fix(node): sanitize systemd backup secrets

coygeek · coygeek · commit 3949a9fb6be1 · 2026-05-05T11:18:34.000-07:00
Remove file-backed managed systemd environment keys from .bak units during restage so upgrades from inline-token units do not preserve leaked gateway tokens.

Add regression coverage for restaging over a vulnerable unit while preserving unrelated environment entries.
diff --git a/src/daemon/systemd.test.ts b/src/daemon/systemd.test.ts
@@ -877,6 +877,47 @@ describe("stageSystemdService", () => {
     });
   });
 
+  it("sanitizes file-backed managed secrets out of the backup unit on re-stage", async () => {
+    await withStageFixture(async ({ env, unitPath }) => {
+      await fs.mkdir(path.dirname(unitPath), { recursive: true });
+      await fs.writeFile(
+        unitPath,
+        [
+          "[Service]",
+          "ExecStart=/usr/bin/openclaw node run",
+          "Environment=OPENCLAW_GATEWAY_TOKEN=inline-token",
+          "Environment=OPENCLAW_GATEWAY_PORT=18789",
+        ].join("\n"),
+        "utf8",
+      );
+
+      mockSystemctlStatusOk();
+
+      await stageSystemdService({
+        env,
+        stdout: { write: vi.fn() } as unknown as NodeJS.WritableStream,
+        programArguments: ["/usr/bin/openclaw", "node", "run"],
+        workingDirectory: "/tmp",
+        environment: {
+          OPENCLAW_GATEWAY_TOKEN: "fresh-token",
+          OPENCLAW_GATEWAY_PORT: "18789",
+        },
+        environmentValueSources: {
+          OPENCLAW_GATEWAY_TOKEN: "file",
+        },
+      });
+
+      const [unit, backupUnit] = await Promise.all([
+        fs.readFile(unitPath, "utf8"),
+        fs.readFile(`${unitPath}.bak`, "utf8"),
+      ]);
+
+      expect(unit).not.toContain("Environment=OPENCLAW_GATEWAY_TOKEN=fresh-token");
+      expect(backupUnit).not.toContain("Environment=OPENCLAW_GATEWAY_TOKEN=inline-token");
+      expect(backupUnit).toContain("Environment=OPENCLAW_GATEWAY_PORT=18789");
+    });
+  });
+
   it("clears stale inline-managed keys from env file on re-stage (#76860)", async () => {
     await withStageFixture(async ({ env, stateDir, unitPath, envFilePath }) => {
       // Existing env file carries a stale OPENCLAW_GATEWAY_TOKEN that the
diff --git a/src/daemon/systemd.ts b/src/daemon/systemd.ts
@@ -231,6 +231,27 @@ function collectSystemdFileBackedEnvironment(params: {
   return environment;
 }
 
+function sanitizeSystemdUnitBackupContent(params: {
+  content: string;
+  fileManagedKeys: ReadonlySet<string>;
+}): string {
+  if (params.fileManagedKeys.size === 0) {
+    return params.content;
+  }
+  return params.content
+    .split("\n")
+    .filter((rawLine) => {
+      const line = rawLine.trim();
+      if (!line.startsWith("Environment=")) {
+        return true;
+      }
+      const parsed = parseSystemdEnvAssignment(line.slice("Environment=".length).trim());
+      const key = parsed ? normalizeSystemdEnvironmentKey(parsed.key) : null;
+      return !key || !params.fileManagedKeys.has(key);
+    })
+    .join("\n");
+}
+
 function expandSystemdSpecifier(input: string, env: GatewayServiceEnv): string {
   // Support the common unit-specifier used in user services.
   return input.replaceAll("%h", toPosixPath(resolveHomeDir(env)));
@@ -593,13 +614,20 @@ async function writeSystemdUnit({
 
   const unitPath = resolveSystemdUnitPath(env);
   await fs.mkdir(path.dirname(unitPath), { recursive: true });
+  const fileManagedKeys = collectSystemdFileManagedKeys({
+    environmentValueSources,
+  });
 
   // Preserve user customizations: back up existing unit file before overwriting.
   let backedUp = false;
   try {
-    await fs.access(unitPath);
     const backupPath = `${unitPath}.bak`;
-    await fs.copyFile(unitPath, backupPath);
+    const existingUnit = await fs.readFile(unitPath, "utf8");
+    const backupUnit = sanitizeSystemdUnitBackupContent({
+      content: existingUnit,
+      fileManagedKeys,
+    });
+    await fs.writeFile(backupPath, backupUnit, "utf8");
     backedUp = true;
   } catch {
     // File does not exist yet — nothing to back up.
@@ -620,9 +648,6 @@ async function writeSystemdUnit({
     environment,
     environmentValueSources,
   });
-  const fileManagedKeys = collectSystemdFileManagedKeys({
-    environmentValueSources,
-  });
   const environmentFileResult = await writeSystemdGatewayEnvironmentFile({
     stateDir,
     dotenvVars: stateDirDotEnvVars,
