SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(device-edge): use compatible Node hardening

Browse Source
This commit is contained in:
Codex
2026-08-12 01:23:38 +03:00
parent 6fa9164933
commit 2eb6116880
4 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
device-plane/vps/systemd/nodedc-device-edge-channel.service
+2 -2
View File
@@ -7,7 +7,7 @@ Wants=network-online.target
Type=simple Type=simple
User=nodedc-channel User=nodedc-channel
Group=nodedc-channel Group=nodedc-channel
ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node --jitless /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs
Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0 Environment=DEVICE_EDGE_CHANNEL_HOST=0.0.0.0
Environment=DEVICE_EDGE_CHANNEL_PORT=8443 Environment=DEVICE_EDGE_CHANNEL_PORT=8443
Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1 Environment=DEVICE_EDGE_CHANNEL_HEALTH_HOST=127.0.0.1
@@ -34,7 +34,7 @@ ProtectHostname=yes
RestrictSUIDSGID=yes RestrictSUIDSGID=yes
RestrictRealtime=yes RestrictRealtime=yes
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=no
SystemCallArchitectures=native SystemCallArchitectures=native
RestrictAddressFamilies=AF_INET AF_INET6 RestrictAddressFamilies=AF_INET AF_INET6
CapabilityBoundingSet= CapabilityBoundingSet=
infra/deploy-runner/build-device-edge-vps-artifact.mjs
+3 -1
View File
@@ -262,7 +262,8 @@ async function assertBoundary() {
"\"runtimeUser\": \"nodedc-channel\"", "\"runtimeUser\": \"nodedc-channel\"",
"\"trackerIngress\": \"disabled\"", "\"trackerIngress\": \"disabled\"",
"User=nodedc-channel", "User=nodedc-channel",
"node --jitless", "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
"MemoryDenyWriteExecute=no",
"tcp dport 8443", "tcp dport 8443",
"MemoryMax=128M", "MemoryMax=128M",
"MemorySwapMax=0", "MemorySwapMax=0",
@@ -279,6 +280,7 @@ async function assertBoundary() {
"LocalForward", "LocalForward",
"tailscale-userspace", "tailscale-userspace",
"DEVICE_EDGE_RELAY_UPSTREAM", "DEVICE_EDGE_RELAY_UPSTREAM",
"--jitless",
]) { ]) {
if (combined.includes(forbidden)) { if (combined.includes(forbidden)) {
throw new Error(`core_channel_boundary_violation:${forbidden}`); throw new Error(`core_channel_boundary_violation:${forbidden}`);
infra/deploy-runner/nodedc-b2-vps-deploy
+1 -1
View File
@@ -202,7 +202,7 @@ PHASE_FILE_SHA256 = {
"vps/config/nftables-core-channel.conf": "vps/config/nftables-core-channel.conf":
"1a04a5450042e80b8a20da3c6634dd6bc68693f191a463ba9a62984279d81d0c", "1a04a5450042e80b8a20da3c6634dd6bc68693f191a463ba9a62984279d81d0c",
"vps/systemd/nodedc-device-edge-channel.service": "vps/systemd/nodedc-device-edge-channel.service":
"57c6c0c5eb952e1e196f50c410a8537468af145941b21dd4aad6ff0e8ca56249", "afb2842db18d1863b2a089b4e89693f1ec17c78921457774ac9652f26b804856",
"deployment/device-edge-vps-core-channel-v1.json": "deployment/device-edge-vps-core-channel-v1.json":
"938f6f7959b78e6be3a6e91a54dca2922fbd813f1a33dca5cebe0dc256a83a14", "938f6f7959b78e6be3a6e91a54dca2922fbd813f1a33dca5cebe0dc256a83a14",
}, },
infra/deploy-runner/test_device_edge_vps_artifact.py
+7 -1
View File
@@ -418,7 +418,13 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
self.assertIn("DEVICE_EDGE_RELAY_SOURCE_POLICY=public-ipv4-only", relay_unit) self.assertIn("DEVICE_EDGE_RELAY_SOURCE_POLICY=public-ipv4-only", relay_unit)
self.assertIn("MemoryMax=192M", relay_unit) self.assertIn("MemoryMax=192M", relay_unit)
self.assertIn("User=nodedc-channel", channel_unit) self.assertIn("User=nodedc-channel", channel_unit)
self.assertIn("node --jitless", channel_unit) self.assertIn(
"ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node "
"/opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
channel_unit,
)
self.assertIn("MemoryDenyWriteExecute=no", channel_unit)
self.assertNotIn("--jitless", channel_unit)
self.assertIn("MemoryMax=128M", channel_unit) self.assertIn("MemoryMax=128M", channel_unit)
self.assertIn("MemorySwapMax=0", channel_unit) self.assertIn("MemorySwapMax=0", channel_unit)
self.assertIn("CPUQuota=50%", channel_unit) self.assertIn("CPUQuota=50%", channel_unit)