mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/Mapleawaa/PVE-Tools-9.git
synced 2026-09-20 08:03:35 +08:00
Merge pull request #89 from PVE-Tools/beta-v10
Bump version to v10.0.1 and add CVE fixes and enhancements
This commit is contained in:
CyreneNight
2
.github/workflows/beta-release.yml
vendored
2
.github/workflows/beta-release.yml
vendored
@@ -43,7 +43,7 @@ jobs:
|
||||
|
||||
**直接运行脚本 (推荐)**
|
||||
```bash
|
||||
bash <(curl -sSL https://pve.oowo.cc/PVE-Tools.sh)
|
||||
bash <(curl -sSL https://pve.u3u.icu/PVE-Tools.sh)
|
||||
```
|
||||
files: |
|
||||
dist/PVE-Tools.sh
|
||||
|
||||
2
.github/workflows/release.yml
vendored
2
.github/workflows/release.yml
vendored
@@ -62,7 +62,7 @@ jobs:
|
||||
|
||||
**直接运行脚本 (推荐)**
|
||||
```bash
|
||||
bash <(curl -sSL https://pve.oowo.cc/PVE-Tools.sh)
|
||||
bash <(curl -sSL https://pve.u3u.icu/PVE-Tools.sh)
|
||||
```
|
||||
files: |
|
||||
dist/PVE-Tools.sh
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
PVE Tools Pro 是一个面向 Proxmox VE 9.x 的交互式 Bash 运维工具集。目标是把高频、易错、需要大量人工检查的 PVE 运维动作收口为一个更清晰的菜单驱动工具，配合更严格的校验和更明确的高风险提示，降低误操作概率。
|
||||
|
||||
**官网**: https://pve.oowo.cc | **仓库**: https://github.com/PVE-Tools/PVE-Tools-9
|
||||
**官网**: https://pve.u3u.icu | **仓库**: https://github.com/PVE-Tools/PVE-Tools-9
|
||||
|
||||
## 架构总览
|
||||
|
||||
@@ -95,7 +95,7 @@ graph TD
|
||||
|
||||
```bash
|
||||
# Cloudflare 短域名（推荐）
|
||||
bash <(curl -sSL https://pve.oowo.cc/PVE-Tools.sh)
|
||||
bash <(curl -sSL https://pve.u3u.icu/PVE-Tools.sh)
|
||||
|
||||
# 中国大陆网络
|
||||
bash <(curl -sSL https://ghfast.top/raw.githubusercontent.com/PVE-Tools/PVE-Tools-9/main/PVE-Tools.sh)
|
||||
|
||||
Binary file not shown.
28
README.md
28
README.md
@@ -2,7 +2,7 @@
|
||||
|
||||
<div align="center">
|
||||
|
||||
[官网 / Docs](https://pve.oowo.cc) | [更新日志](https://pve.oowo.cc/update) | [FAQ](https://pve.oowo.cc/faq) | [English](./README_EN.md) | [日本語](./REAMDE-JP.md)
|
||||
[官网 / Docs](https://pve.u3u.icu) | [更新日志](https://pve.u3u.icu/update) | [FAQ](https://pve.u3u.icu/faq) | [English](./README_EN.md) | [日本語](./REAMDE-JP.md)
|
||||
|
||||
[](https://www.gnu.org/licenses/gpl-3.0.html)
|
||||
[](https://www.gnu.org/software/bash/)
|
||||
@@ -49,7 +49,7 @@
|
||||
|
||||
### cloudflare 短域名
|
||||
```bash
|
||||
bash <(curl -sSL https://pve.oowo.cc/PVE-Tools.sh)
|
||||
bash <(curl -sSL https://pve.u3u.icu/PVE-Tools.sh)
|
||||
```
|
||||
|
||||
### 中国大陆网络
|
||||
@@ -83,19 +83,19 @@ PVE Tools Pro 是一个面向 Proxmox VE 9.x 的交互式 Bash 工具。
|
||||
|
||||
## 官网入口
|
||||
|
||||
- 官方文档：https://pve.oowo.cc
|
||||
- 功能特性：https://pve.oowo.cc/features
|
||||
- 更新日志：https://pve.oowo.cc/update
|
||||
- 常见问题：https://pve.oowo.cc/faq
|
||||
- 数据误操作恢复参考：https://pve.oowo.cc/advanced/data-recovery-after-mistake
|
||||
- 宿主机网络 / 防火墙 / IPv6 专题：https://pve.oowo.cc/advanced/host-network-firewall-ipv6
|
||||
- VM 备份 / 迁移 / Cloud-Init 专题：https://pve.oowo.cc/advanced/vm-backup-migration-cloudinit
|
||||
- 官方文档：https://pve.u3u.icu
|
||||
- 功能特性：https://pve.u3u.icu/features
|
||||
- 更新日志：https://pve.u3u.icu/update
|
||||
- 常见问题：https://pve.u3u.icu/faq
|
||||
- 数据误操作恢复参考：https://pve.u3u.icu/advanced/data-recovery-after-mistake
|
||||
- 宿主机网络 / 防火墙 / IPv6 专题：https://pve.u3u.icu/advanced/host-network-firewall-ipv6
|
||||
- VM 备份 / 迁移 / Cloud-Init 专题：https://pve.u3u.icu/advanced/vm-backup-migration-cloudinit
|
||||
|
||||
## Sponsor
|
||||
|
||||
如果这个项目帮你节省了时间、避开了误操作，或者单纯想支持后续维护与继续更新，可以通过以下页面赞助：
|
||||
|
||||
- Sponsor 页面：https://pve.oowo.cc/sponsor
|
||||
- Sponsor 页面：https://pve.u3u.icu/sponsor
|
||||
- 爱发电：https://afdian.com/a/cyrenenight
|
||||
- 微信：
|
||||
|
||||
@@ -105,7 +105,7 @@ PVE Tools Pro 是一个面向 Proxmox VE 9.x 的交互式 Bash 工具。
|
||||
|
||||
如果你需要一对一远程协助、紧急救砖、网络配置、直通问题排查或完整代配，可以直接查看官方付费支持说明：
|
||||
|
||||
- 付费技术支持页面：https://pve.oowo.cc/pay
|
||||
- 付费技术支持页面：https://pve.u3u.icu/pay
|
||||
|
||||
这里购买的是时间与交付结果，不是单纯赞助。
|
||||
|
||||
@@ -118,17 +118,17 @@ PVE Tools Pro 是一个面向 Proxmox VE 9.x 的交互式 Bash 工具。
|
||||
|
||||
这是一个会真实调用 PVE 原生命令并修改宿主机 / VM 配置的运维工具。如果你在没有经过验证的备份、没有维护窗口、没有明确回滚方案的前提下执行高风险动作，可能导致管理面失联、业务中断、配置损坏或不可逆的数据损失。所有数据损失、恢复成本与第三方恢复费用均由实际操作人自行承担。
|
||||
|
||||
完整 ULA 页面：https://pve.oowo.cc/ula
|
||||
完整 ULA 页面：https://pve.u3u.icu/ula
|
||||
该页面主要说明脚本的适用范围、风险边界、用户自担的操作责任，以及对网络中断、配置错误、数据损坏、业务不可用和衍生恢复成本的免责声明。
|
||||
执行备份恢复、迁移、Cloud-Init、磁盘调整、GPU 直通、宿主机网络或防火墙变更前，建议先完整阅读。
|
||||
|
||||
## Community
|
||||
|
||||
- 官网：https://pve.oowo.cc
|
||||
- 官网：https://pve.u3u.icu
|
||||
- GitHub Issues：https://github.com/PVE-Tools/PVE-Tools-9/issues
|
||||
- QQ 群：1031976463
|
||||
- Telegram 群：https://t.me/pvetools233
|
||||
- Sponsor：https://pve.oowo.cc/sponsor
|
||||
- Sponsor：https://pve.u3u.icu/sponsor
|
||||
|
||||
## License
|
||||
|
||||
|
||||
22
README_EN.md
22
README_EN.md
@@ -4,7 +4,7 @@
|
||||
|
||||
An all-in-one operations script for Proxmox VE 9.x, covering VM lifecycle workflows, host networking / firewall / IPv6, GPU / PCI passthrough, day-to-day maintenance, and third-party integrations.
|
||||
|
||||
[Docs](https://pve.oowo.cc) | [Changelog](https://pve.oowo.cc/update) | [FAQ](https://pve.oowo.cc/faq) | [中文](./README.md) | [日本語](./REAMDE-JP.md)
|
||||
[Docs](https://pve.u3u.icu) | [Changelog](https://pve.u3u.icu/update) | [FAQ](https://pve.u3u.icu/faq) | [中文](./README.md) | [日本語](./REAMDE-JP.md)
|
||||
|
||||
</div>
|
||||
|
||||
@@ -30,7 +30,7 @@ Key capabilities:
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
bash <(curl -sSL https://pve.oowo.cc/PVE-Tools.sh)
|
||||
bash <(curl -sSL https://pve.u3u.icu/PVE-Tools.sh)
|
||||
```
|
||||
|
||||
## Safety Notes
|
||||
@@ -42,25 +42,25 @@ bash <(curl -sSL https://pve.oowo.cc/PVE-Tools.sh)
|
||||
|
||||
## Website Links
|
||||
|
||||
- Documentation: https://pve.oowo.cc
|
||||
- Features: https://pve.oowo.cc/features
|
||||
- Changelog: https://pve.oowo.cc/update
|
||||
- FAQ: https://pve.oowo.cc/faq
|
||||
- Host network / firewall / IPv6 guide: https://pve.oowo.cc/advanced/host-network-firewall-ipv6
|
||||
- VM backup / migration / Cloud-Init guide: https://pve.oowo.cc/advanced/vm-backup-migration-cloudinit
|
||||
- Documentation: https://pve.u3u.icu
|
||||
- Features: https://pve.u3u.icu/features
|
||||
- Changelog: https://pve.u3u.icu/update
|
||||
- FAQ: https://pve.u3u.icu/faq
|
||||
- Host network / firewall / IPv6 guide: https://pve.u3u.icu/advanced/host-network-firewall-ipv6
|
||||
- VM backup / migration / Cloud-Init guide: https://pve.u3u.icu/advanced/vm-backup-migration-cloudinit
|
||||
|
||||
## Sponsor
|
||||
|
||||
If this project saves you time or helps you avoid costly mistakes, you can support ongoing maintenance here:
|
||||
|
||||
- Sponsor page: https://pve.oowo.cc/sponsor
|
||||
- Sponsor page: https://pve.u3u.icu/sponsor
|
||||
- Afdian: https://afdian.com/a/cyrenenight
|
||||
|
||||
## Pay For Services
|
||||
|
||||
If you need one-on-one remote support, emergency recovery, passthrough troubleshooting, network work, or a full PVE setup, check the paid support page:
|
||||
|
||||
- Paid support: https://pve.oowo.cc/pay
|
||||
- Paid support: https://pve.u3u.icu/pay
|
||||
|
||||
## Other Languages
|
||||
|
||||
@@ -71,7 +71,7 @@ If you need one-on-one remote support, emergency recovery, passthrough troublesh
|
||||
|
||||
This project is a real operations tool for Proxmox VE hosts and guests. If you run high-risk actions without validated backups, a maintenance window, and a rollback plan, you may cause management-plane loss, guest outage, or irreversible data damage. All data loss, recovery cost, and third-party recovery expenses remain the responsibility of the operator.
|
||||
|
||||
Full ULA page: https://pve.oowo.cc/ula
|
||||
Full ULA page: https://pve.u3u.icu/ula
|
||||
The ULA outlines the intended scope of the script, its risk boundaries, the operator's responsibilities, and the disclaimer for network interruption, configuration mistakes, data damage, service unavailability, and related recovery costs. Read it before running backup or restore, migration, Cloud-Init, disk changes, GPU passthrough, host networking, or firewall operations.
|
||||
|
||||
## License
|
||||
|
||||
BIN
home-full.png
BIN
home-full.png
Binary file not shown.
|
Before Width: | Height: | Size: 305 KiB After Width: | Height: | Size: 545 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 110 KiB After Width: | Height: | Size: 196 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 687 KiB After Width: | Height: | Size: 1.2 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 858 KiB After Width: | Height: | Size: 1.5 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.1 MiB After Width: | Height: | Size: 1.9 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.8 MiB After Width: | Height: | Size: 3.2 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 151 KiB After Width: | Height: | Size: 265 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 2.8 MiB After Width: | Height: | Size: 5.0 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 728 KiB After Width: | Height: | Size: 1.3 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 390 KiB After Width: | Height: | Size: 677 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 914 KiB After Width: | Height: | Size: 1.6 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 952 KiB After Width: | Height: | Size: 1.7 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 810 KiB After Width: | Height: | Size: 1.4 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 831 KiB After Width: | Height: | Size: 1.5 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 851 KiB After Width: | Height: | Size: 1.5 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 124 KiB After Width: | Height: | Size: 233 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 144 KiB After Width: | Height: | Size: 270 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 600 KiB After Width: | Height: | Size: 1.1 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.9 MiB After Width: | Height: | Size: 3.1 MiB |
BIN
images/main.png
BIN
images/main.png
Binary file not shown.
|
Before Width: | Height: | Size: 288 KiB After Width: | Height: | Size: 445 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.2 MiB After Width: | Height: | Size: 2.2 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.2 MiB After Width: | Height: | Size: 2.2 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.1 MiB After Width: | Height: | Size: 1.9 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.6 MiB After Width: | Height: | Size: 2.9 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 614 KiB After Width: | Height: | Size: 1.1 MiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1004 KiB After Width: | Height: | Size: 1.8 MiB |
@@ -3,7 +3,7 @@
|
||||
# Copyright (C) 2026 Ciriu Networks
|
||||
|
||||
# 版本信息
|
||||
CURRENT_VERSION="10.0.0-beta"
|
||||
CURRENT_VERSION="10.0.1"
|
||||
BUILD_NICKNAME="Evanescia"
|
||||
VERSION_FILE_URL="https://raw.githubusercontent.com/PVE-Tools/PVE-Tools-9/main/VERSION"
|
||||
UPDATE_FILE_URL="https://raw.githubusercontent.com/PVE-Tools/PVE-Tools-9/main/UPDATE"
|
||||
|
||||
27
lib/core.sh
27
lib/core.sh
@@ -126,10 +126,11 @@ confirm_high_risk_action() {
|
||||
}
|
||||
vm_show_data_risk_banner() {
|
||||
echo -e "${RED}${UI_DIVIDER}${NC}"
|
||||
echo -e "${RED}高风险提示：以下操作可能直接改写 VM 配置、磁盘、快照、克隆、恢复或迁移状态。${NC}"
|
||||
echo -e "${YELLOW}开始前请确认：已有可验证备份、已核对 VMID/磁盘槽位/目标存储、业务已处于维护窗口。${NC}"
|
||||
echo -e "${YELLOW}一旦误操作，数据恢复成功率通常取决于后续写入量、存储类型以及是否立即停止写入。${NC}"
|
||||
echo -e "${RED}恢复参考: https://pve.oowo.cc/advanced/data-recovery-after-mistake${NC}"
|
||||
echo -e "${RED}以下操作将直接改写 VM 配置、磁盘、快照、克隆、恢复或迁移状态。${NC}"
|
||||
echo -e "${RED}本软件会执行您要求它做的事情，不会替您判断对错。${NC}"
|
||||
echo -e "${RED}您已被告知风险，请确保备份就绪、窗口明确、命令理解到位。${NC}"
|
||||
echo -e "${RED}如果心存疑虑，请停下来——数据无价。${NC}"
|
||||
echo -e "${RED}恢复参考: https://pve.u3u.icu/advanced/data-recovery-after-mistake${NC}"
|
||||
echo -e "${RED}${UI_DIVIDER}${NC}"
|
||||
}
|
||||
|
||||
@@ -146,12 +147,18 @@ ensure_legal_acceptance() {
|
||||
|
||||
clear
|
||||
show_menu_header "许可与服务条款"
|
||||
echo -e "${CYAN}继续使用本脚本前，请先认真阅读并同意以下条款：${NC}"
|
||||
echo -e " - ULA（最终用户许可与使用协议）: https://pve.oowo.cc/ula"
|
||||
echo -e " - TOS（服务条款）: https://pve.oowo.cc/tos"
|
||||
echo -e "${RED} 高风险提醒：涉及宿主机网络、桥接/Bond/VLAN、防火墙，以及 VM、磁盘、快照、克隆、恢复、导入导出、迁移等操作时，可能造成管理面失联、业务中断或不可逆的数据/配置损坏。${NC}"
|
||||
echo -e "${RED} 请仅在已完成可验证备份、明确维护窗口并理解命令影响范围后继续；误操作导致的数据损失、恢复成本与第三方恢复费用均由使用者自行承担。${NC}"
|
||||
echo -e "${RED} 您可以随时撤回同意，只需删除 ${marker} 文件即可。${NC}"
|
||||
echo -e "继续使用本脚本即表示您同意以下条款："
|
||||
echo -e " ${CYAN}ULA${NC}（最终用户许可与使用协议）: https://pve.u3u.icu/ula"
|
||||
echo -e " ${CYAN}TOS${NC}（服务条款）: https://pve.u3u.icu/tos"
|
||||
echo
|
||||
echo -e "${RED}本软件会做您明确告诉它要做的事情，无论那件事情多么荒谬或具有破坏性。${NC}"
|
||||
echo -e "${RED}您已被告知所有风险，并已独立决定使用本软件。${NC}"
|
||||
echo -e "${RED}从此刻起，您与您的数据之间唯一的屏障就是您自己的谨慎与备份策略。${NC}"
|
||||
echo
|
||||
echo -e "${YELLOW}最后提醒：如果您仍然心存疑虑，请不要使用本软件。${NC}"
|
||||
echo -e "${YELLOW}世界上有许多带有商业支持、附带责任保险的成熟 PVE 管理工具，您可以考虑购买它们。${NC}"
|
||||
echo
|
||||
echo -e "${YELLOW} 撤回同意: 删除 ${marker}${NC}"
|
||||
echo -e "${UI_DIVIDER}"
|
||||
echo -n "是否同意协议并继续？(Y/N): "
|
||||
local ans
|
||||
|
||||
@@ -6,7 +6,7 @@ menu_optimization() {
|
||||
while true; do
|
||||
clear
|
||||
echo "功能 1/2 请在外部SSH环境下使用该功能！否则会导致PVE WebUi重启导致Shell断开连接修改失效！"
|
||||
echo "不要犟！查看如何连接到PVE SSH教程：https://pve.oowo.cc/advanced/how-to-connect-ssh.html"
|
||||
echo "不要犟！查看如何连接到PVE SSH教程：https://pve.u3u.icu/advanced/how-to-connect-ssh.html"
|
||||
show_menu_header "系统优化"
|
||||
show_menu_option "1" "删除订阅弹窗"
|
||||
show_menu_option "2" "${MAGENTA}一键优化 (换源+删弹窗+更新)${NC}"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
igpu_gvtg_setup() {
|
||||
echo -e "${H2}开始配置 Intel 6-10代 GVT-g 核显虚拟化${NC}"
|
||||
echo -e "详细原理与教程： ${CYAN}https://pve.oowo.cc/advanced/gpu-virtualization${NC}"
|
||||
echo -e "详细原理与教程： ${CYAN}https://pve.u3u.icu/advanced/gpu-virtualization${NC}"
|
||||
echo -e "如果配置失败，请访问文档站下方留言反馈。"
|
||||
echo
|
||||
|
||||
|
||||
@@ -50,7 +50,7 @@ restore_qemu_kvm() {
|
||||
intel_gpu_passthrough() {
|
||||
log_step "开始 Intel 核显直通配置"
|
||||
echo "注意：此功能基于 AICodo 的修改版 QEMU 和 ROM"
|
||||
echo "详细原理与教程：https://pve.oowo.cc/advanced/gpu-passthrough"
|
||||
echo "详细原理与教程：https://pve.u3u.icu/advanced/gpu-passthrough"
|
||||
echo "适用于需要将 Intel 核显直通给 Windows 虚拟机且遇到代码 43 或黑屏的情况"
|
||||
echo "支持的 CPU 架构：6代(Skylake) 到 14代(Raptor Lake Refresh)"
|
||||
echo "项目地址：https://github.com/AICodo/intel6-14rom"
|
||||
@@ -65,7 +65,7 @@ intel_gpu_passthrough() {
|
||||
log_warn "折腾有风险，入坑需谨慎！"
|
||||
echo
|
||||
log_tips "如果配置失败，请访问文档站查看详细教程并留言反馈："
|
||||
log_tips "🔗 https://pve.oowo.cc/advanced/gpu-passthrough"
|
||||
log_tips "🔗 https://pve.u3u.icu/advanced/gpu-passthrough"
|
||||
echo
|
||||
log_tips "如需要反馈或者请求更新ROM文件适配你的CPU，请前往AICodo的GitHub仓库开ISSUE反馈，不是找我。"
|
||||
echo
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
igpu_sriov_setup() {
|
||||
echo -e "${H2}开始配置 Intel 11-15代 SR-IOV 核显虚拟化${NC}"
|
||||
echo -e "详细原理与教程： ${CYAN}https://pve.oowo.cc/advanced/gpu-virtualization${NC}"
|
||||
echo -e "详细原理与教程： ${CYAN}https://pve.u3u.icu/advanced/gpu-virtualization${NC}"
|
||||
echo -e "如果配置失败，请访问文档站下方留言反馈。"
|
||||
echo
|
||||
|
||||
|
||||
@@ -585,7 +585,7 @@ nvidia_setup_vgpu_unlock() {
|
||||
echo " 驱动/内核/补丁版本不匹配可能导致服务异常、宿主机告警或 VM 无法使用 vGPU。"
|
||||
echo
|
||||
echo -e "${CYAN}推荐先阅读 Wiki：${NC}"
|
||||
echo " 对应文章: https://pve.oowo.cc/advanced/nvidia-vgpu-driver-notes"
|
||||
echo " 对应文章: https://pve.u3u.icu/advanced/nvidia-vgpu-driver-notes"
|
||||
echo "${UI_DIVIDER}"
|
||||
read -p "请输入 '确认' 或 'Sure' 继续: " response
|
||||
response=$(echo "$response" | xargs)
|
||||
|
||||
@@ -96,7 +96,7 @@ check_update() {
|
||||
|
||||
echo -e "----------------------------------------------"
|
||||
echo -e "${CYAN}官方文档与最新脚本：${NC}"
|
||||
echo -e "🔗 https://pve.oowo.cc (推荐)"
|
||||
echo -e "🔗 https://pve.u3u.icu (推荐)"
|
||||
echo -e "🔗 https://github.com/PVE-Tools/PVE-Tools-9"
|
||||
echo -e "${UI_FOOTER}"
|
||||
echo -e "按 ${GREEN}回车键${NC} 进入主菜单..."
|
||||
|
||||
797
src/modules/09-security/cve-fix.sh
Normal file
797
src/modules/09-security/cve-fix.sh
Normal file
@@ -0,0 +1,797 @@
|
||||
#!/bin/bash
|
||||
# SPDX-License-Identifier: GPL-3.0-only
|
||||
# Copyright (C) 2026 Ciriu Networks
|
||||
|
||||
# 检测宿主机 CPU 虚拟化厂商 (Intel VMX / AMD SVM)
|
||||
security_cve_detect_cpu_vendor() {
|
||||
if grep -q vmx /proc/cpuinfo 2>/dev/null; then
|
||||
echo "intel"
|
||||
return 0
|
||||
elif grep -q svm /proc/cpuinfo 2>/dev/null; then
|
||||
echo "amd"
|
||||
return 0
|
||||
fi
|
||||
return 1
|
||||
}
|
||||
|
||||
# 检测嵌套虚拟化是否启用
|
||||
security_cve_detect_nested_virt() {
|
||||
local vendor
|
||||
vendor="$(security_cve_detect_cpu_vendor)" || return 2
|
||||
|
||||
case "$vendor" in
|
||||
intel)
|
||||
if [[ -f /sys/module/kvm_intel/parameters/nested ]]; then
|
||||
local nested
|
||||
nested="$(cat /sys/module/kvm_intel/parameters/nested 2>/dev/null)"
|
||||
[[ "$nested" == "Y" || "$nested" == "1" ]] && return 0
|
||||
fi
|
||||
;;
|
||||
amd)
|
||||
if [[ -f /sys/module/kvm_amd/parameters/nested ]]; then
|
||||
local nested
|
||||
nested="$(cat /sys/module/kvm_amd/parameters/nested 2>/dev/null)"
|
||||
[[ "$nested" == "1" ]] && return 0
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
return 1
|
||||
}
|
||||
|
||||
# 检测内核构建日期是否早于修复日期（仅供参考，backport 内核可能误判）
|
||||
security_cve_detect_kernel_build_date_before() {
|
||||
local cutoff_date="${1:-2026-06-19}"
|
||||
local kernel_build_date
|
||||
kernel_build_date="$(cat /proc/version 2>/dev/null | sed -n 's/.*SMP PREEMPT[^ ]* //p' | cut -d' ' -f2- 2>/dev/null)"
|
||||
if [[ -z "$kernel_build_date" ]]; then
|
||||
kernel_build_date="$(uname -v 2>/dev/null)"
|
||||
fi
|
||||
|
||||
local build_epoch cutoff_epoch
|
||||
build_epoch="$(date -d "$kernel_build_date" +%s 2>/dev/null)" || return 2
|
||||
cutoff_epoch="$(date -d "$cutoff_date" +%s 2>/dev/null)" || return 2
|
||||
|
||||
[[ "$build_epoch" -lt "$cutoff_epoch" ]] && return 0
|
||||
return 1
|
||||
}
|
||||
|
||||
# Januscape (CVE-2026-53359) 综合漏洞检测
|
||||
security_cve_januscape_detect() {
|
||||
clear
|
||||
show_menu_header "Januscape (CVE-2026-53359) 漏洞检测"
|
||||
|
||||
echo -e "${CYAN}漏洞概述：${NC}"
|
||||
echo " Januscape 是 KVM/x86 shadow MMU 中的 use-after-free 漏洞"
|
||||
echo " 影响范围：2010-08 ~ 2026-06-19（潜伏约 16 年）"
|
||||
echo " 危害等级：${RED}严重 (Guest-to-Host Escape)${NC}"
|
||||
echo " 触发条件：宿主机启用嵌套虚拟化 + 非特权客户机"
|
||||
echo " CVE 编号：CVE-2026-53359"
|
||||
echo " 修复提交：81ccda30b4e8 (mainline 2026-06-19)"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
# 1. 检测 KVM 模块
|
||||
local vendor
|
||||
if ! vendor="$(security_cve_detect_cpu_vendor)"; then
|
||||
echo -e "${GREEN}[通过]${NC} 未检测到 Intel VMX / AMD SVM，非 KVM 虚拟化主机"
|
||||
return 0
|
||||
fi
|
||||
echo -e " CPU 虚拟化: ${CYAN}$vendor${NC}"
|
||||
|
||||
# 2. 检测嵌套虚拟化
|
||||
echo -e "${CYAN}嵌套虚拟化检测：${NC}"
|
||||
if security_cve_detect_nested_virt; then
|
||||
local nested_param
|
||||
case "$vendor" in
|
||||
intel) nested_param="$(cat /sys/module/kvm_intel/parameters/nested 2>/dev/null)" ;;
|
||||
amd) nested_param="$(cat /sys/module/kvm_amd/parameters/nested 2>/dev/null)" ;;
|
||||
esac
|
||||
echo -e " 状态: ${RED}已启用${NC} (kvm_${vendor}.nested=$nested_param)"
|
||||
echo -e " ${RED}风险: 系统存在被 Januscape 攻击的前提条件${NC}"
|
||||
else
|
||||
echo -e " 状态: ${GREEN}未启用${NC}"
|
||||
echo -e " ${GREEN}嵌套虚拟化已关闭，当前不受 Januscape 影响${NC}"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# 3. 检测内核版本
|
||||
echo -e "${CYAN}内核版本检测：${NC}"
|
||||
local current_kernel
|
||||
current_kernel="$(uname -r)"
|
||||
echo " 当前内核: $current_kernel"
|
||||
|
||||
security_cve_detect_kernel_build_date_before "2026-06-19"
|
||||
case $? in
|
||||
0) echo -e " 内核编译日期早于 2026-06-19: ${RED}可能受影响${NC} (仅供参考)" ;;
|
||||
1) echo -e " 内核编译日期晚于 2026-06-19: ${GREEN}可能已包含修复${NC} (仅供参考)" ;;
|
||||
*) echo -e " 内核编译日期: ${YELLOW}无法确定${NC} (若有疑问请检查 changelog)" ;;
|
||||
esac
|
||||
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${RED}[警告] 检测到潜在风险！建议立即采取修补措施。${NC}"
|
||||
return 0
|
||||
}
|
||||
|
||||
# Januscape 临时修补：禁用嵌套虚拟化
|
||||
security_cve_januscape_mitigate() {
|
||||
block_non_pve9_destructive "Januscape 临时修补" || return 1
|
||||
|
||||
clear
|
||||
show_menu_header "Januscape 临时修补 — 禁用嵌套虚拟化"
|
||||
|
||||
echo " 此操作将通过 GRUB 内核参数禁用 KVM 嵌套虚拟化："
|
||||
echo " Intel: kvm_intel.nested=0"
|
||||
echo " AMD: kvm_amd.nested=0"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${YELLOW}影响说明：${NC}"
|
||||
echo " • 嵌套虚拟化关闭后，VM 内将无法再运行虚拟机（不支持 L2）"
|
||||
echo " • 不影响普通 VM 的正常运行"
|
||||
echo " • 重启后生效"
|
||||
echo " • 可随时通过「恢复嵌套虚拟化」功能还原"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if ! confirm_high_risk_action \
|
||||
"禁用 KVM 嵌套虚拟化 (Januscape 临时修补)" \
|
||||
"将通过 GRUB 添加 kvm_intel.nested=0 或 kvm_amd.nested=0 参数。" \
|
||||
"嵌套虚拟化关闭后，已有嵌套 VM (L2) 将无法启动。重启后生效。" \
|
||||
"请确认你了解此操作的影响。如需回滚可使用「恢复嵌套虚拟化」。" \
|
||||
"CONFIRM"; then
|
||||
log_info "用户取消操作"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local vendor
|
||||
vendor="$(security_cve_detect_cpu_vendor)" || {
|
||||
log_error "无法检测 CPU 虚拟化类型"
|
||||
return 1
|
||||
}
|
||||
|
||||
local nested_param
|
||||
case "$vendor" in
|
||||
intel) nested_param="kvm_intel.nested=0" ;;
|
||||
amd) nested_param="kvm_amd.nested=0" ;;
|
||||
esac
|
||||
|
||||
log_info "正在添加 GRUB 参数: $nested_param"
|
||||
if ! grub_add_param "$nested_param"; then
|
||||
log_error "GRUB 参数添加失败"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log_info "正在更新 GRUB 配置..."
|
||||
if command -v update-grub &>/dev/null; then
|
||||
if ! update-grub; then
|
||||
log_error "update-grub 执行失败，请手动检查 GRUB 配置"
|
||||
return 1
|
||||
fi
|
||||
elif command -v grub-mkconfig &>/dev/null; then
|
||||
if ! grub-mkconfig -o /boot/grub/grub.cfg; then
|
||||
log_error "grub-mkconfig 执行失败，请手动检查 GRUB 配置"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
log_error "找不到 GRUB 更新工具 (update-grub / grub-mkconfig)"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log_success "临时修补完成！嵌套虚拟化将在重启后关闭"
|
||||
log_tips "请执行 reboot 重启系统使配置生效"
|
||||
echo
|
||||
if confirm_action "是否现在重启系统？"; then
|
||||
reboot
|
||||
fi
|
||||
}
|
||||
|
||||
# Januscape 升级内核修补
|
||||
security_cve_januscape_kernel_fix() {
|
||||
clear
|
||||
show_menu_header "Januscape 升级内核修补"
|
||||
|
||||
echo " Januscape (CVE-2026-53359) 已于 2026-06-19 在内核主线修复"
|
||||
echo " 修复提交: 81ccda30b4e8"
|
||||
echo " 参考链接: https://github.com/V4bel/Januscape"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
local current_kernel
|
||||
current_kernel="$(uname -r)"
|
||||
echo -e " 当前内核版本: ${CYAN}$current_kernel${NC}"
|
||||
|
||||
security_cve_detect_kernel_build_date_before "2026-06-19"
|
||||
case $? in
|
||||
0) echo -e " 状态: ${RED}内核编译日期早于修复日期，可能受影响${NC} (仅供参考)" ;;
|
||||
1) echo -e " 状态: ${GREEN}内核编译日期晚于修复日期，可能已包含修复${NC} (仅供参考)" ;;
|
||||
*) echo -e " 状态: ${YELLOW}无法通过编译日期确定${NC}" ;;
|
||||
esac
|
||||
|
||||
echo "$UI_DIVIDER"
|
||||
echo " 修补方式："
|
||||
echo " 1. 前往「内核管理」安装最新内核（推荐）"
|
||||
echo " 2. 或使用「临时修补」先关闭嵌套虚拟化"
|
||||
echo " 3. 安装新内核后，重启并验证嵌套虚拟化仍可安全使用"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if confirm_action "是否前往内核管理菜单安装新内核？"; then
|
||||
kernel_management_menu
|
||||
fi
|
||||
}
|
||||
|
||||
# 恢复嵌套虚拟化（移除禁用参数）
|
||||
security_cve_januscape_restore() {
|
||||
block_non_pve9_destructive "恢复嵌套虚拟化" || return 1
|
||||
|
||||
clear
|
||||
show_menu_header "恢复嵌套虚拟化"
|
||||
|
||||
echo " 此操作将移除之前添加的 KVM 嵌套虚拟化禁用参数"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${YELLOW}注意：${NC}"
|
||||
echo " • 恢复嵌套虚拟化后，如果内核未升级到已修复版本，系统将重新面临风险"
|
||||
echo " • 建议先确认内核已包含 Januscape 修复后再执行此操作"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
local vendor
|
||||
vendor="$(security_cve_detect_cpu_vendor)" || {
|
||||
log_error "无法检测 CPU 虚拟化类型"
|
||||
return 1
|
||||
}
|
||||
|
||||
local nested_param
|
||||
case "$vendor" in
|
||||
intel) nested_param="kvm_intel.nested" ;;
|
||||
amd) nested_param="kvm_amd.nested" ;;
|
||||
esac
|
||||
|
||||
if ! grep -q "$nested_param" /etc/default/grub 2>/dev/null; then
|
||||
log_warn "未检测到 $nested_param 禁用参数，可能未应用过临时修补"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if ! confirm_high_risk_action \
|
||||
"恢复 KVM 嵌套虚拟化" \
|
||||
"将移除 GRUB 中的 $nested_param 禁用参数。" \
|
||||
"如果内核未包含 Januscape 修复，系统将重新面临 CVE-2026-53359 攻击风险。" \
|
||||
"请先确认已通过内核升级获得修复，或确认你接受该风险。" \
|
||||
"CONFIRM"; then
|
||||
log_info "用户取消操作"
|
||||
return 0
|
||||
fi
|
||||
|
||||
log_info "正在移除 GRUB 参数: $nested_param"
|
||||
if ! grub_remove_param "$nested_param"; then
|
||||
log_warn "GRUB 参数移除可能失败（参数不存在或 GRUB 配置异常）"
|
||||
fi
|
||||
|
||||
log_info "正在更新 GRUB 配置..."
|
||||
if command -v update-grub &>/dev/null; then
|
||||
if ! update-grub; then
|
||||
log_error "update-grub 执行失败，请手动检查 GRUB 配置"
|
||||
return 1
|
||||
fi
|
||||
elif command -v grub-mkconfig &>/dev/null; then
|
||||
if ! grub-mkconfig -o /boot/grub/grub.cfg; then
|
||||
log_error "grub-mkconfig 执行失败，请手动检查 GRUB 配置"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
log_error "找不到 GRUB 更新工具 (update-grub / grub-mkconfig)"
|
||||
return 1
|
||||
fi
|
||||
|
||||
log_success "嵌套虚拟化将在重启后恢复正常"
|
||||
echo
|
||||
if confirm_action "是否现在重启系统？"; then
|
||||
reboot
|
||||
fi
|
||||
}
|
||||
|
||||
# 通用：写入内核模块黑名单到 /etc/modprobe.d
|
||||
security_cve_module_blacklist() {
|
||||
local conf_name="$1"
|
||||
local conf_path="/etc/modprobe.d/${conf_name}.conf"
|
||||
shift
|
||||
local -a modules=("$@")
|
||||
|
||||
backup_file "$conf_path" 2>/dev/null || true
|
||||
|
||||
if [[ -f "$conf_path" && -s "$conf_path" ]]; then
|
||||
local last_char
|
||||
last_char="$(tail -c1 "$conf_path" 2>/dev/null || true)"
|
||||
if [[ -n "$last_char" && "$last_char" != $'\n' ]]; then
|
||||
echo >> "$conf_path"
|
||||
fi
|
||||
fi
|
||||
|
||||
for mod in "${modules[@]}"; do
|
||||
if [[ -f "$conf_path" ]] && grep -qE "^install[[:space:]]+$mod[[:space:]]" "$conf_path" 2>/dev/null; then
|
||||
log_info "模块 $mod 已在黑名单中，跳过"
|
||||
continue
|
||||
fi
|
||||
if ! echo "install $mod /bin/false" >> "$conf_path"; then
|
||||
log_error "无法写入黑名单: $conf_path"
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
log_success "已写入模块黑名单: $conf_path"
|
||||
return 0
|
||||
}
|
||||
|
||||
# 通用：移除内核模块黑名单配置文件
|
||||
security_cve_module_restore() {
|
||||
local conf_name="$1"
|
||||
local conf_path="/etc/modprobe.d/${conf_name}.conf"
|
||||
|
||||
if [[ ! -f "$conf_path" ]]; then
|
||||
log_warn "未找到黑名单配置 $conf_path，无需还原"
|
||||
return 0
|
||||
fi
|
||||
backup_file "$conf_path" 2>/dev/null || true
|
||||
if ! rm -f "$conf_path"; then
|
||||
log_error "无法移除黑名单配置: $conf_path"
|
||||
return 1
|
||||
fi
|
||||
log_success "已移除模块黑名单: $conf_path"
|
||||
}
|
||||
|
||||
# 通用：卸载内核模块并清理页面缓存
|
||||
security_cve_rmmod_and_drop_caches() {
|
||||
local -a modules=("$@")
|
||||
local has_mod=0
|
||||
|
||||
for mod in "${modules[@]}"; do
|
||||
if lsmod 2>/dev/null | grep -q "^$mod "; then
|
||||
if rmmod "$mod" 2>/dev/null; then
|
||||
log_info "已卸载模块: $mod"
|
||||
has_mod=1
|
||||
else
|
||||
log_warn "无法卸载模块: $mod (可能正在使用)"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if (( has_mod )); then
|
||||
if echo 3 > /proc/sys/vm/drop_caches 2>/dev/null; then
|
||||
log_info "页面缓存已清理"
|
||||
else
|
||||
log_warn "无法写入 /proc/sys/vm/drop_caches，页面缓存未清理"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# Copy Fail — Page-Cache Write LPE (algif_aead)
|
||||
# ============================================================
|
||||
|
||||
security_cve_copyfail_detect() {
|
||||
clear
|
||||
show_menu_header "Copy Fail 漏洞检测 (LPE)"
|
||||
|
||||
echo -e "${CYAN}漏洞概述：${NC}"
|
||||
echo " Copy Fail 属于 Dirty Pipe/Dirty Frag 同类的 Page-Cache Write 漏洞"
|
||||
echo " 通过 splice() + AF_ALG 实现在只读文件上写入任意数据"
|
||||
echo " 危害等级：${RED}高危 (Local Privilege Escalation → root)${NC}"
|
||||
echo " 影响范围：大多数主流 Linux 发行版"
|
||||
echo " 利用模块：algif_aead"
|
||||
echo " 参考链接：https://copy.fail"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
echo -e "${CYAN}模块检测：${NC}"
|
||||
|
||||
local found=0
|
||||
if lsmod 2>/dev/null | grep -q '^algif_aead '; then
|
||||
echo -e " algif_aead: ${RED}已加载${NC} — 系统可能受 Copy Fail 影响"
|
||||
found=1
|
||||
elif modinfo algif_aead &>/dev/null; then
|
||||
echo -e " algif_aead: ${YELLOW}可用但未加载${NC} — 潜在风险"
|
||||
found=1
|
||||
else
|
||||
echo -e " algif_aead: ${GREEN}不可用${NC}"
|
||||
fi
|
||||
|
||||
echo "$UI_DIVIDER"
|
||||
if [[ "$found" -eq 1 ]]; then
|
||||
echo -e "${RED}[警告] 检测到 Copy Fail 攻击面。注意：Dirty Frag 可绕过 Copy Fail 缓解措施！${NC}"
|
||||
echo -e "${YELLOW}建议同时应用 Dirty Frag 修补以获得完整保护。${NC}"
|
||||
else
|
||||
echo -e "${GREEN}未检测到 Copy Fail 直接攻击面。${NC}"
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
security_cve_copyfail_mitigate() {
|
||||
block_non_pve9_destructive "Copy Fail 修补" || return 1
|
||||
|
||||
clear
|
||||
show_menu_header "Copy Fail 修补 — 禁用 algif_aead"
|
||||
|
||||
echo " 此操作将创建 /etc/modprobe.d/pve-tools-copyfail.conf"
|
||||
echo " 禁用 algif_aead 内核模块"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${RED}重要提示：${NC}"
|
||||
echo " • Copy Fail 缓解措施（禁用 algif_aead）${RED}可被 Dirty Frag 绕过${NC}"
|
||||
echo " • 建议同步应用 Dirty Frag 修补（esp4/esp6/rxrpc）"
|
||||
echo " • 推荐方案：使用「一键批量修补」或升级内核"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if ! confirm_high_risk_action \
|
||||
"禁用 algif_aead 模块 (Copy Fail 缓解)" \
|
||||
"将创建 modprobe.d 黑名单阻止 algif_aead 加载，并卸载已加载的模块。" \
|
||||
"可能影响 IPsec AEAD 相关功能。此措施可被 Dirty Frag 绕过。" \
|
||||
"建议同时应用 Dirty Frag 修补。" \
|
||||
"CONFIRM"; then
|
||||
log_info "用户取消操作"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if ! security_cve_module_blacklist "pve-tools-copyfail" "algif_aead"; then
|
||||
log_error "Copy Fail 黑名单写入失败"
|
||||
return 1
|
||||
fi
|
||||
security_cve_rmmod_and_drop_caches "algif_aead"
|
||||
log_success "Copy Fail 缓解措施已应用"
|
||||
log_tips "建议立即前往 Dirty Frag 页面应用完整修补"
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# Dirty Frag — xfrm-ESP + RxRPC Page-Cache Write LPE
|
||||
# CVE-2026-43284 + CVE-2026-43500
|
||||
# ============================================================
|
||||
|
||||
security_cve_dirtyfrag_detect() {
|
||||
clear
|
||||
show_menu_header "Dirty Frag (CVE-2026-43284 + CVE-2026-43500) 检测"
|
||||
|
||||
echo -e "${CYAN}漏洞概述：${NC}"
|
||||
echo " Dirty Frag 是 Dirty Pipe/Copy Fail 同类 Page-Cache Write 漏洞"
|
||||
echo " 由两个漏洞链式组合实现通用 Linux 本地提权 (LPE → root)"
|
||||
echo " 是确定性逻辑漏洞，无需竞争条件，成功率极高"
|
||||
echo ""
|
||||
echo " CVE-2026-43284: xfrm-ESP Page-Cache Write (2017-01 ~ 2026-05-05)"
|
||||
echo " 修复提交: f4c50a4034e6 | 模块: esp4, esp6"
|
||||
echo " CVE-2026-43500: RxRPC Page-Cache Write (2023-06 ~ 2026-05-10)"
|
||||
echo " 修复提交: aa54b1d27fe0 | 模块: rxrpc"
|
||||
echo " 参考链接：https://github.com/V4bel/dirtyfrag"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
echo -e "${CYAN}模块检测：${NC}"
|
||||
local found=0
|
||||
local -a mods=("esp4" "esp6" "rxrpc")
|
||||
for mod in "${mods[@]}"; do
|
||||
if lsmod 2>/dev/null | grep -q "^$mod "; then
|
||||
echo -e " $mod: ${RED}已加载${NC}"
|
||||
found=1
|
||||
elif modinfo "$mod" &>/dev/null; then
|
||||
echo -e " $mod: ${YELLOW}可用但未加载${NC}"
|
||||
found=1
|
||||
else
|
||||
echo -e " $mod: ${GREEN}不可用${NC}"
|
||||
fi
|
||||
done
|
||||
|
||||
echo "$UI_DIVIDER"
|
||||
local current_kernel
|
||||
current_kernel="$(uname -r)"
|
||||
echo -e "当前内核: ${CYAN}$current_kernel${NC}"
|
||||
|
||||
if [[ "$found" -eq 1 ]]; then
|
||||
echo -e "${RED}[警告] 检测到 Dirty Frag 攻击面！可被非特权用户利用提权至 root。${NC}"
|
||||
else
|
||||
echo -e "${GREEN}未检测到 Dirty Frag 直接攻击面。${NC}"
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
security_cve_dirtyfrag_mitigate() {
|
||||
block_non_pve9_destructive "Dirty Frag 修补" || return 1
|
||||
|
||||
clear
|
||||
show_menu_header "Dirty Frag 修补 — 禁用 esp4/esp6/rxrpc"
|
||||
|
||||
echo " 此操作将创建 /etc/modprobe.d/pve-tools-dirtyfrag.conf"
|
||||
echo " 并禁用以下内核模块：esp4, esp6, rxrpc"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${YELLOW}影响说明：${NC}"
|
||||
echo " • 禁用 esp4/esp6：影响 IPsec ESP 隧道功能"
|
||||
echo " • 禁用 rxrpc：影响 RxRPC 协议功能（通常不用于 PVE）"
|
||||
echo " • 立即生效（卸载已加载模块 + 清理页面缓存）"
|
||||
echo " • 重启后黑名单持续生效"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if ! confirm_high_risk_action \
|
||||
"禁用 esp4/esp6/rxrpc 模块 (Dirty Frag 修补)" \
|
||||
"将创建 modprobe.d 黑名单并卸载相关模块。立即清理页面缓存。" \
|
||||
"禁用 esp4/esp6 可能影响 IPsec VPN/隧道功能。PVE 通常不依赖这些模块。" \
|
||||
"如需回滚，可使用「恢复模块黑名单」功能。" \
|
||||
"CONFIRM"; then
|
||||
log_info "用户取消操作"
|
||||
return 0
|
||||
fi
|
||||
|
||||
if ! security_cve_module_blacklist "pve-tools-dirtyfrag" "esp4" "esp6" "rxrpc"; then
|
||||
log_error "Dirty Frag 黑名单写入失败"
|
||||
return 1
|
||||
fi
|
||||
security_cve_rmmod_and_drop_caches "esp4" "esp6" "rxrpc"
|
||||
log_success "Dirty Frag 缓解措施已应用"
|
||||
log_tips "建议升级内核以获得永久修复"
|
||||
}
|
||||
|
||||
# 共享的 LPE 内核升级引导
|
||||
security_cve_lpe_kernel_fix() {
|
||||
clear
|
||||
show_menu_header "Copy Fail / Dirty Frag — 升级内核修补"
|
||||
|
||||
echo " Copy Fail 和 Dirty Frag 均属于 Page-Cache Write 漏洞类"
|
||||
echo " 以下内核补丁已合入主线："
|
||||
echo " Copy Fail: (algif_aead 相关修复)"
|
||||
echo " Dirty Frag: f4c50a4034e6 (xfrm-ESP, 2026-05-05)"
|
||||
echo " aa54b1d27fe0 (RxRPC, 2026-05-10)"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
local current_kernel
|
||||
current_kernel="$(uname -r)"
|
||||
echo -e " 当前内核版本: ${CYAN}$current_kernel${NC}"
|
||||
echo -e " 建议升级到 2026-05-10 之后编译的内核版本"
|
||||
echo "$UI_DIVIDER"
|
||||
echo " 升级后可移除所有模块黑名单，恢复正常功能"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if confirm_action "是否前往内核管理菜单安装新内核？"; then
|
||||
kernel_management_menu
|
||||
fi
|
||||
}
|
||||
|
||||
# 恢复 Dirty Frag + Copy Fail 模块黑名单
|
||||
security_cve_lpe_restore() {
|
||||
block_non_pve9_destructive "恢复 LPE 模块黑名单" || return 1
|
||||
|
||||
clear
|
||||
show_menu_header "恢复 LPE 模块黑名单"
|
||||
|
||||
echo " 此操作将移除以下模块黑名单配置："
|
||||
echo " • /etc/modprobe.d/pve-tools-dirtyfrag.conf (esp4/esp6/rxrpc)"
|
||||
echo " • /etc/modprobe.d/pve-tools-copyfail.conf (algif_aead)"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${RED}警告：${NC}"
|
||||
echo " • 移除黑名单后，如果内核未升级到已修复版本，系统将重新面临 LPE 风险"
|
||||
echo " • 建议先确认内核已包含 Copy Fail/Dirty Frag 修复"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if ! confirm_high_risk_action \
|
||||
"恢复 LPE 相关模块黑名单" \
|
||||
"将删除 modprobe.d 中的 Copy Fail 和 Dirty Frag 黑名单配置。" \
|
||||
"如果内核未包含修复，系统将重新面临本地提权风险。" \
|
||||
"请确认内核已升级到已修复版本。" \
|
||||
"CONFIRM"; then
|
||||
log_info "用户取消操作"
|
||||
return 0
|
||||
fi
|
||||
|
||||
security_cve_module_restore "pve-tools-dirtyfrag"
|
||||
security_cve_module_restore "pve-tools-copyfail"
|
||||
log_success "LPE 模块黑名单已移除，重启后生效"
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# 一键批量修补
|
||||
# ============================================================
|
||||
|
||||
security_cve_batch_mitigate() {
|
||||
block_non_pve9_destructive "一键批量修补" || return 1
|
||||
|
||||
clear
|
||||
show_menu_header "一键批量漏洞修补"
|
||||
|
||||
echo " 此操作将一次性应用以下所有缓解措施："
|
||||
echo ""
|
||||
echo " ${CYAN}1. Januscape (CVE-2026-53359) — KVM 逃逸${NC}"
|
||||
echo " → 禁用嵌套虚拟化 (kvm_intel/kvm_amd.nested=0)"
|
||||
echo ""
|
||||
echo " ${CYAN}2. Dirty Frag (CVE-2026-43284 + CVE-2026-43500) — LPE${NC}"
|
||||
echo " → 禁用 esp4/esp6/rxrpc 模块"
|
||||
echo ""
|
||||
echo " ${CYAN}3. Copy Fail — LPE (额外加固)${NC}"
|
||||
echo " → 禁用 algif_aead 模块"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${RED}影响汇总：${NC}"
|
||||
echo " • 关闭嵌套虚拟化：VM 内无法运行嵌套 VM (L2)"
|
||||
echo " • 关闭 IPsec ESP：影响 VPN/隧道功能"
|
||||
echo " • 所有措施重启后生效"
|
||||
echo " • 升级内核后可逐一恢复各项功能"
|
||||
echo "$UI_DIVIDER"
|
||||
|
||||
if ! confirm_high_risk_action \
|
||||
"一键批量应用所有 CVE 缓解措施" \
|
||||
"将同时禁用 KVM 嵌套虚拟化、esp4/esp6/rxrpc/algif_aead 模块。" \
|
||||
"影响嵌套 VM、IPsec VPN 等功能。重启后生效。" \
|
||||
"建议先在测试环境验证，确保业务不受影响。" \
|
||||
"BATCH-FIX"; then
|
||||
log_info "用户取消操作"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# 1. Januscape
|
||||
local januscape_ok=0
|
||||
local vendor
|
||||
if vendor="$(security_cve_detect_cpu_vendor)"; then
|
||||
case "$vendor" in
|
||||
intel)
|
||||
if grub_add_param "kvm_intel.nested=0"; then
|
||||
log_success "Januscape: kvm_intel.nested=0 已添加"
|
||||
januscape_ok=1
|
||||
else
|
||||
log_error "Januscape: kvm_intel.nested=0 添加失败"
|
||||
fi
|
||||
;;
|
||||
amd)
|
||||
if grub_add_param "kvm_amd.nested=0"; then
|
||||
log_success "Januscape: kvm_amd.nested=0 已添加"
|
||||
januscape_ok=1
|
||||
else
|
||||
log_error "Januscape: kvm_amd.nested=0 添加失败"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
else
|
||||
log_warn "Januscape: 未检测到 KVM，跳过"
|
||||
januscape_ok=1
|
||||
fi
|
||||
|
||||
# 2. Dirty Frag
|
||||
if ! security_cve_module_blacklist "pve-tools-dirtyfrag" "esp4" "esp6" "rxrpc"; then
|
||||
log_warn "Dirty Frag 黑名单写入失败，继续执行后续步骤"
|
||||
fi
|
||||
security_cve_rmmod_and_drop_caches "esp4" "esp6" "rxrpc"
|
||||
|
||||
# 3. Copy Fail
|
||||
if ! security_cve_module_blacklist "pve-tools-copyfail" "algif_aead"; then
|
||||
log_warn "Copy Fail 黑名单写入失败，继续执行后续步骤"
|
||||
fi
|
||||
security_cve_rmmod_and_drop_caches "algif_aead"
|
||||
|
||||
# 4. Update GRUB
|
||||
local grub_ok=0
|
||||
if command -v update-grub &>/dev/null; then
|
||||
if update-grub; then grub_ok=1; fi
|
||||
elif command -v grub-mkconfig &>/dev/null; then
|
||||
if grub-mkconfig -o /boot/grub/grub.cfg; then grub_ok=1; fi
|
||||
fi
|
||||
|
||||
echo
|
||||
if [[ "$januscape_ok" -eq 1 && "$grub_ok" -eq 1 ]]; then
|
||||
log_success "批量修补完成！所有缓解措施已应用"
