An important security issue was discovered in YunoHost. A fixed version was released in version 12.1.41 and 13.0.7.1.
We recommend to upgrade and run the migration 0037_fix_bad_permissions as soon as possible. This migration could take a while and will search for paths left writable by other users and fix these too large permissions.
yunohost tools update
yunohost tools upgrade system
yunohost tools migrations run 0037_fix_bad_permissions
You might have some good reasons to grant write permissions to others on some paths, if so you should reapply your customization manually. After the migration, you can check the list of change in the log of the migration.
IMPORTANT: On some servers, this migration may take several hours (or days) if there are a large number of files.
Alternatively, if you don’t want to run the migration on all your writable mounted filesystems, you can fix your paths by hand with the command bellow (think to replace <PATH> by the part of the tree files you want to fix):
/usr/bin/find <PATH> -mount \( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /var/spool/postfix -o \( -regextype posix-extended -regex '.*/.snapshots(/.*)?' \) \) -prune -o \( -type f -or -type d -or -type s \) -perm -o+w ! -perm /o+t -exec chmod o-w {} \; -print
Questions & answers
Should i run the migration 0036 about DKIM before or could i run it later ?
Those migrations are not related and can be made in the order you want.
In webadmin, you can skip the DKIM migration, and run it later with:
yunohost tools migrations run 0036_dkim_keys_upgrade
I use samba and use ACL and unix permissions, does the migration could break something ?
We guess no. The migration only remove the write permissions for others users.
So for example if you have a file with permissions like this
-rw-rw-rw- myfile.txt
Permissions will be changed with
chmod o-w myfile.txt
And permissions should be like that
-rw-rw-r-- myfile.txt
If something going wrong, you still could fix it by running the reverse operation (by getting the list of change from your migration log):
chmod o+w myfile.txt
Will resetting the permissions on each file cause everything to resync on Nextcloud clients?
In theory, we suppose nextcloud file in /home/yunohost.app/nextcloud should not be impacted, however, /home/USER could be impacted.
For now we don’t know if changing permissions in /home/USER could resync nextcloud.
My Discourse return a 502 error, what can i do ?
You can restart the discourse service or run:
chown discourse:www-data /var/www/discourse/discourse/tmp/sockets/unicorn.sock
I’ve edited the first post to mention that trixie is covered as well.