hotcell-server 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0353cf7589212280f099039e6bec97f6da765b1d0c7442fe3183de5ba9e8077
-  data.tar.gz: 588b3f6a12b02dc00b096843d61335291d7bf62590337c2f52487df759f4ef05
+  metadata.gz: 390fc0f10953763de1f745cc3002fa0e548b362cbb21c82faba7dfa807b49dd5
+  data.tar.gz: fd6932e090acccea7964e38d76e65ea6163b1ebf6b5f401f6854fe8fa1e38034
 SHA512:
-  metadata.gz: a15cb0b8e9d399a3a37659e7008b3c717337ea14beb6a13ad44e4490cb4faedf59aed7520b9abc265b4c762fdbd7d624a32632886470f915925e183739178496
-  data.tar.gz: fffde7009ac88742aa9694585203de60cee1da4e637821f851eff453f67d9beaa52305049dfe1882373c396b92c933cf84bde9cf8b0fbd4850295a5ea7b3d020
+  metadata.gz: a34f827e6dbb2616e4e20b122ff6a8fdd78e40c19bfd8297c767c450a06ea4efaebc245d3ca3fb117caf13b70d922236e3c51f6a0a93207b5fc0a815e60e2583
+  data.tar.gz: '0769c12d7f26f35380dd5532edd8073c160f6a823128dcc4c88fddc697fd896be8cabec1eaa21dedf3c505a26ccda5a90cc38716a23461fa70410eb92d2ccc1e'

data/exe/hotcell

@@ -3,9 +3,13 @@
 
 require "hot_cell/server"
 
+development = ARGV.delete("--development") ? true : false
+abort "usage: hotcell [--development]" unless ARGV.empty?
+
 HotCell.load!
 
 HotCell::Supervisor
-  .new(directory: ENV.fetch("HOTCELL_DIR", "/run/hotcell/cell"), workspace: ENV["HOTCELL_WORKSPACE"])
+  .new(directory: ENV.fetch("HOTCELL_DIR", "/run/hotcell/cell"), workspace: ENV["HOTCELL_WORKSPACE"],
+       development: development)
   .boot
   .run

data/lib/hot_cell/server/version.rb

@@ -2,6 +2,6 @@
 
 module HotCell
   module Server
-    VERSION = "0.4.0"
+    VERSION = "0.4.1"
   end
 end

data/lib/hot_cell/supervisor.rb

@@ -138,9 +138,10 @@ module HotCell
 
     attr_reader :configuration, :counters, :log, :directory, :workspace
 
-    def initialize(directory:, workspace: nil, configuration: HotCell.configuration, log: Log.new,
-                   ptrace_scope_path: PTRACE_SCOPE)
+    def initialize(directory:, workspace: nil, development: false, configuration: HotCell.configuration,
+                   log: Log.new, ptrace_scope_path: PTRACE_SCOPE)
       @directory = directory
+      @development_tmpdir = own_tmpdir if development
       @workspace = workspace || File.join(tmpdir, "hotcell-workspace")
       @configuration = configuration
       @log = log
@@ -156,6 +157,7 @@ module HotCell
       verify_socket_paths!
       verify_limits!
       verify_ptrace_scope!
+      claim_tmpdir if @development_tmpdir
       verify_scratches!
       prepare_directories
       preload
@@ -164,7 +166,7 @@ module HotCell
       @control_handler = Control.new(configuration: configuration, counters: counters)
       trap_signals
 
