@synopackageland/cli 0.13.1 → 0.15.0

package/assets/go/daemon/main_test.go

@@ -1,315 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"os/user"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func fixture(t *testing.T, mode string) (string, string, string) {
-	t.Helper()
-	root, err := os.MkdirTemp("/tmp", "c1-runtime-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(root) })
-	dest, data := filepath.Join(root, "target"), filepath.Join(root, "var")
-	if err := os.MkdirAll(filepath.Join(dest, "daemon/payload"), 0755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Mkdir(data, 0700); err != nil {
-		t.Fatal(err)
-	}
-	control, child := os.Getenv("DAEMON_CONTROL_BIN"), os.Getenv("DAEMON_CHILD_BIN")
-	if control == "" {
-		control, child = filepath.Join(root, "control"), filepath.Join(root, "child")
-		for _, spec := range [][]string{{"build", "-o", control, "."}, {"build", "-o", child, "./testdata/child.go"}} {
-			if raw, err := exec.Command("go", spec...).CombinedOutput(); err != nil {
-				t.Fatalf("%v: %s", err, raw)
-			}
-		}
-	}
-	raw, err := os.ReadFile(child)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app := filepath.Join(dest, "daemon/payload/app")
-	if err := os.WriteFile(app, raw, 0755); err != nil {
-		t.Fatal(err)
-	}
-	// macOS verifies a newly written executable on its first exec, which takes
-	// seconds on a loaded host; pay it here, not inside a one-second budget.
-	if raw, err := exec.Command(app, "cleanup").CombinedOutput(); err != nil {
-		t.Fatalf("payload warm-up: %v %s", err, raw)
-	}
-	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1, Uninstall: 2}}
-	if os.Geteuid() == 0 {
-		cfg.Package = "nobody"
-	} else {
-		u, err := user.Current()
-		if err != nil {
-			t.Fatal(err)
-		}
-		cfg.Package = u.Username
-	}
-	raw, _ = json.Marshal(cfg)
-	if err := os.WriteFile(filepath.Join(dest, "daemon/config.json"), raw, 0644); err != nil {
-		t.Fatal(err)
-	}
-	if os.Geteuid() == 0 {
-		// Only inside the disposable root VM: run the shipped manager as nobody.
-		if runtime.GOOS != "linux" {
-			t.Fatal("root fixture requires Linux VM")
-		}
-		filepath.Walk(root, func(path string, _ os.FileInfo, err error) error {
-			if err == nil {
-				return os.Chown(path, 65534, 65534)
-			}
-			return err
-		})
-		os.Chmod(root, 0755)
-	}
-	t.Cleanup(func() { runControl(control, "stop", dest, data) })
-	return control, dest, data
-}
-
-func runControl(control, action, dest, data string) (int, string) {
-	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, control, action, dest, data)
-	cmd.Env = append(os.Environ(), "UNLISTED_SECRET=must-not-leak", "LD_PRELOAD=must-not-leak")
-	dropFixtureUser(cmd)
-	raw, err := cmd.CombinedOutput()
-	if err == nil {
-		return 0, string(raw)
-	}
-	if e, ok := err.(*exec.ExitError); ok {
-		return e.ExitCode(), string(raw)
-	}
-	return -1, err.Error()
-}
-
-// Readiness only proves the child stayed alive for a second, not that it reached
-// main: on a loaded host a stop can kill it before it writes its line. Spawn
-// identity therefore comes from the inventory, and log content is awaited.
-func recordedChild(t *testing.T, data string) int {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var r record
-	if err := json.Unmarshal(raw, &r); err != nil || r.Child < 1 {
-		t.Fatalf("daemon inventory: %v %s", err, raw)
-	}
-	return r.Child
-}
-
-func awaitChildLines(t *testing.T, data string, want int) {
-	t.Helper()
-	path := filepath.Join(data, "daemon/daemon.log")
-	for deadline := time.Now().Add(10 * time.Second); ; time.Sleep(20 * time.Millisecond) {
-		raw, _ := os.ReadFile(path)
-		if got := strings.Count(string(raw), `"uid":`); got >= want || time.Now().After(deadline) {
-			if got != want {
-				t.Fatalf("child lines=%d want=%d: %s", got, want, raw)
-			}
-			return
-		}
-	}
-}
-
-func TestDaemonLifecycle(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	step := func(action string, want int) {
-		t.Helper()
-		if rc, out := runControl(control, action, dest, data); rc != want {
-			t.Fatalf("%s rc=%d want=%d: %s", action, rc, want, out)
-		}
-	}
-	step("status", 3)
-	step("stop", 0)
-	step("start", 0)
-	awaitChildLines(t, data, 1)
-	first := recordedChild(t, data)
-	step("status", 0)
-	step("start", 0)
-	if child := recordedChild(t, data); child != first {
-		t.Fatalf("duplicate start spawned another child: %d replaced %d", child, first)
-	}
-	step("restart", 0)
-	if child := recordedChild(t, data); child == first {
-		t.Fatalf("restart kept child %d", child)
-	}
-	awaitChildLines(t, data, 2)
-	step("stop", 0)
-	step("stop", 0)
-	step("status", 3)
-	step("unknown", 1)
-	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Count(string(raw), `"uid":`) != 2 {
-		t.Fatalf("unexpected child spawn: %s", raw)
-	}
-	if strings.Contains(string(raw), "must-not-leak") {
-		t.Fatalf("ambient environment leaked: %s", raw)
-	}
-	if !strings.Contains(string(raw), "$(touch BAD)'") || !strings.Contains(string(raw), "/a space") {
-		t.Fatalf("argv changed: %s", raw)
-	}
-	stat, _ := os.Stat(filepath.Join(data, "daemon/daemon.log"))
-	if stat.Mode().Perm() != 0600 {
-		t.Fatal("log permissions")
-	}
-	stat, err = os.Stat(filepath.Join(data, "daemon/tmp"))
-	if err != nil || stat.Mode().Perm() != 0700 {
-		t.Fatal("private TMPDIR missing", err)
-	}
-}
-
-func TestImmediateExitAndEscalation(t *testing.T) {
-	for _, mode := range []string{"exit", "ignore"} {
-		t.Run(mode, func(t *testing.T) {
-			control, dest, data := fixture(t, mode)
-			rc, out := runControl(control, "start", dest, data)
-			if mode == "exit" {
-				if rc != 1 {
-					t.Fatalf("false readiness: %d %s", rc, out)
-				}
-			} else {
-				if rc != 0 {
-					t.Fatalf("start: %d %s", rc, out)
-				}
-				if rc, out = runControl(control, "stop", dest, data); rc != 0 {
-					t.Fatalf("escalation: %d %s", rc, out)
-				}
-			}
-			if rc, out = runControl(control, "status", dest, data); rc != 3 {
-				t.Fatalf("residue: %d %s", rc, out)
-			}
-		})
-	}
-}
-
-func TestForeignStateAndRootRefusal(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	if os.Geteuid() == 0 {
-		raw, err := exec.Command(control, "start", dest, data).CombinedOutput()
-		if err == nil || !strings.Contains(string(raw), "package account") {
-			t.Fatalf("root accepted: %s %v", raw, err)
-		}
-	}
-	os.Mkdir(filepath.Join(data, "daemon"), 0700)
-	if os.Geteuid() == 0 {
-		os.Chown(filepath.Join(data, "daemon"), 65534, 65534)
-	}
-	os.Symlink(filepath.Join(data, "victim"), filepath.Join(data, "daemon/daemon.log"))
-	if rc, out := runControl(control, "start", dest, data); rc != 1 {
-		t.Fatalf("symlink accepted: %d %s", rc, out)
-	}
-	if _, err := os.Stat(filepath.Join(data, "victim")); !os.IsNotExist(err) {
-		t.Fatal("followed log symlink")
-	}
-}
-
-func TestUninstallCleanup(t *testing.T) {
-	for _, mode := range []string{"cleanup", "cleanup-fail", "cleanup-hang"} {
-		t.Run(mode, func(t *testing.T) {
-			control, dest, data := fixture(t, "normal")
-			path := filepath.Join(dest, "daemon/config.json")
-			raw, _ := os.ReadFile(path)
-			var cfg config
-			json.Unmarshal(raw, &cfg)
-			cfg.UninstallArgs = []string{mode, "${SYNOPKG_PKGVAR}"}
-			raw, _ = json.Marshal(cfg)
-			os.WriteFile(path, raw, 0644)
-			if rc, out := runControl(control, "start", dest, data); rc != 0 {
-				t.Fatalf("start: %d %s", rc, out)
-			}
-			want := 1
-			if mode == "cleanup" {
-				want = 0
-			}
-			if rc, out := runControl(control, "uninstall", dest, data); rc != want {
-				t.Fatalf("cleanup rc=%d want=%d: %s", rc, want, out)
-			}
-			if rc, out := runControl(control, "status", dest, data); rc != 3 {
-				t.Fatalf("cleanup must not restart daemon: %d %s", rc, out)
-			}
-		})
-	}
-}
-
-// A revoke on uninstall can outlast the stop deadline on a loaded NAS; it has
-// its own budget instead of Stop-1.
-func TestUninstallCommandHasItsOwnBudget(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	path := filepath.Join(dest, "daemon/config.json")
-	raw, _ := os.ReadFile(path)
-	var cfg config
-	json.Unmarshal(raw, &cfg)
-	cfg.UninstallArgs = []string{"cleanup-slow"}
-	cfg.Timeouts.Uninstall = 5
-	raw, _ = json.Marshal(cfg)
-	os.WriteFile(path, raw, 0644)
-	if rc, out := runControl(control, "start", dest, data); rc != 0 {
-		t.Fatalf("start: %d %s", rc, out)
-	}
-	if rc, out := runControl(control, "uninstall", dest, data); rc != 0 {
-		t.Fatalf("slow uninstall within its budget failed: %d %s", rc, out)
-	}
-}
-
-func TestPackageAccountIdentity(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	path := filepath.Join(dest, "daemon/config.json")
-	raw, _ := os.ReadFile(path)
-	var cfg config
-	json.Unmarshal(raw, &cfg)
-	cfg.Package = "root"
-	raw, _ = json.Marshal(cfg)
-	os.WriteFile(path, raw, 0644)
-	rc, out := runControl(control, "start", dest, data)
-	if rc == 0 {
-		runControl(control, "stop", dest, data)
-	}
-	if rc != 1 {
-		t.Fatalf("other account accepted: %d %s", rc, out)
-	}
-}
-
-func TestFIFOInventoryCannotBlockStatus(t *testing.T) {
-	control, dest, data := fixture(t, "normal")
-	state := filepath.Join(data, "daemon")
-	os.Mkdir(state, 0700)
-	path := filepath.Join(state, "daemon.pid")
-	t.Cleanup(func() { os.Remove(path) })
-	if err := syscall.Mkfifo(path, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if os.Geteuid() == 0 {
-		os.Chown(state, 65534, 65534)
-		os.Chown(path, 65534, 65534)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, control, "status", dest, data)
-	dropFixtureUser(cmd)
-	raw, err := cmd.CombinedOutput()
-	if ctx.Err() != nil {
-		t.Fatal("status blocked on FIFO")
-	}
-	if e, ok := err.(*exec.ExitError); !ok || e.ExitCode() != 1 {
-		t.Fatalf("FIFO status: %s %v", raw, err)
-	}
-}

package/assets/go/daemon/network.go

@@ -1,107 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-)
-
-// Host-network containers use the package UID. The kernel tables, rather than
-// an application's claimed environment setting, prove its listener bindings.
-// This is a configuration guard, not a network namespace or a firewall.
-type networkPolicy struct {
-	Ports       []int `json:"ports"`
-	PublicPorts []int `json:"public_ports"`
-}
-
-func containsPort(ports []int, port int) bool {
-	for _, p := range ports {
-		if p == port {
-			return true
-		}
-	}
-	return false
-}
-
-func checkSocketTable(raw string, uid int, p *networkPolicy, udp bool) error {
-	_, err := socketPorts(raw, uid, p, udp)
-	return err
-}
-
-func socketPorts(raw string, uid int, p *networkPolicy, udp bool) (map[int]bool, error) {
-	found := map[int]bool{}
-	scan := bufio.NewScanner(strings.NewReader(raw))
-	if !scan.Scan() {
-		return nil, errors.New("missing socket table header")
-	}
-	for scan.Scan() {
-		f := strings.Fields(scan.Text())
-		if len(f) == 0 {
-			continue
-		}
-		if len(f) < 10 {
-			return nil, errors.New("invalid socket table")
-		}
-		owner, err := strconv.Atoi(f[7])
-		if err != nil {
-			return nil, err
-		}
-		if owner != uid {
-			continue
-		}
-		if (!udp && f[3] != "0A") || (udp && f[3] != "07") {
-			continue
-		}
-		endpoint := strings.Split(f[1], ":")
-		if len(endpoint) != 2 {
-			return nil, errors.New("invalid socket endpoint")
-		}
-		port64, err := strconv.ParseInt(endpoint[1], 16, 32)
-		if err != nil {
-			return nil, err
-		}
-		port := int(port64)
-		if !udp && containsPort(p.PublicPorts, port) {
-			continue
-		}
-		// /proc/net's IPv4 and IPv6 words are little-endian on supported DSM arches.
-		loopback := endpoint[0] == "0100007F" || endpoint[0] == "00000000000000000000000001000000"
-		if !loopback {
-			return nil, fmt.Errorf("compose package listener on port %d is not bound to loopback", port)
-		}
-		if !udp && containsPort(p.Ports, port) && endpoint[0] == "0100007F" {
-			found[port] = true
-		}
-	}
-	return found, scan.Err()
-}
-
-func checkNetwork(dir string, uid int, p *networkPolicy) error {
-	if p == nil {
-		return nil
-	}
-	found := map[int]bool{}
-	for _, name := range []string{"tcp", "tcp6", "udp", "udp6"} {
-		raw, err := os.ReadFile(filepath.Join(dir, name))
-		if err != nil {
-			return err
-		}
-		ports, err := socketPorts(string(raw), uid, p, strings.HasPrefix(name, "udp"))
-		if err != nil {
-			return err
-		}
-		for port := range ports {
-			found[port] = true
-		}
-	}
-	for _, port := range p.Ports {
-		if !found[port] {
-			return fmt.Errorf("compose upstream port %d is not ready as the package UID on 127.0.0.1", port)
-		}
-	}
-	return nil
-}

package/assets/go/daemon/network_test.go

@@ -1,86 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestComposeNetworkPolicy(t *testing.T) {
-	uid := os.Geteuid()
-	for _, tc := range []struct {
-		name, addr, state, port string
-		ok                      bool
-	}{
-		{"loopback", "0100007F", "0A", "6D64", true},
-		{"wildcard", "00000000", "0A", "6D64", false},
-		{"other loopback", "0200007F", "0A", "6D64", false},
-		{"public gateway", "00000000", "0A", "6D60", true},
-		{"unknown port", "00000000", "0A", "6D66", false},
-		{"connected", "00000000", "01", "6D66", true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			line := socketFixture(tc.addr, tc.port, tc.state, uid)
-			err := checkSocketTable(line, uid, &networkPolicy{Ports: []int{28004}, PublicPorts: []int{28000}}, false)
-			if (err == nil) != tc.ok {
-				t.Fatalf("got %v, expected ok %v", err, tc.ok)
-			}
-		})
-	}
-}
-
-func TestComposeNetworkRequiresOwnedUpstream(t *testing.T) {
