Merge 4007d7f8ca into 5aef304ed7

2.0.0 ran 'install -d -m 0750 /var/lib/secubox/security-posture' which re-moded
the shared parent to 0750 secubox:secubox, breaking traversal for other
secubox-* daemons (kbin/toolbox -> HTTP 500). Keep parent 0755; restrict only
the leaf; service creates its dir at runtime. Regression of the #511 class.

packages/secubox-security-posture/debian/changelog

@@ -1,3 +1,14 @@
+secubox-security-posture (2.0.1-1) unstable; urgency=medium
+
+  * fix(postinst): stop clobbering /var/lib/secubox parent mode. The 2.0.0
+    postinst ran `install -d -m 0750 /var/lib/secubox/security-posture`, which
+    re-moded the SHARED parent to 0750 secubox:secubox and broke directory
+    traversal for every other secubox-* daemon (took kbin/toolbox to HTTP 500).
+    Now: keep the parent 0755, create only the leaf restricted; service creates
+    its own dir at runtime. (#511 traversal class — regression fix.)
+
+ -- Gerald Kerma <devel@cybermind.fr>  Mon, 16 Jun 2026 18:00:00 +0200
+
 secubox-security-posture (2.0.0-1) unstable; urgency=medium
 
   * Full rewrite — honest, board-truthful posture scorecard (closes #617).

packages/secubox-security-posture/debian/postinst

@@ -3,8 +3,18 @@
 set -e
 
 # Writable cache dir for the posture snapshot (service runs as secubox).
+# IMPORTANT: never use `install -d -m 0750 /var/lib/secubox/<leaf>` — it re-modes
+# the SHARED parent /var/lib/secubox to 0750, which breaks traversal for every
+# other secubox-* daemon (e.g. it took kbin/toolbox down). The parent must stay
+# 0755; only the leaf is restricted; the service (User=secubox) creates the leaf
+# itself at runtime, so we just guarantee the parent is traversable here.
+if [ -d /var/lib/secubox ]; then
+    chmod 0755 /var/lib/secubox 2>/dev/null || true
+fi
 if getent passwd secubox >/dev/null 2>&1; then
-    install -d -o secubox -g secubox -m 0750 /var/lib/secubox/security-posture 2>/dev/null || true
+    mkdir -p /var/lib/secubox/security-posture 2>/dev/null || true
+    chown secubox:secubox /var/lib/secubox/security-posture 2>/dev/null || true
+    chmod 0750 /var/lib/secubox/security-posture 2>/dev/null || true
 fi
 
 #DEBHELPER#