Skip to content

feat(security): allow non-root operation and harden service #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
outlook84 wants to merge 7 commits into
base: main
Choose a base branch
from
+220 −31
Open

feat(security): allow non-root operation and harden service #12

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d4de25e
feat(systemd): Harden openlist service unit
outlook84 Aug 15, 2025
50ce900
feat: Allow custom user/group for systemd service
outlook84 Aug 15, 2025
3996c04
feat(script): Add permission checks and fix version file path
outlook84 Aug 16, 2025
875cdcc
Refactor(script): The read (`r`) permission is not needed for parent…
outlook84 Aug 16, 2025
16081c3
feat(script): Validate systemd user and group existence
outlook84 Aug 26, 2025
a057739
Merge remote-tracking branch 'upstream/main'
outlook84 Aug 26, 2025
db039eb
Merge branch 'main' into main
ILoveScratch2 Sep 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions script/v4.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -732,14 +732,38 @@ INIT() {
cat >/etc/systemd/system/openlist.service <<EOF
[Unit]
Description=OpenList service
Wants=network.target
After=network.target network.service
After=network-online.target nss-lookup.target

[Service]
Type=simple
WorkingDirectory=$INSTALL_PATH
ExecStart=$INSTALL_PATH/openlist server
KillMode=process
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_OVERRIDE
NoNewPrivileges=true
ProtectSystem=true
ProtectProc=invisible
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectClock=true
ProtectHostname=true
PrivateTmp=disconnected
PrivateDevices=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictSUIDSGID=true
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@resources
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
RemoveIPC=true
Copy link
Member

@jyxjjj jyxjjj Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although uncertain, but it could potentially affect our upcoming plug-in system.

Copy link
Member

@jyxjjj jyxjjj Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need @dezhishen check this.

IPAddressDeny=multicast
MemoryDenyWriteExecute=true
LockPersonality=true

[Install]
WantedBy=multi-user.target
Expand Down