Merge 6a74f3c7d0 into 5aef304ed7

packages/secubox-security-posture/debian/changelog

@@ -1,14 +1,3 @@
-secubox-security-posture (2.0.1-1) unstable; urgency=medium
-
-  * fix(postinst): stop clobbering /var/lib/secubox parent mode. The 2.0.0
-    postinst ran `install -d -m 0750 /var/lib/secubox/security-posture`, which
-    re-moded the SHARED parent to 0750 secubox:secubox and broke directory
-    traversal for every other secubox-* daemon (took kbin/toolbox to HTTP 500).
-    Now: keep the parent 0755, create only the leaf restricted; service creates
-    its own dir at runtime. (#511 traversal class — regression fix.)
-
- -- Gerald Kerma <devel@cybermind.fr>  Mon, 16 Jun 2026 18:00:00 +0200
-
 secubox-security-posture (2.0.0-1) unstable; urgency=medium
 
   * Full rewrite — honest, board-truthful posture scorecard (closes #617).

packages/secubox-security-posture/debian/postinst

@@ -3,18 +3,8 @@
 set -e
 
 # Writable cache dir for the posture snapshot (service runs as secubox).
-# IMPORTANT: never use `install -d -m 0750 /var/lib/secubox/<leaf>` — it re-modes
-# the SHARED parent /var/lib/secubox to 0750, which breaks traversal for every
-# other secubox-* daemon (e.g. it took kbin/toolbox down). The parent must stay
-# 0755; only the leaf is restricted; the service (User=secubox) creates the leaf
-# itself at runtime, so we just guarantee the parent is traversable here.
-if [ -d /var/lib/secubox ]; then
-    chmod 0755 /var/lib/secubox 2>/dev/null || true
-fi
 if getent passwd secubox >/dev/null 2>&1; then
-    mkdir -p /var/lib/secubox/security-posture 2>/dev/null || true
-    chown secubox:secubox /var/lib/secubox/security-posture 2>/dev/null || true
-    chmod 0750 /var/lib/secubox/security-posture 2>/dev/null || true
+    install -d -o secubox -g secubox -m 0750 /var/lib/secubox/security-posture 2>/dev/null || true
 fi
 
 #DEBHELPER#