From c9d0d31cd66b3adf0ab739ecdd4149cd6555233f Mon Sep 17 00:00:00 2001 From: Alex Date: Sat, 22 Aug 2026 23:41:52 +0000 Subject: [PATCH] Install MTProxy readable and executable by its service user. install.sh sets umask 077 and install-mtproxy.sh inherits it, so make created objs/ and objs/bin/ as 0700 and the built binary as 0700. After the tree is chowned to root, the unprivileged mtproxy user that mtproxy.service runs as can neither traverse the directories nor execute the binary, and the unit fails with status=203/EXEC on every clean build. Apply a+rX to the installed tree. This runs outside the build guard so it also repairs a tree left behind by an earlier run, which the pinned-commit check would otherwise skip. Co-Authored-By: Claude Opus 5 (1M context) --- deploy/install-mtproxy.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/deploy/install-mtproxy.sh b/deploy/install-mtproxy.sh index 141ec08..cabac83 100755 --- a/deploy/install-mtproxy.sh +++ b/deploy/install-mtproxy.sh @@ -47,6 +47,10 @@ if [[ ! -x "$source_directory/objs/bin/mtproto-proxy" ]] || trap - EXIT rm -rf "$temporary" fi +# The build inherits the caller's umask, so the tree can end up root-only. +# mtproxy.service runs as the unprivileged mtproxy user and must be able to +# traverse the directories and execute the built binary. +chmod -R a+rX "$source_directory" install -d -o root -g mtproxy -m 0750 /etc/mtproxy secret_temp="$(mktemp /etc/mtproxy/proxy-secret.XXXXXX)"