SWWAF_STATE_DIR given as a file: the run script gives the default directory to the smallwebwaf user, and the start fails #137

New Issue

2026-10-14T20:11:24+02:00

clawbot commented

2026-10-14 20:11:24 +02:00

share/smallwebwaf.run gives ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the smallwebwaf user. It reads the plain variable only, so with SWWAF_STATE_DIR_FILE it gives /var/lib/smallwebwaf to that user and leaves the directory smallwebwaf then uses as it was.

Repro, with the image of next at 6fcbda6: a new named volume mounted at /srv/state, SWWAF_LOOKUP_SOURCE=off, and SWWAF_STATE_DIR_FILE naming a file that holds /srv/state, owned by uid 65532 with mode 0400 and mounted read-only, as "Settings given as files" in the README shows for a token. smallwebwaf never starts: every second it logs cannot use the state files with SWWAF_STATE_DIR cannot be written: open /srv/state/write-check-…: permission denied, and the health check never passes. /srv/state stays owned by root. The same volume with SWWAF_STATE_DIR=/srv/state starts normally.

README, "Settings given as files": any setting may instead be given as a file that holds its value. README, "How it works, in short", and SPEC.md, "Deployment": at each start the run script gives the state directory and every file in it to the smallwebwaf user, so a volume or host directory mounted there needs no change of owner.

The _FILE form came with #87.

Severity: major. A configuration the README documents keeps smallwebwaf from starting, so nothing answers on port 8080. It fails at the first start with a message naming SWWAF_STATE_DIR, and the plain variable is a workaround.

Model: opus-5-5

`share/smallwebwaf.run` gives `${SWWAF_STATE_DIR:-/var/lib/smallwebwaf}` to the `smallwebwaf` user. It reads the plain variable only, so with `SWWAF_STATE_DIR_FILE` it gives `/var/lib/smallwebwaf` to that user and leaves the directory `smallwebwaf` then uses as it was. Repro, with the image of `next` at `6fcbda6`: a new named volume mounted at `/srv/state`, `SWWAF_LOOKUP_SOURCE=off`, and `SWWAF_STATE_DIR_FILE` naming a file that holds `/srv/state`, owned by uid 65532 with mode `0400` and mounted read-only, as "Settings given as files" in the README shows for a token. `smallwebwaf` never starts: every second it logs `cannot use the state files` with `SWWAF_STATE_DIR cannot be written: open /srv/state/write-check-…: permission denied`, and the health check never passes. `/srv/state` stays owned by root. The same volume with `SWWAF_STATE_DIR=/srv/state` starts normally. README, "Settings given as files": any setting may instead be given as a file that holds its value. README, "How it works, in short", and SPEC.md, "Deployment": at each start the run script gives the state directory and every file in it to the `smallwebwaf` user, so a volume or host directory mounted there needs no change of owner. The `_FILE` form came with https://git.eeqj.de/sneak/smallwebwaf/issues/87. Severity: major. A configuration the README documents keeps `smallwebwaf` from starting, so nothing answers on port 8080. It fails at the first start with a message naming `SWWAF_STATE_DIR`, and the plain variable is a workaround. Model: opus-5-5

clawbot referenced this issue

2026-10-14 20:12:12 +02:00

Run the image as an operator would, in front of a small test backend, and file the defects found #123

clawbot referenced this issue

2026-10-14 20:25:08 +02:00

1.0: what stands between next and a release candidate #140

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#137