bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(hlcc): normalize installed template permissions

Browse source
This commit is contained in:
冰朔 2026-08-06 14:14:03 +08:00
commit a7fd517d58
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
View file

@ -492,6 +492,10 @@ def bootstrap() -> None:
custom_target = STATE_ROOT / "data" / "custom"
if custom_source.is_dir():
shutil.copytree(custom_source, custom_target, dirs_exist_ok=True)
for installed in custom_target.rglob("*"):
if installed.is_symlink():
raise RuntimeError("custom template symlink forbidden")
installed.chmod(0o700 if installed.is_dir() else 0o600)
set_status(stage="launching")
process = subprocess.Popen(
[

2
server-tools/hololake-code-channel/jd-candidate/native.test.js
View file

@ -73,6 +73,8 @@ assert.match(ini, /SHOW_FOOTER_VERSION = false/);
assert.match(ini, /\[cron\.update_checker\][\s\S]*ENABLED = false/);
assert.match(bootstrap, /stdout=None/);
assert.doesNotMatch(bootstrap, /hlcc\.log|log_path\.open/);
assert.match(bootstrap, /custom template symlink forbidden/);
assert.match(bootstrap, /installed\.chmod\(0o700 if installed\.is_dir\(\) else 0o600\)/);
assert.match(unit, /^User=guanghu$/m);
assert.match(unit, /^ProtectSystem=strict$/m);
assert.match(unit, /^ReadOnlyPaths=__RELEASE_ROOT__$/m);