empeira 0.1.0.pre.alpha.1

data/resources/network/adapter/main_linux.go

@@ -0,0 +1,273 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Linux endpoint for an authenticated runtime/SSH binary exec channel.
+package main
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+	"unsafe"
+)
+
+func ioctl(fd int, operation uintptr, value unsafe.Pointer) error {
+	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), operation, uintptr(value))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func ifreq(name string) ([40]byte, error) {
+	var request [40]byte
+	if len(name) == 0 || len(name) > 15 {
+		return request, fmt.Errorf("invalid interface name")
+	}
+	copy(request[:16], name)
+	return request, nil
+}
+
+func tap(name, bridge string) (*os.File, error) {
+	request, err := ifreq(name)
+	if err != nil {
+		return nil, err
+	}
+	f, err := os.OpenFile("/dev/net/tun", os.O_RDWR, 0)
+	if err != nil {
+		return nil, err
+	}
+	// TUN_EXCL prevents adopting an existing interface. No persistence: close removes it.
+	*(*uint16)(unsafe.Pointer(&request[16])) = 0x0002 | 0x1000 | 0x8000
+	if err = ioctl(int(f.Fd()), 0x400454ca, unsafe.Pointer(&request[0])); err != nil {
+		f.Close()
+		return nil, err
+	}
+	if err = attach(name, bridge); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return f, nil
+}
+
+func attach(name, bridge string) error {
+	nic, err := net.InterfaceByName(name)
+	if err != nil {
+		return err
+	}
+	request, err := ifreq(bridge)
+	if err != nil {
+		return err
+	}
+	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+	*(*int32)(unsafe.Pointer(&request[16])) = int32(nic.Index)
+	if err := ioctl(fd, 0x89a2, unsafe.Pointer(&request[0])); err != nil {
+		return err
+	} // SIOCBRADDIF
+	request, _ = ifreq(name)
+	*(*uint16)(unsafe.Pointer(&request[16])) = syscall.IFF_UP
+	return ioctl(fd, syscall.SIOCSIFFLAGS, unsafe.Pointer(&request[0]))
+}
+
+// Docker's endpoint owns only its container network namespace. A local bridge
+// joins its veth to the TAP; the TAP kernel path completes checksum/GSO work
+// before frames enter the QEMU stream. No IP/application parsing is necessary.
+func localBridge(name, ethernet string) error {
+	if _, err := net.InterfaceByName(name); err == nil {
+		master, err := os.Readlink("/sys/class/net/" + ethernet + "/master")
+		if err != nil || filepath.Base(master) != name {
+			return fmt.Errorf("unexpected existing adapter bridge")
+		}
+		return nil
+	}
+
+	req, err := ifreq(name)
+	if err != nil {
+		return err
+	}
+	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(fd)
+	if err = ioctl(fd, 0x89a0, unsafe.Pointer(&req[0])); err != nil {
+		return err
+	}
+	*(*uint16)(unsafe.Pointer(&req[16])) = syscall.IFF_UP
+	if err = ioctl(fd, syscall.SIOCSIFFLAGS, unsafe.Pointer(&req[0])); err != nil {
+		return err
+	}
+	if err = attach(ethernet, name); err != nil {
+		return err
+	}
+	if err = disableUplinkLearning(ethernet); err != nil {
+		return err
+	}
+	// Keep the runtime-assigned IPv4 as a local peer endpoint on the bridge.
+	// Forwarding stays disabled; SSH needs no host route or external publication.
+	address, err := ifreq(ethernet)
+	if err != nil {
+		return err
+	}
+	if err = ioctl(fd, syscall.SIOCGIFADDR, unsafe.Pointer(&address[0])); err != nil {
+		return err
+	}
+	mask, err := ifreq(ethernet)
+	if err != nil {
+		return err
+	}
+	if err = ioctl(fd, syscall.SIOCGIFNETMASK, unsafe.Pointer(&mask[0])); err != nil {
+		return err
+	}
+	req, err = ifreq(ethernet)
+	if err != nil {
+		return err
+	}
+	*(*uint16)(unsafe.Pointer(&req[16])) = syscall.AF_INET
