⚠ SECURITY: Run the manual migration 0037_fix_bad_permissions

Announcements Security
1

:uk: An important security issue was discovered in YunoHost. A fixed version was released in version 12.1.41.

We recommend to upgrade and run the migration 0037_fix_bad_permissions as soon as possible. This migration could take a while and will search for paths left writable by other users and fix these too large permissions.

yunohost tools migrations run 0037_fix_bad_permissions

You might have some good reasons to grant write permissions to others on some paths, if so you should reapply your customization manually. After the migration, you can check the list of change in the log of the migration.

IMPORTANT: On some servers, this migration may take several hours (or days) if there are a large number of files.

Alternatively, if you don’t want to run the migration on all your writable mounted filesystems, you can fix your paths by hand with the command bellow (think to replace <PATH> by the part of the tree files you want to fix):

/usr/bin/find <PATH> -mount \( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /var/spool/postfix -o  \( -regextype posix-extended -regex .*/.snapshots(/.*)? \) \) -prune -o \( -type f -or -type d -or -type s \) -perm -o+w ! -perm /o+t -exec chmod o-w {} ; -print

NB: if you have skipped the migration 0036 about DKIM from the web admin, you can run this migration later with the following command:

yunohost tools migrations run 0036_dkim_keys_upgrade
3

And let’s thank @lelabtv for their great security report! I’m glad the Yunohost team managed to fix this issue in the end.

4

Can anyone tell me why it failed?

ended_at: 2026-09-04 04:20:54.636462
error: ‘Migration 0037_fix_bad_permissions did not complete, aborting. Error: The
find command fails for an unknow reasons (return code: 1)’
interface: api
operation: tools_migrations_migrate_forward
parent: null
started_at: 2026-09-04 04:20:49.600901
started_by: ******
success: false
yunohost_version: 12.1.41.2

============

2026-09-04 04:20:50,656: INFO - Running migration 0037_fix_bad_permissions…
2026-09-04 04:20:50,657: DEBUG - Removing others writable permissions for the following paths:
2026-09-04 04:20:50,661: DEBUG - [‘/usr/bin/find’, ‘/’, ‘-mount’, ‘(’, ‘-path’, ‘/tmp’, ‘-o’, ‘-path’, ‘/var/spool/postfix’, ‘-o’, ‘-path’, ‘/ynh-dev’, ‘-o’, ‘(’, ‘-regextype’, ‘posix-extended’, ‘-regex’, ‘./.snapshots(/.)?’, ‘)’, ‘)’, ‘-prune’, ‘-o’, ‘(’, ‘-type’, ‘f’, ‘-or’, ‘-type’, ‘d’, ‘-or’, ‘-type’, ‘s’, ‘)’, ‘-perm’, ‘-o+w’, ‘!’, ‘-perm’, ‘/o+t’, ‘-exec’, ‘chmod’, ‘o-w’, ‘{}’, ‘;’, ‘-print’]
2026-09-04 04:20:50,690: WARNING - /usr/bin/find: ‘/lost+found’: Permission denied
2026-09-04 04:20:54,631: WARNING - 1 paths might still be unprotected but are probably in read only mode (check the logs for debugging why the chmod command did not work for them).
2026-09-04 04:20:54,633: ERROR - Migration 0037_fix_bad_permissions did not complete, aborting. Error: The find command fails for an unknow reasons (return code: 1)
Traceback (most recent call last):
File “/usr/lib/python3/dist-packages/yunohost/tools.py”, line 932, in tools_migrations_run
migration.run()
File “/usr/lib/python3/dist-packages/yunohost/migrations/0037_fix_bad_permissions.py”, line 111, in run
raise YunohostError(
yunohost.utils.error.YunohostError: The find command fails for an unknow reasons (return code: 1)

5

If I do the upgrade in the webadmin page. Do I have to run the command yunohost tools migrations run 0037_fix_bad_permissions nevertheless from ssh ?

6

I’ll answer this question myself: webadmin will nicely guide you through the migration process immediately after the update. Nicely done, bravo!

7

That directory is not always present, so the error probably did not appear in the VM/Container used to test the migration.

You can look into /lost+found and see if there is something to recover. If it contains nothing of value you can delete the whole directory and should be safe.

8

Thanks, that worked.