mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

image: the TLS key's group is the panel's alone, 10997 (audit I1)

Browse Source 
Security audit 2026-10-17, finding I1, stage 2; the help mockup is ff3a118.
The guide had operators give the TLS private key to group 10998 so the
panel can archive it, and the Dockerfile puts postfix in that group (for
sasldb2 and the maps): `docker exec -u postfix head privkey.pem` printed
the live key. postfix-config.sh copies the key to a root-only directory
precisely so that a compromised Postfix daemon cannot read it - the mounted
original undid that.

Now a group backupkey (gid 10997, outside the system range like 10998)
whose one member is the panel; the guide (Apache/certbot, nginx, Taking a
full backup, the backup table), Help, and the backup's refusal name 10997
and say why; postfix-config.sh, extract-cert.sh and the Dockerfile's
comments follow. A key still given to 10998 keeps working for the backup.
CHANGELOG has an Upgrading note.

e2e: the stage gives its key to 10997 at 0640 when the runner is root
(stageKeyMode; 0644 otherwise), and testFullBackupRestore, after the
refusal that now names chgrp 10997, checks that the postfix uid cannot read
/etc/postfix/tls/privkey.pem and the panel can.

Docs: security.md § Output and process (the groups); guide; CHANGELOG;
plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 22:03:10 +03:00
co-authored by Claude Opus 5.5
parent 17b7049311
commit 1bafd78364
11 changed files with 89 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/e2e/restore_test.go
+14 -3
View File
@@ -24,7 +24,7 @@ import (
// record that was published before the backup.
func testFullBackupRestore(t *testing.T, sc *scenario) {
// A private key the panel may not read - the state a server is in until
// its operator gives the key to group 10998. The panel does not make an
// its operator gives the key to group 10997. The panel does not make an
// archive without it: it refuses, names the file and says what to do.
keyPath := filepath.Join(h.stageDir, "certs", "privkey.pem")
if err := os.Chmod(keyPath, 0o600); err != nil {
@@ -46,12 +46,23 @@ func testFullBackupRestore(t *testing.T, sc *scenario) {
if err != nil {
t.Fatalf("full backup with an unreadable key: %v", err)
}
if resp.StatusCode != 500 || !strings.Contains(body, "not allowed to read certs/privkey.pem") || !strings.Contains(body, "chgrp 10998") {
if resp.StatusCode != 500 || !strings.Contains(body, "not allowed to read certs/privkey.pem") || !strings.Contains(body, "chgrp 10997") {
t.Fatalf("full backup with an unreadable key: status %d, want a refusal that names the file and the way out:\n%.800s", resp.StatusCode, body)
}
if err := os.Chmod(keyPath, 0o644); err != nil {
if err := stageKeyMode(keyPath); err != nil {
t.Fatal(err)
}
// Given to group 10997 the key is the panel's to read and no Postfix
// daemon's: postfix is in selfpost, not in backupkey (security audit
// 2026-10-17, I1). Only where the runner could give it that group.
if keyGroupStaged {
if out, err := h.compose("exec", "-T", "-u", "postfix", "selfpost", "head", "-c", "1", "/etc/postfix/tls/privkey.pem"); err == nil {
t.Errorf("the postfix uid reads the TLS key given to group %d:\n%s", keyGroup, out)
}
if out, err := h.compose("exec", "-T", "-u", "panel", "selfpost", "head", "-c", "1", "/etc/postfix/tls/privkey.pem"); err != nil {
t.Errorf("the panel cannot read the TLS key given to group %d: %v\n%s", keyGroup, err, out)
}
}
// A map under data/postfix by a name the entrypoint does not list - the
// DMARC maps were such, with DMARC on (review of audit stage 3, H1). The