From 9d077110917307ee70cda09f69108a5ae96eb2a8 Mon Sep 17 00:00:00 2001 From: "nepomuk.gail" Date: Mon, 7 Sep 2026 15:44:04 +0000 Subject: [PATCH] install.sh build-e738594 --- install.sh | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/install.sh b/install.sh index 2144953..6886b9e 100644 --- a/install.sh +++ b/install.sh @@ -188,7 +188,7 @@ need() { command -v "$1" &>/dev/null; } # ── Step 1: System packages ─────────────────────────────────────────────────── step "Installing system dependencies" apt-get update -qq -PACKAGES=(git curl openssl ca-certificates) +PACKAGES=(git curl openssl ca-certificates acl) [[ $SKIP_HAPROXY -eq 0 ]] && PACKAGES+=(haproxy) apt-get install -y -qq "${PACKAGES[@]}" success "System packages installed" @@ -558,8 +558,16 @@ if getent group haproxy &>/dev/null; then usermod -aG haproxy "$CERTEXPORT_USER" 2>/dev/null || true fi -# grants.json lives here: SERVICE_USER writes it, certexport group can read it -install -d -m 0750 -o "$SERVICE_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_DATA" +# grants.json lives here: SERVICE_USER writes it, certexport group can read it. +# setgid (2750): Dateien im Verzeichnis erben die Gruppe certexport, damit der +# als certexport laufende SSH-Forced-Command sie lesen kann. +install -d -m 2750 -o "$SERVICE_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_DATA" +# certexport muss DATA_DIR nur durchqueren (x), nicht lesen — execute-only-ACL. +if command -v setfacl >/dev/null 2>&1; then + setfacl -m u:${CERTEXPORT_USER}:--x "$DATA_DIR" 2>/dev/null || echo " ! setfacl auf $DATA_DIR fehlgeschlagen — certexport-Traverse prüfen" +else + echo " ! setfacl fehlt (Paket 'acl'?) — certexport kann $DATA_DIR evtl. nicht durchqueren" +fi # audit log dir: certexport user writes here (runs outside systemd as certexport) install -d -m 0750 -o "$CERTEXPORT_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_LOG"