Skip to content

Executable files are not executable (+x) after upgrade #2619

Closed
#2620
Closed
Executable files are not executable (+x) after upgrade#2619
#2620
Labels
bug

Description

@pjrobertson
pjrobertson
opened on Mar 31, 2024

Steps To Reproduce

Every time I upgrade using sudo bash /var/scripts/menu.sh my executable files (mainly: notify_push and translate/bin/node are not executable which causes errors. If I manually chmod +x these files then it works OK.

  1. Ugrade a major or minor version using sudo bash /var/scripts/menu.sh and going to minor/major upgrade
  2. Make sure during this upgrade that either the translations or notify_push apps are updated
  3. For translations node: go to the admin settings and see an error stating that there was an error initiating the app, due to node not being executable. For notify_push: run the command in debug mode and see:
sudo -u www-data php /var/www/nextcloud/occ notify_push:log debug
sudo journalctl -eu notify_push
...
Mar 30 08:09:41 XX systemd[47543]: notify_push.service: Failed at step EXEC spawning /var/www/nextcloud/apps/notify_push/bin/x86_64/notify_push: Permissio>

This might be an issue with running the upgrade script with sudo, but the script complains if you don't do this.

Expected Result

The apps installed during an update should be executable and continue to run

Actual Result

Files are not executable

Screenshots, Videos, or Pastebins

No response

Additional Context

No response

Build Version

28.0.4

Environment

By downloading the VM

Environment Details

No response

Activity

  1. pjrobertson
    added
    bug
    on Mar 31, 2024

  2. enoch85 commented on Apr 1, 2024

    @enoch85
    enoch85
    on Apr 1, 2024
    Member

    Thanks for posting your issue!

    Exactly where are these files located?

    I'm thinking, maybe we should add some more files to setup_secure_nextcloud_permissions...?

  3. pjrobertson commented on Apr 1, 2024

    @pjrobertson
    pjrobertson
    on Apr 1, 2024
    ContributorAuthor

    These are the two apps I have come across so far that have this issue:

    • Translate app: /var/www/nextcloud/apps/translate/bin/node
    • notify push app: /var/www/nextcloud/apps/notify_push/bin/x86_64/notify_push
      • and also these for other archs:
      • /var/www/nextcloud/apps/notify_push/bin/armv7/notify_push
      • /var/www/nextcloud/apps/notify_push/bin/aarch64/notify_push

  4. enoch85 commented on Apr 1, 2024

    @enoch85
    enoch85
    on Apr 1, 2024
    Member

    Aah, I see what you mean.

    For notify push we can implement this:

    if nextcloud_occ app:list | grep -q notify_push
then
    chmod +x /var/www/nextcloud/apps/notify_push/bin/x86_64/notify_push
    systemctl restart notify_push.service
fi

    But I'm not sure about the translate app, can you do a nextcloud_occ app:list | grep translate?

  5. enoch85
    added a commit that references this issue on Apr 1, 2024

    part fix #2619

    3aa6c97

  6. pjrobertson commented on Apr 1, 2024

    @pjrobertson
    pjrobertson
    on Apr 1, 2024
    ContributorAuthor

    It's the translate app: https://apps.nextcloud.com/apps/translate

    ncadmin@box:/var/www/nextcloud$ sudo -u www-data php occ app:list | grep translate
  - translate: 2.1.0

  7. enoch85 commented on Apr 2, 2024

    @enoch85
    enoch85
    on Apr 2, 2024
    Member

    Just wrote a fix for all files from the top of my head, need to test before merge.

  8. enoch85 commented on Apr 2, 2024

    @enoch85
    enoch85
    on Apr 2, 2024
    Member

    Please test this file: https://raw.githubusercontent.com/nextcloud/vm/2619/nextcloud_update.sh

    It should work with all executable, no matter the name. :)

  9. pjrobertson commented on Apr 3, 2024

    @pjrobertson
    pjrobertson
    on Apr 3, 2024
    ContributorAuthor

    Great stuff, thanks for the quick fix! I haven't tested the code out, but I've had a quick look through it.

    My first concern was: finding all executable files and making them execuable could be a security issue (for example, if someone's managed to get bad files into your nextcloud install). But then I saw you are not making any new files executable, only the ones that were executable before the upgrade - so that looks good.

    There is maybe a very small risk of a certain file no longer existing after an upgrade which could lead to a security issue / attack route in, but I think this is very small.

    Example:

    1. My app called "great app" has an executable in "great_app/bin/executable"
    2. Before the upgrade, this path gets added to $find_executables
    3. After the upgrade, my app also gets upgraded and in the new 2.0 version of the app, my executable is as "great_app/bin/executable2.0"
    4. The script will now try to make "great_app/bin/executable" executable - if somebody (somehow) managed to get an evil file into that location - then we would make their file executable.

    I don't think this is really an issue, and I guess this is what code signing is supposed to solve - not something we can really deal with!

  10. enoch85 commented on Apr 3, 2024

    @enoch85
    enoch85
    on Apr 3, 2024
    Member

    After the upgrade, my app also gets upgraded and in the new 2.0 version of the app, my executable is as "great_app/bin/executable2.0"

    That's not likely, I don't see any reason to change name of the executable, and if that occurs we will handle that then.

    I haven't tested this widely, so please run the new script to see if it does what 's expected.

  11. pjrobertson commented on Apr 3, 2024

    @pjrobertson
    pjrobertson
    on Apr 3, 2024
    ContributorAuthor

    That sounds reasonable, yeah. I am probably being overly cautious.

    For the script - can I just run it straight off or do I need to wait for an actual upgrade/release?

    I found another executable that popped up in my logs just now:

    /var/www/nextcloud/apps/recognize/bin/node

  12. enoch85 commented on Apr 3, 2024

    @enoch85
    enoch85
    on Apr 3, 2024
    Member

    For the script - can I just run it straight off or do I need to wait for an actual upgrade/release?

    Yes, just run it, it will be like a standard run with the fix implemented. 👍 It won't actually execute any chmod +x since that only happens after an actual Nextcloud upgrade.

    Though, if you run it with bash -x you will be able to see if the variable finds the executables. :)

  13. enoch85 commented on Apr 5, 2024

    @enoch85
    enoch85
    on Apr 5, 2024
    Member

    Were you able to test? :)

  14. pjrobertson commented on Apr 6, 2024

    @pjrobertson
    pjrobertson
    on Apr 6, 2024
    ContributorAuthor

    No not yet, I've had a busy few days! Will try to look at it in the next 2-3 days and reply here :D

  15. enoch85
    closed this as completedin #2620on Apr 15, 2024
  16. enoch85
    added a commit that references this issue on Apr 15, 2024

    fix #2619 (#2620)

    28b4b20

  17. Reis-A commented on Apr 26, 2024

    @Reis-A
    Reis-A
    on Apr 26, 2024

    Thank you for this! I had no problems with upgrade to 28.0.5
    This finally closes #2578 which was the same issue., pretty much.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bug

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions