pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-10-15 18:35:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(systemd): let the WireGuard kernel TUN write rp_filter under the sandbox

Browse Source 
ProtectKernelTunables=yes (#6718) mounts all of /proc/sys read-only, and a
WireGuard outbound in kernel-TUN mode zeroes net.ipv4.conf.all.rp_filter (and
its ipv6 and per-device siblings) while Xray creates its handlers, so the core
aborted with "failed to disable ipv4 rp_filter for all: ... read-only file
system". The unit is reinstalled on every update, so a hand edit did not stick.

Keep ProtectKernelTunables and reopen only /proc/sys/net. Turning the
protection off (#6797) also lets the core start, but leaves kernel.core_pattern
writable to the root panel, which turns any panel-level code execution into a
way out of the whole sandbox. net.* is per network namespace and grants nothing
beyond the CAP_NET_ADMIN the panel already holds.

Verified on systemd 257 (Debian trixie) with the shipped unit and the pinned
core: the v3.10.0 unit reproduces the error, the new one starts the kernel TUN,
and kernel.core_pattern stays read-only for the service.

Closes #6796
This commit is contained in:
MHSanaei
2026-10-12 17:52:21 +02:00
parent 097bb7646a
commit 1f2738eda5
3 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
x-ui.service.arch
+4
View File
@@ -50,6 +50,10 @@ ProtectSystem=full
# alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
ReadWritePaths=-/proc/sys/net
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
x-ui.service.debian
+4
View File
@@ -50,6 +50,10 @@ ProtectSystem=full
# alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
ReadWritePaths=-/proc/sys/net
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
x-ui.service.rhel
+4
View File
@@ -50,6 +50,10 @@ ProtectSystem=full
# alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable.
ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui
# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts
# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only.
# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232.
ReadWritePaths=-/proc/sys/net
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes