mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-11 21:59:06 +00:00
UNITRONIX
edfd493be1
Security update H-7 runs the console as User=betterdesk, which cannot bind ports below 1024 without CAP_NET_BIND_SERVICE. Fall back to high ports at startup, add the capability to systemd when .env uses :443/:80, and handle EACCES on listen without an unhandled process crash.
37 lines
1.4 KiB
JavaScript
37 lines
1.4 KiB
JavaScript
'use strict';
|
|
|
|
const {
|
|
buildUpdateSudoersContent,
|
|
resolveSystemctlPath,
|
|
SVC_USER,
|
|
} = require('../scripts/linux-ensure-console-user');
|
|
const { ensureBindCapabilityInServiceUnit } = require('../lib/privilegedPorts');
|
|
|
|
describe('linux-ensure-console-user helpers', () => {
|
|
test('buildUpdateSudoersContent references resolved binary paths', () => {
|
|
const content = buildUpdateSudoersContent();
|
|
expect(content).toContain('# Managed by BetterDesk linux-ensure-console-user.js');
|
|
expect(content).toContain(`${SVC_USER} ALL=(root) NOPASSWD: ${resolveSystemctlPath()}`);
|
|
expect(content).toMatch(/NOPASSWD: \/usr\/bin\/journalctl|NOPASSWD: \/bin\/journalctl/);
|
|
});
|
|
|
|
test('resolveSystemctlPath returns an existing path when available', () => {
|
|
const resolved = resolveSystemctlPath();
|
|
expect(typeof resolved).toBe('string');
|
|
expect(resolved.endsWith('systemctl')).toBe(true);
|
|
});
|
|
|
|
test('ensureBindCapabilityInServiceUnit inserts capability lines after User=', () => {
|
|
const unit = [
|
|
'[Service]',
|
|
'User=betterdesk',
|
|
'ExecStart=/usr/bin/node server.js',
|
|
].join('\n');
|
|
const patched = ensureBindCapabilityInServiceUnit(unit);
|
|
expect(patched.changed).toBe(true);
|
|
expect(patched.content.indexOf('User=betterdesk')).toBeLessThan(
|
|
patched.content.indexOf('AmbientCapabilities=CAP_NET_BIND_SERVICE')
|
|
);
|
|
});
|
|
});
|