From 5573c64b209eae391c77f2a476ccc6784fd5b2e2 Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Thu, 17 Sep 2026 11:17:48 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DLinux=E5=8A=A0=E5=9B=BA?=
 =?UTF-8?q?=E6=9C=8D=E5=8A=A1=E6=97=A0=E6=B3=95=E8=AF=BB=E5=8F=96=E5=88=9D?=
 =?UTF-8?q?=E5=A7=8B=E5=8C=96=E7=BD=91=E5=8D=A1=E5=9C=B0=E5=9D=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/servicehost/linux.go      |  3 ++-
 backend/internal/servicehost/linux_test.go | 27 +++++++++++++++++++++-
 deploy/systemd/Scert.service               |  3 ++-
 3 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/backend/internal/servicehost/linux.go b/backend/internal/servicehost/linux.go
index 8786b8c..29eafd7 100644
--- a/backend/internal/servicehost/linux.go
+++ b/backend/internal/servicehost/linux.go
@@ -202,7 +202,8 @@ func renderUnitFile(options Options) (string, error) {
 		"RestrictSUIDSGID=yes",
 		"RemoveIPC=yes",
 		"SystemCallArchitectures=native",
-		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+		// 初始化证书枚举本机网卡需要 NETLINK_ROUTE，空能力集仍禁止网络管理操作。
+		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK",
 	)
 	if len(normalized.ReadWritePaths) > 0 {
 		quotedPaths := make([]string, 0, len(normalized.ReadWritePaths))
diff --git a/backend/internal/servicehost/linux_test.go b/backend/internal/servicehost/linux_test.go
index 332fa34..4d27be5 100644
--- a/backend/internal/servicehost/linux_test.go
+++ b/backend/internal/servicehost/linux_test.go
@@ -3,6 +3,7 @@
 package servicehost
 
 import (
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -53,7 +54,7 @@ func TestRenderUnitFileIncludesExecutableConfigurationAndWorkDir(t *testing.T) {
 		"RestrictSUIDSGID=yes",
 		"RemoveIPC=yes",
 		"SystemCallArchitectures=native",
-		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK",
 		"ReadWritePaths=\"/var/lib/scert\" \"/var/log/scert\"",
 		"[Install]",
 		"WantedBy=multi-user.target",
@@ -64,6 +65,30 @@ func TestRenderUnitFileIncludesExecutableConfigurationAndWorkDir(t *testing.T) {
 	}
 }
 
+func TestPackagedUnitAllowsInterfaceDiscoveryWithoutCapabilities(t *testing.T) {
+	content, err := os.ReadFile(filepath.Join("..", "..", "..", "deploy", "systemd", "Scert.service"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, expected := range []string{
+		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK",
+		"CapabilityBoundingSet=",
+		"AmbientCapabilities=",
+		"NoNewPrivileges=yes",
+		"User=Scert",
+	} {
+		found := false
+		for _, line := range strings.Split(string(content), "\n") {
+			if strings.TrimSpace(line) == expected {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("发布服务缺少安全配置：%s", expected)
+		}
+	}
+}
+
 func TestUnitFilePathRejectsPathTraversal(t *testing.T) {
 	for _, name := range []string{"", ".", "..", "../Scert", "a/b", `a\\b`} {
 		if _, err := unitFilePath(name); err == nil {
diff --git a/deploy/systemd/Scert.service b/deploy/systemd/Scert.service
index d89855a..7dae22f 100644
--- a/deploy/systemd/Scert.service
+++ b/deploy/systemd/Scert.service
@@ -38,7 +38,8 @@ RestrictSUIDSGID=yes
 RemoveIPC=yes
 SystemCallArchitectures=native
 ReadWritePaths=/ssl /scert/conf /scert/data /scert/log /scert/backups
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target