From b4ec9ca4e3f994998a5f452e46cb120bb6a02d0b Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 29 Sep 2026 18:55:24 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85Smail=E4=B8=BB=E6=9C=8D?=
 =?UTF-8?q?=E5=8A=A1=E7=9B=AE=E5=BD=95=E8=AF=BB=E5=8F=96=E8=83=BD=E5=8A=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/systemd/smail.service | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deploy/systemd/smail.service b/deploy/systemd/smail.service
index 4b6dd7d..ee5af50 100644
--- a/deploy/systemd/smail.service
+++ b/deploy/systemd/smail.service
@@ -34,7 +34,8 @@ RuntimeDirectoryMode=0750
 
 NoNewPrivileges=true
 AmbientCapabilities=CAP_NET_BIND_SERVICE
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN
+# 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=full