fix: cve-fix.sh - remove double pause, idempotent blacklist, drop_caches gating

- Remove pause_function from all leaf action functions (menus handle it)
- Module blacklist: trailing newline guard before appending
- rmmod_and_drop_caches: only flush when modules actually unloaded
- Batch mitigation: check grub_add_param and update-grub return values
- Final message reflects actual success/failure state

src/modules/09-security/cve-fix.sh

@@ -73,7 +73,6 @@ security_cve_januscape_detect() {
     local vendor
     if ! vendor="$(security_cve_detect_cpu_vendor)"; then
         echo -e "${GREEN}[通过]${NC} 未检测到 Intel VMX / AMD SVM，非 KVM 虚拟化主机"
-        pause_function
         return 0
     fi
     echo -e "  CPU 虚拟化: ${CYAN}$vendor${NC}"
@@ -91,7 +90,6 @@ security_cve_januscape_detect() {
     else
         echo -e "  状态: ${GREEN}未启用${NC}"
         echo -e "  ${GREEN}嵌套虚拟化已关闭，当前不受 Januscape 影响${NC}"
-        pause_function
         return 0
     fi
 
@@ -110,7 +108,6 @@ security_cve_januscape_detect() {
 
     echo "$UI_DIVIDER"
     echo -e "${RED}[警告] 检测到潜在风险！建议立即采取修补措施。${NC}"
-    pause_function
     return 0
 }
 
@@ -245,7 +242,6 @@ security_cve_januscape_restore() {
 
     if ! grep -q "$nested_param" /etc/default/grub 2>/dev/null; then
         log_warn "未检测到 $nested_param 禁用参数，可能未应用过临时修补"
-        pause_function
         return 0
     fi
 
@@ -295,8 +291,17 @@ security_cve_module_blacklist() {
     local -a modules=("$@")
 
     backup_file "$conf_path" 2>/dev/null || true
+
+    if [[ -f "$conf_path" && -s "$conf_path" ]]; then
+        local last_char
+        last_char="$(tail -c1 "$conf_path" 2>/dev/null || true)"
+        if [[ -n "$last_char" && "$last_char" != $'\n' ]]; then
+            echo >> "$conf_path"
+        fi
+    fi
+
     for mod in "${modules[@]}"; do
-        if [[ -f "$conf_path" ]] && grep -q "^install $mod " "$conf_path" 2>/dev/null; then
+        if [[ -f "$conf_path" ]] && grep -qE "^install[[:space:]]+$mod[[:space:]]" "$conf_path" 2>/dev/null; then
             log_info "模块 $mod 已在黑名单中，跳过"
             continue
         fi
@@ -333,13 +338,22 @@ security_cve_rmmod_and_drop_caches() {
 
     for mod in "${modules[@]}"; do
         if lsmod 2>/dev/null | grep -q "^$mod "; then
-            rmmod "$mod" 2>/dev/null && log_info "已卸载模块: $mod" || log_warn "无法卸载模块: $mod (可能正在使用)"
-            has_mod=1
+            if rmmod "$mod" 2>/dev/null; then
+                log_info "已卸载模块: $mod"
+                has_mod=1
+            else
+                log_warn "无法卸载模块: $mod (可能正在使用)"
+            fi
         fi
     done
 
-    echo 3 > /proc/sys/vm/drop_caches 2>/dev/null
-    log_info "页面缓存已清理"
+    if (( has_mod )); then
+        if echo 3 > /proc/sys/vm/drop_caches 2>/dev/null; then
+            log_info "页面缓存已清理"
+        else
+            log_warn "无法写入 /proc/sys/vm/drop_caches，页面缓存未清理"
+        fi
+    fi
 }
 
 # ============================================================
@@ -379,7 +393,6 @@ security_cve_copyfail_detect() {
     else
         echo -e "${GREEN}未检测到 Copy Fail 直接攻击面。${NC}"
     fi
-    pause_function
     return 0
 }
 
@@ -415,7 +428,6 @@ security_cve_copyfail_mitigate() {
     security_cve_rmmod_and_drop_caches "algif_aead"
     log_success "Copy Fail 缓解措施已应用"
     log_tips "建议立即前往 Dirty Frag 页面应用完整修补"
-    pause_function
 }
 
 # ============================================================
@@ -464,7 +476,6 @@ security_cve_dirtyfrag_detect() {
     else
         echo -e "${GREEN}未检测到 Dirty Frag 直接攻击面。${NC}"
     fi
-    pause_function
     return 0
 }
 
@@ -501,7 +512,6 @@ security_cve_dirtyfrag_mitigate() {
     security_cve_rmmod_and_drop_caches "esp4" "esp6" "rxrpc"
     log_success "Dirty Frag 缓解措施已应用"
     log_tips "建议升级内核以获得永久修复"
-    pause_function
 }
 
 # 共享的 LPE 内核升级引导
@@ -558,7 +568,6 @@ security_cve_lpe_restore() {
     security_cve_module_restore "pve-tools-dirtyfrag"
     security_cve_module_restore "pve-tools-copyfail"
     log_success "LPE 模块黑名单已移除，重启后生效"
-    pause_function
 }
 
 # ============================================================
@@ -600,14 +609,30 @@ security_cve_batch_mitigate() {
     fi
 
     # 1. Januscape
+    local januscape_ok=0
     local vendor
     if vendor="$(security_cve_detect_cpu_vendor)"; then
         case "$vendor" in
-            intel) grub_add_param "kvm_intel.nested=0" && log_success "Januscape: kvm_intel.nested=0 已添加" ;;
-            amd)   grub_add_param "kvm_amd.nested=0" && log_success "Januscape: kvm_amd.nested=0 已添加" ;;
+            intel)
+                if grub_add_param "kvm_intel.nested=0"; then
+                    log_success "Januscape: kvm_intel.nested=0 已添加"
+                    januscape_ok=1
+                else
+                    log_error "Januscape: kvm_intel.nested=0 添加失败"
+                fi
+                ;;
+            amd)
+                if grub_add_param "kvm_amd.nested=0"; then
+                    log_success "Januscape: kvm_amd.nested=0 已添加"
+                    januscape_ok=1
+                else
+                    log_error "Januscape: kvm_amd.nested=0 添加失败"
+                fi
+                ;;
         esac
     else
         log_warn "Januscape: 未检测到 KVM，跳过"
+        januscape_ok=1
     fi
 
     # 2. Dirty Frag
@@ -623,14 +648,19 @@ security_cve_batch_mitigate() {
     security_cve_rmmod_and_drop_caches "algif_aead"
 
     # 4. Update GRUB
+    local grub_ok=0
     if command -v update-grub &>/dev/null; then
-        update-grub
+        if update-grub; then grub_ok=1; fi
     elif command -v grub-mkconfig &>/dev/null; then
-        grub-mkconfig -o /boot/grub/grub.cfg
+        if grub-mkconfig -o /boot/grub/grub.cfg; then grub_ok=1; fi
     fi
 
     echo
-    log_success "批量修补完成！所有缓解措施已应用"
+    if [[ "$januscape_ok" -eq 1 && "$grub_ok" -eq 1 ]]; then
+        log_success "批量修补完成！所有缓解措施已应用"
+    else
+        log_warn "批量修补部分完成，请检查上述错误信息"
+    fi
     log_tips "请重启系统使 GRUB 参数生效"
     echo
     if confirm_action "是否现在重启系统？"; then