awaioi/ERP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 8 Wiki Activity

fix: support older systemd hardening settings

Browse Source
This commit is contained in:
Qiufeng
2026-08-04 09:43:34 +08:00
parent 76a0f1ffbd
commit b792f3f21b
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.sh
+1 -1
View File
@@ -451,7 +451,7 @@ SuccessExitStatus=143
UMask=0077 UMask=0077
NoNewPrivileges=true NoNewPrivileges=true
PrivateTmp=true PrivateTmp=true
ProtectSystem=strict ProtectSystem=full
ProtectHome=true ProtectHome=true
ReadWritePaths="$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT" ReadWritePaths="$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT"
tests/release-scripts.test.sh
+6
View File
@@ -469,6 +469,11 @@ test_linux_service_preflight_requires_systemd() (
NO_SERVICE=1 PATH="$tmp/bin" validate_service_manager NO_SERVICE=1 PATH="$tmp/bin" validate_service_manager
) )
test_systemd_unit_uses_compatible_protection() (
grep -Fqx 'ProtectSystem=full' <(sed -n '/^ cat > \/etc\/systemd\/system\/kaidi-erp.service/,/^ systemctl daemon-reload/p' "$PROJECT_ROOT/install.sh")
! grep -Fq 'ProtectSystem=strict' "$PROJECT_ROOT/install.sh"
)
test_no_service_install_disables_online_update() ( test_no_service_install_disables_online_update() (
local tmp local tmp
tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-no-service-test.XXXXXX")" || return 1 tmp="$(mktemp -d "${TMPDIR:-/tmp}/erp-no-service-test.XXXXXX")" || return 1
@@ -520,6 +525,7 @@ run_test 'update helper rejects a concurrent process' test_update_lock_rejects_c
run_test 'installer moves database setup to the web wizard' test_installer_moves_database_setup_to_web_wizard run_test 'installer moves database setup to the web wizard' test_installer_moves_database_setup_to_web_wizard
run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url run_test 'installer requires an explicit Gitea URL' test_installer_requires_explicit_gitea_url
run_test 'Linux production install requires systemd' test_linux_service_preflight_requires_systemd run_test 'Linux production install requires systemd' test_linux_service_preflight_requires_systemd
run_test 'systemd unit uses compatible protection' test_systemd_unit_uses_compatible_protection
run_test 'no-service install disables online update' test_no_service_install_disables_online_update run_test 'no-service install disables online update' test_no_service_install_disables_online_update
run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token run_test 'release workflow uses the scoped Gitea job token' test_release_workflow_uses_scoped_job_token
run_test 'installer starts correctly when piped to bash' test_installer_runs_when_piped_to_bash run_test 'installer starts correctly when piped to bash' test_installer_runs_when_piped_to_bash