From 401a585abf236a32de863e0e30d15d352cf5449d Mon Sep 17 00:00:00 2001 From: voovvaa Date: Thu, 27 Aug 2026 17:22:36 +0300 Subject: [PATCH 1/2] test: make credential permission test umask-independent install.sh sets umask 077, so os.WriteFile's requested 0444 mode is silently reduced to 0400 and the 'group/other-readable profiles file outside a credential directory' assertion never fires. Chmod the file explicitly so the test verifies the intended permission handling under any umask. --- internal/config/config_test.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/config/config_test.go b/internal/config/config_test.go index d977312..213ab18 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -234,6 +234,12 @@ func TestLoadAcceptsSystemdCredentialReadPermissions(t *testing.T) { if err := os.WriteFile(profiles, []byte(content), 0444); err != nil { t.Fatal(err) } + // Force the intended mode: install.sh runs tests under umask 077, + // which would otherwise strip the group/other read bits and make the + // "outside a credential directory" assertion below vacuously pass. + if err := os.Chmod(profiles, 0444); err != nil { + t.Fatal(err) + } t.Setenv("CREDENTIALS_DIRECTORY", credentials) server := `{"public_hostname":"proxy.example.com","public_dir":"public","profiles_file":"credentials/profiles.json"}` path := filepath.Join(directory, "config.json") From 217ba2583f15cf4d5becd8c68efbc854f8277a15 Mon Sep 17 00:00:00 2001 From: voovvaa Date: Thu, 27 Aug 2026 17:22:36 +0300 Subject: [PATCH 2/2] fix: make MTProxy build tree usable by the mtproxy service user install.sh runs with umask 077, so make's output keeps owner-only permissions. After chown root:root the binary and its directories are 0700 root, and mtproxy.service (User=mtproxy) fails with 203/EXEC because it cannot traverse the tree or execute the binary, leaving tproxy-server /readyz stuck at 503 ('tproxy-server did not become ready'). Normalize ownership and read/execute bits unconditionally after the build guard: a previous failed run may have left /opt/MTProxy with a root-owned 0700 binary, and the guard (checked as root) then skips the rebuild while the tree stays unusable for the mtproxy user. Verified by simulating the broken state on a live install: binary 0700 -> script skips rebuild, applies 0755, mtproxy.service comes up, /readyz = 200. --- deploy/install-mtproxy.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/deploy/install-mtproxy.sh b/deploy/install-mtproxy.sh index 141ec08..948ee1b 100755 --- a/deploy/install-mtproxy.sh +++ b/deploy/install-mtproxy.sh @@ -48,6 +48,15 @@ if [[ ! -x "$source_directory/objs/bin/mtproto-proxy" ]] || rm -rf "$temporary" fi +# install.sh runs with umask 077, so make's output keeps owner-only +# permissions; the unprivileged mtproxy service user must be able to +# traverse the tree and execute the binary. Normalize permissions +# unconditionally: when the guard above skipped a rebuild (a previous +# failed run may already have left /opt/MTProxy with a root-owned +# 0700 binary), the tree is reused as-is and still needs this fix. +chown -R root:root "$source_directory" +chmod -R a+rX "$source_directory" + install -d -o root -g mtproxy -m 0750 /etc/mtproxy secret_temp="$(mktemp /etc/mtproxy/proxy-secret.XXXXXX)" config_temp="$(mktemp /etc/mtproxy/proxy-multi.conf.XXXXXX)"