@consiliency/agent-board-cli 1.24.0 → 1.25.0

package/keyslot/optin.sh

@@ -0,0 +1,185 @@
+# shellcheck shell=bash
+# The unsealed slot's validation (A1), ONE predicate shared by keyslot-load.sh, which runs it
+# before every load (boot included), and by status.sh and provision.sh (through lib.sh). The
+# loader therefore never loads a key that status would call a contradiction. In the install
+# set, so it runs with the checkout gone. Needs constants.sh and seam.sh sourced first.
+#
+# Principle 4 in bash: every ancestor directory is a real directory (never a symlink), owned by
+# the user or root, and not group/other-writable unless root-owned and sticky (/tmp). The file
+# itself is refused unless its lstat is a regular file (so a FIFO is never opened, and never
+# blocks a boot), then OPENED, and judged on the opened descriptor (/proc/self/fd/N): the same
+# inode as the lstat, a regular file, the user's, no group/other bit. Every consumer reads that
+# descriptor: the opt-in's lines, ssh-keygen's derivation (/proc/self/fd/N), and the loader's
+# ssh-add, which is fed the descriptor it checked. File types come from stat's numeric mode
+# (%f), never its translated names.
+#
+# Every function prints its problems, one per line, and returns 0 only when there are none.
+
+# keyseal_trusted_ancestors <dir>: <dir> and every directory above it.
+keyseal_trusted_ancestors() {
+  local dir=$1 path=/ part uid rc=0
+  local -a parts
+  uid=$("$KEYSEAL_BIN_ID" -u)
+  [[ $dir == /* ]] || { printf '%s is not absolute\n' "$dir"; return 1; }
+  IFS=/ read -ra parts <<<"${dir#/}"
+  keyseal_trusted_dir_entry / "$uid" || rc=1
+  for part in "${parts[@]}"; do
+    [[ -n $part ]] || continue
+    path=${path%/}/$part
+    keyseal_trusted_dir_entry "$path" "$uid" || { rc=1; [[ -e $path ]] || return 1; }
+  done
+  return "$rc"
+}
+
+# One directory, not followed: a real directory, the user's or root's, not writable by others
+# unless root-owned and sticky.
+# The file type of a raw stat mode (%f, hex): dir, link, reg, or other.
+keyseal_ftype() {
+  case $(((16#$1) & 16#F000)) in
+    $((16#4000))) printf dir ;;
+    $((16#A000))) printf link ;;
+    $((16#8000))) printf reg ;;
+    *) printf other ;;
+  esac
+}
+
+keyseal_trusted_dir_entry() {
+  local path=$1 uid=$2 info type owner mode
+  info=$("$KEYSEAL_BIN_STAT" -c '%f|%u|%a' -- "$path" 2>/dev/null) || { printf 'ancestor %s: missing\n' "$path"; return 1; }
+  type=$(keyseal_ftype "${info%%|*}") info=${info#*|}
+  owner=${info%%|*} mode=$((8#${info#*|}))
+  if [[ $type == link ]]; then printf 'ancestor %s is a symlink\n' "$path"; return 1; fi
+  if [[ $type != dir ]]; then printf 'ancestor %s is not a directory\n' "$path"; return 1; fi
+  local rc=0
+  if [[ $owner != "$uid" && $owner != 0 ]]; then printf 'ancestor %s is owned by uid %s\n' "$path" "$owner"; rc=1; fi
+  if ((mode & 8#022)) && ! { ((mode & 8#1000)) && [[ $owner == 0 ]]; }; then
+    printf 'ancestor %s is group/other-writable\n' "$path"; rc=1
+  fi
+  return "$rc"
+}
+
+# keyseal_trusted_open <path> <max-bytes>: principle 4 on the file. On success, KEYSEAL_FD is
+# an open read descriptor on it (the caller closes it).
+keyseal_trusted_open() {
+  local p=$1 max=$2 name=${1##*/} before after info uid rc=0
+  uid=$("$KEYSEAL_BIN_ID" -u)
+  KEYSEAL_FD=
+  keyseal_trusted_ancestors "${p%/*}" || rc=1
+  if [[ -L $p ]]; then printf '%s is a symlink\n' "$name"; return 1; fi
+  before=$("$KEYSEAL_BIN_STAT" -c '%f|%d:%i' -- "$p" 2>/dev/null) || { printf '%s: missing\n' "$name"; return 1; }
+  # Judged BEFORE the open: opening a FIFO blocks until a writer appears.
