From b0ea780bb1ae921c596a4ae42bd46a2f8e2edd9d Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 29 Sep 2026 18:01:55 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DLinux=E6=8F=92=E4=BB=B6?=
 =?UTF-8?q?=E9=9A=94=E7=A6=BB=E9=83=A8=E7=BD=B2=E8=BA=AB=E4=BB=BD=E9=85=8D?=
 =?UTF-8?q?=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

为生产环境补充插件专用系统用户、运行 UID/GID 和主进程所需的受限能力，确保插件可以隔离降权运行。
---
 deploy/install-systemd.sh    | 8 ++++++++
 deploy/systemd/smail.service | 6 +++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/deploy/install-systemd.sh b/deploy/install-systemd.sh
index 48801a7..96e4d38 100644
--- a/deploy/install-systemd.sh
+++ b/deploy/install-systemd.sh
@@ -78,6 +78,8 @@ if [ -f /etc/smail/smail.env ]; then cp -p -- /etc/smail/smail.env "$backup_dir/
 
 if ! getent group smail >/dev/null; then groupadd --system smail; fi
 if ! getent passwd smail >/dev/null; then useradd --system --gid smail --home-dir "$runtime_dir" --shell /usr/sbin/nologin smail; fi
+if ! getent group smail-plugin >/dev/null; then groupadd --system smail-plugin; fi
+if ! getent passwd smail-plugin >/dev/null; then useradd --system --gid smail-plugin --home-dir /nonexistent --shell /usr/sbin/nologin smail-plugin; fi
 install -d -o root -g root -m 0755 "$runtime_dir"
 install -d -o root -g root -m 0750 /etc/smail
 if [ ! -e /etc/smail/smail.env ]; then
@@ -85,6 +87,12 @@ if [ ! -e /etc/smail/smail.env ]; then
   umask 0077
   printf '%s\n' 'SMAIL_ROOT=/opt/smail' 'GOMEMLIMIT=256MiB' > /etc/smail/smail.env
 fi
+if ! grep -q '^SMAIL_PLUGIN_UID=' /etc/smail/smail.env; then
+  printf 'SMAIL_PLUGIN_UID=%s\n' "$(id -u smail-plugin)" >> /etc/smail/smail.env
+fi
+if ! grep -q '^SMAIL_PLUGIN_GID=' /etc/smail/smail.env; then
+  printf 'SMAIL_PLUGIN_GID=%s\n' "$(id -g smail-plugin)" >> /etc/smail/smail.env
+fi
 chown root:root /etc/smail/smail.env
 chmod 0600 /etc/smail/smail.env
 for directory in config data ssl log plugins; do
diff --git a/deploy/systemd/smail.service b/deploy/systemd/smail.service
index aaf672e..4b6dd7d 100644
--- a/deploy/systemd/smail.service
+++ b/deploy/systemd/smail.service
@@ -7,8 +7,8 @@ StartLimitBurst=3
 
 [Service]
 Type=simple
-User=smail
-Group=smail
+# 主进程需要保留受限的 root 能力，才能为插件创建 chroot 和网络隔离；插件
+# 通过 SMAIL_PLUGIN_UID/SMAIL_PLUGIN_GID 降权运行，不能以 root 身份执行。
 # 运行环境仅由 root 可读写的独立文件提供，避免在 unit 中混入部署环境配置。
 EnvironmentFile=/etc/smail/smail.env
 WorkingDirectory=/opt/smail
@@ -34,7 +34,7 @@ RuntimeDirectoryMode=0750
 
 NoNewPrivileges=true
 AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=full