-	dir := t.TempDir()
-	for _, name := range []string{"tcp", "tcp6", "udp", "udp6"} {
-		os.WriteFile(filepath.Join(dir, name), []byte("header\n"), 0600)
-	}
-	p := &networkPolicy{Ports: []int{28004}, PublicPorts: []int{28000}}
-	if err := checkNetwork(dir, os.Geteuid(), p); err == nil {
-		t.Fatal("missing upstream accepted")
-	}
-	os.WriteFile(filepath.Join(dir, "tcp"), []byte(socketFixture("0100007F", "6D64", "0A", os.Geteuid()+1)), 0600)
-	if err := checkNetwork(dir, os.Geteuid(), p); err == nil {
-		t.Fatal("foreign upstream accepted")
-	}
-	os.WriteFile(filepath.Join(dir, "tcp"), []byte(socketFixture("0100007F", "6D64", "0A", os.Geteuid())), 0600)
-	if err := checkNetwork(dir, os.Geteuid(), p); err != nil {
-		t.Fatal(err)
-	}
-	os.WriteFile(filepath.Join(dir, "udp"), []byte(socketFixture("00000000", "6D66", "07", os.Geteuid())), 0600)
-	if err := checkNetwork(dir, os.Geteuid(), p); err == nil {
-		t.Fatal("UDP wildcard accepted")
-	}
-}
-
-func socketFixture(addr, port, state string, uid int) string {
-	return fmt.Sprintf("header\n 0: %s:%s 00000000:0000 %s 0:0 0:0 0 %d 0 1\n", addr, port, state, uid)
-}
-
-func TestComposeUDPConnectedIsNotAListener(t *testing.T) {
-	raw := socketFixture("EA53110A", "BEEF", "01", os.Geteuid())
-	if err := checkSocketTable(raw, os.Geteuid(), &networkPolicy{Ports: []int{28004}}, true); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestComposeIPv6AndUDPPublicPort(t *testing.T) {
-	p := &networkPolicy{Ports: []int{28004}, PublicPorts: []int{28000}}
-	for _, tc := range []struct {
-		addr, port string
-		udp, ok    bool
-	}{
-		{"00000000000000000000000001000000", "6D64", false, true},
-		{"00000000000000000000000000000000", "6D64", false, false},
-		{"00000000", "6D60", true, false},
-	} {
-		state := "0A"
-		if tc.udp {
-			state = "07"
-		}
-		err := checkSocketTable(socketFixture(tc.addr, tc.port, state, os.Geteuid()), os.Geteuid(), p, tc.udp)
-		if (err == nil) != tc.ok {
-			t.Fatalf("%+v: %v", tc, err)
-		}
-	}
-}

package/assets/go/daemon/process_linux.go

@@ -1,55 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"errors"
-	"net"
-	"os"
-	"strconv"
-	"syscall"
-)
-
-func childAttributes() *syscall.SysProcAttr { return &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL} }
-func processBirth(pid int) string {
-	raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
-	if err != nil {
-		return ""
-	}
-	birth, _ := parseBirth(string(raw))
-	return birth
-}
-func recordedChildAlive(pid int, birth string) bool {
-	raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
-	if os.IsNotExist(err) {
-		return false
-	}
-	if err != nil {
-		return true
-	}
-	actual, alive := parseBirth(string(raw))
-	if actual == "" {
-		return true
-	}
-	return alive && (birth == "" || actual == birth)
-}
-func checkPeer(conn *net.UnixConn, pid int) error {
-	fd, err := conn.SyscallConn()
-	if err != nil {
-		return err
-	}
-	var peer *syscall.Ucred
-	var getErr error
-	if err := fd.Control(func(raw uintptr) {
-		peer, getErr = syscall.GetsockoptUcred(int(raw), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
-	}); err != nil {
-		return err
-	}
-	if getErr != nil {
-		return getErr
-	}
-	if peer.Uid != uint32(os.Geteuid()) || peer.Pid != int32(pid) {
-		return errors.New("foreign daemon supervisor")
-	}
-	return nil
-}