+  [[ $(keyseal_ftype "${before%%|*}") == reg ]] || { printf '%s is not a regular file\n' "$name"; return 1; }
+  before=${before#*|}
+  exec {KEYSEAL_FD}<"$p" || { printf '%s: unreadable\n' "$name"; KEYSEAL_FD=; return 1; }
+  info=$("$KEYSEAL_BIN_STAT" -L -c '%d:%i|%f|%u|%a|%s' -- "/proc/self/fd/$KEYSEAL_FD" 2>/dev/null) || info=
+  after=${info%%|*}
+  local rest=${info#*|}
+  local type=${rest%%|*}; rest=${rest#*|}
+  local owner=${rest%%|*}; rest=${rest#*|}
+  local mode=${rest%%|*} size=${rest#*|}
+  if [[ -z $info || $after != "$before" ]]; then printf '%s changed while it was opened\n' "$name"; rc=1
+  else
+    [[ $(keyseal_ftype "$type") == reg ]] || { printf '%s is not a regular file\n' "$name"; rc=1; }
+    [[ $owner == "$uid" ]] || { printf '%s is owned by uid %s\n' "$name" "$owner"; rc=1; }
+    (((8#$mode & 8#077) == 0)) || { printf '%s has mode %s, not 0600\n' "$name" "$mode"; rc=1; }
+    ((size <= max)) || { printf '%s is over %s bytes\n' "$name" "$max"; rc=1; }
+  fi
+  if ((rc)); then exec {KEYSEAL_FD}<&-; KEYSEAL_FD=; fi
+  return "$rc"
+}
+
+# keyseal_machine_id_of <file>: the opt-in's host comparand, sha256(file)[:16].
+keyseal_machine_id_of() {
+  local h
+  h=$("$KEYSEAL_BIN_SHA256SUM" <"$1" 2>/dev/null) || return 1
+  printf '%s' "${h:0:16}"
+}
+
+# keyseal_optin_verify <optin> <pub> <slot> <uid> <machine_id>: the opt-in record, opened under
+# principle 4, holds exactly the frozen fields, and each matches (IF-0-KEYSEAL-6).
+keyseal_optin_verify() {
+  local path=$1 pub=$2 slot=$3 uid=$4 mid=$5 line k v rc=0 h
+  local -A rec=()
+  local fields=(version machine_id uid slot pub_sha256 granted_at)
+  keyseal_trusted_open "$path" 4096 || return 1
+  while IFS= read -r line <&"$KEYSEAL_FD" || [[ -n $line ]]; do
+    [[ -z $line ]] && continue
+    k=${line%%=*} v=${line#*=}
+    if [[ $line != *=* || " ${fields[*]} " != *" $k "* ]]; then printf 'unknown or malformed line "%s"\n' "$k"; rc=1; continue; fi
+    if [[ -n ${rec[$k]+x} ]]; then printf 'duplicate %s\n' "$k"; rc=1; continue; fi
+    rec[$k]=$v
+  done
+  exec {KEYSEAL_FD}<&-
+  local -A grammar=([version]='^1$' [machine_id]='^[0-9a-f]{16}$' [uid]='^[0-9]+$' [slot]="$KEYSEAL_SLOT_RE"
+    [pub_sha256]='^[0-9a-f]{64}$' [granted_at]='^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$')
+  for k in "${fields[@]}"; do
+    if [[ -z ${rec[$k]+x} ]]; then printf 'missing %s\n' "$k"; rc=1
+    elif [[ ! ${rec[$k]} =~ ${grammar[$k]} ]]; then printf 'malformed %s\n' "$k"; rc=1
+    fi
+  done
+  h=
+  if [[ -f $pub && ! -L $pub ]]; then h=$("$KEYSEAL_BIN_SHA256SUM" <"$pub" 2>/dev/null) && h=${h%% *} || h=; fi
+  [[ -z ${rec[machine_id]+x} || ${rec[machine_id]} == "$mid" ]] || { printf "machine_id is another machine's\n"; rc=1; }
+  [[ -z ${rec[uid]+x} || ${rec[uid]} == "$uid" ]] || { printf "uid is another user's\n"; rc=1; }
+  [[ -z ${rec[slot]+x} || ${rec[slot]} == "$slot" ]] || { printf "slot is another slot's\n"; rc=1; }
+  [[ -z ${rec[pub_sha256]+x} || ${rec[pub_sha256]} == "$h" ]] || { printf 'pub_sha256 does not match the pin file\n'; rc=1; }
+  return "$rc"
+}
+
+# keyseal_keyfile_pub <key>: the key file under principle 4, then the raw Ed25519 public key
+# (43-char base64url) ssh-keygen derives from it, read through the opened descriptor.
