78e7651ea0
The CLI wrapper already runs as the manager (libreportal) but then did
'sudo ./start.sh', so the whole runtime executed as root — the reason
NOPASSWD:ALL was load-bearing. Drop that sudo so start.sh runs as the
manager; also drop the now-redundant sudo from the wrapper's own
manager-owned ops (config sed, /docker/configs + /docker/install
mkdir/cp/chown/rm, 'sudo -u libreportal' git clone, chmod). Only the
'cp -f init.sh /root/' copies stay root.
Running as the manager surfaced data-plane writes that only worked under
root; fixed to be owner-correct:
- webui_system_metrics: .metrics_{cpu,net}_prev state via runFileWrite
- atomicWriteWebUI: path-aware temp+chmod+mv (atomic same-dir rename as
the path owner) instead of bare >/mv
- webui_app_config last_update trigger via runFileWrite
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>
38 lines
1.2 KiB
Bash
Executable File
38 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# LibrePortal WebUI Atomic Write Utilities
|
|
# Provides atomic file writing functionality for web UI safety
|
|
|
|
# Atomic file write function for web UI safety
|
|
atomicWriteWebUI() {
|
|
local content="$1"
|
|
local target_file="$2"
|
|
local temp_file="${target_file}.tmp.$$"
|
|
|
|
# Every step runs as the path's owner so the manager-run runtime (Model A)
|
|
# can write the dockerinstall-owned WebUI/app files. Temp + rename share the
|
|
# target's directory, so the mv stays atomic (same filesystem, same owner).
|
|
local op="runInstallOp" wop="runInstallWrite"
|
|
if [[ "$target_file" == "$containers_dir"* || "$target_file" == /docker/containers/* ]]; then
|
|
op="runFileOp"; wop="runFileWrite"
|
|
fi
|
|
|
|
# Ensure directory exists
|
|
$op mkdir -p "$(dirname "$target_file")"
|
|
|
|
# Write to temp file first
|
|
printf '%s' "$content" | $wop "$temp_file"
|
|
|
|
# Set proper permissions
|
|
$op chmod 644 "$temp_file"
|
|
|
|
# Atomic rename (instantaneous - no partial reads)
|
|
$op mv "$temp_file" "$target_file"
|
|
|
|
if [ $? -eq 0 ]; then
|
|
echo "✓ Atomic write successful: $target_file"
|
|
else
|
|
echo "✗ Atomic write failed: $target_file"
|
|
fi
|
|
}
|