From 834d1e46339c9c84bb1026d08d3db83d820e871b Mon Sep 17 00:00:00 2001 From: smail Date: Tue, 29 Sep 2026 19:27:13 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E6=8F=92=E4=BB=B6=E9=9A=94?= =?UTF-8?q?=E7=A6=BB=E6=9C=8D=E5=8A=A1=E6=9D=83=E9=99=90=E6=96=AD=E8=A8=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 按systemd默认root行为校正回归用例，禁止错误降权并保留插件隔离能力检查。 --- backend/cmd/smail-admin/systemd_policy_test.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/cmd/smail-admin/systemd_policy_test.go b/backend/cmd/smail-admin/systemd_policy_test.go index 47070cb..a0c738d 100644 --- a/backend/cmd/smail-admin/systemd_policy_test.go +++ b/backend/cmd/smail-admin/systemd_policy_test.go @@ -104,8 +104,6 @@ func TestSmailServiceRetainsPluginIsolationCapabilities(t *testing.T) { } content := string(unit) for _, required := range []string{ - "User=root", - "Group=root", "EnvironmentFile=/etc/smail/smail.env", "NoNewPrivileges=true", "AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER", @@ -125,6 +123,9 @@ func TestSmailServiceRetainsPluginIsolationCapabilities(t *testing.T) { if !usesEnvironmentFile { t.Fatal("smail unit must define EnvironmentFile as a standalone directive") } + if strings.Contains(content, "User=smail") || strings.Contains(content, "Group=smail") { + t.Fatal("smail unit must retain root privileges for plugin isolation") + } if strings.Count(content, "CAP_NET_BIND_SERVICE") != 2 { t.Fatal("smail unit does not retain the expected bind capability entries") }