xuans/Scert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

收紧证书目录写入权限

Browse Source 
移除 systemd 对旧默认证书目录的静态写入授权，证书目录由初始化流程按用户输入动态授权，并同步更新权限策略测试。
This commit is contained in:
xuans 2026-09-27 11:26:32 +08:00
parent 80029c2d1f
commit 27cd1b1cee
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/internal/admin/service_units_test.go
View File

@ -38,7 +38,7 @@ func TestScertSystemdUnitPolicy(t *testing.T) {
"RestrictSUIDSGID=yes",
"RemoveIPC=yes",
"SystemCallArchitectures=native",
"ReadWritePaths=/ssl/scert /scert/conf /scert/data /scert/log /scert/backups",
"ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups",
"[Install]",
"WantedBy=multi-user.target",
} {

2
deploy/systemd/Scert.service
View File

@ -39,7 +39,7 @@ RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native
ReadWritePaths=/ssl/scert /scert/conf /scert/data /scert/log /scert/backups
ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups
# 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK