From 122d7d4a35313bc15d3abde61dea601314e9518c Mon Sep 17 00:00:00 2001
From: ochenstarik-ui <ochenstarik@gmail.com>
Date: Wed, 15 Jul 2026 15:17:53 +0700
Subject: [PATCH] Keep validated agent installers root-owned

---
 ochenstarik-server-ai-agents-8.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/ochenstarik-server-ai-agents-8.sh b/ochenstarik-server-ai-agents-8.sh
index 07f1d55..68cb9b4 100644
--- a/ochenstarik-server-ai-agents-8.sh
+++ b/ochenstarik-server-ai-agents-8.sh
@@ -153,8 +153,10 @@ install_agent() {
     || die "The downloaded ${name} installer is empty or unsafe"
   bash -n "$TEMP_INSTALLER" || die "The official ${name} installer failed Bash syntax validation"
 
-  chown "$TARGET_USER:$TARGET_GROUP" "$TEMP_INSTALLER"
-  chmod 500 "$TEMP_INSTALLER"
+  # Keep the validated file root-owned until execution so the target account
+  # cannot replace it between validation and launch.
+  chown root:root "$TEMP_INSTALLER"
+  chmod 555 "$TEMP_INSTALLER"
   log "Installing ${name} for ${TARGET_USER}"
   runuser -u "$TARGET_USER" -- env \
     HOME="$TARGET_HOME" USER="$TARGET_USER" LOGNAME="$TARGET_USER" SHELL=/bin/bash PATH="$path_value" \