From 1f2738eda5be553325b476fd7bdbea002a165550 Mon Sep 17 00:00:00 2001 From: MHSanaei Date: Mon, 12 Oct 2026 17:52:21 +0200 Subject: [PATCH] fix(systemd): let the WireGuard kernel TUN write rp_filter under the sandbox ProtectKernelTunables=yes (#6718) mounts all of /proc/sys read-only, and a WireGuard outbound in kernel-TUN mode zeroes net.ipv4.conf.all.rp_filter (and its ipv6 and per-device siblings) while Xray creates its handlers, so the core aborted with "failed to disable ipv4 rp_filter for all: ... read-only file system". The unit is reinstalled on every update, so a hand edit did not stick. Keep ProtectKernelTunables and reopen only /proc/sys/net. Turning the protection off (#6797) also lets the core start, but leaves kernel.core_pattern writable to the root panel, which turns any panel-level code execution into a way out of the whole sandbox. net.* is per network namespace and grants nothing beyond the CAP_NET_ADMIN the panel already holds. Verified on systemd 257 (Debian trixie) with the shipped unit and the pinned core: the v3.10.0 unit reproduces the error, the new one starts the kernel TUN, and kernel.core_pattern stays read-only for the service. Closes #6796 --- x-ui.service.arch | 4 ++++ x-ui.service.debian | 4 ++++ x-ui.service.rhel | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/x-ui.service.arch b/x-ui.service.arch index 59c1964c9..c36335d8f 100644 --- a/x-ui.service.arch +++ b/x-ui.service.arch @@ -50,6 +50,10 @@ ProtectSystem=full # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable. ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui +# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts +# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only. +# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232. +ReadWritePaths=-/proc/sys/net ProtectKernelTunables=yes ProtectKernelModules=yes ProtectKernelLogs=yes diff --git a/x-ui.service.debian b/x-ui.service.debian index 074bda292..3a6085d7d 100644 --- a/x-ui.service.debian +++ b/x-ui.service.debian @@ -50,6 +50,10 @@ ProtectSystem=full # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable. ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui +# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts +# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only. +# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232. +ReadWritePaths=-/proc/sys/net ProtectKernelTunables=yes ProtectKernelModules=yes ProtectKernelLogs=yes diff --git a/x-ui.service.rhel b/x-ui.service.rhel index ee2763331..18b115dcd 100644 --- a/x-ui.service.rhel +++ b/x-ui.service.rhel @@ -50,6 +50,10 @@ ProtectSystem=full # alias for older systemd, needed so ProtectSystem=full keeps /etc/x-ui writable. ReadWritePaths=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui ReadWriteDirectories=-/etc/x-ui -/usr/local/x-ui -/var/log/x-ui +# A kernel-TUN WireGuard outbound zeroes net.ipv{4,6}.conf.*.rp_filter as Xray starts +# (#6796). Reopen only /proc/sys/net: kernel.* (core_pattern among them) stays read-only. +# No ReadWriteDirectories alias needed: ProtectKernelTunables itself requires systemd 232. +ReadWritePaths=-/proc/sys/net ProtectKernelTunables=yes ProtectKernelModules=yes ProtectKernelLogs=yes