+	if err = ioctl(fd, syscall.SIOCSIFADDR, unsafe.Pointer(&req[0])); err != nil {
+		return err
+	}
+	bridgeAddress, err := ifreq(name)
+	if err != nil {
+		return err
+	}
+	copy(bridgeAddress[16:32], address[16:32])
+	if err = ioctl(fd, syscall.SIOCSIFADDR, unsafe.Pointer(&bridgeAddress[0])); err != nil {
+		return err
+	}
+	copy(bridgeAddress[16:32], mask[16:32])
+	return ioctl(fd, syscall.SIOCSIFNETMASK, unsafe.Pointer(&bridgeAddress[0]))
+}
+
+func bridgeFrames(read func([]byte) (int, error), write func([]byte) error) error {
+	done := make(chan error, 2)
+	go func() {
+		for {
+			frame, err := readFrame(os.Stdin)
+
+			if err == nil {
+				err = write(frame)
+			}
+			if err != nil {
+				done <- err
+				return
+			}
+		}
+	}()
+	go func() {
+		buf := make([]byte, maxFrame)
+		for {
+			n, err := read(buf)
+
+			if err == nil {
+				err = writeFrame(os.Stdout, buf[:n])
+			}
+			if err != nil {
+				done <- err
+				return
+			}
+		}
+	}()
+	return <-done
+}
+
+func run() error {
+	if len(os.Args) == 5 && os.Args[1] == "connect" {
+		address := net.ParseIP(os.Args[2])
+		port, err := strconv.Atoi(os.Args[3])
+		source := net.ParseIP(os.Args[4])
+		if source == nil || source.To4() == nil || !source.IsPrivate() || address == nil || address.To4() == nil || !address.IsPrivate() || err != nil || port < 1 || port > 65535 {
+			return fmt.Errorf("invalid private SSH destination")
+		}
+		dialer := net.Dialer{Timeout: 5 * time.Second, LocalAddr: &net.TCPAddr{IP: source}}
+		connection, err := dialer.Dial("tcp4", net.JoinHostPort(address.String(), os.Args[3]))
+		if err != nil {
+			return err
+		}
+		defer connection.Close()
+		go func() {
+			_, err := io.Copy(connection, os.Stdin)
+			if err != nil {
+				connection.Close()
+			} else {
+				connection.(*net.TCPConn).CloseWrite()
+			}
+		}()
+		_, err = io.Copy(os.Stdout, connection)
+		return err
+	}
+	if len(os.Args) == 2 && os.Args[1] == "capabilities" {
+		data, err := os.ReadFile("/proc/self/status")
+		if err != nil {
+			return err
+		}
+		for _, line := range strings.Split(string(data), "\n") {
+			if strings.HasPrefix(line, "CapEff:") {
+				fmt.Println(strings.TrimSpace(strings.TrimPrefix(line, "CapEff:")))
+				return nil
+			}
+		}
+		return fmt.Errorf("effective capabilities unavailable")
+	}
+
+	if len(os.Args) == 2 && os.Args[1] == "hold" {
+		signals := make(chan os.Signal, 1)
+		signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
+		<-signals
+		return nil
+	}
+	if len(os.Args) == 2 && os.Args[1] == "sha256" {
+		data, err := os.ReadFile("/proc/self/exe")
+		if err != nil {
+			return err
+		}
+		fmt.Printf("%x\n", sha256.Sum256(data))
+		return nil
+	}
+
+	if len(os.Args) != 4 {
+		return fmt.Errorf("usage: adapter tap NAME BRIDGE | bridge NAME INTERFACE")
+	}
+	if os.Args[1] == "bridge" {
+		return localBridge(os.Args[2], os.Args[3])
+	}
+	if os.Args[1] != "tap" {
+		return fmt.Errorf("unsupported mode")
+	}
+	bridge := os.Args[3]
+	f, err := tap(os.Args[2], bridge)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	fd := int(f.Fd())
+	if err = syscall.SetNonblock(fd, false); err != nil {
+		return err
+	}
+	// Opened before TUNSETIFF, the descriptor need not have joined Go's netpoller.
+	// Use blocking Linux I/O consistently; EOF on the exec channel ends the process.
+	return bridgeFrames(func(b []byte) (int, error) { return syscall.Read(fd, b) }, func(b []byte) error {
+		n, e := syscall.Write(fd, b)
+		if e == nil && n != len(b) {
+			e = io.ErrShortWrite
+		}
+		return e
+	})
+}
+
+func main() {
+	if err := run(); err != nil && err != io.EOF {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}

