From 7c629a060767941c066ac6a600409a56bf6e0e01 Mon Sep 17 00:00:00 2001 From: stqfdyr <89149493+stqfdyr@users.noreply.github.com> Date: Tue, 15 Sep 2026 13:42:51 +0800 Subject: [PATCH 1/2] =?UTF-8?q?fix:=20agent=20=E6=94=B9=E7=94=A8=E5=9B=BA?= =?UTF-8?q?=E5=AE=9A=E7=B3=BB=E7=BB=9F=E7=94=A8=E6=88=B7=EF=BC=8C=E4=BF=AE?= =?UTF-8?q?=E5=A4=8D=E9=83=A8=E5=88=86=20LXC=20=E5=AE=B9=E5=99=A8=E5=90=AF?= =?UTF-8?q?=E5=8A=A8=E5=A4=B1=E8=B4=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 没开 nesting 的 LXC 容器建不了挂载命名空间。单元写的是静态 User= 时， systemd 会跳过 ProtectSystem= 等挂载类隔离照常启动；写的是 DynamicUser= 时则拒绝启动，报 226/NAMESPACE。 install.sh 先建系统用户 monitor-agent，单元里 DynamicUser=yes 换成 User=monitor-agent，其余隔离项不变。已安装的节点重跑安装命令即可换上新单元。 Fixes #5 --- install.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/install.sh b/install.sh index 6f043cc3..45f029d2 100755 --- a/install.sh +++ b/install.sh @@ -224,6 +224,16 @@ RC exit 0 fi +# A fixed user rather than DynamicUser=: when the mount namespace cannot be +# created, as in an LXC container without nesting, systemd skips ProtectSystem= +# and the other mount sandboxing for a unit with a static User=, but refuses to +# start one with DynamicUser= and exits 226/NAMESPACE. +id -u monitor-agent >/dev/null 2>&1 || + useradd --system --no-create-home --shell /usr/sbin/nologin monitor-agent || { + echo "cannot create the system user monitor-agent" >&2 + exit 1 +} + cat >/etc/systemd/system/monitor-agent.service < Date: Wed, 16 Sep 2026 11:16:11 +0800 Subject: [PATCH 2/2] =?UTF-8?q?fix:=20=E5=8D=95=E5=85=83=E8=A1=A5=E5=9B=9E?= =?UTF-8?q?=20RestrictSUIDSGID=3D=EF=BC=8C=E5=BB=BA=E7=94=A8=E6=88=B7?= =?UTF-8?q?=E6=8F=90=E5=89=8D=E5=88=B0=E4=B8=8B=E8=BD=BD=E4=B8=8E=E6=B3=A8?= =?UTF-8?q?=E5=86=8C=E4=B9=8B=E5=89=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DynamicUser= 隐含 RestrictSUIDSGID= 与 RemoveIPC=，换成静态 User= 后两者 一并失效（systemd-analyze security 由 7.3 降到 7.5）。RestrictSUIDSGID= 明写补回，它由 seccomp 实现，不经挂载命名空间，不会把 226/NAMESPACE 带回来。 RemoveIPC= 对不建 IPC 对象的 agent 没有作用，不再保留。 useradd 原先排在下载、注册与停服之后，失败时节点已经停机、注册键已经花掉， 而单元尚未改写。移到 init 检测之后，并以 $INIT 守住：Alpine 没有 useradd， 无条件执行会让 OpenRC 主机全部装不上。 解释 User= 的注释一并移入单元，systemctl cat 的读者正好看得到。 --- install.sh | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/install.sh b/install.sh index 45f029d2..a0c2ebe7 100755 --- a/install.sh +++ b/install.sh @@ -112,6 +112,16 @@ else exit 1 fi +# The service user the unit below runs as, created before the download and the +# registration, so a host where this fails keeps the agent it already runs and +# spends no registration key. OpenRC has no equivalent and Alpine ships no +# useradd, which is why this is confined to systemd. +if [ "$INIT" = systemd ]; then + id -u monitor-agent >/dev/null 2>&1 || + useradd --system --no-create-home --shell /usr/sbin/nologin monitor-agent || + { echo "cannot create the system user monitor-agent" >&2; exit 1; } +fi + case "$(uname -m)" in x86_64 | amd64) ARCH=x86_64 ;; aarch64 | arm64) ARCH=aarch64 ;; @@ -224,16 +234,6 @@ RC exit 0 fi -# A fixed user rather than DynamicUser=: when the mount namespace cannot be -# created, as in an LXC container without nesting, systemd skips ProtectSystem= -# and the other mount sandboxing for a unit with a static User=, but refuses to -# start one with DynamicUser= and exits 226/NAMESPACE. -id -u monitor-agent >/dev/null 2>&1 || - useradd --system --no-create-home --shell /usr/sbin/nologin monitor-agent || { - echo "cannot create the system user monitor-agent" >&2 - exit 1 -} - cat >/etc/systemd/system/monitor-agent.service <