fix(net): 修复沙箱 resolv.conf 权限与 VPN 切换 DNS 解析回退 (#180) - #181
Merged
Conversation
Slacker-LLC
force-pushed
the
feat/issue-180-sandbox-network-dns
branch
from
September 4, 2026 08:06
b4e20c1 to
191bb3e
Compare
- 在 minisd/src/env.rs 的 write_resolv_conf 中显式设置 0644 权限，确保沙箱普通用户 (uid=10347) 可读取 DNS 配置 - 扩展 FALLBACK_DNS 包含国内主流公共 DNS 节点 (223.5.5.5, 114.114.114.114, 119.29.29.29) - 修正 minisd/src/proxy.rs 的 resolve_ipv4，在系统解析与发现的 DNS 均不可用时无条件回退到公共 DNS，消除关 VPN 后域名解析彻底失败的问题 - 在 MinisdBootstrap 中增加 resolv.conf 权限 644 兜底保护 - Rust 85 项单测全部通过
Slacker-LLC
force-pushed
the
feat/issue-180-sandbox-network-dns
branch
from
September 4, 2026 08:19
191bb3e to
0b486e4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
关联 Issue
变更说明
minisd/src/env.rs的write_resolv_conf中，写入文件后显式调用set_permissions(0o644)，消除沙箱非 root 进程（uid=10347）读取/etc/resolv.conf时遭遇的Permission denied，使 glibc 原生域名解析无论是否走代理均可稳定工作。minisd/src/proxy.rs的resolve_ipv4，移除tried == 0的限制，当系统解析和发现的 DNS 均不可用（例如关闭 VPN 后残留无效 DNS 地址）时，无条件回退到公共 DNS 列表解析。FALLBACK_DNS，增加阿里 DNS（223.5.5.5）、114 DNS（114.114.114.114）、腾讯 DNSPod（119.29.29.29）。MinisdBootstrap.kt启动脚本中添加chmod 644 /data/adb/minis/rootfs/etc/resolv.conf兜底保护。验证
git diff --check检查通过。