+keyseal_keyfile_pub() {
+  local key=$1 rc=0
+  keyseal_trusted_open "$key" 65536 || return 1
+  keyseal_fd_pub "$KEYSEAL_FD" "${key##*/}" || rc=1
+  exec {KEYSEAL_FD}<&-
+  return "$rc"
+}
+
+# keyseal_fd_pub <fd> <name>: the raw Ed25519 public key ssh-keygen derives from the open
+# descriptor <fd>. ssh-keygen is resolved through the seam, as probe.sh resolves it (N5).
+keyseal_fd_pub() {
+  local fd=$1 name=$2 out wire raw keygen
+  keygen=$(seam_resolve KEYSEAL_TEST_SSH_KEYGEN "$KEYSEAL_BIN_SSH_KEYGEN") || { printf '%s: ssh-keygen refused by the seam\n' "$name"; return 1; }
+  out=$("$keygen" -y -f "/proc/self/fd/$fd" 2>/dev/null) || out=
+  [[ $out == "ssh-ed25519 "* ]] || { printf '%s is not a usable Ed25519 key\n' "$name"; return 1; }
+  wire=${out#ssh-ed25519 }
+  wire=${wire%% *}
+  # The wire blob is string("ssh-ed25519") + string(32 raw bytes): 51 bytes, 68 base64
+  # characters, with this fixed prefix; the raw key is its last 32 bytes.
+  [[ ${#wire} == 68 && $wire == AAAAC3NzaC1lZDI1NTE5AAAAI* ]] || { printf '%s is not a usable Ed25519 key\n' "$name"; return 1; }
+  raw=$(printf '%s' "$wire" | "$KEYSEAL_BIN_BASE64" -d 2>/dev/null | "$KEYSEAL_BIN_TAIL" -c 32 | "$KEYSEAL_BIN_BASE64" -w0) || raw=
+  raw=${raw//+/-}
+  raw=${raw//\//_}
+  raw=${raw%%=*}
+  [[ $raw =~ ^[A-Za-z0-9_-]{43}$ ]] || { printf '%s is not a usable Ed25519 key\n' "$name"; return 1; }
+  printf '%s' "$raw"
+}
+
+# keyseal_unsealed_verify <slot> <uid> <machine_id>: the whole unsealed predicate. A valid
+# opt-in, a 0600 key of this user, and the key's public key equal to the pin in <slot>.pub.
+# On success prints the pin it verified (the loader compares its own descriptor with THAT value,
+# never a re-read of <slot>.pub); otherwise prints the problems. rc 0 only when the slot may be
+# loaded. The pin file is read under principle 4 too, so a FIFO there never blocks.
+keyseal_unsealed_verify() {
+  local slot=$1 uid=$2 mid=$3 K pin= kp line rc=0
+  K=$(keyseal_key_dir)
+  # Called directly (not in $(...)): the descriptor must be open in THIS shell to be read.
+  if keyseal_trusted_open "$K/$slot.pub" 256; then
+    IFS= read -r pin <&"$KEYSEAL_FD" || true
+    exec {KEYSEAL_FD}<&-
+  fi
+  [[ $pin =~ ^[A-Za-z0-9_-]{43}$ ]] || { printf 'pin missing or malformed\n'; rc=1; }
+  if [[ -e $K/$slot.unsealed-optin || -L $K/$slot.unsealed-optin ]]; then
+    keyseal_optin_verify "$K/$slot.unsealed-optin" "$K/$slot.pub" "$slot" "$uid" "$mid" || rc=1
+  else
+    printf 'no opt-in record\n'; rc=1
+  fi
+  if kp=$(keyseal_keyfile_pub "$K/$slot.key"); then
+    [[ -z $pin || $kp == "$pin" ]] || { printf 'the pin does not derive from %s.key\n' "$slot"; rc=1; }
+  else
+    printf '%s\n' "$kp"; rc=1
+  fi
+  ((rc)) || printf '%s' "$pin"
+  return "$rc"
+}

package/keyslot/probe.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+# probe.sh [--json]: can this host hold a key slot, and in which mode? (IF-0-KEYSEAL-4,
+# IF-0-KEYSEAL-6)
+#
+# Seals a random canary under a throwaway credential name, decrypts it IN A PIPE and
+# compares the bytes. Also reports linger, the user manager's state, the systemd version and
+# the absolute binaries the loader and the operator tools use, then removes its artefacts.
