only-office: bar every account but the converter from the state root (issue 1843)

lib (bind-mounted into the container at /var/lib/onlyoffice) was 0711 so nginx inside the container could reach App_Data/cache, and the module root above it stayed 0711 too, so any account on the machine could walk through the root into lib's 0755 directories and 0644 files to read converted documents. The container never passes through the root — only the converter process does, to read jwt.secret and broker-converter.secret — so the root is now 0710, owned by the converter account: only that account and root pass through it. lib stays 0711 (1837/AC3).
2026-10-22 16:34:06 +02:00
parent edb6d3b7d3
commit d0a3784be2
2 changed files with 54 additions and 1 deletions
@@ -144,7 +144,8 @@
    {
      "id": "state",
      "type": "directory",
-      "mode": "0711",
+      "mode": "0710",
+      "owner": "only-office-converter",
      "place": ".",
      "unknown": "program"
    },