From a7fd517d585403d62dc434f6a06cc16f82403de7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Thu, 6 Aug 2026 14:14:03 +0800 Subject: [PATCH] fix(hlcc): normalize installed template permissions --- .../hololake-code-channel/jd-candidate/hlcc-bootstrap.py | 4 ++++ .../hololake-code-channel/jd-candidate/native.test.js | 2 ++ 2 files changed, 6 insertions(+) diff --git a/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py b/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py index 9d21c98..35bcf9b 100644 --- a/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py +++ b/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py @@ -492,6 +492,10 @@ def bootstrap() -> None: custom_target = STATE_ROOT / "data" / "custom" if custom_source.is_dir(): shutil.copytree(custom_source, custom_target, dirs_exist_ok=True) + for installed in custom_target.rglob("*"): + if installed.is_symlink(): + raise RuntimeError("custom template symlink forbidden") + installed.chmod(0o700 if installed.is_dir() else 0o600) set_status(stage="launching") process = subprocess.Popen( [ diff --git a/server-tools/hololake-code-channel/jd-candidate/native.test.js b/server-tools/hololake-code-channel/jd-candidate/native.test.js index 3b4a552..336722e 100644 --- a/server-tools/hololake-code-channel/jd-candidate/native.test.js +++ b/server-tools/hololake-code-channel/jd-candidate/native.test.js @@ -73,6 +73,8 @@ assert.match(ini, /SHOW_FOOTER_VERSION = false/); assert.match(ini, /\[cron\.update_checker\][\s\S]*ENABLED = false/); assert.match(bootstrap, /stdout=None/); assert.doesNotMatch(bootstrap, /hlcc\.log|log_path\.open/); +assert.match(bootstrap, /custom template symlink forbidden/); +assert.match(bootstrap, /installed\.chmod\(0o700 if installed\.is_dir\(\) else 0o600\)/); assert.match(unit, /^User=guanghu$/m); assert.match(unit, /^ProtectSystem=strict$/m); assert.match(unit, /^ReadOnlyPaths=__RELEASE_ROOT__$/m);