boban
/
mailwolt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: ClamAV-Socket false-positive + --check-only als root + Backup sudoers 

ClamAV: nur systemd-Probe – Socket-Datei bleibt nach Stop erhalten.
--check-only: git ls-remote als root statt www-data (keine Credentials).
Backup: /etc/sudoers.d/mailwolt immer anlegen, unabhängig von certbot/dkim.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
main v1.1.347
boban 2026-04-26 21:52:02 +02:00
parent de314adebe
commit 77fad53655
2 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/woltguard.php
View File

@ -25,8 +25,8 @@ return [
'label' => 'ClamAV', 'hint' => 'Virenscanner', 'label' => 'ClamAV', 'hint' => 'Virenscanner',
'optional' => true, 'optional' => true,
'sources' => [ 'sources' => [
'systemd:clamav-daemon', 'systemd:clamav-daemon@scan', 'systemd:clamd', // Nur systemd – Socket-Datei bleibt nach dem Stoppen erhalten (false positive)
'socket:/run/clamav/clamd.ctl', 'pid:/run/clamav/clamd.pid', 'tcp:127.0.0.1:3310', 'systemd:clamav-daemon',
], ],
], ],

21
scripts/update.sh
View File

@ -12,9 +12,9 @@ ALLOW_DIRTY="${ALLOW_DIRTY:-0}"
# -------- --check-only: nur Remote-Tags holen, Version schreiben, sicher beenden --- # -------- --check-only: nur Remote-Tags holen, Version schreiben, sicher beenden ---
# (wird von CheckUpdates via sudo aufgerufen — kein Update, nur Versionsprüfung) # (wird von CheckUpdates via sudo aufgerufen — kein Update, nur Versionsprüfung)
if [[ "${1:-}" == "--check-only" ]]; then if [[ "${1:-}" == "--check-only" ]]; then
LATEST="$(sudo -u "$APP_USER" bash -c \ # Als root ausführen – www-data hat keine Git-Credentials für private Repos
"git -C '${APP_DIR}' ls-remote --tags --sort=-v:refname origin 'v*' 2>/dev/null \ LATEST="$(git -C "${APP_DIR}" ls-remote --tags --sort=-v:refname origin 'v*' 2>/dev/null \
| grep -v '\^{}' | head -1 | sed 's|.*refs/tags/||'" 2>/dev/null || true)" | grep -v '\^{}' | head -1 | sed 's|.*refs/tags/||' || true)"
if [[ -n "$LATEST" ]]; then if [[ -n "$LATEST" ]]; then
mkdir -p /var/lib/mailwolt mkdir -p /var/lib/mailwolt
printf '%s\n' "$LATEST" > /var/lib/mailwolt/version_remote printf '%s\n' "$LATEST" > /var/lib/mailwolt/version_remote
@ -207,13 +207,18 @@ ensure_system(){
_sbin_install "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update _sbin_install "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update
_sbin_install "${APP_DIR}/scripts/mailwolt-clamav" /usr/local/sbin/mailwolt-clamav _sbin_install "${APP_DIR}/scripts/mailwolt-clamav" /usr/local/sbin/mailwolt-clamav
_sbin_install "${APP_DIR}/scripts/mailwolt-backup" /usr/local/sbin/mailwolt-backup _sbin_install "${APP_DIR}/scripts/mailwolt-backup" /usr/local/sbin/mailwolt-backup
# Sudoers-Regeln nachrüsten # Sudoers-Regeln: dediziertes File – unabhängig von certbot/dkim
local MW_SUDO="/etc/sudoers.d/mailwolt"
if [[ ! -f "$MW_SUDO" ]]; then touch "$MW_SUDO"; chmod 440 "$MW_SUDO"; fi
_sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags'
_sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-update --check-only'
_sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-clamav'
_sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-backup'
_sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
# Legacy-Files ebenfalls nachrüsten (falls vorhanden)
for f in /etc/sudoers.d/mailwolt-certbot /etc/sudoers.d/mailwolt-dkim; do for f in /etc/sudoers.d/mailwolt-certbot /etc/sudoers.d/mailwolt-dkim; do
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags' [[ -f "$f" ]] || continue
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-update --check-only'
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-clamav'
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-backup' _sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-backup'
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
done done
# Laravel Scheduler cron (schedule:run muss jede Minute laufen) # Laravel Scheduler cron (schedule:run muss jede Minute laufen)
local cron_file="/etc/cron.d/mailwolt" local cron_file="/etc/cron.d/mailwolt"