From 6415e81ee75a6783b889b67b985f61825f9a074e Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 10 Nov 2026 23:43:55 -0600 Subject: [PATCH] docs(run-sheet): check config directory ancestors before accounts init (#1873) mosaic accounts init refuses accounts-unsafe since #1919 when a folder above the config directory is writable by another user. Step 3 now gives the read-only check. --- docs/guides/host-run-sheet.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/guides/host-run-sheet.md b/docs/guides/host-run-sheet.md index ca45d1487..84b48d207 100644 --- a/docs/guides/host-run-sheet.md +++ b/docs/guides/host-run-sheet.md @@ -442,7 +442,13 @@ stack picks or invents a subject: the subjects come from `console.sso`, which a `docs/plans/2026-11-10_accounts-design.md`. Jason places the client secrets (section 9). 3. Run `mosaic accounts init --name ` as `mosaic`. This is a human verb, run from a human shell and never by an agent. It creates the one operator account from the configured `console.sso` subjects and - refuses if `accounts.json` exists. + refuses if `accounts.json` exists. It also refuses `accounts-unsafe` when any folder above the config + directory is not root's or `mosaic`'s, or is group or other writable without the sticky bit (#1919). + Check first, read-only: every line printed by + `p=/srv/mosaic/.config/mosaic-dev; while [ "$p" != / ]; do stat -c '%U %a %n' "$p"; p=$(dirname "$p"); done; stat -c '%U %a %n' /` + names `root` or `mosaic`, and its mode has no group or other write bit unless it starts with 1 (sticky). + The config directory itself is `mosaic`'s with no group or other write bit. A group-writable `.config` + refuses on purpose; fix the mode, never the check. 4. Provision the dedicated uid. `mosaic` must keep section 1's shape: a non-login shell, the only member of its primary group, and owner of its config directory and data root. An accounts instance never runs under a human or development seat uid, and never under the `webui-service.sh` user units. -- 2.54.0