xuans/Smail
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

修复Linux插件隔离部署身份配置

Browse Source 
为生产环境补充插件专用系统用户、运行 UID/GID 和主进程所需的受限能力，确保插件可以隔离降权运行。
This commit is contained in:
smail 2026-09-29 18:01:55 +08:00
parent 9a73939f78
commit b0ea780bb1
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
deploy/install-systemd.sh
View File

@ -78,6 +78,8 @@ if [ -f /etc/smail/smail.env ]; then cp -p -- /etc/smail/smail.env "$backup_dir/
if ! getent group smail >/dev/null; then groupadd --system smail; fi
if ! getent passwd smail >/dev/null; then useradd --system --gid smail --home-dir "$runtime_dir" --shell /usr/sbin/nologin smail; fi
if ! getent group smail-plugin >/dev/null; then groupadd --system smail-plugin; fi
if ! getent passwd smail-plugin >/dev/null; then useradd --system --gid smail-plugin --home-dir /nonexistent --shell /usr/sbin/nologin smail-plugin; fi
install -d -o root -g root -m 0755 "$runtime_dir"
install -d -o root -g root -m 0750 /etc/smail
if [ ! -e /etc/smail/smail.env ]; then
@ -85,6 +87,12 @@ if [ ! -e /etc/smail/smail.env ]; then
umask 0077
printf '%s\n' 'SMAIL_ROOT=/opt/smail' 'GOMEMLIMIT=256MiB' > /etc/smail/smail.env
fi
if ! grep -q '^SMAIL_PLUGIN_UID=' /etc/smail/smail.env; then
printf 'SMAIL_PLUGIN_UID=%s\n' "$(id -u smail-plugin)" >> /etc/smail/smail.env
fi
if ! grep -q '^SMAIL_PLUGIN_GID=' /etc/smail/smail.env; then
printf 'SMAIL_PLUGIN_GID=%s\n' "$(id -g smail-plugin)" >> /etc/smail/smail.env
fi
chown root:root /etc/smail/smail.env
chmod 0600 /etc/smail/smail.env
for directory in config data ssl log plugins; do

6
deploy/systemd/smail.service
View File

@ -7,8 +7,8 @@ StartLimitBurst=3
[Service]
Type=simple
User=smail
Group=smail
# 主进程需要保留受限的 root 能力，才能为插件创建 chroot 和网络隔离；插件
# 通过 SMAIL_PLUGIN_UID/SMAIL_PLUGIN_GID 降权运行，不能以 root 身份执行。
# 运行环境仅由 root 可读写的独立文件提供，避免在 unit 中混入部署环境配置。
EnvironmentFile=/etc/smail/smail.env
WorkingDirectory=/opt/smail
@ -34,7 +34,7 @@ RuntimeDirectoryMode=0750
NoNewPrivileges=true
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN
PrivateTmp=true
ProtectHome=true
ProtectSystem=full