15308555518/ MaxKB
1
0
Fork 0
mirror of https://github.com/1Panel-dev/MaxKB.git synced 2025-12-26 01:33:05 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix: fix incorrect permission may introduce security vulnerabilities.

This commit is contained in:
liqiang-fit2cloud 2025-11-19 14:32:05 +08:00
parent 9d4b2bf010
commit 7d3f92bd51
2 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
apps/common/utils/tool_code.py
View File

@ -36,13 +36,10 @@ class ToolExecutor:
if ToolExecutor._dir_initialized:
# 只初始化一次
return
if self.sandbox:
os.system(f"chown {self.user}:root {self.sandbox_path}")
os.chmod(self.sandbox_path, 0o550)
if CONFIG.get("SANDBOX_TMP_DIR_ENABLED", '0') == "1":
tmp_dir_path = os.path.join(self.sandbox_path, 'tmp')
os.makedirs(tmp_dir_path, 0o700, exist_ok=True)
os.system(f"chown -R {self.user}:root {tmp_dir_path}")
if CONFIG.get("SANDBOX_TMP_DIR_ENABLED", '0') == "1":
tmp_dir_path = os.path.join(self.sandbox_path, 'tmp')
os.makedirs(tmp_dir_path, 0o700, exist_ok=True)
os.system(f"chown -R {self.user}:root {tmp_dir_path}")
if os.path.exists(self.sandbox_so_path):
os.chmod(self.sandbox_so_path, 0o440)
try:

2
installer/Dockerfile-base
View File

@ -26,7 +26,7 @@ RUN ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime && \
curl -L --connect-timeout 120 -m 1800 https://resource.fit2cloud.com/maxkb/ffmpeg/get-ffmpeg-linux | sh && \
mkdir -p /opt/maxkb-app/sandbox && \
useradd --no-create-home --home /opt/maxkb-app/sandbox sandbox -g root && \
chown -R sandbox:root /opt/maxkb-app/sandbox && \
chown -R sandbox:root /opt/maxkb-app/sandbox && chmod 550 /opt/maxkb-app/sandbox && \
chmod g-xr /usr/local/bin/* /usr/bin/* /bin/* /usr/sbin/* /sbin/* /usr/lib/postgresql/17/bin/* && \
chmod g+xr /usr/bin/ld.so && \
chmod g+x /usr/local/bin/python* && \