data/resources/network/channel.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: AGPL-3.0-only
+
+require_relative '../../lib/empeira'
+
+path = Pathname(ARGV.fetch(0))
+metadata = path.lstat
+unless metadata.file? && metadata.uid == Process.uid && metadata.mode.nobits?(0o077)
+  abort 'Unsafe peer channel configuration'
+end
+Process.daemon(false, false)
+begin
+  Empeira::Network::Peer::ChannelServer.new(path).run
+rescue StandardError => e
+  File.open(path.dirname.join('channel.log'), 'a', 0o600) { |log| log.puts("#{e.class}: #{e.message}") }
+  exit 1
+end

data/resources/network/ssh_connect.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: AGPL-3.0-only
+# SSH byte tunnel inside the rootless runtime namespace.
+require 'socket'
+require 'ipaddr'
+
+address, value = ARGV.size == 1 ? ['127.0.0.1', ARGV.fetch(0)] : ARGV
+ip = IPAddr.new(address)
+raise ArgumentError, 'Invalid SSH destination' unless ip.ipv4? && (ip.private? || address == '127.0.0.1')
+
+port = Integer(value, 10)
+raise ArgumentError, 'Invalid SSH port' unless port.between?(1, 65_535)
+
+begin
+  Socket.tcp(address, port, connect_timeout: 5) do |socket|
+    request = Thread.new do
+      IO.copy_stream($stdin, socket)
+      socket.close_write
+    rescue IOError, SystemCallError
+      nil
+    end
+    begin
+      IO.copy_stream(socket, $stdout)
+    ensure
+      request.kill.join
+    end
+  end
+rescue IOError, SystemCallError => e
+  warn "System SSH connection failed: #{e.message}"
+  exit 1
+end

data/resources/nodes/apt_sources.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'pathname'
+require 'uri'
+
+module Empeira
+  # Read-only bootstrap check. Repository management after bootstrap belongs to Puppet.
+  class AptSources
+    def initialize(root = '/')
+      @root = Pathname(root)
+    end
+
+    def valid?
+      release = @root.join('etc/os-release').read
+      return true unless release.match?(/^ID=["']?(?:ubuntu|debian)["']?$/)
+
+      apt = @root.join('etc/apt')
+      lists = [apt.join('sources.list'), *apt.glob('sources.list.d/*.list')]
+      lists.any? { |path| path.file? && legacy?(path.read) } ||
+        apt.glob('sources.list.d/*.sources').any? { |path| deb822?(path.read) }
+    end
+
+    private
+
+    def uri?(value)
+      uri = URI.parse(value)
+      %w[http https file].include?(uri.scheme) && (uri.scheme == 'file' || !uri.host.to_s.empty?)
+    rescue URI::InvalidURIError
+      false
+    end
+
+    def legacy?(content)
+      content.lines.any? do |line|
+        fields = line.sub(/#.*/, '').strip.sub(/\Adeb\s+\[[^\]]*\]\s+/, 'deb ').split
+        fields.first == 'deb' && fields.length >= 4 && uri?(fields[1]) && fields.drop(3).include?('main')
+      end
+    end
+
+    def deb822?(content)
+      content.gsub(/^#.*\n?/, '').gsub(/\n[ \t]+/, ' ').split(/\n\s*\n/).any? do |paragraph|
+        active?(fields(paragraph))
+      end
+    end
+
+    def fields(paragraph)
+      paragraph.lines.filter_map do |line|
+        key, value = line.split(':', 2)
+        [key.downcase, value.strip] if value
+      end.to_h
+    end
+
+    def active?(fields)
+      fields.fetch('enabled', 'yes').downcase != 'no' && fields.fetch('types', '').split.include?('deb') &&
+        fields.fetch('uris', '').split.any? { |value| uri?(value) } &&
+        !fields.fetch('suites', '').empty? && fields.fetch('components', '').split.include?('main')
+    end
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  begin
+    exit(Empeira::AptSources.new.valid? ? 0 : 1)
+  rescue StandardError
+    exit 1
+  end
+end

data/resources/nodes/debian/Containerfile

@@ -0,0 +1,10 @@
+ARG EMPEIRA_BASE_NODE=@BASE_IMAGE@
+FROM ${EMPEIRA_BASE_NODE}
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates openssh-server curl systemd systemd-sysv dbus iproute2 iputils-ping dnsutils procps sudo plocate
+COPY node-start /usr/local/libexec/empeira-node-start
+COPY node-connect /usr/local/libexec/empeira-ssh-connect.rb
+COPY sshd_config /etc/ssh/sshd_config
+RUN chmod 0755 /usr/local/libexec/empeira-node-start && rm -f /etc/ssh/ssh_host_* && systemctl enable ssh.service
+ENTRYPOINT ["/usr/local/libexec/empeira-node-start"]
+CMD ["/usr/sbin/sshd", "-D", "-e"]

