From fd8873ef75b0d8137e7e6b5f2b934d4721e88bf5 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 29 Sep 2026 19:20:46 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85Linux=E6=8F=92=E4=BB=B6?=
 =?UTF-8?q?=E9=9A=94=E7=A6=BB=E5=9B=9E=E5=BD=92=E7=94=A8=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

验证插件配置和可执行文件在目标文件关闭前完成权限处理，覆盖文件权限与复制流程。
---
 backend/hooks/plugin_isolation_linux_test.go | 34 ++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/backend/hooks/plugin_isolation_linux_test.go b/backend/hooks/plugin_isolation_linux_test.go
index 5d4b91d..d05c332 100644
--- a/backend/hooks/plugin_isolation_linux_test.go
+++ b/backend/hooks/plugin_isolation_linux_test.go
@@ -25,6 +25,40 @@ func TestCopyPluginFileRejectsGrowthPastLimit(t *testing.T) {
 	}
 }
 
+func TestPluginCopiesApplySecurityBeforeClosingTargets(t *testing.T) {
+	directory := t.TempDir()
+	configSource := filepath.Join(directory, "source.json")
+	configTarget := filepath.Join(directory, "target.json")
+	if err := os.WriteFile(configSource, []byte(`{"enabled":true}`), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := copyPluginFile(configSource, configTarget, os.Getuid(), os.Getgid(), 0600); err != nil {
+		t.Fatalf("copy plugin configuration: %v", err)
+	}
+	configInfo, err := os.Stat(configTarget)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if configInfo.Mode().Perm() != 0600 {
+		t.Fatalf("configuration mode = %o, want 0600", configInfo.Mode().Perm())
+	}
+
+	executableSource := filepath.Join(directory, "source-plugin")
+	executableTarget := filepath.Join(directory, "target-plugin")
+	if err := os.WriteFile(executableSource, []byte("plugin"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := copyPluginExecutable(executableSource, executableTarget, os.Getuid(), os.Getgid()); err != nil {
+		t.Fatalf("copy plugin executable: %v", err)
+	}
+	executableInfo, err := os.Stat(executableTarget)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if executableInfo.Mode().Perm() != 0700 {
+		t.Fatalf("executable mode = %o, want 0700", executableInfo.Mode().Perm())
+	}
+}
 func TestInheritedAbstractSocketRemainsReachableAcrossListenerCopy(t *testing.T) {
 	socketName, err := newPluginSocketName(1)
 	if err != nil {