From b792f3f21bfb4cf2d290f80a0738d0c8bc0ef36d Mon Sep 17 00:00:00 2001 From: Qiufeng Date: Tue, 4 Aug 2026 09:43:34 +0800 Subject: [PATCH] fix: support older systemd hardening settings --- install.sh | 2 +- tests/release-scripts.test.sh | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/install.sh b/install.sh index b6443ec..c9b03b8 100755 --- a/install.sh +++ b/install.sh @@ -451,7 +451,7 @@ SuccessExitStatus=143 UMask=0077 NoNewPrivileges=true PrivateTmp=true -ProtectSystem=strict +ProtectSystem=full ProtectHome=true ReadWritePaths="$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT" diff --git a/tests/release-scripts.test.sh b/tests/release-scripts.test.sh index 478dbb7..f0c239a 100755 --- a/tests/release-scripts.test.sh +++ b/tests/release-scripts.test.sh @@ -469,6 +469,11 @@ test_linux_service_preflight_requires_systemd() ( NO_SERVICE=1 PATH="$tmp/bin" validate_service_manager ) +test_systemd_unit_uses_compatible_protection() ( + grep -Fqx 'ProtectSystem=full' <(sed -n '/^ cat > \/etc\/systemd\/system\/kaidi-erp.service/,/^ systemctl daemon-reload/p' "$PROJECT_ROOT/install.sh") + ! grep -Fq 'ProtectSystem=strict' "$PROJECT_ROOT/install.sh" +) + test_no_service_install_disables_online_update() ( local tmp tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-no-service-test.XXXXXX")" || return 1 @@ -520,6 +525,7 @@ run_test 'update helper rejects a concurrent process' test_update_lock_rejects_c run_test 'installer moves database setup to the web wizard' test_installer_moves_database_setup_to_web_wizard run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url run_test 'Linux production install requires systemd' test_linux_service_preflight_requires_systemd +run_test 'systemd unit uses compatible protection' test_systemd_unit_uses_compatible_protection run_test 'no-service install disables online update' test_no_service_install_disables_online_update run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token run_test 'installer starts correctly when piped to bash' test_installer_runs_when_piped_to_bash