mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-01 08:48:05 +00:00
ChuckBuildsandClaude Sonnet 5
8de706323a
ledmatrix-web.service runs as a non-root user, so "Reinstall plugin
requirements" installed packages into that user's ~/.local site-packages.
ledmatrix.service (the actual display, which loads and runs plugin code)
runs as root and can't see another user's user-site packages, so plugins
with dependencies not already present system-wide would silently fail at
runtime with ModuleNotFoundError even after a "successful" reinstall.
Reproduced and fixed live against a real device (weather plugin's astral
dependency, used for moon-phase data): confirmed the exact failure
("No module named 'astral'" on every almanac cycle) and confirmed it's
gone after this fix.
Adds scripts/fix_perms/safe_pip_install.sh, a root-owned wrapper (mirroring
the existing safe_plugin_rm.sh pattern) that validates the target is
requirements.txt at the project root or under plugin-repos/ or plugins/
before running pip install as root. configure_web_sudo.sh provisions a
narrowly-scoped sudoers rule for it. api_v3.py's install_base_requirements
and install_plugin_requirements actions now use it via `sudo -n`, falling
back to today's current-user-only install (with an explanatory note) if
the wrapper isn't set up yet, so existing installs don't regress.
Also uses --ignore-installed in the wrapper: root's site-packages often has
apt/dpkg-managed copies of common libraries (requests, etc.) with no pip
RECORD file, which pip refuses to upgrade in place and aborts the *entire*
requirements.txt install over — discovered this while testing the fix live,
since a plugin's other already-satisfied-for-the-web-user dependencies had
never actually been attempted as root before.
Also fixes a pre-existing bug in configure_web_sudo.sh where the
display_controller.py/start_display.sh/stop_display.sh sudoers entries used
PROJECT_DIR (scripts/install/, where this script lives) instead of
PROJECT_ROOT (where those files actually live) — visible as the script's
own "File access test" self-check failing. Verified fixed live.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ
75 lines
2.7 KiB
Bash
Executable File
75 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# safe_pip_install.sh — Install a requirements.txt as root after validating
|
|
# that the resolved path is the project's own requirements.txt or a plugin's
|
|
# requirements.txt under plugin-repos/ or plugins/.
|
|
#
|
|
# This script is intended to be called via sudo from the web interface, so
|
|
# that packages a plugin declares end up visible to ledmatrix.service (which
|
|
# runs as root) rather than only to whichever non-root user runs the web
|
|
# interface. Plugin code already runs as root once loaded, so installing its
|
|
# declared dependencies as root is not a new trust boundary.
|
|
#
|
|
# Usage: safe_pip_install.sh <requirements_txt_path>
|
|
|
|
set -euo pipefail
|
|
|
|
if [ $# -ne 1 ]; then
|
|
echo "Usage: $0 <requirements_txt_path>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
TARGET="$1"
|
|
|
|
# Determine the project root (parent of scripts/fix_perms/)
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
|
|
# Allowed locations (resolved, no trailing slash):
|
|
# - the project's own requirements.txt
|
|
# - any requirements.txt under plugin-repos/ or plugins/
|
|
ALLOWED_EXACT="$(realpath --canonicalize-missing "$PROJECT_ROOT/requirements.txt")"
|
|
ALLOWED_BASES=(
|
|
"$(realpath --canonicalize-missing "$PROJECT_ROOT/plugin-repos")"
|
|
"$(realpath --canonicalize-missing "$PROJECT_ROOT/plugins")"
|
|
)
|
|
|
|
# Resolve the target path (follow symlinks); works even if it doesn't exist.
|
|
RESOLVED_TARGET="$(realpath --canonicalize-missing "$TARGET")"
|
|
|
|
# Must be named requirements.txt — never install from an arbitrary file.
|
|
if [ "$(basename "$RESOLVED_TARGET")" != "requirements.txt" ]; then
|
|
echo "DENIED: $RESOLVED_TARGET is not a requirements.txt file" >&2
|
|
exit 2
|
|
fi
|
|
|
|
ALLOWED=false
|
|
if [ "$RESOLVED_TARGET" = "$ALLOWED_EXACT" ]; then
|
|
ALLOWED=true
|
|
else
|
|
for BASE in "${ALLOWED_BASES[@]}"; do
|
|
if [[ "$RESOLVED_TARGET" == "$BASE/"* ]]; then
|
|
ALLOWED=true
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
|
|
if [ "$ALLOWED" = false ]; then
|
|
echo "DENIED: $RESOLVED_TARGET is not an allowed requirements.txt location" >&2
|
|
echo "Allowed: $ALLOWED_EXACT, or any requirements.txt under: ${ALLOWED_BASES[*]}" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [ ! -f "$RESOLVED_TARGET" ]; then
|
|
echo "ERROR: $RESOLVED_TARGET does not exist" >&2
|
|
exit 3
|
|
fi
|
|
|
|
PYTHON_PATH="$(command -v python3)"
|
|
# --ignore-installed: root's site-packages often has apt/dpkg-managed copies
|
|
# of common libraries (requests, urllib3, ...) with no pip RECORD file, which
|
|
# pip refuses to uninstall in place ("Cannot uninstall: no RECORD file was
|
|
# found"). This tells pip to install the newer version alongside rather than
|
|
# aborting the whole requirements.txt install over one such conflict.
|
|
exec "$PYTHON_PATH" -m pip install --break-system-packages --ignore-installed -r "$RESOLVED_TARGET"
|