Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Secure the Logviewer service #354

Open
wants to merge 1 commit into
base: release/107x
Choose a base branch
from

Conversation

pppanghu77
Copy link

Secure the Logviewer service

Log: Secure the Logviewer service
Task: https://pms.uniontech.com/task-view-355359.html

    Secure the Logviewer service

Log: Secure the Logviewer service
Task: https://pms.uniontech.com/task-view-355359.html
@deepin-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pppanghu77

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@deepin-ci-robot
Copy link

deepin pr auto review

代码审查意见:

.gitignore 文件

  • 新增的 .gitignore 规则 !debian/deepin-log-viewer.sysusers 是否有特定的原因需要忽略,如果这个文件是必要的,请确保它不会包含敏感信息。
  • 确认新增的规则是否与项目的其他部分保持一致,避免重复或遗漏。

dldbushandler.cpp 文件

  • isFileExist 函数中,使用 waitForFinished 可能会导致阻塞,建议使用异步调用方式来避免阻塞主线程。
  • qCWarning 日志记录应该包含更多的上下文信息,比如函数名和调用参数,以便于调试。
  • bRet 变量名不够直观,建议使用更具描述性的变量名。

deepin-log-viewer-daemon.service 文件

  • CapabilityBoundingSet 注释掉的部分,如果不需要 CAP_NET_RAW 能力,应该移除注释。
  • User=deepin-daemon 注释掉的部分,如果不需要以 deepin-daemon 用户运行,应该移除注释。
  • ProtectHome=yes 注释掉的部分,如果不需要保护用户主目录,应该移除注释。
  • DeviceAllow=/dev/loop-controlRestrictFileSystems=~@network 注释掉的部分,如果不需要这些权限,应该移除注释。
  • ProtectSystem=strict 设置为 strict 可能会限制很多系统功能,需要确认这是否符合项目需求。
  • InaccessiblePaths 列表中的路径,需要确认这些路径是否确实不应该被访问,以避免潜在的安全风险。
  • NoNewPrivileges=yes 确保服务在运行过程中不会获得新的权限,这有助于提高安全性。
  • MemoryDenyWriteExecute=yes 确保内存区域不允许执行代码,有助于防止某些类型的攻击。

总体来说,代码的改动看起来是为了提高服务的安全性和稳定性,但是需要确保每个改动都有充分的理由,并且不会对现有功能产生负面影响。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants