Bug 57534

Summary:	matrix-synapse: некорректные права на /etc/synapse
Product:	Sisyphus	Reporter:	Alexander Makeenkov <amakeenk>
Component:	matrix-synapse	Assignee:	Vitaly Lipatov <lav>
Status:	CLOSED FIXED	QA Contact:	qa-sisyphus
Severity:	normal
Priority:	P5	CC:	blinovdv, lav
Version:	unstable
Hardware:	x86_64
OS:	Linux

Description

Alexander Makeenkov 2026-01-18 22:33:53 MSK

Версия:
matrix-synapse-1.129.0-alt1.x86_64

Сервис падает с ошибкой:
systemd[1]: Started matrix-synapse.service - Synapse Matrix homeserver.
python3[1649]: /usr/lib64/python3/site-packages/synapse/config/_base.py:49: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
python3[1649]:   import pkg_resources
python3[1649]: Traceback (most recent call last):
python3[1649]:   File "<frozen runpy>", line 198, in _run_module_as_main
python3[1649]:   File "<frozen runpy>", line 88, in _run_code
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/app/homeserver.py", line 419, in <module>
python3[1649]:     main()
python3[1649]:     ~~~~^^
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/app/homeserver.py", line 409, in main
python3[1649]:     hs = setup(sys.argv[1:])
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/app/homeserver.py", line 318, in setup
python3[1649]:     config = HomeServerConfig.load_or_generate_config(
python3[1649]:         "Synapse Homeserver", config_options
python3[1649]:     )
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/config/_base.py", line 833, in load_or_generate_config
python3[1649]:     obj.generate_missing_files(config_dict, config_dir_path)
python3[1649]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/config/_base.py", line 880, in generate_missing_files
python3[1649]:     self.invoke_all("generate_files", config_dict, config_dir_path)
python3[1649]:     ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/config/_base.py", line 443, in invoke_all
python3[1649]:     res[config_class.section] = getattr(config, func_name)(*args, **kwargs)
python3[1649]:                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/config/key.py", line 309, in generate_files
python3[1649]:     with open(
python3[1649]:          ~~~~^
python3[1649]:         signing_key_path, "w", opener=lambda p, f: os.open(p, f, mode=0o640)
python3[1649]:         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
python3[1649]:     ) as signing_key_file:
python3[1649]:     ^
python3[1649]:   File "/usr/lib64/python3/site-packages/synapse/config/key.py", line 310, in <lambda>
python3[1649]:     signing_key_path, "w", opener=lambda p, f: os.open(p, f, mode=0o640)
python3[1649]:                                                ~~~~~~~^^^^^^^^^^^^^^^^^^
python3[1649]: PermissionError: [Errno 13] Permission denied: '/etc/synapse/my.matrix.test.signing.key'
python3[1649]: Generating signing key file /etc/synapse/my.matrix.test.signing.key
systemd[1]: matrix-synapse.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: matrix-synapse.service: Failed with result 'exit-code'.


Права на директорию:
# stat /etc/synapse
  Файл: /etc/synapse
  Размер: 4             Блоков: 1          Блок В/В: 131072 каталог
Устройство: 0/46        Инода: 96043       Ссылки: 2
Доступ: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)


Сервис работает от пользователя _synapse:
# systemctl cat matrix-synapse | grep -E "User|Group"
User=_synapse
Group=_synapse

Решение:
# chown _synapse:_synapse /etc/synapse

Comment 1

Repository Robot 2026-03-16 01:41:16 MSK

matrix-synapse-1.148.0-alt2 -> sisyphus:

Mon Mar 16 2026 Vitaly Lipatov <lav@altlinux.ru> 1.148.0-alt2
- fix /etc/synapse directory permissions for _synapse user (ALT bug 57534)

Comment 2

Блинов Денис Вячеславович 2026-04-06 19:33:49 MSK

Ошибка так же воспроизводится на версии matrix-synapse-1.148.0-alt2.
С точно такой же причиной и решением

Comment 3

Repository Robot 2026-10-12 00:20:28 MSK

matrix-synapse-1.162.0-alt1 -> sisyphus:

Sun Oct 11 2026 Vitaly Lipatov <lav@altlinux.ru> 1.162.0-alt1
- new version 1.162.0
- security fixes:
  + CVE-2026-45076, GHSA-6qf2-7x63-mm6v: fix pagination denial of service
  + CVE-2026-45078, GHSA-8q93-326v-3m7g: fix CPU starvation under worker lock contention
  + CVE-2026-102534, GHSA-fp53-rw9v-hcf9: fix resource exhaustion from user-configured push rules
  + CVE-2026-102533, GHSA-rgv2-84w7-5j9p: fix accepting spoofed to-device messages
  + CVE-2026-102535, GHSA-27p5-4f45-gx76: fix event disclosure via federation /get_missing_events
  + CVE-2026-102543, GHSA-95fh-hv8c-chvq: fix relaying federation 401 responses to clients
  + CVE-2026-102531, GHSA-cjh7-rcpx-xpf8: fix malicious redirection of room aliases
  + CVE-2026-102592, GHSA-6wjm-9p2x-gvpm: fix memory exhaustion by multipart/form-data requests
  + CVE-2026-102532, GHSA-qcjr-46gf-7f4r: fix auth event disclosure via federation /event_auth
  + CVE-2026-102542, GHSA-r66v-qhwx-8rg4: fix event ID disclosure via federation /timestamp_to_event
  + CVE-2026-102591, GHSA-jhcg-5392-5mjw: fix invalid Sliding Sync responses on invalid room data
  + CVE-2026-102595, GHSA-vh4c-pqh4-w3wq: fix extraneous HTTP path segments in some endpoints
  + CVE-2026-102597, GHSA-hgcg-p9gx-fq5f: fix extraneous trailing data on the URL of some endpoints
  + GHSA-82j2-j2ch-gfr8: fix rustls-webpki denial of service via malformed CRL
  + GHSA-36hh-v3qg-5jq4: fix PyO3 out-of-bounds read in PyList/PyTuple iterators
  + GHSA-chgr-c6px-7xpp: fix PyO3 missing Sync bound on PyCFunction closures
- update requirements, require python-multipart instead of multipart
- filter out requires on internal synapse.synapse_rust modules
- make /etc/synapse writable for _synapse group to create the signing key
  (closes: #57534) (closes: #38962)