55 lines
1.6 KiB
Desktop File
55 lines
1.6 KiB
Desktop File
[Unit]
|
||
Description=Scert-admin 本机管理员交互终端
|
||
Documentation=file:///scert/docs/Scert-admin-service-management.md
|
||
After=Scert.service
|
||
Requisite=Scert.service
|
||
ConditionPathExists=/scert/conf/scert.json
|
||
|
||
[Service]
|
||
Type=oneshot
|
||
RemainAfterExit=no
|
||
User=root
|
||
Group=root
|
||
WorkingDirectory=/scert
|
||
RuntimeDirectory=scert-admin
|
||
RuntimeDirectoryMode=0700
|
||
ExecStart=/scert/scert-admin
|
||
KillSignal=SIGTERM
|
||
TimeoutStartSec=130s
|
||
TimeoutStopSec=5s
|
||
KillMode=mixed
|
||
Restart=no
|
||
UMask=0077
|
||
NoNewPrivileges=yes
|
||
CapabilityBoundingSet=CAP_SYS_PTRACE CAP_DAC_OVERRIDE
|
||
AmbientCapabilities=
|
||
PrivateTmp=yes
|
||
PrivateDevices=yes
|
||
PrivateNetwork=yes
|
||
ProtectHome=yes
|
||
ProtectSystem=strict
|
||
ProtectHostname=yes
|
||
ProtectClock=yes
|
||
ProtectKernelTunables=yes
|
||
ProtectKernelModules=yes
|
||
ProtectControlGroups=yes
|
||
ProtectKernelLogs=yes
|
||
LockPersonality=yes
|
||
MemoryDenyWriteExecute=yes
|
||
RestrictNamespaces=yes
|
||
RestrictRealtime=yes
|
||
RestrictSUIDSGID=yes
|
||
RemoveIPC=yes
|
||
SystemCallArchitectures=native
|
||
ReadWritePaths=/run/scert-admin
|
||
DeviceAllow=char-pts rw
|
||
RestrictAddressFamilies=AF_UNIX
|
||
|
||
# Scert-admin 只通过受保护的 Unix Socket 管理主服务，不提供 HTTP/TCP 恢复入口。
|
||
# 刻意不提供 [Install] 段，禁止通过 systemctl enable 纳入开机启动。
|
||
# 不配置 ExecReload，reload 不属于受支持的控制操作。
|
||
|
||
# 仅支持 root 在前台交互终端显式执行 systemctl start Scert-admin。
|
||
# 管理程序使用 root 读取显式启动者的终端；只保留终端访问及本机 Socket 所需能力。
|
||
# 新密码和验证码只在调用终端输入，不写入文件、命令参数或服务日志。
|