install.sh build-e738594

install.sh

@@ -188,7 +188,7 @@ need() { command -v "$1" &>/dev/null; }
 # ── Step 1: System packages ───────────────────────────────────────────────────
 step "Installing system dependencies"
 apt-get update -qq
-PACKAGES=(git curl openssl ca-certificates)
+PACKAGES=(git curl openssl ca-certificates acl)
 [[ $SKIP_HAPROXY -eq 0 ]] && PACKAGES+=(haproxy)
 apt-get install -y -qq "${PACKAGES[@]}"
 success "System packages installed"
@@ -558,8 +558,16 @@ if getent group haproxy &>/dev/null; then
   usermod -aG haproxy "$CERTEXPORT_USER" 2>/dev/null || true
 fi
 
-# grants.json lives here: SERVICE_USER writes it, certexport group can read it
-install -d -m 0750 -o "$SERVICE_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_DATA"
+# grants.json lives here: SERVICE_USER writes it, certexport group can read it.
+# setgid (2750): Dateien im Verzeichnis erben die Gruppe certexport, damit der
+# als certexport laufende SSH-Forced-Command sie lesen kann.
+install -d -m 2750 -o "$SERVICE_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_DATA"
+# certexport muss DATA_DIR nur durchqueren (x), nicht lesen — execute-only-ACL.
+if command -v setfacl >/dev/null 2>&1; then
+  setfacl -m u:${CERTEXPORT_USER}:--x "$DATA_DIR" 2>/dev/null     || echo "  ! setfacl auf $DATA_DIR fehlgeschlagen — certexport-Traverse prüfen"
+else
+  echo "  ! setfacl fehlt (Paket 'acl'?) — certexport kann $DATA_DIR evtl. nicht durchqueren"
+fi
 
 # audit log dir: certexport user writes here (runs outside systemd as certexport)
 install -d -m 0750 -o "$CERTEXPORT_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_LOG"