From 8f23b95ca8edefb6961fcf06a864f8bf0f6198c1 Mon Sep 17 00:00:00 2001 From: MDA2AV Date: Sat, 22 Aug 2026 18:23:35 +0100 Subject: [PATCH] validate: the staleness probe must not make the file unreadable The static staleness probe built its replacement with mktemp, which creates the file 0600. mv carries the source mode onto the destination, so after the replace the static file was mode 0600 owned by the invoking user. Any container running as a non-root user then got EACCES reading it, the probe saw bytes that never matched, and the entry was failed for "serving a copy taken at image build" -- the exact opposite of what it was doing. phoenix-bandit runs as nobody and failed on that alone; it passes 70/0 with the mode carried over. Entries that happened to pass were all running as root, so the bug penalised precisely the images following good practice. Carry the mode of the file being replaced onto the replacement. --- scripts/validate.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/scripts/validate.sh b/scripts/validate.sh index 9400d7960..bd5981f1a 100755 --- a/scripts/validate.sh +++ b/scripts/validate.sh @@ -473,6 +473,12 @@ static_staleness_probe() { # comparison can miss the change cat "$file" > "$probe" printf 'httparena-staleness-probe-%s\n' "$$" >> "$probe" + # mktemp creates 0600, and mv carries the source mode onto the destination. + # Left alone that makes the replacement unreadable to any container running + # as non-root, which reads back as "the server ignored the disk" -- a false + # failure for exactly the entries doing the right thing. Carry the mode of + # the file being replaced instead. + chmod --reference="$backup" "$probe" original_sum="$(sha256sum "$backup" | cut -d' ' -f1)" probe_sum="$(sha256sum "$probe" | cut -d' ' -f1)"