feat: complete unified plugin admin v1.1.0

scripts/install-local.sh

@@ -46,6 +46,11 @@ done
 command -v go >/dev/null 2>&1 || die "缺少 Go；请安装 Go 1.23 或更高版本"
 command -v systemctl >/dev/null 2>&1 || die "缺少 systemd/systemctl"
 command -v install >/dev/null 2>&1 || die "缺少 install 命令"
+GO_MAJOR=$(go version | sed -nE 's/.* go([0-9]+)\.([0-9]+).*/\1/p')
+GO_MINOR=$(go version | sed -nE 's/.* go([0-9]+)\.([0-9]+).*/\2/p')
+if [[ -z "$GO_MAJOR" || -z "$GO_MINOR" ]] || (( GO_MAJOR < 1 || (GO_MAJOR == 1 && GO_MINOR < 23) )); then
+  die "需要 Go 1.23 或更高版本"
+fi
 
 case "$SELECTION" in
   all) PLUGINS=(plugin-admin subscription-admin) ;;
@@ -78,6 +83,27 @@ random_secret() {
   fi
 }
 
+validate_install_root() {
+  local value=$1 label=$2 component current=""
+  [[ -n "$value" && "$value" = /* && "$value" != "/" ]] || die "$label 必须是非根绝对路径"
+  [[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] || die "$label 包含非法换行"
+  local parts=()
+  IFS='/' read -r -a parts <<< "${value#/}"
+  for component in "${parts[@]}"; do
+    [[ -z "$component" ]] && continue
+    [[ "$component" != "." && "$component" != ".." ]] || die "$label 不能包含 . 或 .. 路径组件"
+    current="$current/$component"
+    [[ ! -L "$current" ]] || die "$label 的路径组件不能是符号链接：$current"
+  done
+  if [[ "$value" != */sub2api-add && "${PLUGIN_ALLOW_CUSTOM_PATHS:-false}" != "true" ]]; then
+    die "$label 必须位于受管的 sub2api-add 目录；如确需自定义路径请显式设置 PLUGIN_ALLOW_CUSTOM_PATHS=true"
+  fi
+}
+
+validate_install_root "$PREFIX" PLUGIN_INSTALL_PREFIX
+validate_install_root "$ETC_DIR" PLUGIN_ETC_DIR
+validate_install_root "$VAR_DIR" PLUGIN_VAR_DIR
+
 install_one() {
   local name=$1 source="$ROOT/plugins/$1" env_file="$ETC_DIR/$1.env"
   local binary_dir="$PREFIX/$1/bin" data_dir="$VAR_DIR/$1"
@@ -125,8 +151,21 @@ Restart=on-failure
 RestartSec=3
 NoNewPrivileges=true
 PrivateTmp=true
+PrivateDevices=true
 ProtectSystem=strict
 ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+CapabilityBoundingSet=
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+TasksMax=128
+MemoryMax=512M
+CPUQuota=200%
 ReadWritePaths=${data_dir}
 
 [Install]