Nextcloud installation changes ACLs/rights for all users

Support apps
,
1

What app is this about, and its version: Nextcloud 34.0.1~ynh1
What YunoHost version are you running: 12.1.40.1
What type of hardware are you using: VPS bought online

Describe your issue

I am trying to install a second Nextcloud. The installation proceeds without issue, I can use the app, etc.

However: the installation systematically changes the permissions of all user dirs, as far as I can see, including admin.

Only reason I notice is that this disables SSH access to my server.

Originally, I just removed the nextcloud__2 group manually from the relevant dirs (chmod g-w /home/admin, setfacl -R -x g:nextcloud__2 /home/admin, etc.).

However, every upgrade will reset these ACLs.

I don’t believe this is expected, as I already have Nextcloud on my system and I can’t see it changing ACLs on any user. I think the ACLs issue might have bitten someone else here too: Nextcloud multimedia files (external storage) belonging to all users are visible to all users

Share relevant logs or error messages

Before:

➜  ~ getfacl /home/admin
getfacl: Removing leading '/' from absolute path names
# file: home/admin
# owner: admin
# group: 1007
user::rwx
group::r-x
mask::r-x
other::---
default:user::rwx
default:group::r-x
default:mask::r-x
default:other::---

After:

➜  ~ getfacl /home/admin
getfacl: Removing leading '/' from absolute path names
# file: home/admin
# owner: admin
# group: 1007
user::rwx
group::r-x
group:nextcloud__2:rwx
mask::rwx
other::---
default:user::rwx
default:group::r-x
default:group:nextcloud__2:rwx
default:mask::rwx
default:other::---

➜  ~ ls -ld /home/admin /home/admin/.ssh /home/admin/.ssh/authorized_keys
drwxrwx---+ 11 admin 1007 4096 /home/admin
drwxrwx---+  2 admin 1007 4096 /home/admin/.ssh
-rw-rw----+  1 admin 1007  273 /home/admin/.ssh/authorized_keys

What I had to do to re-enable SSH:

chmod g-w /home/admin
chmod 700 /home/admin/.ssh
chmod 600 /home/admin/.ssh/authorized_keys
2

Afair, it also occurs when installing app that use multimedia folder.

3

I wonder why my first install of Nextcloud and further upgrades don’t affect this however. I just upgraded Nextcloud (first install), no changes to ACLs anywhere.

I also wonder whether my patch (the chmods) is sufficient, because it does allow me to SSH into my server, but every user still has these (potentially unsafe?) ACL changes.

4

You probably have set “Add the users’ home directory in Nextcloud?” to on on the second install.
This corresponds to this upgrade section nextcloud_ynh/scripts/upgrade at bcba5c3e41f1641c982d0240a72fede6b763bb7a · YunoHost-Apps/nextcloud_ynh · GitHub

Check yunohost app setting nextcloud user_home and yunohost app setting nextcloud__2 user_home

5

Thanks: this option actually automatically toggles on, independent of what I set, as soon as I launch the install. Checked with multiple installs.

And as you expected, the first install indeed has the option set to False.

I can check whether toggling it off in the cli and going through with an upgrade resets it to True, but this might be an error in the install script.

To fix it, would I need to repeat the iteration here and reverse the ACLs with:

for u in $(ynh_user_list); do
    setfacl --remove g:nextcloud__2 "/home/$u" || true
done
6

You can set it to off : yunohost app setting nextcloud__2 user_home -v "0" so you won’t need to fix permissions on every upgrade

7

Thanks, done.

One last question: can you confirm if I need to run the command above that removes the g:nextcloud__2 ACLs from every user? I can always reinstall if needed.

8

Didn’t understand what you meant. You probably need it once