This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit 54d403c1090eeb3807873ac5d857089e3eef633b Author: Richard Zowalla <[email protected]> AuthorDate: Tue Oct 13 08:47:41 2026 +0200 Keep Debian package configuration read-only for the service group (#3071) The service runs as apachetomee, so it must not be able to rewrite server.xml or tomcat-users.xml. (cherry picked from commit 920eaedbc5e3b660957895adf5ee700839b2487d) --- tomee/tomee-deb/src/main/resources/control/postinst.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/tomee/tomee-deb/src/main/resources/control/postinst.sh b/tomee/tomee-deb/src/main/resources/control/postinst.sh index 6039ba5326..573fa28623 100644 --- a/tomee/tomee-deb/src/main/resources/control/postinst.sh +++ b/tomee/tomee-deb/src/main/resources/control/postinst.sh @@ -42,18 +42,23 @@ mkdir -p /usr/share/tomee-${classifier}/lib ${libLinks} mkdir -p /var/log/tomee-${classifier} +mkdir -p /var/lib/tomee-${classifier}/work +# Pre-create the host config base so Tomcat does not try (and fail) to create it. +mkdir -p /var/lib/tomee-${classifier}/conf/Catalina/localhost chown -R root:apachetomee /var/log/tomee-${classifier} chown -R root:apachetomee /var/lib/tomee-${classifier} chown -R root:apachetomee /etc/tomee-${classifier} chown -R root:apachetomee /var/lib/tomee-${classifier}-user-data -# users from the apachetomee group should be able to change settings. -# there is no need to be root. -chmod -R g+w /etc/tomee-${classifier} +# The service runs as the apachetomee user, so the configuration and the catalina base +# (conf links, bin/setenv.sh) must stay read-only for that group. Change settings as root. +chmod -R g+rX,g-w /etc/tomee-${classifier} +chmod -R g+rX,g-w /var/lib/tomee-${classifier} +# Directories the service writes to at runtime. +chmod -R g+w /var/lib/tomee-${classifier}/work chmod -R g+w /var/log/tomee-${classifier} -chmod -R g+w /var/lib/tomee-${classifier} chmod -R g+w /var/lib/tomee-${classifier}-user-data update-rc.d tomee-${classifier} defaults >/dev/null 2>&1
