From 8d2fb7862b7c6d4dd5761e75e5aeef822df8b146 Mon Sep 17 00:00:00 2001 From: Alex Russell Date: Thu, 30 Jul 2026 02:41:19 +0200 Subject: [PATCH] fix(packaging): let the service user read its own config `systemctl start labelfab-agent` fails on any fresh install: PermissionError: [Errno 13] Permission denied: '/etc/labelfab/agent.toml' postinst did `chmod 750 /etc/labelfab` but never chowned it, so the directory stayed root:root. The unit runs as User=labelfab, which therefore could not even traverse it. The package has been unusable out of the box since the unit gained User=labelfab; the only reason it was not obvious is that postinst deliberately enables without starting, so the failure waits until an operator finishes setup and looks like their misconfiguration rather than ours. Now root-owned and group-readable: the agent can read its config, only root can write it. The config file itself was also shipping 0664 -- world-readable, which it has no reason to be even with the password held outside it -- so it is 0640 now. Demonstrated in a clean bookworm container, installing each .deb and su'ing to the service user: 0.2.0 /etc/labelfab root:root read: NO -> PermissionError 0.2.1 /etc/labelfab root:labelfab read: YES -> config loads The chown of agent.toml is guarded by a -f test because postinst also runs on upgrade, where a purged-config box would otherwise fail the script under `set -e`. --- deploy/postinst.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/deploy/postinst.sh b/deploy/postinst.sh index 6c392b9..86f3a0d 100755 --- a/deploy/postinst.sh +++ b/deploy/postinst.sh @@ -15,7 +15,18 @@ if getent group bluetooth >/dev/null 2>&1; then fi chown labelfab:labelfab /var/lib/labelfab + +# The service runs as User=labelfab, so it has to be able to read its own config. +# chmod 750 alone left this root:root, which means the service user could not even +# traverse the directory -- `systemctl start` died with PermissionError on +# /etc/labelfab/agent.toml on any fresh install. Root-owned and group-readable: the +# agent can read, only root can write. +chown root:labelfab /etc/labelfab chmod 750 /etc/labelfab +if [ -f /etc/labelfab/agent.toml ]; then + chown root:labelfab /etc/labelfab/agent.toml + chmod 640 /etc/labelfab/agent.toml +fi if [ -d /run/systemd/system ]; then systemctl daemon-reload || true