data/resources/nodes/diagnostic_exec.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: AGPL-3.0-only
+# Guest-only supervisor, invoked by an owned native container exec as numeric UID 0.
+require 'json'
+require 'timeout'
+
+module EmpeiraDiagnosticExec
+  ROOT = '/run/empeira-exec'
+
+  # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Both root and session directory must remain private numeric-root paths.
+  def self.directory(token, create: false)
+    raise 'Invalid diagnostic identity' unless token.match?(/\A[0-9a-f]{32}\z/)
+
+    path = File.join(ROOT, token)
+    [ROOT, path].each do |entry|
+      if create
+        begin
+          Dir.mkdir(entry, 0o700)
+        rescue Errno::EEXIST
+          raise 'Existing diagnostic session' if entry == path
+        end
+      end
+      metadata = File.lstat(entry)
+      unless metadata.directory? && metadata.uid.zero? && metadata.mode.nobits?(0o077)
+        raise 'Unsafe diagnostic directory'
+      end
+    end
+    path
+  end
+
+  # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- Scan only the pinned owned process session before TERM/KILL.
+  def self.cleanup_groups
+    groups = Dir.glob('/proc/[0-9]*/stat').filter_map do |path|
+      fields = File.read(path).rpartition(') ').last.split
+      Integer(fields[2]) if Integer(fields[3]) == Process.pid && Integer(fields[2]) != Process.getpgrp
+    rescue Errno::ENOENT, Errno::ESRCH
+      nil
+    end.uniq
+    %w[TERM KILL].each do |signal|
+      groups.each do |group|
+        Process.kill(signal, -group)
+      rescue Errno::ESRCH
+        nil
+      end
+      sleep 0.1 if signal == 'TERM' && !groups.empty?
+    end
+  end
+
+  # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity -- Completion is published only after interruption, timeout and owned-group cleanup.
+  def self.run(token, duration, arguments)
+    raise 'Diagnostic supervisor requires UID 0' unless Process.uid.zero?
+
+    path = directory(token, create: true)
+    begin
+      Process.setsid
+    rescue Errno::EPERM
+      raise unless Process.getsid == Process.pid
+    end
+    owner = Thread.current
+    monitor = Thread.new do
+      $stdin.read(1)
+      owner.raise Interrupt
+    end
+    environment = { 'PATH' => '/opt/puppetlabs/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' }
+    pid = Process.spawn(environment, [arguments.first, arguments.first], *arguments.drop(1),
+                        in: File::NULL, pgroup: true)
+    status = Timeout.timeout(duration == 'none' ? nil : Float(duration)) { Process.wait2(pid).last }
+    result = { 'status' => status.exitstatus || (128 + status.termsig), 'timed_out' => false }
+  rescue Interrupt
+    result = { 'status' => 130, 'timed_out' => false }
+  rescue Timeout::Error
+    result = { 'status' => nil, 'timed_out' => true }
+  rescue SystemCallError => e
+    warn "Guest command could not start (#{e.class.name})"
+    result = { 'status' => e.is_a?(Errno::ENOENT) ? 127 : 126, 'timed_out' => false }
+  ensure
+    monitor&.kill&.join
+    cleanup_groups if path && Process.getsid == Process.pid
+    begin
+      Process.wait(pid) if pid
+    rescue Errno::ECHILD
+      nil
+    end
+    if result && path
+      File.open(File.join(path, 'status'), File::WRONLY | File::CREAT | File::EXCL, 0o600) do |file|
+        file.write(JSON.generate(result))
+      end
+    end
+  end
+
+  def self.completion(token)
+    path = directory(token)
+    file = File.join(path, 'status')
+    metadata = File.lstat(file)
+    raise 'Unsafe diagnostic completion' unless metadata.file? && metadata.uid.zero? && metadata.mode.nobits?(0o077)
+
+    print File.read(file, 1024)
+    File.unlink(file)
+    Dir.rmdir(path)
+  end
+end
+
+mode, token, duration, *arguments = ARGV
+if mode == 'read'
+  EmpeiraDiagnosticExec.completion(token)
+else
+  EmpeiraDiagnosticExec.run(token, duration, arguments)
+end

