host
7cba3c2b21
fix(chv-muse-r12fix3-2): worker socket 组权限 + allowed_uids 含 chv(P6 缺口 ②)
R12 复测 2 钉死:即使 worker active,chv 客户端也永远连不上
socket——worker root + 目录 /run/chv-gitea 0700 root + socket
0600 root + allowed_uids=(0,) 三处锁死;chv ping 一律 EACCES
(rc=2),root ping rc=0,privsep_worker_call 恒为 0,全部同步
走回落。
修法:三处配套改,只改一处仍锁死——
1. chv-gitea-worker.py:DEFAULT_ALLOWED_UIDS=(0, 1000)(root +
chv;round-11 authd 同款;环境变量
CHV_GITEA_WORKER_ALLOWED_UIDS 可覆盖);socket 用 group 权限
(目录 0750、socket 0660、组为第一个非 root 放行 uid 的主组,
_socket_group_gid/_set_group_perms 与 authd 同款实现;gid
解析不出时回落 root-only 0700/0600,绝不放给全员)。
拒绝 0666 探针口径。
2. build.sh tmpfiles.d:d /run/chv-gitea 改为 0750 root 1000,与
新方案一致。gid 写数字 1000 而不用组名 chv——tmpfiles-setup
跑在 07:23:24,chv 用户由 cloud-init 在 07:23:40 才建,组名
当时解析不出;1000 是 chv 的 uid/gid(seed users 块未指定
uid/gid,cloud-init 取首个空闲 1000;authd 同款假设)。
worker 启动时再按 passwd 重新推导 gid 并重设权限,tmpfiles
行只是开机存在性保证。审计日志仍 0600 root,不动。
3. 服务单元 ReadWritePaths 不动(/run/chv-gitea 仍在列,存在性
由 tmpfiles 保证)。
注意:单元内 agent 同样映射为 chv uid 1000,故也能走到 socket,
但只能走类型化协议——操作白名单、仓库 confinement、安全扫描三
处仍在,worker 不持凭证(见 worker 模块注释)。
测试:WorkerSocketGroupPermsTest 新增 7 项——默认白名单含
(0,1000)、环境变量覆盖、gid 可推导时 0750/0660 + 组正确、显式
socket_group 时同样组权限、只有 root 时回落 0700/0600、gid 推导
函数四档、tmpfiles 行 0750 root 1000;WorkerUnitTmpfilesTest 的
/run/chv-gitea 期望改 0750。P6/round12/P2/P4 四模块 205 项全过。
2026-11-08 09:48:16 +00:00
..
2026-10-26 16:27:42 +08:00
2026-10-26 16:47:55 +08:00
2026-10-27 15:53:50 +08:00
2026-10-27 15:53:50 +08:00
2026-10-30 00:49:03 +08:00
2026-10-28 12:12:10 +08:00
2026-10-30 01:55:59 +08:00
2026-10-27 15:53:50 +08:00
2026-10-27 15:53:50 +08:00
2026-10-29 00:19:30 +08:00
2026-10-27 16:27:50 +00:00
2026-10-27 15:53:50 +08:00
2026-10-29 07:01:57 +08:00
2026-10-30 06:00:31 +00:00
2026-10-29 05:27:22 +08:00
2026-11-06 17:59:53 +00:00
2026-10-31 06:55:26 +00:00
2026-11-06 21:36:56 +00:00
2026-11-07 18:13:31 +00:00
2026-11-06 17:43:54 +00:00
2026-11-06 23:03:06 +00:00
2026-11-07 18:13:31 +00:00
2026-11-07 00:48:25 +00:00
2026-11-06 21:31:48 +00:00
2026-11-07 00:43:50 +00:00
2026-11-08 09:45:48 +00:00
2026-11-07 03:58:45 +00:00
2026-11-08 09:45:48 +00:00
2026-11-06 22:25:55 +00:00
2026-11-06 22:25:55 +00:00
2026-11-06 22:25:55 +00:00
2026-11-06 22:25:55 +00:00
2026-11-08 09:48:16 +00:00
2026-11-08 04:26:13 +00:00
2026-11-07 00:36:25 +00:00
2026-11-06 23:03:06 +00:00
2026-11-08 04:31:36 +00:00
2026-11-07 00:09:55 +00:00
2026-11-07 00:09:55 +00:00
2026-11-06 22:38:19 +00:00
2026-11-07 03:52:34 +00:00
2026-11-07 00:57:05 +00:00
2026-11-07 00:09:26 +00:00
2026-11-07 03:56:24 +00:00
2026-11-06 15:34:06 +08:00
2026-11-06 15:13:23 +08:00
2026-10-27 16:27:50 +00:00
2026-11-07 00:09:26 +00:00
2026-10-29 06:32:38 +08:00
2026-10-30 01:32:35 +08:00
2026-10-28 08:57:05 +00:00
2026-10-29 02:42:52 +08:00
2026-10-30 05:11:06 +08:00
2026-10-26 03:23:06 +08:00
2026-10-26 01:32:57 +08:00
2026-10-26 10:26:21 +08:00
