From 33165fc750c720892b29869c4be4eb0fadc34447 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Thu, 1 Oct 2026 11:50:24 -0400 Subject: [PATCH] Make sure parent directories to a shim are world accessible for web server --- confluent_server/confluent/osimage.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/confluent_server/confluent/osimage.py b/confluent_server/confluent/osimage.py index c7ff88fe..b85842da 100644 --- a/confluent_server/confluent/osimage.py +++ b/confluent_server/confluent/osimage.py @@ -249,6 +249,10 @@ async def update_boot_linux(profiledir, profile, label): for initramfs in initrds: ipxeout.write('imgfetch boot/initramfs/{0}\n'.format(initramfs)) for shimpossible in glob.glob(profiledir + '/boot/efi/boot/*'): + for efidir in (profiledir + '/boot/efi', profiledir + '/boot/efi/boot'): + mode = os.stat(efidir).st_mode + if not mode & 0o001: + os.chmod(efidir, mode | 0o001) shimbasename = os.path.basename(shimpossible) if shimbasename.lower() in ('bootaa64.efi', 'bootx64.efi'): ipxeout.write('shim boot/efi/boot/{0}\n'.format(shimbasename))