From 7942ec351b991925313686c028e06477913dcf4a Mon Sep 17 00:00:00 2001
From: sunlei <yemu2333@outlook.com>
Date: Fri, 26 Jun 2026 18:05:19 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8DNapCat=E8=AE=BE?=
 =?UTF-8?q?=E5=A4=87=E6=8B=9F=E7=9C=9F=E9=AA=8C=E8=AF=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ci/napcat-desktop-cn/README.md                         |  7 ++++++-
 .../entrypoint-device-profile.patch.sh                 | 10 ++++------
 ci/napcat-desktop-cn/verify.sh                         |  1 +
 .../qqbot/napcat/napcat-desktop-cn-image.spec.ts       |  4 +++-
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/ci/napcat-desktop-cn/README.md b/ci/napcat-desktop-cn/README.md
index 52e15cb..550dc60 100644
--- a/ci/napcat-desktop-cn/README.md
+++ b/ci/napcat-desktop-cn/README.md
@@ -48,7 +48,12 @@ docker build `
   .kt-workspace/napcat-desktop-cn-build
 
 $name = "kt-napcat-v8-verify-$([DateTimeOffset]::UtcNow.ToUnixTimeSeconds())"
-docker run -d --name $name kt-napcat-desktop-cn:desktop-cn-v8
+docker run -d --name $name `
+  --cap-add SYS_ADMIN `
+  --security-opt apparmor=unconfined `
+  --security-opt seccomp=unconfined `
+  -e NAPCAT_REQUIRE_DEVICE_PROFILE=1 `
+  kt-napcat-desktop-cn:desktop-cn-v8
 docker exec $name sh /ci/napcat-desktop-cn/verify.sh
 docker rm -f $name
 ```
diff --git a/ci/napcat-desktop-cn/entrypoint-device-profile.patch.sh b/ci/napcat-desktop-cn/entrypoint-device-profile.patch.sh
index b139362..06be13b 100644
--- a/ci/napcat-desktop-cn/entrypoint-device-profile.patch.sh
+++ b/ci/napcat-desktop-cn/entrypoint-device-profile.patch.sh
@@ -130,12 +130,10 @@ if [ "${NAPCAT_REQUIRE_DEVICE_PROFILE:-0}" = "1" ]; then
         echo "NapCat device profile check failed: tty0-active-missing" >&2
         exit 78
     fi
-    for kt_mountinfo in /proc/self/mountinfo /proc/1/mountinfo; do
-        if grep -E 'docker|containerd|overlay|\.dockerenv' "$kt_mountinfo" >/dev/null 2>&1; then
-            echo "NapCat device profile check failed: mountinfo-host-leak:$kt_mountinfo" >&2
-            exit 78
-        fi
-    done
+    if grep -E 'docker|containerd|overlay|\.dockerenv' /proc/1/mountinfo >/dev/null 2>&1; then
+        echo "NapCat device profile check failed: mountinfo-host-leak:/proc/1/mountinfo" >&2
+        exit 78
+    fi
     if grep -q "$(hostname)" /etc/hosts; then
         echo "NapCat device profile check failed: hosts-still-contains-hostname" >&2
         exit 78
diff --git a/ci/napcat-desktop-cn/verify.sh b/ci/napcat-desktop-cn/verify.sh
index 8d79b74..a6e2f13 100644
--- a/ci/napcat-desktop-cn/verify.sh
+++ b/ci/napcat-desktop-cn/verify.sh
@@ -51,6 +51,7 @@ grep -q '/proc/1/cmdline' /app/entrypoint.sh
 grep -q '/proc/1/sched' /app/entrypoint.sh
 grep -q '/proc/1/status' /app/entrypoint.sh
 grep -q '/proc/1/stat' /app/entrypoint.sh
+grep -q '/proc/1/mountinfo' /app/entrypoint.sh
 grep -q '/proc/self/mountinfo' /app/entrypoint.sh
 grep -q '/sys/class/dmi/id/product_name' /app/entrypoint.sh
 grep -q '/sys/class/dmi/id/bios_vendor' /app/entrypoint.sh
diff --git a/test/modules/qqbot/napcat/napcat-desktop-cn-image.spec.ts b/test/modules/qqbot/napcat/napcat-desktop-cn-image.spec.ts
index 0928dc7..b4e67c8 100644
--- a/test/modules/qqbot/napcat/napcat-desktop-cn-image.spec.ts
+++ b/test/modules/qqbot/napcat/napcat-desktop-cn-image.spec.ts
@@ -44,6 +44,7 @@ describe('NapCat Chinese Desktop Runtime image assets', () => {
     expect(verify).toContain('/proc/1/sched');
     expect(verify).toContain('/proc/1/status');
     expect(verify).toContain('/proc/1/stat');
+    expect(verify).toContain('/proc/1/mountinfo');
     expect(verify).toContain('/proc/self/mountinfo');
     expect(verify).toContain('/sys/class/dmi/id/product_name');
     expect(verify).toContain('/sys/class/dmi/id/bios_vendor');
@@ -73,7 +74,8 @@ describe('NapCat Chinese Desktop Runtime image assets', () => {
     expect(source).toContain('/proc/uptime');
     expect(source).toContain('/proc/cpuinfo');
     expect(source).toContain('/sys/devices/virtual/tty/tty0/active');
-    expect(source).toContain('/proc/self/mountinfo');
+    expect(source).toContain('mountinfo-host-leak:/proc/1/mountinfo');
+    expect(source).not.toContain('for kt_mountinfo in /proc/self/mountinfo /proc/1/mountinfo');
     expect(source).toContain('mount --bind "$FAKE_CMDLINE" /proc/1/cmdline');
     expect(source).toContain('kt_require_device_profile');
     expect(source).toContain('exit 78');