-      log.write "cell.boot", pid: Process.pid, directory: directory, operations: Registry.names,
+      log.write "cell.boot", pid: Process.pid, directory: directory, tmpdir: tmpdir, operations: Registry.names,
                              configuration: configuration.to_h
       self
     end
@@ -1032,8 +1034,56 @@ module HotCell
       # `Dir.tmpdir` with its fallbacks removed: it answers `.` for a `/tmp` its owner cannot write, and a
       # worker can leave `/tmp` in that state. The sweep is what puts the mode back, so it has to see the
       # directory `Dir.tmpdir` will answer once it has.
+      #
+      # A cell told no `TMPDIR` sweeps the system's: right on the accessory, whose `/tmp` is its own mount, and
+      # wrong on a developer's machine, where `/tmp` and macOS's per-user `TMPDIR` are shared with everything
+      # else the developer runs. So `--development` never sweeps the directory it is given, unless an explicit
+      # workspace makes it the workspace's parent. Its scratch is a directory of its own beneath it, named for
+      # the socket directory so two cells one uid runs do not sweep each other's slots, and chosen once here so
+      # the default workspace and the boot agree.
       def tmpdir
-        ENV.values_at("TMPDIR", "TMP", "TEMP").compact.reject(&:empty?).first || Etc.systmpdir
+        @development_tmpdir || configured_tmpdir || Etc.systmpdir
+      end
+
+      def configured_tmpdir
+        ENV.values_at("TMPDIR", "TMP", "TEMP").compact.reject(&:empty?).first
+      end
+
+      def own_tmpdir
+        parent = configured_tmpdir || Etc.systmpdir
+        File.expand_path File.join(parent, "hotcell-#{directory.delete_prefix("/").tr("/", "-")}")
+      end
+
+      # The parent is world-writable, so the name is claimed with `mkdir` and, when it exists, read back with
+      # `lstat`: it has to be a plain directory this uid owns. Its mode goes back to `0700` because the sticky
+      # parent stops another uid from replacing the directory, not from writing inside one a worker opened up.
+      # The ancestors are checked before `mkdir` and `chmod` could act through an owned symlink;
+      # `verify_scratches!` checks them again. `ENV["TMPDIR"]` is left alone: the supervisor writes no temporary
+      # files, a worker sets its own per request, and a second supervisor in this process would nest its
+      # scratch inside this one.
+      #
+      # Accepted: an entry another uid plants inside, once a worker has opened the directory up, survives the
+      # sweep, which removes only what this uid owns, and a slot follows it. Opening it up needs code already
+      # running as this uid, which can reach the same files directly.
+      def claim_tmpdir
+        claimed = tmpdir
+        if (link = owned_symlink_on(File.dirname(claimed)))
+          raise ConfigurationError, "#{link} is a symlink the cell's uid owns, on the path to the scratch " \
+                                    "#{claimed}, and a boot sweeps the scratch"
+        end
+
+        begin
+          Dir.mkdir claimed, 0o700
+        rescue Errno::EEXIST
+          stat = File.lstat(claimed)
+          unless stat.directory? && stat.uid == Process.uid
+            raise ConfigurationError, "#{claimed} is not a directory this uid owns, and a boot sweeps it. Set " \
+                                      "TMPDIR to a directory of the cell's own."
+          end
+          File.chmod 0o700, claimed
+        end
+      rescue SystemCallError => error
+        raise ConfigurationError, "the scratch #{claimed} could not be claimed: #{error.message}"
       end
 
       def scratches

data/lib/hot_cell/test_cell.rb

@@ -45,7 +45,8 @@ module HotCell
     end
 
     # Anything in `supervisor:` goes to Supervisor.new; everything else is the cell's own limits.
-    def initialize(name: "test", supervisor: {}, operations: nil, **options)
+    # `own_tmpdir: false` boots the cell with no `TMPDIR` at all, the way a Procfile that sets none does.
+    def initialize(name: "test", supervisor: {}, operations: nil, own_tmpdir: true, **options)
       @name = name
       @supervisor_options = supervisor
       @operations = operations
@@ -54,8 +55,8 @@ module HotCell
       @directory = File.join(@root, name)
       # Boot empties `Dir.tmpdir` and the workspace's parent of what this uid owns. Inside the cell both are
       # this directory, so the sweep reaches neither the developer's `/tmp` nor the log and sockets beside it.
-      @tmpdir = File.join(@root, "tmp")
-      @workspace = File.join(@tmpdir, "workspace")
+      @tmpdir = File.join(@root, "tmp") if own_tmpdir
+      @workspace = File.join(@tmpdir, "workspace") if own_tmpdir
       @log_path = File.join(@root, "cell.log")
     end
 
@@ -78,8 +79,12 @@ module HotCell
 
         HotCell.limits(**@options) unless @options.empty?
 
-        FileUtils.mkdir_p @tmpdir
-        ENV["TMPDIR"] = @tmpdir
+        if @tmpdir
+          FileUtils.mkdir_p @tmpdir
+          ENV["TMPDIR"] = @tmpdir
+        else
+          %w[ TMPDIR TMP TEMP ].each { |key| ENV.delete key }
+        end
 
         supervisor = Supervisor.new(directory: directory, workspace: workspace,
                                     log: Log.new(File.open(log_path, "w")), **@supervisor_options)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hotcell-server
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Mike Dalessio
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: 0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: 0.4.1
 description: |
   Runs a HotCell container. A supervisor listens on two Unix sockets, forks a worker for each request,
   and enforces a wall clock deadline and resource limits on it. Write the work as a subclass of
@@ -62,8 +62,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.4.0/hotcell-server
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.4.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.4.1/hotcell-server
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.4.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []