 'BEGIN { dt = t - pt; di = i - pi; if (dt <= 0) { print "0.0" } else { printf "%.1f", (1 - di/dt) * 100 } }')
fi fi
fi fi
[[ -n "$cur_total" ]] && echo "$cur_total $cur_idle" > "$cpu_state" 2>/dev/null [[ -n "$cur_total" ]] && echo "$cur_total $cur_idle" | runFileWrite "$cpu_state" 2>/dev/null
# Load average (1/5/15) and 1-min load as a % of total cores. # Load average (1/5/15) and 1-min load as a % of total cores.
local load1 load5 load15 local load1 load5 load15
@ -109,7 +109,7 @@ webuiSystemMetrics() {
net_tx_rate=$(awk -v c="$cur_tx" -v p="${prev_tx:-0}" -v d="$dt" 'BEGIN{v=(c-p)/d; if(v<0)v=0; printf "%.0f", v}') net_tx_rate=$(awk -v c="$cur_tx" -v p="${prev_tx:-0}" -v d="$dt" 'BEGIN{v=(c-p)/d; if(v<0)v=0; printf "%.0f", v}')
fi fi
fi fi
echo "$now_epoch $cur_rx $cur_tx" > "$net_state" 2>/dev/null echo "$now_epoch $cur_rx $cur_tx" | runFileWrite "$net_state" 2>/dev/null
# --- Docker summary --------------------------------------------------- # --- Docker summary ---------------------------------------------------
local d_running=0 d_total=0 d_images=0 d_volumes=0 local d_running=0 d_total=0 d_images=0 d_volumes=0

16
scripts/webui/data/utils/webui_atomic_write.sh
View File

@ -9,17 +9,25 @@ atomicWriteWebUI() {
local target_file="$2" local target_file="$2"
local temp_file="${target_file}.tmp.$$" local temp_file="${target_file}.tmp.$$"
# Every step runs as the path's owner so the manager-run runtime (Model A)
# can write the dockerinstall-owned WebUI/app files. Temp + rename share the
# target's directory, so the mv stays atomic (same filesystem, same owner).
local op="runInstallOp" wop="runInstallWrite"
if [[ "$target_file" == "$containers_dir"* || "$target_file" == /docker/containers/* ]]; then
op="runFileOp"; wop="runFileWrite"
fi
# Ensure directory exists # Ensure directory exists
mkdir -p "$(dirname "$target_file")" $op mkdir -p "$(dirname "$target_file")"
# Write to temp file first # Write to temp file first
printf '%s' "$content" > "$temp_file" printf '%s' "$content" | $wop "$temp_file"
# Set proper permissions # Set proper permissions
chmod 644 "$temp_file" $op chmod 644 "$temp_file"
# Atomic rename (instantaneous - no partial reads) # Atomic rename (instantaneous - no partial reads)
mv "$temp_file" "$target_file" $op mv "$temp_file" "$target_file"
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
echo "✓ Atomic write successful: $target_file" echo "✓ Atomic write successful: $target_file"