LibrePortal

Webstar/LibrePortal

Fork 0

Commit Graph

Author	SHA1	Message	Date
librelad	cb055b4b1f	fix(uninstall): wipe container sub-UID app data via root helper dockerDeleteData (uninstall) and the wipe-before-restore step in restoreAppStart both did `runFileOp rm -rf $containers_dir$app_name`, which runs as $CFG_DOCKER_INSTALL_USER (dockerinstall, uid 1002 on rootless). That user owns app-template files but CANNOT remove container sub-UID dirs created by the daemon's userns mapping — postgres data at uid 232070, nextcloud html at uid 33, etc. The rm therefore silently failed with rm: cannot remove '/libreportal-containers/invidious/postgresdata': Permission denied while still reporting "<app> successfully uninstalled" — leaving the sub-UID directory tree on disk to confuse the next install and leak storage. Fix: route the wipe through a new `app-data-remove` action in the root-owned libreportal-ownership helper. Root can rm sub-UID files unconditionally. The helper validates the app name (alphanumeric + . _ -, no traversal), refuses the WebUI's own slot (libreportal), and is idempotent when the dir is already gone. Two callers updated: - scripts/docker/app/uninstall/delete_data.sh - scripts/restore/restore_app_start.sh The helper itself ships root-owned at /usr/local/lib/libreportal/, so a fresh install or release upgrade is needed to pick up the new action. Bumped init.sh footprint_version 2 → 3 so the runtime updater prompts a root re-install on the next release. Signed-off-by: librelad <librelad@digitalangels.vip>	2026-05-27 15:32:44 +01:00
librelad	8b14f26125	refactor(desudo): route scattered runtime sudo through privilege helpers Convert the remaining ad-hoc 'sudo' calls across the data plane to the run_privileged helpers so every file op lands as the correct owner with no blanket root: - DB/configs (manager-owned): db_list_all_apps, delete_db_file, install_sqlite, cli_webui_commands -> runInstallOp - containers (dockerinstall-owned): scan_container_socket, delete_data, webui_task_files, webui_app_log, webui_config_patch, application_missing_variables, uninstall_app -> runFileOp/runFileWrite - genuine root: passwd, tailscale, ufw-docker, sysctl grep, systemd unit read, authorized_keys read, nobody chown -> runSystem - interactive editors and 'id -u': drop sudo entirely (run as caller) - owncloud/adguard container-UID config edits -> runSystem (funnel; docker-exec rework deferred) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>	2026-05-24 18:00:19 +01:00
librelad	875a60f90f	LibrePortal v0.1.0 — initial release A free, open, self-hosted app platform (GNU AGPLv3): one-click app deploys, Traefik reverse proxy with automatic SSL, rootless Docker support, gluetun VPN routing, and a web dashboard to manage it all. Free & open forever to self-host; optional paid hosted services fund it. See PROMISE.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>	2026-05-21 20:37:54 +01:00

Author

SHA1

Message

Date

librelad

cb055b4b1f

fix(uninstall): wipe container sub-UID app data via root helper

dockerDeleteData (uninstall) and the wipe-before-restore step in
restoreAppStart both did `runFileOp rm -rf $containers_dir$app_name`,
which runs as $CFG_DOCKER_INSTALL_USER (dockerinstall, uid 1002 on
rootless). That user owns app-template files but CANNOT remove
container sub-UID dirs created by the daemon's userns mapping —
postgres data at uid 232070, nextcloud html at uid 33, etc. The rm
therefore silently failed with

  rm: cannot remove '/libreportal-containers/invidious/postgresdata':
    Permission denied

while still reporting "<app> successfully uninstalled" — leaving the
sub-UID directory tree on disk to confuse the next install and leak
storage.

Fix: route the wipe through a new `app-data-remove` action in the
root-owned libreportal-ownership helper. Root can rm sub-UID files
unconditionally. The helper validates the app name (alphanumeric +
. _ -, no traversal), refuses the WebUI's own slot (libreportal), and
is idempotent when the dir is already gone.

Two callers updated:
- scripts/docker/app/uninstall/delete_data.sh
- scripts/restore/restore_app_start.sh

The helper itself ships root-owned at /usr/local/lib/libreportal/, so a
fresh install or release upgrade is needed to pick up the new action.
Bumped init.sh footprint_version 2 → 3 so the runtime updater
prompts a root re-install on the next release.

Signed-off-by: librelad <librelad@digitalangels.vip>

2026-05-27 15:32:44 +01:00

librelad

8b14f26125

refactor(desudo): route scattered runtime sudo through privilege helpers

Convert the remaining ad-hoc 'sudo' calls across the data plane to the
run_privileged helpers so every file op lands as the correct owner with
no blanket root:

- DB/configs (manager-owned): db_list_all_apps, delete_db_file,
  install_sqlite, cli_webui_commands -> runInstallOp
- containers (dockerinstall-owned): scan_container_socket, delete_data,
  webui_task_files, webui_app_log, webui_config_patch,
  application_missing_variables, uninstall_app -> runFileOp/runFileWrite
- genuine root: passwd, tailscale, ufw-docker, sysctl grep, systemd
  unit read, authorized_keys read, nobody chown -> runSystem
- interactive editors and 'id -u': drop sudo entirely (run as caller)
- owncloud/adguard container-UID config edits -> runSystem (funnel;
  docker-exec rework deferred)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

2026-05-24 18:00:19 +01:00

librelad

875a60f90f

LibrePortal v0.1.0 — initial release

A free, open, self-hosted app platform (GNU AGPLv3): one-click app deploys,
Traefik reverse proxy with automatic SSL, rootless Docker support, gluetun
VPN routing, and a web dashboard to manage it all.

Free & open forever to self-host; optional paid hosted services fund it.
See PROMISE.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Signed-off-by: librelad <librelad@digitalangels.vip>

2026-05-21 20:37:54 +01:00

3 Commits