data/resources/nodes/interactive_tools.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'pathname'
+require 'rbconfig'
+require 'shellwords'
+require 'tempfile'
+require 'fileutils'
+
+module Empeira
+  class InteractiveToolsGuest
+    PROFILE = '/etc/profile.d/90-empeira-tools.sh'
+    BEGIN_MARKER = "# BEGIN EMPEIRA INTERACTIVE TOOLS\n"
+    END_MARKER = "# END EMPEIRA INTERACTIVE TOOLS\n"
+
+    def initialize(request, root: Pathname('/'))
+      @root = Pathname(root)
+      @candidates = [Pathname(request.fetch('puppet')).dirname.to_s, RbConfig::CONFIG.fetch('bindir')].uniq
+    end
+
+    def reconcile
+      directory = tool_directory
+      changed = profile(directory)
+      global_initializers.each { |target| changed = bash(target) || changed }
+      { 'changed' => changed, 'directory' => directory }
+    end
+
+    private
+
+    def tool_directory
+      directory = @candidates.find do |candidate|
+        %w[puppet facter].all? { |command| path(candidate).join(command).executable? }
+      end
+      directory || raise('Cannot locate installed puppet and facter tools together')
+    end
+
+    def global_initializers
+      initializers = %w[/etc/bash.bashrc /etc/bashrc].map { |value| path(value) }.select(&:exist?)
+      raise 'No supported global Bash initializer; inspect the image shell setup' if initializers.empty?
+
+      initializers
+    end
+
+    def path(value)
+      @root.join(value.delete_prefix('/'))
+    end
+
+    def read(target)
+      target.parent.ascend do |parent|
+        raise 'Unsafe interactive startup directory' if parent.symlink?
+      end
+      stat = target.lstat
+      unless stat.file? && stat.nlink == 1 && stat.uid == Process.euid && stat.mode.nobits?(0o022)
+        raise 'Unsafe or unowned interactive startup file'
+      end
+
+      target.binread
+    rescue Errno::ENOENT
+      nil
+    end
+
+    def write(target, content, mode: nil)
+      FileUtils.mkdir_p(target.parent, mode: 0o755)
+      mode ||= target.exist? ? target.stat.mode & 0o777 : 0o644
+      Tempfile.create('.empeira-tools-', target.parent) do |file|
+        file.chmod(mode)
+        file.write(content)
+        file.flush
+        file.fsync
+        File.rename(file.path, target)
+      end
+    end
+
+    def profile_content(directory)
+      <<~SH
+        # Managed by Empeira: installed agent tools, interactive shells only.
+        case $- in
+          *i*)
+            empeira_tool_bin=#{Shellwords.escape(path(directory).to_s)}
+            case ":${PATH-}:" in
+              *":${empeira_tool_bin}:"*) ;;
+              *) PATH="${empeira_tool_bin}${PATH:+:$PATH}"; export PATH ;;
+            esac
+            unset empeira_tool_bin
+            ;;
+        esac
+      SH
+    end
+
+    # rubocop:disable-next Naming/PredicateMethod -- Reconciliation writes an owned profile fragment.
+    def profile(directory)
+      target = path(PROFILE)
+      current = read(target)
+      if current && @candidates.none? { |candidate| current == profile_content(candidate) }
+        raise 'Foreign or modified /etc/profile.d/90-empeira-tools.sh; refusing to overwrite it'
+      end
+
+      content = profile_content(directory)
+      return false if current == content && (target.stat.mode & 0o777) == 0o644
+
+      write(target, content, mode: 0o644)
+      true
+    end
+
+    def hook
+      <<~SH
+        #{BEGIN_MARKER.chomp}
+        case $- in
+          *i*) . #{Shellwords.escape(path(PROFILE).to_s)} ;;
+        esac
+        #{END_MARKER.chomp}
+      SH
+    end
+
+    # rubocop:disable-next Naming/PredicateMethod -- Preserve every foreign line in the global Bash initializer.
+    def bash(target)
+      current = read(target)
+      if current.include?(BEGIN_MARKER) || current.include?(END_MARKER)
+        unless current.scan(BEGIN_MARKER).size == 1 && current.scan(END_MARKER).size == 1 && current.include?(hook)
+          raise 'Modified Empeira global Bash hook; refusing to overwrite it'
+        end
+
+        return false
+      end
+
+      write(target, "#{hook}#{current}")
+      true
+    end
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  begin
+    puts JSON.generate(Empeira::InteractiveToolsGuest.new(JSON.parse(ARGV.fetch(0))).reconcile)
+  rescue StandardError => e
+    warn e.message
+    exit 1
+  end
+end