@synopackageland/cli 0.14.1 → 0.15.0

package/assets/go/daemon/main.go

@@ -1,636 +0,0 @@
-// Package-account supervisor for one fixed foreground executable. The pidfile
-// is inventory, never authority for kill(pid). Only the parent signals its child.
-package main
-
-import (
-	"bufio"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"os/exec"
-	"os/signal"
-	"os/user"
-	"path/filepath"
-	"runtime"
-	"sort"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-)
-
-type deadlines struct {
-	Start  int `json:"start"`
-	Stop   int `json:"stop"`
-	Status int `json:"status"`
-	// Uninstall bounds uninstall_args separately from Stop: a revoke on a
-	// loaded NAS can take longer than stopping the daemon.
-	Uninstall int `json:"uninstall"`
-}
-type config struct {
-	Network       *networkPolicy    `json:"network,omitempty"`
-	Package       string            `json:"package"`
-	Exec          string            `json:"exec"`
-	Args          []string          `json:"args"`
-	UninstallArgs []string          `json:"uninstall_args,omitempty"`
-	Env           map[string]string `json:"env"`
-	Timeouts      deadlines         `json:"timeouts"`
-}
-type record struct {
-	Supervisor int    `json:"supervisor"`
-	Child      int    `json:"child"`
-	Birth      string `json:"birth"`
-	Digest     string `json:"digest"`
-}
-type controller struct {
-	config
-	dest, data, dir, digest string
-}
-
-func main() {
-	if len(os.Args) != 4 {
-		os.Exit(1)
-	}
-	c, err := load(os.Args[2], os.Args[3])
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	rc, err := c.run(os.Args[1])
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-	}
-	os.Exit(rc)
-}
-
-func load(dest, data string) (*controller, error) {
-	if os.Geteuid() == 0 || os.Getuid() != os.Geteuid() {
-		return nil, errors.New("daemon requires a non-root package account")
-	}
-	if !filepath.IsAbs(dest) || !filepath.IsAbs(data) {
-		return nil, errors.New("daemon paths must be absolute")
-	}
-	raw, err := os.ReadFile(filepath.Join(dest, "daemon/config.json"))
-	if err != nil || len(raw) > 512*1024 {
-		return nil, errors.New("invalid daemon config")
-	}
-	var cfg config
-	d := json.NewDecoder(strings.NewReader(string(raw)))
-	d.DisallowUnknownFields()
-	if err := d.Decode(&cfg); err != nil {
-		return nil, err
-	}
-	account, err := user.Lookup(cfg.Package)
-	if err != nil || account.Uid != strconv.Itoa(os.Geteuid()) {
-		return nil, errors.New("daemon requires its configured package account")
-	}
-	if cfg.Exec == "" || filepath.IsAbs(cfg.Exec) || filepath.Clean(cfg.Exec) != cfg.Exec || strings.HasPrefix(cfg.Exec, "../") {
-		return nil, errors.New("invalid fixed executable")
-	}
-	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 || cfg.Timeouts.Uninstall < 2 || cfg.Timeouts.Uninstall > 120 {
-		return nil, errors.New("invalid daemon deadlines")
-	}
-	hash := sha256.Sum256(raw)
-	c := &controller{config: cfg, dest: dest, data: data, dir: filepath.Join(data, "daemon"), digest: hex.EncodeToString(hash[:])}
-	if err := os.Mkdir(c.dir, 0700); err != nil && !os.IsExist(err) {
-		return nil, err
-	}
-	st, err := os.Lstat(c.dir)
-	if err != nil || !st.IsDir() || st.Mode().Perm() != 0700 || !owned(st) {
-		return nil, errors.New("foreign daemon state directory")
-	}
-	tmp := filepath.Join(c.dir, "tmp")
-	if err := os.Mkdir(tmp, 0700); err != nil && !os.IsExist(err) {
-		return nil, err
-	}
-	st, err = os.Lstat(tmp)
-	if err != nil || !st.IsDir() || st.Mode().Perm() != 0700 || !owned(st) {
-		return nil, errors.New("foreign daemon temporary directory")
-	}
-	return c, nil
-}
-
-func owned(st os.FileInfo) bool {
-	s, ok := st.Sys().(*syscall.Stat_t)
-	return ok && s.Uid == uint32(os.Geteuid())
-}
-
-func safeFile(path string) (*os.File, error) {
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0600)
-	if err != nil {
-		return nil, err
-	}
-	st, err := f.Stat()
-	if err != nil || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || !owned(st) || st.Sys().(*syscall.Stat_t).Nlink != 1 {
-		f.Close()
-		return nil, errors.New("foreign daemon file")
-	}
-	return f, nil
-}
-
-func (c *controller) lock(name string, until time.Time) (*os.File, error) {
-	f, err := safeFile(filepath.Join(c.dir, name))
-	if err != nil {
-		return nil, err
-	}
-	for {
-		err = syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
-		if err == nil {
-			return f, nil
-		}
-		if !errors.Is(err, syscall.EWOULDBLOCK) && !errors.Is(err, syscall.EAGAIN) || !time.Now().Before(until) {
-			f.Close()
-			return nil, errors.New("daemon lock busy")
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-}
-
-func (c *controller) run(action string) (int, error) {
-	if action == "supervise" {
-		return 1, c.supervise()
-	}
-	budget := c.Timeouts.Status
-	if action == "start" {
-		budget = c.Timeouts.Start
-	}
-	if action == "stop" || action == "restart" || action == "uninstall" {
-		budget = c.Timeouts.Stop + 1
-	}
-	if action == "restart" {
-		budget += c.Timeouts.Start
-	}
-	if action == "uninstall" {
-		budget += c.Timeouts.Uninstall + 2
-	}
-	if action != "start" && action != "stop" && action != "status" && action != "restart" && action != "uninstall" {
-		return 1, errors.New("unsupported daemon action")
-	}
-	until := time.Now().Add(time.Duration(budget) * time.Second)
-	lock, err := c.lock("command.lock", until)
-	if err != nil {
-		return 1, err
-	}
-	defer lock.Close()
-	if action == "status" {
-		if err := c.request("status", until); err == nil {
-			return 0, nil
-		}
-		if _, err := os.Lstat(filepath.Join(c.dir, "daemon.pid")); os.IsNotExist(err) {
-			owner, err := c.lock("owner.lock", time.Now())
-			if err == nil {
-				owner.Close()
-				return 3, nil
-			}
-		}
-		return 1, errors.New("daemon failed or supervisor unavailable")
-	}
-	if action == "stop" || action == "restart" || action == "uninstall" {
-		stopUntil := time.Now().Add(time.Duration(c.Timeouts.Stop+1) * time.Second)
-		if until.Before(stopUntil) {
-			stopUntil = until
-		}
-		if err := c.stop(stopUntil); err != nil {
-			return 1, err
-		}
-		if action == "stop" {
-			return 0, nil
-		}
-		if action == "uninstall" {
-			if len(c.UninstallArgs) == 0 {
-				return 0, nil
-			}
-			if err := c.uninstall(); err != nil {
-				return 1, err
-			}
-			return 0, nil
-		}
-	}
-	if err := c.request("status", time.Now().Add(time.Duration(c.Timeouts.Status)*time.Second)); err == nil {
-		return 0, nil
-	}
-	if err := c.start(until); err != nil {
-		return 1, err
-	}
-	return 0, nil
-}
-
-func (c *controller) readRecord() (record, error) {
-	var r record
-	f, err := safeFileExisting(filepath.Join(c.dir, "daemon.pid"))
-	if err != nil {
-		return r, err
-	}
-	defer f.Close()
-	err = json.NewDecoder(io.LimitReader(f, 4096)).Decode(&r)
-	if err == nil && (r.Supervisor < 1 || r.Child < 1 || r.Digest != c.digest) {
-		err = errors.New("daemon inventory mismatch")
-	}
-	return r, err
-}
-
-func safeFileExisting(path string) (*os.File, error) {
-	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
-	if err != nil {
-		return nil, err
-	}
-	st, err := f.Stat()
-	if err != nil || !st.Mode().IsRegular() || !owned(st) || st.Mode().Perm() != 0600 || st.Size() > 4096 || st.Sys().(*syscall.Stat_t).Nlink != 1 {
-		f.Close()
-		return nil, errors.New("foreign daemon record")
-	}
-	return f, nil
-}
-
-func (c *controller) request(action string, until time.Time) error {
-	r, err := c.readRecord()
-	if err != nil {
-		return err
-	}
-	conn, err := net.DialTimeout("unix", filepath.Join(c.dir, "ctl.sock"), time.Until(until))
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	if err := checkPeer(conn.(*net.UnixConn), r.Supervisor); err != nil {
-		return err
-	}
-	conn.SetDeadline(until)
-	if _, err := fmt.Fprintf(conn, "%s %s\n", action, c.digest); err != nil {
-		return err
-	}
-	raw, err := bufio.NewReader(io.LimitReader(conn, 256)).ReadString('\n')
-	if err != nil {
-		return err
-	}
-	if raw != "ok\n" {
-		return errors.New("daemon operation refused")
-	}
-	return nil
-}
-
-// With no supervisor lock held, never signal a PID read from inventory. A live
-// witnessed child means cleanup-required. Dead/zombie/reused PIDs can be retired.
