crowdsec: own notification-slack plugin via C+ args, not a follow-up z - #38
Merged
Conversation
The plugin-ownership tmpfiles rule copied the notification-slack binary root-owned (C+ with mode/uid/gid "-") and relied on a separate z line to chown it to crowdsec. But the module owns the parent /etc/crowdsec/plugins as crowdsec, so a root-owned leaf is a crowdsec-dir -> root-file "unsafe path transition". Modern systemd-tmpfiles aborts the entire run (exit 73) on that transition, so z never ran: the plugin stayed root-owned, the crowdsec LAPI crash-looped refusing to load a plugin it doesn't own, :8081 never bound, and crowdsec-firewall-bouncer failed with connection-refused / "bouncer stream halted". Copy straight to crowdsec:crowdsec by putting owner/mode on the C+ line, so parent and leaf owners match — no transition, one atomic op. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adjusts the CrowdSec NixOS module’s tmpfiles configuration so the notification-slack plugin binary is copied directly as crowdsec:crowdsec, avoiding a root-owned leaf under a crowdsec-owned directory that can cause modern systemd-tmpfiles to abort (and prevent the follow-up ownership fix from running). This aligns the module’s on-disk ownership expectations with CrowdSec’s plugin broker checks and prevents the LAPI crash-loop described in the PR.
Changes:
- Replace the two-step
C+(copy) +z(chown/mode fix) tmpfiles approach with a singleC+entry that setsuser,group, andmodeduring the copy. - Expand inline commentary documenting the
systemd-tmpfiles“unsafe path transition” failure mode and its operational impact.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The plugin-ownership tmpfiles rule copied the notification-slack binary root-owned (C+ with mode/uid/gid "-") and relied on a separate z line to chown it to crowdsec. But the module owns the parent /etc/crowdsec/plugins as crowdsec, so a root-owned leaf is a crowdsec-dir -> root-file "unsafe path transition". Modern systemd-tmpfiles aborts the entire run (exit 73) on that transition, so z never ran: the plugin stayed root-owned, the crowdsec LAPI crash-looped refusing to load a plugin it doesn't own, :8081 never bound, and crowdsec-firewall-bouncer failed with connection-refused / "bouncer stream halted".
Copy straight to crowdsec:crowdsec by putting owner/mode on the C+ line, so parent and leaf owners match — no transition, one atomic op.