+#
+# Four outcomes, frozen (A1), in this precedence:
+#   error                  anything the probe cannot judge: no XDG_RUNTIME_DIR, a user manager
+#                          that is not running/degraded, linger unreadable, an operator binary
+#                          missing, an unreadable systemd version, and ANY failed round trip
+#                          on systemd >= 256. Never `incapable`: provision refuses.
+#   incapable-for-keyslot  linger off, or ssh-agent/ssh-add/ssh-keygen missing: no mode survives
+#                          a reboot.
+#   incapable              ONLY systemd-creds absent (systemd 249), or `--user` refused on
+#                          systemd < 256, both measured: the unsealed opt-in is admissible.
+#   capable                a byte-equal `systemd-creds --user` round trip, with linger on.
+# Exit 0 capable, 2 for each other outcome (the JSON's `outcome` says which), 1 on a usage or
+# seam error. Never 0 without a byte-equal round trip. dev0's manager reads `degraded` and is
+# capable. `machine_id` is the opt-in record's host comparand, sha256(/etc/machine-id)[:16].
+set -euo pipefail
+# The measured refusal is matched as text, so every child speaks the C locale (review round 2, N4).
+export LC_ALL=C
+
+here=${BASH_SOURCE[0]%/*}
+[[ $here == "${BASH_SOURCE[0]}" ]] && here=.
+# shellcheck source=lib.sh
+. "$here/lib.sh"
+
+json=no
+for arg in "$@"; do
+  case $arg in
+    --json) json=yes ;;
+    *) keyseal_die "usage: probe.sh [--json]" ;;
+  esac
+done
+keyseal_resolve_bins || exit 1
+
+linger=$(keyseal_linger)
+manager_state=$("$SYSTEMCTL" --user is-system-running 2>/dev/null) || true
+manager_state=${manager_state:-unreachable}
+
+bins_json=
+declare -A present
+for b in "$CREDS" "$SSH_ADD" "$SLEEP" "$SYSTEMCTL" "$LOGINCTL" "$FLOCK" "$KEYSEAL_BIN_SSH_AGENT" "$SSH_KEYGEN"; do
+  if [[ -x $b ]]; then present[$b]=true; else present[$b]=false; fi
+  bins_json+="${bins_json:+,}$(keyseal_json_str "$b"):${present[$b]}"
+done
+
+# The systemd version, as systemd-creds reports it. Empty when absent or unreadable.
+systemd_version=
+if [[ ${present[$CREDS]} == true ]]; then
+  v=$("$CREDS" --version 2>/dev/null) || v=
+  v=${v%%$'\n'*}
+  # Unanchored (review round 1, Gemini S2): a distro prefix before "systemd N" still parses.
+  [[ $v =~ (^|[^A-Za-z0-9_-])systemd\ ([0-9]+)([^0-9]|$) ]] && systemd_version=${BASH_REMATCH[2]}
+fi
+
+round_trip=not_run
+user_refused=no
+dir=
+cleanup() { if [[ -n $dir ]]; then rm -rf -- "$dir"; fi; }
+trap cleanup EXIT
+if [[ ${present[$CREDS]} == true && -n ${XDG_RUNTIME_DIR-} && -d $XDG_RUNTIME_DIR ]] &&
+  dir=$(mktemp -d "$XDG_RUNTIME_DIR/keyseal-probe.XXXXXX"); then
+  round_trip=failed
+  canary=$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')
+  name="keyseal-probe-$(head -c 6 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+  if enc_err=$(printf '%s' "$canary" | "$CREDS" --user encrypt --name="$name" - "$dir/canary.cred" 2>&1 >/dev/null); then
+    if got=$("$CREDS" --user decrypt --name="$name" "$dir/canary.cred" - 2>/dev/null | sha256sum); then
+      if [[ ${got%% *} == "$(keyseal_sha256_str "$canary")" ]]; then round_trip=equal; else round_trip=mismatch; fi
+    fi
+  else
+    # The measured refusal (systemd < 256), not merely any failure (review round 1, Opus S4).
