fix: pin logrotate config mode in image and fail loud on bad permissions

COPY --chmod makes /etc/logrotate.d/mail 0644 regardless of build context
file modes (Windows tar sync). logrotate-loop preflight exits non-zero when
logrotate would ignore the config. E2e covers mode, forced rotation, and a
group-writable context build.

Co-Authored-By: Composer 2.5 <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/Dockerfile

@@ -88,20 +88,20 @@ COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
 
 # Licence text shipped with the image (AGPL-3.0 conveyance). The panel also
 # serves the same text at /license from an embedded copy.
-COPY LICENSE NOTICE /usr/share/doc/selfpost/
+COPY --chmod=0644 LICENSE NOTICE /usr/share/doc/selfpost/
 
-COPY build/opendkim.conf /etc/opendkim.conf
-COPY build/logrotate-mail.conf /etc/logrotate.d/mail
-COPY build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
-COPY build/postfix-config.sh /usr/local/bin/postfix-config.sh
-COPY build/postfix-cert-reload.sh /usr/local/bin/postfix-cert-reload.sh
-COPY build/logrotate-loop.sh /usr/local/bin/logrotate-loop.sh
-COPY build/crashexit.py /usr/local/bin/crashexit.py
-COPY build/entrypoint.sh /usr/local/bin/entrypoint.sh
-COPY build/supervisord.conf /etc/supervisor/supervisord.conf
-RUN chmod +x /usr/local/bin/postfix-wrapper.sh /usr/local/bin/postfix-config.sh \
-      /usr/local/bin/postfix-cert-reload.sh /usr/local/bin/logrotate-loop.sh \
-      /usr/local/bin/crashexit.py /usr/local/bin/entrypoint.sh
+# File modes are pinned here so a build context copied from a checkout without
+# POSIX permissions (e.g. Windows tar sync) cannot land group-writable config
+# that logrotate would silently ignore — see docs/plans/logrotate-mode.md.
+COPY --chmod=0644 build/opendkim.conf /etc/opendkim.conf
+COPY --chmod=0644 build/logrotate-mail.conf /etc/logrotate.d/mail
+COPY --chmod=0755 build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
+COPY --chmod=0755 build/postfix-config.sh /usr/local/bin/postfix-config.sh
+COPY --chmod=0755 build/postfix-cert-reload.sh /usr/local/bin/postfix-cert-reload.sh
+COPY --chmod=0755 build/logrotate-loop.sh /usr/local/bin/logrotate-loop.sh
+COPY --chmod=0755 build/crashexit.py /usr/local/bin/crashexit.py
+COPY --chmod=0755 build/entrypoint.sh /usr/local/bin/entrypoint.sh
+COPY --chmod=0644 build/supervisord.conf /etc/supervisor/supervisord.conf
 
 # Published submission ports: 465 (smtps, primary) and 587 (submission, optional)
 # plus the panel on 8080. Outbound delivery dials remote MXs on 25 as a client,

build/logrotate-loop.sh

@@ -14,10 +14,49 @@
 # often than daily — polling merely bounds how late a legitimate rotation runs.
 set -eu
 
+CONFIG=/etc/logrotate.d/mail
 INTERVAL="${LOGROTATE_INTERVAL_SECONDS:-21600}"
 
+# logrotate refuses configs writable by group or others and exits 0 while
+# ignoring them — fail here so supervisord reports the fault.
+logrotate_config_ok() {
+	mode=$(stat -c '%a' "$CONFIG")
+	mode=${mode#0}
+	grp=$(( (mode / 10) % 10 ))
+	oth=$(( mode % 10 ))
+	case $grp in 2|3|6|7) return 1 ;; esac
+	case $oth in 2|3|6|7) return 1 ;; esac
+	return 0
+}
+
+logrotate_config_fatal() {
+	echo "logrotate-loop: refusing to run: $CONFIG mode $(stat -c '%a' "$CONFIG") is writable by group or others" >&2
+	exit 1
+}
+
+if ! logrotate_config_ok; then
+	logrotate_config_fatal
+fi
+
+run_logrotate() {
+	out=$(logrotate "$CONFIG" 2>&1) || {
+		echo "$out" >&2
+		return 1
+	}
+	case "$out" in
+		*Ignoring*|*Potentially\ dangerous\ mode*)
+			echo "$out" >&2
+			logrotate_config_fatal
+			;;
+	esac
+	return 0
+}
+
 while true; do
-	if logrotate /etc/logrotate.d/mail; then
+	if ! logrotate_config_ok; then
+		logrotate_config_fatal
+	fi
+	if run_logrotate; then
 		:
 	else
 		echo "logrotate-loop: logrotate failed, will retry after ${INTERVAL}s" >&2

build/supervisord.conf

@@ -104,8 +104,9 @@ stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
 ; Periodic logrotate for /data/log/mail.log (spec 9, 10: daily, 7-14 files kept
-; in the image). Runs as root so logrotate can read/rotate the log; never exits
-; non-zero, so it neither trips the crashexit listener nor needs restarting.
+; in the image). Runs as root so logrotate can read/rotate the log. Exits
+; non-zero when the config is group/other-writable (logrotate would ignore it
+; silently); autorestart surfaces BACKOFF on the Status page.
 [program:logrotate]
 command=/usr/local/bin/logrotate-loop.sh
 priority=400