@b00dea/cockpit 0.0.0-bootstrap.0 → 0.1.0

package/libexec/fenced-group-runner.cjs

@@ -0,0 +1,77 @@
+'use strict'
+
+// Runs one fenced action as the leader of its own process group, under libexec/fenced-supervisor.cjs.
+//
+// argv: <config>, base64url JSON { command, args, argv0, cwd, spawnNotAfter, fence, approved }, where
+// `approved` is the active marker the executor published ({ supervisorPid, markerDev, markerIno,
+// parentDev, parentIno }).
+// fd 3 to the supervisor: 'EXPIRED\n' when the spawn deadline had passed (the action never starts),
+// otherwise exactly one 'DONE <exit code>\n' when the action closes.
+// stdin from the supervisor: 'STOP\n' stops the group. Any other input, or stdin closing without it,
+// means the supervisor is gone: the runner then records a 'terminating' marker naming its group, so
+// a later repair can prove the group ended, before it stops the group itself.
+const { spawn } = require('node:child_process')
+const fs = require('node:fs')
+const path = require('node:path')
+const { replaceApprovedActiveMarker, syncDirectory } = require('./fence-marker.cjs')
+
+const STOP_KILL_DELAY_MS = 50
+
+const config = JSON.parse(Buffer.from(process.argv[2], 'base64url').toString('utf8'))
+const { fence, approved } = config
+
+// The group ends only through SIGKILL below, after the action had its SIGTERM; a stray terminal
+// signal must not take the runner down and orphan the action outside its fence.
+process.on('SIGTERM', () => {})
+process.on('SIGINT', () => {})
+
+const expired = config.spawnNotAfter !== undefined && Date.now() > Date.parse(config.spawnNotAfter)
+const child = expired ? undefined : spawn(config.command, config.args, {
+    argv0: config.argv0, cwd: config.cwd, env: process.env, stdio: ['ignore', 'inherit', 'inherit'],
+})
+let reported = false
+const report = code => {
+    if (reported) return
+    reported = true
+    fs.writeSync(3, `DONE ${Number.isInteger(code) ? code : 1}\n`)
+}
+if (expired) fs.writeSync(3, 'EXPIRED\n')
+else {
+    child.once('error', () => report(1))
+    child.once('close', code => report(code))
+}
+
+function publishTerminating() {
+    if (!replaceApprovedActiveMarker(fence, approved, 'runner', { status: 'terminating', groupPid: process.pid })) return false
+    try {
+        try { fs.unlinkSync(fence.socketPath) } catch (error) { if (error.code !== 'ENOENT') return false }
+        syncDirectory(path.dirname(fence.socketPath))
+        return true
+    } catch {
+        // The 'terminating' marker is already durable; repair still waits for the socket to go.
+        return false
+    }
+}
+
+let stopping = false
+let controlled = false
+function stop(supervisorLost) {
+    if (stopping) return
+    if (supervisorLost) publishTerminating()
+    stopping = true
+    process.kill(-process.pid, 'SIGTERM')
+    setTimeout(() => process.kill(-process.pid, 'SIGKILL'), STOP_KILL_DELAY_MS)
+}
+
+let input = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+    input += chunk
+    if (stopping || !input.includes('\n')) return
+    if (input !== 'STOP\n') return stop(true)
+    controlled = true
+    stop(false)
+})
+process.stdin.on('end', () => { if (!controlled) stop(true) })
+// Keeps the runner alive after the action closes, until the supervisor sends STOP.
+setInterval(() => {}, 1000)

