From 52f7df7bef3415c1c638dda7603c40c736d983a5 Mon Sep 17 00:00:00 2001 From: hmo Date: Tue, 21 Jul 2026 23:45:26 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E6=8F=90=E4=BA=A4=E7=99=BD=E5=90=8D?= =?UTF-8?q?=E5=8D=95=E9=85=8D=E5=A5=97=E2=80=94=E2=80=94guard=E5=B8=A6GIT?= =?UTF-8?q?=5FALLOW=5FCOMMIT=E4=BB=A4=E7=89=8C=20+=20hygiene=E6=96=B0?= =?UTF-8?q?=E5=A2=9E=E9=92=A9=E5=AD=90=E5=AD=98=E5=9C=A8=E6=80=A7=E6=A3=80?= =?UTF-8?q?=E6=9F=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/profile-scripts/deploy_guard.py | 4 +++- deploy/profile-scripts/system_hygiene_audit.py | 17 ++++++++++++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/deploy/profile-scripts/deploy_guard.py b/deploy/profile-scripts/deploy_guard.py index 1b5b17d9..9b68d65e 100644 --- a/deploy/profile-scripts/deploy_guard.py +++ b/deploy/profile-scripts/deploy_guard.py @@ -60,8 +60,10 @@ def xmpp(msg, level=None): def git(*args, check=True): + env = dict(os.environ) + env["GIT_ALLOW_COMMIT"] = "1" # pre-commit 白名单令牌（知微无此令牌无法提交） r = subprocess.run(["git", "-C", REPO] + list(args), - capture_output=True, text=True, timeout=60) + capture_output=True, text=True, timeout=60, env=env) if check and r.returncode != 0: raise RuntimeError(f"git {' '.join(args)}: {r.stderr.strip()[:200]}") return r.stdout.strip() diff --git a/deploy/profile-scripts/system_hygiene_audit.py b/deploy/profile-scripts/system_hygiene_audit.py index 7b5f8407..1a8c355d 100644 --- a/deploy/profile-scripts/system_hygiene_audit.py +++ b/deploy/profile-scripts/system_hygiene_audit.py @@ -170,6 +170,21 @@ def check_orphan_files(): return issues +def check_commit_hook(): + """提交白名单钩子存在性检查（2026-07-21 起：知微 git 写权限封锁的载体， + 被删/被改 = 告警）""" + hook = f'{MOFIN_ROOT}/.git/hooks/pre-commit' + if not os.path.isfile(hook): + return [{'type': '安全机制缺失', 'file': hook, + 'action': 'pre-commit 提交白名单钩子丢失！知微封锁失效，立即恢复'}] + with open(hook, encoding='utf-8', errors='replace') as f: + content = f.read() + if 'GIT_ALLOW_COMMIT' not in content: + return [{'type': '安全机制异常', 'file': hook, + 'action': 'pre-commit 钩子内容被篡改（不含白名单令牌校验）'}] + return [] + + def check_dead_cron(): """cron job 指向不存在的脚本""" issues = [] @@ -280,7 +295,7 @@ def main(): for name, fn in [('分叉副本', check_diverged), ('断裂硬链接', check_broken_hardlinks), ('僵尸进程', check_zombies), ('孤儿文件', check_orphan_files), ('死cron', check_dead_cron), ('DB新鲜度', check_db_freshness), - ('指令冻结session', check_stale_sessions)]: + ('指令冻结session', check_stale_sessions), ('提交白名单钩子', check_commit_hook)]: found = fn() status = f'❌ {len(found)}' if found else '✅' print(f' {status} {name}')