xuans/Smail
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

完成目录权限告警整改
Some checks are pending
Security Checks / security (push) Waiting to run
Details

Browse Source
This commit is contained in:
smail 2026-09-22 03:47:52 +08:00
parent 3f3ee2c0e1
commit 3bee658717
5 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
backend/config/migrate.go
View File

@ -985,7 +985,8 @@ func writeLegacyMigrationBackup(directory string, data []byte, now time.Time) (s
if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
return "", ErrManagerStorage
}
if err := os.Chmod(backupDirectory, 0700); err != nil { // #nosec G302
// #nosec G302 -- 迁移备份目录仅允许应用用户访问，目录权限需要保留执行位。
if err := os.Chmod(backupDirectory, 0700); err != nil {
return "", err
}
token := make([]byte, 8)

3
backend/config/ssl_storage.go
View File

@ -693,7 +693,8 @@ func ensureManagedDirectoryAtRoot(root, directory string) error {
if statErr != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
return ErrUnsafeSSLFile
}
if err := os.Chmod(current, 0700); err != nil { // #nosec G302
// #nosec G302 -- 证书存储目录仅允许应用用户访问，目录权限需要保留执行位。
if err := os.Chmod(current, 0700); err != nil {
return err
}
}

3
backend/services/adminreset/transport_unix.go
View File

@ -33,7 +33,8 @@ func ListenUnix(path string, allowedUIDs []uint32) (*UnixServer, error) {
if err := validateControlDirectory(parent); err != nil {
return nil, err
}
if err := os.Chmod(parent, 0750); err != nil { // #nosec G302
// #nosec G302 -- 本地控制目录需要允许受控组遍历，访问仍由属主和组权限限制。
if err := os.Chmod(parent, 0750); err != nil {
return nil, fmt.Errorf("set control directory permissions: %w", err)
}
if info, err := os.Lstat(path); err == nil {

3
backend/utils/runtimepath/deployment.go
View File

@ -64,7 +64,8 @@ func SecureDirectory(root, name string) (string, error) {
if err := safeDirectory(directory); err != nil {
return "", err
}
return directory, os.Chmod(directory, 0700) // #nosec G302
// #nosec G302 -- 运行目录仅允许应用用户访问，目录权限需要保留执行位。
return directory, os.Chmod(directory, 0700)
}
func KeyDirectory(root string) string {

3
backend/utils/runtimepath/layout.go
View File

@ -28,7 +28,8 @@ func Directory(root string) (string, error) {
if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
return "", errors.New("运行数据目录无效")
}
if err := os.Chmod(directory, 0700); err != nil { // #nosec G302
// #nosec G302 -- 运行数据目录仅允许应用用户访问，目录权限需要保留执行位。
if err := os.Chmod(directory, 0700); err != nil {
return "", err
}
return directory, nil