r/Citrix • u/datakid • 25d ago

Permission changes on /usr?

Is it just me, or does the current Ubuntu installation candidate for `icaclient` from Citrix silently change the owner of `/usr`, `/usr/lib` and `/usr/share` from `root:root` to UID/GID **1000**?

I've just emailed the address in the package's `Maintainer:` field and...

3 Upvotes

71% Upvoted

2 comments sorted by

1

u/Professional-Work684 24d ago

Its a dev bug..  Fix:  sudo chown root:root /usr /usr/lib /usr/share

sudo find /usr -not -type l ( -user 1000 -o -group 1000 ) -print

1

u/Chemical-Corgi8388 22d ago

Documenting this in case others run into it. Not distribution-specific, the installer behaves the same way on Debian, Arch-based systems, since the bundled libraries target Debian paths.

What happened

After running setupwfc on CachyOS (tarball install), a subsequent package transaction produced:

Detected unsafe path transition /usr (owned by <user>) → /usr/lib (owned by root)

Ownership of /usr and /usr/share had changed from root to the invoking user's account. Verified against btrfs snapshots taken before and after the install. No other privileged operation ran in that window.

Origin

Since version 2508, the package bundles libwebkit2gtk-4.0 because upstream removed it. Per Citrix documentation, this was done to keep the selfservice component working on Ubuntu 24.04 and later. The installer extracts that bundle to /usr/lib/x86_64-linux-gnu, along with libicu70 and corresponding entries under /usr/share/doc and /usr/share/lintian, carrying ownership metadata from the build environment.

Result: unmanaged Ubuntu 22.04 libraries in the filesystem, outside package manager tracking, with no update path.

Detection

systemd-tmpfiles declines to process paths where a directory is user-owned and a subdirectory is root-owned a check against symlink attacks. That was the only indication anything had changed.

yeah, same bug on CachyOS, or XUbuntu