package/libexec/fenced-supervisor.cjs

@@ -0,0 +1,137 @@
+'use strict'
+
+// Supervises one fenced action for the executor (packages/cockpit/src/environment-exec/execute.ts) so
+// that an attempt whose executor died can still be ended and proven gone by `repairFencedExecution`.
+//
+// argv: <config>, base64url JSON { command, args, argv0, cwd, spawnNotAfter, fence }.
+// fd 3 to the executor: 'READY\n' once the repair socket listens; 'EXPIRED\n' before exiting when the
+// action was never released because its spawn deadline passed or the executor cancelled it.
+// stdin from the executor: one release line, 'GO' or 'CANCEL', then the attempt id and the device and
+// inode of the active marker and its parent directory that the executor published. Anything else exits.
+// repair socket: a client that writes the attempt id is answered { attemptId, supervisorPid } and the
+// action is stopped.
+// exit code: the action's exit code, or 125 when the fence could not be kept (protocol violation, the
+// runner lost, or no durable 'terminated' marker). The supervisor exits only after the action's process
+// group is gone and the marker reads 'terminated', so that marker proves nothing of the attempt runs.
+const { spawn } = require('node:child_process')
+const { createServer } = require('node:net')
+const fs = require('node:fs')
+const path = require('node:path')
+const { replaceApprovedActiveMarker } = require('./fence-marker.cjs')
+
+const FENCE_LOST = 125
+const GROUP_EXIT_WAIT_MS = 2000
+const RUNNER = path.join(__dirname, 'fenced-group-runner.cjs')
+
+const config = JSON.parse(Buffer.from(process.argv[2], 'base64url').toString('utf8'))
+const { fence } = config
+
+let action
+let approved
+let started = false
+let finished = false
+let terminating = false
+let expired = false
+let actionCode = 1
+
+const groupGone = pid => {
+    try { process.kill(-pid, 0); return false } catch (error) { return error.code === 'ESRCH' }
+}
+const removeSocket = () => {
+    try { fs.unlinkSync(fence.socketPath) } catch { /* already absent; repair checks absence itself */ }
+}
+const abandon = () => {
+    removeSocket()
+    process.exit(FENCE_LOST)
+}
+const publishTerminated = () => approved !== undefined && replaceApprovedActiveMarker(
+    fence, { ...approved, supervisorPid: process.pid }, 'supervisor',
+    { status: 'terminated', finishedAt: new Date().toISOString() },
+)
+
+const server = createServer(socket => {
+    let request = ''
+    socket.setEncoding('utf8')
+    socket.on('data', chunk => {
+        request += chunk
+        if (request.length > 256) return socket.destroy()
+        if (!request.includes('\n')) return
+        if (request.trim() !== fence.attemptId) return socket.destroy()
+        socket.end(`${JSON.stringify({ attemptId: fence.attemptId, supervisorPid: process.pid })}\n`)
+        terminate()
+    })
+})
+
+function finish(deadline) {
+    if (finished) return
+    if (action && !groupGone(action.pid)) {
+        if (Date.now() >= deadline) return abandon()
+        return setTimeout(() => finish(deadline), 10)
+    }
+    finished = true
+    server.close()
+    removeSocket()
+    if (!publishTerminated()) process.exit(FENCE_LOST)
+    if (expired) fs.writeSync(3, 'EXPIRED\n')
+    process.exit(actionCode)
+}
+
+function terminate(code) {
+    if (!action || terminating) return
+    terminating = true
+    actionCode = Number.isInteger(code) ? code : 1
+    // A stop line that cannot be written means the action is unreachable; abandon exits with the fence-lost status.
+    try { action.stdin.end('STOP\n') } catch { abandon() }
+}
+
+function startAction() {
+    const runnerConfig = Buffer.from(JSON.stringify({
+        command: config.command, args: config.args, argv0: config.argv0, cwd: config.cwd,
+        spawnNotAfter: config.spawnNotAfter, fence, approved: { ...approved, supervisorPid: process.pid },
+    })).toString('base64url')
+    action = spawn(process.execPath, ['--', RUNNER, runnerConfig], {
+        cwd: config.cwd, env: process.env, stdio: ['pipe', 'inherit', 'inherit', 'pipe'], detached: true,
+    })
+    let control = ''
+    action.stdio[3].setEncoding('utf8')
+    action.stdio[3].on('data', chunk => {
+        control += chunk
+        if (control.length > 64) return abandon()
+        if (!control.includes('\n')) return
+        if (control === 'EXPIRED\n') {
+            expired = true
+            return terminate(1)
+        }
+        const done = /^DONE (-?[0-9]+)\n$/.exec(control)
+        if (!done) return abandon()
+        terminate(Number(done[1]))
+    })
+    action.once('error', abandon)
+    action.once('close', () => {
+        if (!terminating) return abandon()
+        finish(Date.now() + GROUP_EXIT_WAIT_MS)
+    })
+}
+
+try { fs.unlinkSync(fence.socketPath) } catch (error) { if (error.code !== 'ENOENT') process.exit(FENCE_LOST) }
+server.listen(fence.socketPath, () => fs.writeSync(3, 'READY\n'))
+
+let release = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+    release += chunk
+    if (started || !release.includes('\n')) return
+    const fields = release.trim().split(' ')
+    if (fields.length !== 6 || (fields[0] !== 'GO' && fields[0] !== 'CANCEL') || fields[1] !== fence.attemptId
+        || fields.slice(2).some(value => !/^[0-9]+$/.test(value))) return abandon()
+    approved = { markerDev: fields[2], markerIno: fields[3], parentDev: fields[4], parentIno: fields[5] }
+    started = true
+    if (fields[0] === 'CANCEL' || config.spawnNotAfter !== undefined && Date.now() > Date.parse(config.spawnNotAfter)) {
+        expired = true
+        return finish(Date.now() + GROUP_EXIT_WAIT_MS)
+    }
+    startAction()
+})
+process.stdin.on('end', () => { if (!started) abandon() })
+process.on('SIGTERM', () => terminate(1))
+process.on('SIGINT', () => terminate(1))