From c9aa63fd74ef4ddedaf3c162e709e916b09f2b3d Mon Sep 17 00:00:00 2001 From: smail Date: Tue, 29 Sep 2026 19:25:20 +0800 Subject: [PATCH] =?UTF-8?q?=E5=90=8C=E6=AD=A5Smail=E6=9C=8D=E5=8A=A1?= =?UTF-8?q?=E6=9D=83=E9=99=90=E5=9B=9E=E5=BD=92=E6=96=AD=E8=A8=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 使systemd回归用例匹配当前为Linux插件隔离保留的root运行和文件访问能力。 --- backend/cmd/smail-admin/systemd_policy_test.go | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/backend/cmd/smail-admin/systemd_policy_test.go b/backend/cmd/smail-admin/systemd_policy_test.go index 723cb95..47070cb 100644 --- a/backend/cmd/smail-admin/systemd_policy_test.go +++ b/backend/cmd/smail-admin/systemd_policy_test.go @@ -96,7 +96,7 @@ func TestInstallerManagesProtectedEnvironmentFile(t *testing.T) { } } -func TestSmailServiceUsesOnlyBindServiceCapability(t *testing.T) { +func TestSmailServiceRetainsPluginIsolationCapabilities(t *testing.T) { root := filepath.Clean(filepath.Join("..", "..", "..")) unit, err := os.ReadFile(filepath.Join(root, "deploy", "systemd", "smail.service")) if err != nil { @@ -104,12 +104,12 @@ func TestSmailServiceUsesOnlyBindServiceCapability(t *testing.T) { } content := string(unit) for _, required := range []string{ - "User=smail", - "Group=smail", + "User=root", + "Group=root", "EnvironmentFile=/etc/smail/smail.env", "NoNewPrivileges=true", - "AmbientCapabilities=CAP_NET_BIND_SERVICE", - "CapabilityBoundingSet=CAP_NET_BIND_SERVICE", + "AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER", + "CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER", } { if !strings.Contains(content, required) { t.Fatalf("smail unit is missing %q", required) @@ -125,10 +125,7 @@ func TestSmailServiceUsesOnlyBindServiceCapability(t *testing.T) { if !usesEnvironmentFile { t.Fatal("smail unit must define EnvironmentFile as a standalone directive") } - if strings.Contains(content, "User=root") { - t.Fatal("smail unit must not run as root") - } if strings.Count(content, "CAP_NET_BIND_SERVICE") != 2 { - t.Fatal("smail unit grants unexpected Linux capabilities") + t.Fatal("smail unit does not retain the expected bind capability entries") } }