+    if [[ $enc_err == *"unrecognized option '--user'"* || $enc_err == *'unrecognized option "--user"'* ]]; then user_refused=yes; fi
+  fi
+fi
+cleanup
+dir=
+
+outcome= reason=
+if [[ -z ${XDG_RUNTIME_DIR-} || ! -d $XDG_RUNTIME_DIR ]]; then
+  outcome=error reason=no_runtime_dir
+elif [[ $manager_state != running && $manager_state != degraded ]]; then
+  outcome=error reason="manager_$manager_state"
+elif [[ $linger != yes && $linger != no ]]; then
+  outcome=error reason=linger_unreadable
+elif [[ ${present[$SYSTEMCTL]} != true || ${present[$LOGINCTL]} != true || ${present[$FLOCK]} != true || ${present[$SLEEP]} != true ]]; then
+  outcome=error reason=operator_binary_missing
+elif [[ ${present[$CREDS]} != true ]]; then
+  outcome=incapable reason=systemd_creds_absent
+elif [[ -z $systemd_version ]]; then
+  outcome=error reason=systemd_version_unreadable
+elif [[ $round_trip == equal ]]; then
+  outcome=capable reason=round_trip_equal
+elif ((systemd_version < 256)) && [[ $round_trip == failed && $user_refused == yes ]]; then
+  outcome=incapable reason=user_scope_refused
+else
+  # Every other non-equal round trip is an error, never a reason to accept an unsealed key: any
+  # failure on systemd >= 256 (expected to seal at user scope), and below 256 anything but the
+  # measured `--user` refusal (bytes that came back different, or another failure).
+  outcome=error reason="round_trip_$round_trip"
+fi
+if [[ $outcome == capable || $outcome == incapable ]]; then
+  if [[ $linger != yes ]]; then
+    outcome=incapable-for-keyslot reason="linger_off (fix: loginctl enable-linger $(id -un))"
+  elif [[ ${present[$SSH_ADD]} != true || ${present[$KEYSEAL_BIN_SSH_AGENT]} != true || ${present[$SSH_KEYGEN]} != true ]]; then
+    # ssh-keygen: the loader derives an unsealed key's public key with it before loading.
+    outcome=incapable-for-keyslot reason="ssh_agent_or_ssh_add_missing (fix: install openssh-client)"
+  fi
+fi
+
+capable=false
+rc=2
+if [[ $outcome == capable ]]; then
+  capable=true
+  rc=0
+fi
+machine_id=$(keyseal_machine_id) || machine_id=
+mid_json=null
+[[ -n $machine_id ]] && mid_json=$(keyseal_json_str "$machine_id")
+ver_json=null
+[[ -n $systemd_version ]] && ver_json=$systemd_version
+
+if [[ $json == yes ]]; then
+  printf '{"tool":"probe","seam":%s,"host":%s,"uid":%s,"machine_id":%s,"linger":%s,"manager_state":%s,"systemd_version":%s,"binaries":{%s},"round_trip":%s,"outcome":%s,"reason":%s,"capable":%s,"exit":%s}\n' \
+    "$(keyseal_seam_json)" "$(keyseal_json_str "$(uname -n)")" "$(keyseal_uid)" "$mid_json" "$(keyseal_json_str "$linger")" \
+    "$(keyseal_json_str "$manager_state")" "$ver_json" "$bins_json" "$(keyseal_json_str "$round_trip")" \
+    "$(keyseal_json_str "$outcome")" "$(keyseal_json_str "$reason")" "$capable" "$rc"
+else
+  printf 'probe: outcome=%s reason=%s round_trip=%s linger=%s manager=%s systemd=%s seam=%s\n' \
+    "$outcome" "$reason" "$round_trip" "$linger" "$manager_state" "${systemd_version:-?}" "$(keyseal_seam_json)"
+fi
+exit "$rc"