xuans/Smail
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

补齐Smail主服务文件权限能力

Browse Source
This commit is contained in:
smail 2026-09-29 19:12:10 +08:00
parent 0ce1e32de0
commit e563e7c3da
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
deploy/systemd/smail.service
View File

@ -33,9 +33,9 @@ RuntimeDirectoryMode=0750
# 目录由 smail 进程拥有，允许主服务创建受保护的本机控制套接字。
NoNewPrivileges=true
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
# 主进程需要读取 smail 用户权限保护的配置和数据目录，同时保留插件隔离能力。
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_SETUID CAP_SETGID CAP_CHOWN CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
PrivateTmp=true
ProtectHome=true
ProtectSystem=full