chick
934760f8e2
上一轮那段"一键安装"是坏的，而且只在节点上坏。实测三段里漏了三件： 1. systemd 单元写着 `User=msa-agent`，而命令从没创建这个用户； 2. `enroll` 是 sudo 跑的，配置是 root 所有 0600，服务以另一个用户运行——读不到自己的私钥； 3. 单元从 `msa-agent.service` 这个仓库里的路径拷，而节点上没有仓库。 三段都"看起来对"，因为它们各自是一行合理的 shell；错的是它们与单元之间的接缝。这正 是这个项目里反复出现的那一类缺陷。 现在有 `msa-agent install`： - 建 `--system --no-create-home --shell /usr/sbin/nologin` 的用户（已存在则跳过）； - 建日志目录，并把配置、配置目录、日志目录 chown 给该用户； - 把 systemd 单元写进去。单元**嵌在二进制里**（`go:embed`），不是从仓库路径拷的，也不是 从 URL 下的——一个能发 unit 的服务器就能给节点塞一个后门 unit，那与"中继不可信"是同一 条理由。`--print-unit` 可以在装之前把它打出来看； - `daemon-reload` 并 enable/start。 幂等：每步先看已经是什么状态，所以升级或上次失败后重跑都安全。`--dry-run` 打印计划且什么 都不改，并且在缺二进制或配置时**不拒绝**——"还没装"正是会去跑 dry-run 的状态，它只把缺的 东西指出来。chown 走 Runner 而不是 os.Chown，这样整条序列都能在无 root 的情况下测。 install 与 uninstall 共用同一份 `Paths`：装了什么没卸掉会在机器上留一份凭据，卸了什么没装 过会在新节点上失败。单元也一样，`TestVendoredUnitMatchesSystemd` 守着嵌入副本与 `systemd/msa-agent.service` 不漂移。 手机上的安装命令相应简化：`install` 那一步取代了原先手工的 useradd/install/systemctl 三行， 卸载那段也先给 `--dry-run`。 测试新增五项：单元不漂移、install 满足单元的全部要求（用户、所有权、单元来自二进制而非仓库 路径）、install dry run 什么都不改、缺二进制或配置时拒绝且一条命令都不跑、dry run 在全新 节点上不拒绝而是指出缺什么。变异验证：去掉 chown、去掉建用户、让 dry run 执行命令——三处都 让对应测试失败。 Go 全包、Node 134 项、Swift 116 项通过。
65 lines
2.1 KiB
Desktop File
65 lines
2.1 KiB
Desktop File
[Unit]
|
|
Description=MultiSimAdmin relay agent
|
|
Documentation=https://gitea.chickliu.fun/Hermes/simadmin-relay
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/opt/msa-agent/msa-agent --config /etc/msa-agent/config.json
|
|
Restart=always
|
|
# Backing off on our own is not enough: a relay that is down for an hour should not be hammered by
|
|
# every node in the fleet the moment it comes back.
|
|
RestartSec=5
|
|
TimeoutStopSec=20
|
|
KillSignal=SIGTERM
|
|
|
|
User=msa-agent
|
|
Group=msa-agent
|
|
|
|
# The agent needs almost nothing from the host. Everything below is a capability the process never
|
|
# uses, removed so that a compromise of the agent is not automatically a compromise of the box.
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
PrivateUsers=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RemoveIPC=yes
|
|
UMask=0077
|
|
|
|
# Configuration and the audit log are the only writable paths. ReadWritePaths is what keeps
|
|
# ProtectSystem=strict from making the audit log unwritable.
|
|
ReadWritePaths=/var/log/msa-agent
|
|
ConfigurationDirectory=msa-agent
|
|
LogsDirectory=msa-agent
|
|
|
|
# AF_INET and AF_INET6 only: the agent dials out to the relay and to 127.0.0.1, so it has no reason
|
|
# to reach a Unix socket, a netlink family or a packet socket.
|
|
#
|
|
# No IPAddressDeny / IPAddressAllow pair here, deliberately. It reads like the obvious way to pin the
|
|
# agent to loopback, and it is wrong: those directives filter both directions, so IPAddressDeny=any
|
|
# would also cut the outbound connection to the relay the agent exists to maintain. The loopback
|
|
# invariant is enforced in code by internal/egress, which is testable, rather than by a directive
|
|
# that silently breaks the only path out.
|
|
RestrictAddressFamilies=AF_INET AF_INET6
|
|
# No capability at all, so the process cannot even ask to bind a privileged port.
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|