From cb130bf7765f9f941fb301aa8724244384f178db Mon Sep 17 00:00:00 2001 From: vominh1919 Date: Thu, 30 Apr 2026 16:32:27 +0700 Subject: [PATCH] fix(ssh): prevent tar from overwriting remote home dir permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tar xf - -C / extracts the staging directory tree to the remote root. GNU tar default behavior overwrites metadata (including mode) of existing directories. When the local umask is 002 (Ubuntu default), the staging dirs are 0775, and tar chmod's /home/ to 0775 — breaking sshd StrictModes which requires 0755 or stricter for home dirs. Add --no-overwrite-dir to the remote tar command so existing directory metadata is preserved. Fixes #17767 --- tools/environments/ssh.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/environments/ssh.py b/tools/environments/ssh.py index f2f27659c5f..53d03adce8d 100644 --- a/tools/environments/ssh.py +++ b/tools/environments/ssh.py @@ -182,7 +182,11 @@ class SSHEnvironment(BaseEnvironment): tar_cmd = ["tar", "-chf", "-", "-C", staging, "."] ssh_cmd = self._build_ssh_command() - ssh_cmd.append("tar xf - -C /") + # --no-overwrite-dir prevents tar from overwriting the mode of + # existing directories (e.g. /home/) with the staging + # directory's mode. Without this, a umask 002 produces 0775 + # dirs which breaks sshd StrictModes (refuses authorized_keys). + ssh_cmd.append("tar xf - --no-overwrite-dir -C /") tar_proc = subprocess.Popen( tar_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE