From 96a073f13253b2267f340909832ee79ad227fe87 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Wed, 30 Sep 2026 01:22:51 +0800
Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E5=96=84=E6=8F=92=E4=BB=B6=E8=B5=84?=
 =?UTF-8?q?=E6=BA=90=E6=9D=83=E9=99=90=E8=AF=8A=E6=96=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/hooks/base.go        | 6 ++++--
 deploy/systemd/smail.service | 3 ++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/backend/hooks/base.go b/backend/hooks/base.go
index b6cefee..0a2c9e5 100644
--- a/backend/hooks/base.go
+++ b/backend/hooks/base.go
@@ -381,8 +381,10 @@ func Init(serverVersion string) {
 		pluginNo++
 		go waitPlugin(process, logicalID, socketPath, launchSpec)
 		if limitErr := applyPluginResourceLimits(process); limitErr != nil {
-			log.Warnf("[%s] Plugin resource limits could not be applied", logicalID)
-			_ = process.Kill()
+			log.WithError(limitErr).Warnf("[%s] 插件资源限制应用失败，插件未启用", logicalID)
+			if killErr := process.Kill(); killErr != nil && !errors.Is(killErr, os.ErrProcessDone) {
+				log.WithError(killErr).Errorf("[%s] 插件终止失败，请检查服务权限", logicalID)
+			}
 			continue
 		}
 
diff --git a/deploy/systemd/smail.service b/deploy/systemd/smail.service
index 6f951a0..9366d79 100644
--- a/deploy/systemd/smail.service
+++ b/deploy/systemd/smail.service
@@ -35,7 +35,8 @@ RuntimeDirectoryMode=0750
 NoNewPrivileges=true
 AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
 # 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
+# 跨用户限制资源和终止降权插件分别需要资源管理与信号能力；插件本身不继承有效能力。
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SYS_RESOURCE CAP_KILL
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=full