ochenstarik/lightweight-server
1
0
Fork 0
Code Issues Pull requests 5 Projects Releases 1 Packages Wiki Activity Actions

Keep validated agent installers root-owned

Browse source
This commit is contained in:
ochenstarik-ui 2026-07-15 15:17:53 +07:00
parent cb2c3e5135
commit 122d7d4a35
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ochenstarik-server-ai-agents-8.sh
View file

@ -153,8 +153,10 @@ install_agent() {
|| die "The downloaded ${name} installer is empty or unsafe"
bash -n "$TEMP_INSTALLER" || die "The official ${name} installer failed Bash syntax validation"
chown "$TARGET_USER:$TARGET_GROUP" "$TEMP_INSTALLER"
chmod 500 "$TEMP_INSTALLER"
# Keep the validated file root-owned until execution so the target account
# cannot replace it between validation and launch.
chown root:root "$TEMP_INSTALLER"
chmod 555 "$TEMP_INSTALLER"
log "Installing ${name} for ${TARGET_USER}"
runuser -u "$TARGET_USER" -- env \
HOME="$TARGET_HOME" USER="$TARGET_USER" LOGNAME="$TARGET_USER" SHELL=/bin/bash PATH="$path_value" \