xuans/Smail
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

补充Smail主服务目录读取能力

Browse Source
This commit is contained in:
smail 2026-09-29 18:55:24 +08:00
parent ed7f6ade65
commit 46f9677f30
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
deploy/systemd/smail.service
View File

@ -34,7 +34,8 @@ RuntimeDirectoryMode=0750
NoNewPrivileges=true
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN
# 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
PrivateTmp=true
ProtectHome=true
ProtectSystem=full