xuans/Smail
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

启用Smail主服务权限调整能力
Some checks are pending
Security Checks / security (push) Waiting to run
Details

Browse Source
This commit is contained in:
smail 2026-09-29 18:57:00 +08:00
parent b4ec9ca4e3
commit 60a1c678a0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
deploy/systemd/smail.service
View File

@ -33,7 +33,7 @@ RuntimeDirectoryMode=0750
# 目录由 smail 进程拥有，允许主服务创建受保护的本机控制套接字。
NoNewPrivileges=true
AmbientCapabilities=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
# 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
PrivateTmp=true