From 27cd1b1ceec79d1ddaf76c56650f6301087c426c Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Sun, 27 Sep 2026 11:26:32 +0800
Subject: [PATCH] =?UTF-8?q?=E6=94=B6=E7=B4=A7=E8=AF=81=E4=B9=A6=E7=9B=AE?=
 =?UTF-8?q?=E5=BD=95=E5=86=99=E5=85=A5=E6=9D=83=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

移除 systemd 对旧默认证书目录的静态写入授权，证书目录由初始化流程按用户输入动态授权，并同步更新权限策略测试。
---
 backend/internal/admin/service_units_test.go | 2 +-
 deploy/systemd/Scert.service                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/internal/admin/service_units_test.go b/backend/internal/admin/service_units_test.go
index 711b3b5..b5e73b7 100644
--- a/backend/internal/admin/service_units_test.go
+++ b/backend/internal/admin/service_units_test.go
@@ -38,7 +38,7 @@ func TestScertSystemdUnitPolicy(t *testing.T) {
 		"RestrictSUIDSGID=yes",
 		"RemoveIPC=yes",
 		"SystemCallArchitectures=native",
-		"ReadWritePaths=/ssl/scert /scert/conf /scert/data /scert/log /scert/backups",
+		"ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups",
 		"[Install]",
 		"WantedBy=multi-user.target",
 	} {
diff --git a/deploy/systemd/Scert.service b/deploy/systemd/Scert.service
index b602ee1..c12d61d 100644
--- a/deploy/systemd/Scert.service
+++ b/deploy/systemd/Scert.service
@@ -39,7 +39,7 @@ RestrictRealtime=yes
 RestrictSUIDSGID=yes
 RemoveIPC=yes
 SystemCallArchitectures=native
-ReadWritePaths=/ssl/scert /scert/conf /scert/data /scert/log /scert/backups
+ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups
 # 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK