github
/
Xray-install
mirror of https://github.com/XTLS/Xray-install
1
0
Fork 0
Code Issues Releases Wiki Activity

feat(install): Add CAP_DAC_READ_SEARCH capability for root user 

When the service is configured to run as the root user (UID 0), the `CAP_DAC_READ_SEARCH` capability is now added to the `CapabilityBoundingSet` and `AmbientCapabilities`.

This ensures that Xray has the necessary read permissions to avoid breaking change when running as root.
pull/101/head
outlook84 2025-08-17 19:45:27 +08:00
parent d63bc1578d
commit 8d462544d0
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
install-release.sh
View File

@ -527,6 +527,12 @@ install_xray() {
install_startup_service_file() { install_startup_service_file() {
mkdir -p '/etc/systemd/system/xray.service.d' mkdir -p '/etc/systemd/system/xray.service.d'
mkdir -p '/etc/systemd/system/xray@.service.d/' mkdir -p '/etc/systemd/system/xray@.service.d/'
local temp_CapabilityBoundingSet="CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE"
local temp_AmbientCapabilities="AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE"
if [[ "$INSTALL_USER_UID" -eq '0' ]]; then
temp_CapabilityBoundingSet="CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH"
temp_AmbientCapabilities="AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH"
fi
cat >/etc/systemd/system/xray.service <<EOF cat >/etc/systemd/system/xray.service <<EOF
[Unit] [Unit]
Description=Xray Service Description=Xray Service
@ -535,8 +541,8 @@ After=network.target nss-lookup.target
[Service] [Service]
User=$INSTALL_USER User=$INSTALL_USER
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE ${temp_CapabilityBoundingSet}
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE ${temp_AmbientCapabilities}
NoNewPrivileges=true NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/config.json
ReadWritePaths=/var/log/xray ReadWritePaths=/var/log/xray
@ -579,8 +585,8 @@ After=network.target nss-lookup.target
[Service] [Service]
User=$INSTALL_USER User=$INSTALL_USER
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE ${temp_CapabilityBoundingSet}
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE ${temp_AmbientCapabilities}
NoNewPrivileges=true NoNewPrivileges=true
ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/%i.json ExecStart=/usr/local/bin/xray run -config /usr/local/etc/xray/%i.json
ReadWritePaths=/var/log/xray ReadWritePaths=/var/log/xray