-func (c *controller) retired() error {
-	r, err := c.readRecord()
-	if err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	if err == nil && recordedChildAlive(r.Child, r.Birth) {
-		return errors.New("daemon cleanup-required: live child without supervisor")
-	}
-	if err != nil {
-		if _, socketErr := os.Lstat(filepath.Join(c.dir, "ctl.sock")); !os.IsNotExist(socketErr) {
-			return errors.New("foreign daemon socket")
-		}
-	}
-	for _, name := range []string{"daemon.pid", "ctl.sock"} {
-		if err := os.Remove(filepath.Join(c.dir, name)); err != nil && !os.IsNotExist(err) {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *controller) stop(until time.Time) error {
-	if err := c.request("stop", until); err != nil {
-		owner, lockErr := c.lock("owner.lock", time.Now())
-		if lockErr != nil {
-			return err
-		}
-		defer owner.Close()
-		return c.retired()
-	}
-	owner, err := c.lock("owner.lock", until)
-	if err != nil {
-		return err
-	}
-	defer owner.Close()
-	return c.retired()
-}
-
-func (c *controller) start(until time.Time) error {
-	if !time.Now().Before(until) {
-		return errors.New("daemon start timeout")
-	}
-	owner, err := c.lock("owner.lock", time.Now())
-	if err != nil {
-		return err
-	}
-	if err := c.retired(); err != nil {
-		owner.Close()
-		return err
-	}
-	// Pass the already-held lifetime lock to the new supervisor. No handoff gap.
-	log, err := safeFile(filepath.Join(c.dir, "daemon.log"))
-	if err != nil {
-		owner.Close()
-		return err
-	}
-	defer log.Close()
-	if _, err := log.Seek(0, io.SeekEnd); err != nil {
-		owner.Close()
-		return err
-	}
-	reader, writer, err := os.Pipe()
-	if err != nil {
-		owner.Close()
-		return err
-	}
-	defer reader.Close()
-	self, err := os.Executable()
-	if err != nil {
-		owner.Close()
-		writer.Close()
-		return err
-	}
-	cmd := exec.Command(self, "supervise", c.dest, c.data)
-	cmd.Env = []string{"PATH=/usr/bin:/bin"}
-	cmd.Stdin, cmd.Stdout, cmd.Stderr = nil, log, log
-	cmd.ExtraFiles = []*os.File{writer, owner}
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-	err = cmd.Start()
-	writer.Close()
-	owner.Close()
-	if err != nil {
-		return err
-	}
-	// Wait in a goroutine to reap if startup fails. Successful supervisors are
-	// detached when this command exits; their directly-owned child stays attached.
-	go cmd.Wait()
-	ready := make(chan error, 1)
-	go func() {
-		raw, err := bufio.NewReader(io.LimitReader(reader, 32)).ReadString('\n')
-		if err == nil && raw != "ready\n" {
-			err = errors.New("daemon startup refused")
-		}
-		ready <- err
-	}()
-	select {
-	case err := <-ready:
-		return err
-	case <-time.After(time.Until(until)):
-		// Only our own still-retained supervisor can be signalled, never inventory.
