46622cd2f9
Under Model A the runtime runs as the manager, so establishing the /docker ownership model needs root. Granting the manager a blanket 'sudo chown'/'sudo chmod' in the scoped sudoers would be root-equivalent (chown /etc/sudoers, ...). Introduce a self-contained, root-owned helper that performs only a FIXED set of reconciles on FIXED LibrePortal paths, with owners derived from config + a baked manager name (never the caller) and a strictly-validated app-name argument. - scripts/system/libreportal-ownership: the helper (actions: reconcile, traversal, containers-top, app-perms, webui, taskdir, app-data-nobody) - run_privileged: runOwnership wrapper (sudo the installed helper; run the bundled copy directly when already root mid-install) - init.sh: installOwnershipHelper bakes the manager name and installs it root:root 0755 to /usr/local/sbin (manager can't modify it) - libreportal_folders/app_folder/app_update_specifics/task processor: delegate the ownership chowns to runOwnership instead of runSystem chown This removes chown/chmod-on-/docker from the runtime sudo surface, a prerequisite for a non-root-equivalent scoped sudoers. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>
94 lines
4.3 KiB
Bash
Executable File
94 lines
4.3 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# The user that owns container data for the current Docker mode:
|
|
# rooted -> the manager ($sudo_user_name)
|
|
# rootless -> the docker install user
|
|
# For rootless read it AUTHORITATIVELY from config — the $docker_install_user
|
|
# global is set to the manager in rooted mode, so it goes stale across a switch.
|
|
# Single source of truth for "who owns container files", used by the install
|
|
# permission pass and the switch reconcile alike.
|
|
dockerContainerOwner()
|
|
{
|
|
local mode="${1:-$CFG_DOCKER_INSTALL_TYPE}"
|
|
if [[ "$mode" == "rootless" ]]; then
|
|
local cfgdir="${configs_dir:-${docker_dir:-/docker}/configs/}"
|
|
local appusr
|
|
appusr=$(grep -h '^CFG_DOCKER_INSTALL_USER=' "$cfgdir/general/general_docker_install" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
|
|
echo "${appusr:-${CFG_DOCKER_INSTALL_USER:-dockerinstall}}"
|
|
else
|
|
echo "${sudo_user_name:-libreportal}"
|
|
fi
|
|
}
|
|
|
|
# Reconcile the LibrePortal control plane + structural container dirs for the
|
|
# current Docker mode, so the CLI and the de-sudo helpers (runFileOp/
|
|
# runInstallOp) keep working after a rooted<->rootless switch. The control plane
|
|
# is owned by the MANAGER user in BOTH modes (root:root was never the intended
|
|
# model — it only ever appeared as an artifact of un-de-sudo'd commands); the
|
|
# structural container dirs are owned by the mode's container owner (see
|
|
# dockerContainerOwner).
|
|
#
|
|
# Scope is DELIBERATELY narrow — the de-sudo-critical, LibrePortal-owned files
|
|
# only: configs/, logs/, install scripts, the apps DB, the /docker top level
|
|
# (kept o+x for traversal), plus the structural containers/ top dir and the
|
|
# regenerable WebUI dir. It does NOT touch third-party /docker/containers/<app>/
|
|
# data (per-app container UIDs, uid-mapped through subuids in rootless), nor
|
|
# backups/, nor ssl/ssh (key material) — a blanket chown there would break
|
|
# permission-strict apps and can't survive the rootless subuid offset anyway;
|
|
# moving a stateful app across modes is a backup->switch->restore operation, not
|
|
# a chown. Must run as ROOT, apps stopped. Idempotent.
|
|
reconcileDockerOwnership()
|
|
{
|
|
local mode="${1:-$CFG_DOCKER_INSTALL_TYPE}"
|
|
[[ -d "$docker_dir" ]] || return 0
|
|
# All the chown/chmod live in the root-owned helper (see runOwnership) so the
|
|
# scoped sudoers needn't grant blanket `sudo chown`. The helper reads the mode
|
|
# + owners from config itself; this just triggers it.
|
|
runOwnership reconcile "$mode"
|
|
isSuccessful "Reconciled ownership for $mode"
|
|
}
|
|
|
|
# Own the containers/ top dir (structural, NOT per-app data) as the mode's
|
|
# container owner and keep it traversable, so the docker user can create + own
|
|
# its per-app dirs under it. Shared by the install permission pass and the switch
|
|
# reconcile. Runs as root (runSystem stays root in both modes).
|
|
reconcileContainersTopOwnership()
|
|
{
|
|
runOwnership containers-top
|
|
}
|
|
|
|
# Chown LibrePortal's own (regenerable) WebUI container dir to the mode's
|
|
# container owner, so both the WebUI container and the host-side runFileOp
|
|
# generators — which run as that user — can write it. Recurses (one regenerable
|
|
# UID, no per-app uid to clobber). Must run as root. Shared by the switch
|
|
# reconcile and the fresh-install WebUI setup so a fresh install gets the same
|
|
# ownership a switch does — otherwise rootless generators hit "Permission
|
|
# denied" on a manager-owned frontend/data tree.
|
|
reconcileWebuiDirOwnership()
|
|
{
|
|
local mode="${1:-$CFG_DOCKER_INSTALL_TYPE}"
|
|
local cdir="${containers_dir:-${docker_dir:-/docker}/containers/}"
|
|
local webui_dir="${cdir}libreportal"
|
|
if [[ ! -d "$webui_dir" ]]; then
|
|
isNotice "reconcileWebuiDirOwnership: WebUI dir '$webui_dir' not found — skipped"
|
|
return 0
|
|
fi
|
|
runOwnership webui
|
|
isSuccessful "Reconciled WebUI dir ($webui_dir)"
|
|
}
|
|
|
|
# Traversal (+x) bits only. Ownership of the structural container dirs is handled
|
|
# by the shared reconcile helpers above (single source of truth), so install and
|
|
# switch converge on the same state.
|
|
fixFolderPermissions()
|
|
{
|
|
local silent_flag="$1"
|
|
|
|
# +x traversal bits on the structural dirs + the containers/ top owner — all
|
|
# in the root-owned helper (traversal already covers containers-top).
|
|
runOwnership traversal
|
|
if [ "$silent_flag" == "loud" ]; then
|
|
checkSuccess "Updating folder traversal permissions."
|
|
fi
|
|
}
|