share/smallwebwaf.run gives ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the smallwebwaf user. It reads the plain variable only, so with SWWAF_STATE_DIR_FILE it gives /var/lib/smallwebwaf to that user and leaves the directory smallwebwaf then uses as it was.
Repro, with the image of next at 6fcbda6: a new named volume mounted at /srv/state, SWWAF_LOOKUP_SOURCE=off, and SWWAF_STATE_DIR_FILE naming a file that holds /srv/state, owned by uid 65532 with mode 0400 and mounted read-only, as "Settings given as files" in the README shows for a token. smallwebwaf never starts: every second it logs cannot use the state files with SWWAF_STATE_DIR cannot be written: open /srv/state/write-check-…: permission denied, and the health check never passes. /srv/state stays owned by root. The same volume with SWWAF_STATE_DIR=/srv/state starts normally.
README, "Settings given as files": any setting may instead be given as a file that holds its value. README, "How it works, in short", and SPEC.md, "Deployment": at each start the run script gives the state directory and every file in it to the smallwebwaf user, so a volume or host directory mounted there needs no change of owner.
Severity: major. A configuration the README documents keeps smallwebwaf from starting, so nothing answers on port 8080. It fails at the first start with a message naming SWWAF_STATE_DIR, and the plain variable is a workaround.
Model: opus-5-5
`share/smallwebwaf.run` gives `${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}` to the `smallwebwaf` user. It reads the plain variable only, so with `SWWAF_STATE_DIR_FILE` it gives `/var/lib/smallwebwaf` to that user and leaves the directory `smallwebwaf` then uses as it was.
Repro, with the image of `next` at `6fcbda6`: a new named volume mounted at `/srv/state`, `SWWAF_LOOKUP_SOURCE=off`, and `SWWAF_STATE_DIR_FILE` naming a file that holds `/srv/state`, owned by uid 65532 with mode `0400` and mounted read-only, as "Settings given as files" in the README shows for a token. `smallwebwaf` never starts: every second it logs `cannot use the state files` with `SWWAF_STATE_DIR cannot be written: open /srv/state/write-check-…: permission denied`, and the health check never passes. `/srv/state` stays owned by root. The same volume with `SWWAF_STATE_DIR=/srv/state` starts normally.
README, "Settings given as files": any setting may instead be given as a file that holds its value. README, "How it works, in short", and SPEC.md, "Deployment": at each start the run script gives the state directory and every file in it to the `smallwebwaf` user, so a volume or host directory mounted there needs no change of owner.
The `_FILE` form came with https://git.eeqj.de/sneak/smallwebwaf/issues/87.
Severity: major. A configuration the README documents keeps `smallwebwaf` from starting, so nothing answers on port 8080. It fails at the first start with a message naming `SWWAF_STATE_DIR`, and the plain variable is a workaround.
Model: opus-5-5
share/smallwebwaf.run finds the state directory as smallwebwaf does: SWWAF_STATE_DIR if set, else the contents of the file SWWAF_STATE_DIR_FILE names, less one newline at their end, else /var/lib/smallwebwaf. When both are set or the file cannot be read, it skips the change of owner and starts smallwebwaf, which then logs the error naming the setting, as it does for any setting it cannot use.
A check that fails without the fix: in script/example-app, a container on a new volume mounted away from the default path, with its path given by SWWAF_STATE_DIR_FILE in a file readable only by uid 65532, becomes healthy.
The comment in the run script and the README's and SPEC.md's sentences on the change of owner say the file form is covered, if they need to.
Done when that check passes and an independent reviewer passes the PR.
Model: opus-5-5
Plan, one PR to `next`:
- `share/smallwebwaf.run` finds the state directory as `smallwebwaf` does: `SWWAF_STATE_DIR` if set, else the contents of the file `SWWAF_STATE_DIR_FILE` names, less one newline at their end, else `/var/lib/smallwebwaf`. When both are set or the file cannot be read, it skips the change of owner and starts `smallwebwaf`, which then logs the error naming the setting, as it does for any setting it cannot use.
- A check that fails without the fix: in `script/example-app`, a container on a new volume mounted away from the default path, with its path given by `SWWAF_STATE_DIR_FILE` in a file readable only by uid 65532, becomes healthy.
- The comment in the run script and the README's and `SPEC.md`'s sentences on the change of owner say the file form is covered, if they need to.
Done when that check passes and an independent reviewer passes the PR.
Model: opus-5-5
clawbot
self-assigned this 2026-10-20 10:43:05 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
share/smallwebwaf.rungives${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}to thesmallwebwafuser. It reads the plain variable only, so withSWWAF_STATE_DIR_FILEit gives/var/lib/smallwebwafto that user and leaves the directorysmallwebwafthen uses as it was.Repro, with the image of
nextat6fcbda6: a new named volume mounted at/srv/state,SWWAF_LOOKUP_SOURCE=off, andSWWAF_STATE_DIR_FILEnaming a file that holds/srv/state, owned by uid 65532 with mode0400and mounted read-only, as "Settings given as files" in the README shows for a token.smallwebwafnever starts: every second it logscannot use the state fileswithSWWAF_STATE_DIR cannot be written: open /srv/state/write-check-…: permission denied, and the health check never passes./srv/statestays owned by root. The same volume withSWWAF_STATE_DIR=/srv/statestarts normally.README, "Settings given as files": any setting may instead be given as a file that holds its value. README, "How it works, in short", and SPEC.md, "Deployment": at each start the run script gives the state directory and every file in it to the
smallwebwafuser, so a volume or host directory mounted there needs no change of owner.The
_FILEform came with #87.Severity: major. A configuration the README documents keeps
smallwebwaffrom starting, so nothing answers on port 8080. It fails at the first start with a message namingSWWAF_STATE_DIR, and the plain variable is a workaround.Model: opus-5-5
Plan, one PR to
next:share/smallwebwaf.runfinds the state directory assmallwebwafdoes:SWWAF_STATE_DIRif set, else the contents of the fileSWWAF_STATE_DIR_FILEnames, less one newline at their end, else/var/lib/smallwebwaf. When both are set or the file cannot be read, it skips the change of owner and startssmallwebwaf, which then logs the error naming the setting, as it does for any setting it cannot use.script/example-app, a container on a new volume mounted away from the default path, with its path given bySWWAF_STATE_DIR_FILEin a file readable only by uid 65532, becomes healthy.SPEC.md's sentences on the change of owner say the file form is covered, if they need to.Done when that check passes and an independent reviewer passes the PR.
Model: opus-5-5