Skip to content

docs: agent 改用固定系统用户 monitor-agent #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stqfdyr merged 2 commits into from
Sep 16, 2026
Merged

docs: agent 改用固定系统用户 monitor-agent #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9911e38
docs: agent 改用固定系统用户 monitor-agent
stqfdyr Sep 15, 2026
17a0185
docs: 最小权限表补上 RestrictSUIDSGID
stqfdyr Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/Home.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ const SECURITY = [
},
{
t: "两个服务都降权运行",
d: "systemd 单元带 DynamicUser、NoNewPrivileges、ProtectSystem=strict、ProtectHome、PrivateTmp、PrivateDevices，并限死地址族与内存上限。hub 以专用用户运行，只写得了 data/ 一个目录，连自己的二进制都改不了。",
d: "各以专用系统用户运行，systemd 单元带 NoNewPrivileges、ProtectSystem=strict、ProtectHome、PrivateTmp、PrivateDevices，并限死地址族与内存上限。hub 只写得了 data/ 一个目录，连自己的二进制都改不了。",
},
{
t: "默认只监听回环",
Expand Down
10 changes: 7 additions & 3 deletions src/content/guide/philosophy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,20 +15,24 @@ systemd 单元不是只写一行 `ExecStart`：

| | agent | hub |
|---|---|---|
| 身份 | `DynamicUser`，每次启动一个临时 uid | 专用系统用户 `monitor` |
| 身份 | 专用系统用户 `monitor-agent` | 专用系统用户 `monitor` |
| 文件系统 | `ProtectSystem=strict` + `ProtectHome`，全盘只读 | 同上，另加 `ReadWritePaths` 只开 `data/` |
| 提权 | `NoNewPrivileges` | `NoNewPrivileges` |
| 提权 | `NoNewPrivileges`、`RestrictSUIDSGID` | `NoNewPrivileges`、`RestrictSUIDSGID` |
| 隔离 | `PrivateTmp`、`PrivateDevices` | `PrivateTmp`、`PrivateDevices` |
| 网络 | `RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK` | `AF_INET AF_INET6` |
| 内存 | `MemoryMax=64M` | `MemoryMax=256M` |

hub 因此连自己的二进制都改不了：可写的只有数据库和主题所在的那一个目录。

没开 nesting 的 LXC 容器建不了挂载命名空间，systemd 会跳过「文件系统」和「隔离」两行，服务照常启动，
其余几行不受影响。agent 不用 `DynamicUser` 正是为此：带着它的单元在这种容器里 systemd 拒绝启动，
报 `226/NAMESPACE`。

节点 token 写在 `/opt/monitor/agent.env`，权限 `0600`，不写进服务定义——那些内容会出现在
`systemctl cat` 和日志里。

<Note warn>
OpenRC 上 agent 以 root 运行。`DynamicUser` 是 systemd 白送的降权，OpenRC 没有对应开关，
OpenRC 上 agent 以 root 运行。上表的隔离项都是 systemd 的单元选项，OpenRC 没有对应开关，
两边等价的只有自动重启和 token 的存放方式。
</Note>

Expand Down
1 change: 1 addition & 0 deletions src/content/install/agent.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ done
# systemd
systemctl disable --now monitor-agent
rm -f /etc/systemd/system/monitor-agent.service && systemctl daemon-reload
userdel monitor-agent

# OpenRC
rc-update del monitor-agent default && rc-service monitor-agent stop
Expand Down