修复Linux加固服务无法读取初始化网卡地址

backend/internal/servicehost/linux.go

@@ -202,7 +202,8 @@ func renderUnitFile(options Options) (string, error) {
 		"RestrictSUIDSGID=yes",
 		"RemoveIPC=yes",
 		"SystemCallArchitectures=native",
-		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+		// 初始化证书枚举本机网卡需要 NETLINK_ROUTE，空能力集仍禁止网络管理操作。
+		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK",
 	)
 	if len(normalized.ReadWritePaths) > 0 {
 		quotedPaths := make([]string, 0, len(normalized.ReadWritePaths))

backend/internal/servicehost/linux_test.go

@@ -3,6 +3,7 @@
 package servicehost
 
 import (
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -53,7 +54,7 @@ func TestRenderUnitFileIncludesExecutableConfigurationAndWorkDir(t *testing.T) {
 		"RestrictSUIDSGID=yes",
 		"RemoveIPC=yes",
 		"SystemCallArchitectures=native",
-		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK",
 		"ReadWritePaths=\"/var/lib/scert\" \"/var/log/scert\"",
 		"[Install]",
 		"WantedBy=multi-user.target",
@@ -64,6 +65,30 @@ func TestRenderUnitFileIncludesExecutableConfigurationAndWorkDir(t *testing.T) {
 	}
 }
 
+func TestPackagedUnitAllowsInterfaceDiscoveryWithoutCapabilities(t *testing.T) {
+	content, err := os.ReadFile(filepath.Join("..", "..", "..", "deploy", "systemd", "Scert.service"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, expected := range []string{
+		"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK",
+		"CapabilityBoundingSet=",
+		"AmbientCapabilities=",
+		"NoNewPrivileges=yes",
+		"User=Scert",
+	} {
+		found := false
+		for _, line := range strings.Split(string(content), "\n") {
+			if strings.TrimSpace(line) == expected {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("发布服务缺少安全配置：%s", expected)
+		}
+	}
+}
+
 func TestUnitFilePathRejectsPathTraversal(t *testing.T) {
 	for _, name := range []string{"", ".", "..", "../Scert", "a/b", `a\\b`} {
 		if _, err := unitFilePath(name); err == nil {

deploy/systemd/Scert.service

@@ -38,7 +38,8 @@ RestrictSUIDSGID=yes
 RemoveIPC=yes
 SystemCallArchitectures=native
 ReadWritePaths=/ssl /scert/conf /scert/data /scert/log /scert/backups
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+# 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target