2026-10-30 04:17:09 +08:00
2026-10-26 06:19:01 +08:00
2026-10-30 02:53:46 +08:00
2026-10-27 16:27:50 +00:00
2026-10-29 06:32:38 +08:00
2026-10-29 16:45:07 +08:00
2026-10-27 10:56:08 +08:00
2026-10-29 16:32:58 +08:00
2026-10-29 14:21:18 +08:00
2026-10-26 08:39:57 +08:00
2026-10-28 03:43:02 +08:00
2026-10-30 02:53:30 +08:00
2026-10-30 04:05:00 +08:00
2026-10-30 01:32:35 +08:00
2026-10-30 15:39:55 +08:00
2026-10-30 07:15:05 +08:00
2026-10-28 10:13:40 +00:00
2026-10-29 04:40:47 +08:00
2026-10-30 14:46:11 +08:00
2026-10-27 19:10:49 +00:00
2026-10-26 01:23:21 +08:00
2026-10-30 12:58:41 +08:00
2026-10-27 15:35:23 +00:00
2026-10-29 16:45:07 +08:00
2026-10-26 16:27:42 +08:00
2026-10-26 16:27:42 +08:00
2026-10-26 01:32:57 +08:00
2026-10-26 23:51:54 +08:00
2026-10-26 07:42:14 +08:00
2026-10-27 15:35:23 +00:00
2026-10-29 15:31:07 +08:00
2026-10-27 16:27:50 +00:00
2026-10-29 12:42:19 +08:00
2026-10-29 06:32:38 +08:00
2026-10-27 16:37:28 +00:00
2026-10-27 14:12:28 +08:00
2026-10-27 14:12:28 +08:00
2026-10-30 13:36:24 +08:00
2026-10-30 14:27:04 +08:00
2026-10-28 22:49:06 +08:00
2026-10-26 03:23:06 +08:00
2026-10-26 16:47:55 +08:00
2026-10-26 15:20:02 +08:00
2026-10-28 11:14:10 +08:00
2026-10-27 19:10:49 +00:00
2026-10-26 17:01:47 +08:00
2026-10-29 17:46:12 +08:00
2026-10-30 04:15:54 +08:00
2026-10-28 10:12:57 +00:00
2026-10-27 03:05:15 +08:00
2026-10-30 04:18:09 +08:00
2026-10-30 05:11:06 +08:00
2026-10-30 05:11:06 +08:00
2026-10-27 19:10:49 +00:00
2026-10-28 11:09:29 +08:00
2026-10-30 02:46:37 +08:00
2026-10-27 05:40:30 +08:00
2026-10-27 01:44:53 +08:00
2026-10-27 15:53:50 +08:00
2026-10-27 15:53:50 +08:00
2026-10-29 05:41:35 +08:00
2026-10-30 15:14:37 +08:00
2026-10-26 23:17:25 +08:00
2026-10-27 16:27:50 +00:00
2026-10-26 02:46:10 +08:00
2026-10-27 15:35:23 +00:00
2026-10-26 16:47:55 +08:00
2026-10-26 06:46:20 +08:00
2026-10-29 23:16:01 +08:00
2026-10-30 14:46:11 +08:00
2026-10-27 15:35:23 +00:00
2026-10-30 07:15:05 +08:00
2026-10-30 07:08:51 +00:00
2026-10-30 06:00:31 +00:00
2026-10-27 16:37:28 +00:00
2026-10-30 06:33:25 +00:00
2026-10-27 23:09:22 +08:00
2026-10-27 04:30:43 +08:00
2026-10-27 04:40:11 +08:00
2026-10-29 06:32:38 +08:00
2026-10-27 03:17:51 +08:00
2026-10-30 05:11:06 +08:00
2026-10-30 02:25:48 +08:00
2026-10-30 00:39:13 +08:00
2026-10-28 11:14:10 +08:00
2026-10-28 11:25:17 +08:00
2026-10-27 12:58:24 +08:00
2026-10-29 06:32:38 +08:00
2026-10-26 07:24:54 +08:00
2026-10-28 04:56:22 +08:00
2026-10-27 16:37:28 +00:00
2026-10-28 05:36:18 +08:00
2026-10-28 06:10:02 +08:00
2026-10-28 04:33:20 +08:00
2026-10-30 05:11:06 +08:00
2026-10-30 14:46:11 +08:00
2026-11-08 04:32:35 +00:00
2026-10-26 01:23:21 +08:00
2026-10-30 01:16:49 +08:00
2026-10-28 17:14:22 +08:00
2026-10-30 01:16:49 +08:00
2026-10-28 22:17:19 +08:00
2026-10-26 06:46:20 +08:00
2026-10-27 14:12:28 +08:00
2026-10-28 11:25:17 +08:00
2026-10-30 14:46:11 +08:00
2026-10-30 01:38:01 +08:00