|
||||
else
|
||||
log_warn "批量修补部分完成，请检查上述错误信息"
|
||||
fi
|
||||
log_tips "请重启系统使 GRUB 参数生效"
|
||||
echo
|
||||
if confirm_action "是否现在重启系统？"; then
|
||||
reboot
|
||||
fi
|
||||
}
|
||||
|
||||
# ============================================================
|
||||
# CVE 漏洞修补主菜单
|
||||
# ============================================================
|
||||
|
||||
security_cve_menu() {
|
||||
while true; do
|
||||
clear
|
||||
show_menu_header "CVE 漏洞修补中心"
|
||||
|
||||
echo -e "${CYAN}已收录漏洞：${NC}"
|
||||
echo " Januscape (CVE-2026-53359) KVM Guest-to-Host Escape"
|
||||
echo " Dirty Frag (CVE-2026-43284/43500) Page-Cache Write LPE"
|
||||
echo " Copy Fail Page-Cache Write LPE"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "1" "Januscape ${CYAN}(KVM 逃逸 — 检测/修补/恢复)${NC}"
|
||||
show_menu_option "2" "Dirty Frag ${RED}(本地提权 — 检测/修补/恢复)${NC}"
|
||||
show_menu_option "3" "Copy Fail ${YELLOW}(本地提权 — 检测/修补/恢复)${NC}"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "8" "一键批量修补 ${RED}(同时应用全部缓解措施)${NC}"
|
||||
show_menu_option "9" "升级内核 ${GREEN}(永久修复所有 LPE 漏洞)${NC}"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "0" "返回安全中心"
|
||||
show_menu_footer
|
||||
|
||||
local choice
|
||||
read -rp "请选择操作 [0-9]: " choice
|
||||
case "$choice" in
|
||||
1) security_cve_januscape_menu ;;
|
||||
2) security_cve_dirtyfrag_menu ;;
|
||||
3) security_cve_copyfail_menu ;;
|
||||
8) security_cve_batch_mitigate ;;
|
||||
9) security_cve_lpe_kernel_fix ;;
|
||||
0) return ;;
|
||||
*) log_error "无效选择" ;;
|
||||
esac
|
||||
pause_function
|
||||
done
|
||||
}
|
||||
|
||||
# Januscape 子菜单
|
||||
security_cve_januscape_menu() {
|
||||
while true; do
|
||||
clear
|
||||
show_menu_header "Januscape (CVE-2026-53359) — KVM Guest-to-Host Escape"
|
||||
echo " 影响: 2010-08 ~ 2026-06-19 | 修复: 81ccda30b4e8"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "1" "漏洞检测 ${CYAN}(嵌套虚拟化 + 内核版本)${NC}"
|
||||
show_menu_option "2" "临时修补 ${YELLOW}(禁用嵌套虚拟化，重启生效)${NC}"
|
||||
show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复内核，推荐)${NC}"
|
||||
show_menu_option "4" "恢复嵌套虚拟化 ${RED}(确认内核已修复后使用)${NC}"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "0" "返回"
|
||||
show_menu_footer
|
||||
|
||||
local choice
|
||||
read -rp "请选择操作 [0-4]: " choice
|
||||
case "$choice" in
|
||||
1) security_cve_januscape_detect ;;
|
||||
2) security_cve_januscape_mitigate ;;
|
||||
3) security_cve_januscape_kernel_fix ;;
|
||||
4) security_cve_januscape_restore ;;
|
||||
0) return ;;
|
||||
*) log_error "无效选择" ;;
|
||||
esac
|
||||
pause_function
|
||||
done
|
||||
}
|
||||
|
||||
# Dirty Frag 子菜单
|
||||
security_cve_dirtyfrag_menu() {
|
||||
while true; do
|
||||
clear
|
||||
show_menu_header "Dirty Frag (CVE-2026-43284 + CVE-2026-43500) — LPE"
|
||||
echo " 影响: 2017-01 ~ 2026-05 | 修复: f4c50a4034e6 / aa54b1d27fe0"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "1" "漏洞检测 ${CYAN}(esp4/esp6/rxrpc 模块)${NC}"
|
||||
show_menu_option "2" "临时修补 ${YELLOW}(禁用 esp4/esp6/rxrpc，立即生效)${NC}"
|
||||
show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复内核，推荐)${NC}"
|
||||
show_menu_option "4" "恢复模块黑名单 ${RED}(确认内核已修复后使用)${NC}"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "0" "返回"
|
||||
show_menu_footer
|
||||
|
||||
local choice
|
||||
read -rp "请选择操作 [0-4]: " choice
|
||||
case "$choice" in
|
||||
1) security_cve_dirtyfrag_detect ;;
|
||||
2) security_cve_dirtyfrag_mitigate ;;
|
||||
3) security_cve_lpe_kernel_fix ;;
|
||||
4) security_cve_lpe_restore ;;
|
||||
0) return ;;
|
||||
*) log_error "无效选择" ;;
|
||||
esac
|
||||
pause_function
|
||||
done
|
||||
}
|
||||
|
||||
# Copy Fail 子菜单
|
||||
security_cve_copyfail_menu() {
|
||||
while true; do
|
||||
clear
|
||||
show_menu_header "Copy Fail — Page-Cache Write LPE"
|
||||
echo " Dirty Pipe/Dirty Frag 同类漏洞 | 参考: https://copy.fail"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "1" "漏洞检测 ${CYAN}(algif_aead 模块)${NC}"
|
||||
show_menu_option "2" "临时修补 ${YELLOW}(禁用 algif_aead，立即生效)${NC}"
|
||||
show_menu_option "3" "升级内核修补 ${GREEN}(安装已修复内核，推荐)${NC}"
|
||||
show_menu_option "4" "恢复模块黑名单 ${RED}(确认内核已修复后使用)${NC}"
|
||||
echo "$UI_DIVIDER"
|
||||
echo -e "${RED}注意：Copy Fail 缓解可被 Dirty Frag 绕过，建议同时修补！${NC}"
|
||||
echo "$UI_DIVIDER"
|
||||
show_menu_option "0" "返回"
|
||||
show_menu_footer
|
||||
|
||||
local choice
|
||||
read -rp "请选择操作 [0-4]: " choice
|
||||
case "$choice" in
|
||||
1) security_cve_copyfail_detect ;;
|
||||
2) security_cve_copyfail_mitigate ;;
|
||||
3) security_cve_lpe_kernel_fix ;;
|
||||
4) security_cve_lpe_restore ;;
|
||||
0) return ;;
|
||||
*) log_error "无效选择" ;;
|
||||
esac
|
||||
pause_function
|
||||
done
|
||||
}
|
||||
@@ -8,14 +8,16 @@ security_center_menu() {
|
||||
show_menu_header "安全中心"
|
||||
show_menu_option "1" "安全风险检查 ${CYAN}(只读报告)${NC}"
|
||||
show_menu_option "2" "SSH 一键加固 ${CYAN}(端口/密钥/fail2ban)${NC}"
|
||||
show_menu_option "3" "CVE 漏洞修补 ${RED}(Januscape/内核漏洞)${NC}"
|
||||
show_menu_option "0" "返回"
|
||||
show_menu_footer
|
||||
|
||||
local choice
|
||||
read -p "请选择操作 [0-2]: " choice
|
||||
read -p "请选择操作 [0-3]: " choice
|
||||
case "$choice" in
|
||||
1) security_risk_check ;;
|
||||
2) security_ssh_hardening ;;
|
||||
3) security_cve_menu ;;
|
||||
0) return ;;
|
||||
*) log_error "无效选择" ;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user