From 733a583c6acf1ffe008ed169cd95ed684744593b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 03:27:14 +0000 Subject: [PATCH] Grant smsrelay's ACL access after the Asterisk restart, not before Reproduced live: pstn-personal-dids.conf was confirmed readable by smsrelay right after a manual ACL grant, then unreadable again ("does not exist" in the relay's log -- os.path.isfile() swallows the PermissionError and just returns False) immediately after the very next fresh install. The only thing that ran in between was this same install's own Asterisk container restart (needed to pick up the new AMI secret). The ACL grant was sequenced BEFORE that restart. CLAUDE.md documents the container's entrypoint re-chowning its mounted config directory on every restart and says chown alone can't touch ACL entries -- true, but apparently this image's entrypoint also chmods, and chmod recomputes a directory's ACL mask entry, which can silently weaken a named-user grant made before it even though the grant's ACL entry itself is untouched. Fix: do the grant last, after the restart-or-not branch, so nothing left in this install run can undo it. ensure_docker_dir_ownership() (chown only, confirmed in lib/common.sh, no chmod) stays where it was -- chow doesn't need this ordering fix, only the ACL grant does. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01JDyKC6Kdg7tofmYSmRtgww --- services/sms-inbound.sh | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/services/sms-inbound.sh b/services/sms-inbound.sh index 028ace4..0e3b827 100644 --- a/services/sms-inbound.sh +++ b/services/sms-inbound.sh @@ -723,7 +723,6 @@ install_sms-inbound() { local MGR_STATE MGR_STATE="$(_sms_write_manager_conf "$ASTERISK_DIR" "$AMI_SECRET")" ensure_docker_dir_ownership "$ASTERISK_DIR" - _sms_grant_asterisk_read_access "$SMS_SVC_USER" "$ASTERISK_DIR" if [[ "$MGR_STATE" != "unchanged" ]]; then echo "" @@ -743,6 +742,20 @@ install_sms-inbound() { fi fi + # Grant smsrelay's ACL access AFTER any Asterisk container restart above, + # not before. The container's entrypoint re-chowns (and, apparently on + # this image, re-chmods) its mounted config directory on every restart — + # chown alone leaves ACL entries alone (that's the whole reason this uses + # ACLs over chmod/group membership in the first place, see CLAUDE.md), + # but a chmod recomputes the ACL mask entry and can silently weaken a + # grant made before it. Confirmed live: pstn-personal-dids.conf was + # readable by smsrelay immediately after a manual grant+test, then + # unreadable again ("does not exist" — os.path.isfile() swallows the + # PermissionError) right after the very next fresh install, which + # restarts Asterisk for the new AMI secret. Granting last means nothing + # runs afterward in this same install to undo it. + _sms_grant_asterisk_read_access "$SMS_SVC_USER" "$ASTERISK_DIR" + # ── Relay service ───────────────────────────────────────────────────────── mkdir -p "$SMS_APP_DIR" # Stop any instance of this exact service BEFORE scanning for a free