boa icon indicating copy to clipboard operation
boa copied to clipboard

System Integrity checking detects /bin/sh changes if _SKYNET_MODE=OFF

Open reswild opened this issue 6 months ago • 3 comments

I recently turned off the 'Skynet Mode' on some of my servers, and after this, I started getting regular 'System Integrity checking detected a modified system file' emails warning me about changes to /bin/sh and /usr/bin/sh.

I looked into this a bit, and what appears to be happening is that once _SKYNET_MODE is set to OFF, the BOA.sh.txt script executes service clean-boa-env start every time it runs, which changes these two symlinks to point to /bin/dash instead of /bin/websh. Then, every time the manage_ltd_users.sh script runs, this changes it back to /bin/websh.

I was also able to reproduce this on a fresh BOA install.

reswild avatar Aug 27 '24 15:08 reswild