-		cmd.Process.Signal(syscall.SIGTERM)
-		return errors.New("daemon start timeout")
-	}
-}
-
-func (c *controller) expand(v string) string {
-	return strings.ReplaceAll(strings.ReplaceAll(v, "${SYNOPKG_PKGDEST}", c.dest), "${SYNOPKG_PKGVAR}", c.data)
-}
-
-func (c *controller) child(args []string) *exec.Cmd {
-	expanded := make([]string, len(args))
-	for i, v := range args {
-		expanded[i] = c.expand(v)
-	}
-	cmd := exec.Command(filepath.Join(c.dest, "daemon/payload", c.Exec), expanded...)
-	cmd.Dir = c.data
-	cmd.Env = []string{"PATH=/usr/bin:/bin", "HOME=" + c.data, "TMPDIR=" + filepath.Join(c.dir, "tmp")}
-	keys := make([]string, 0, len(c.Env))
-	for key := range c.Env {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-	for _, key := range keys {
-		cmd.Env = append(cmd.Env, key+"="+c.expand(c.Env[key]))
-	}
-	cmd.SysProcAttr = childAttributes()
-	return cmd
-}
-
-func (c *controller) uninstall() error {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	cmd := c.child(c.UninstallArgs)
-	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	done := make(chan error, 1)
-	go func() { done <- cmd.Wait() }()
-	select {
-	case err := <-done:
-		return err
-	case <-time.After(time.Duration(c.Timeouts.Uninstall) * time.Second):
-		cmd.Process.Signal(syscall.SIGTERM)
-	}
-	select {
-	case <-done:
-		return errors.New("daemon uninstall timeout")
-	case <-time.After(time.Second):
-		cmd.Process.Kill()
-	}
-	select {
-	case <-done:
-		return errors.New("daemon uninstall timeout")
-	case <-time.After(time.Second):
-		return errors.New("daemon uninstall cleanup-required")
-	}
-}
-
-func (c *controller) supervise() error {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	ready, owner := os.NewFile(3, "ready"), os.NewFile(4, "owner.lock")
-	if ready == nil || owner == nil {
-		return errors.New("missing supervisor bootstrap")
-	}
-	defer ready.Close()
-	defer owner.Close()
-	syscall.CloseOnExec(3)
-	syscall.CloseOnExec(4)
-	// These descriptors must be the private pipe and exactly our already-held lock.
-	st, err := owner.Stat()
-	if err != nil {
-		return err
-	}
-	pathStat, err := os.Lstat(filepath.Join(c.dir, "owner.lock"))
-	if err != nil || !os.SameFile(st, pathStat) || !owned(st) {
-		return errors.New("invalid supervisor lock")
-	}
-	pipeStat, err := ready.Stat()
-	if err != nil || pipeStat.Mode()&os.ModeNamedPipe == 0 {
-		return errors.New("invalid supervisor pipe")
-	}
-	if err := syscall.Flock(int(owner.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
-		return err
-	}
-	signals := make(chan os.Signal, 1)
-	signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
-	defer signal.Stop(signals)
-	if c.Network != nil {
-		deadline := time.Now().Add(time.Duration(c.Timeouts.Start-2) * time.Second)
-		for {
-			err := checkNetwork("/proc/net", os.Geteuid(), c.Network)
-			if err == nil {
-				break
-			}
-			if !time.Now().Before(deadline) {
-				return err
-			}
-			select {
-			case <-signals:
-				return errors.New("compose startup interrupted")
-			case <-time.After(100 * time.Millisecond):
-			}
-		}
-	}
-	cmd := c.child(c.Args)
-	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	done := make(chan error, 1)
-	go func() { done <- cmd.Wait() }()
-	stop := func() error {
-		cmd.Process.Signal(syscall.SIGTERM)
-		select {
-		case <-done:
-			return nil
-		case <-time.After(time.Duration(c.Timeouts.Stop-1) * time.Second):
-			cmd.Process.Kill()
-		}
-		select {
-		case <-done:
-			return nil
-		case <-time.After(time.Second):
-			return errors.New("daemon child stop timeout")
-		}
-	}
-	// Process stability is the readiness contract; it is not app HTTP readiness.
-	select {
-	case <-done:
-		return errors.New("daemon exited during startup")
-	case <-signals:
-		return stop()
-	case <-time.After(time.Second):
-	}
-	r := record{Supervisor: os.Getpid(), Child: cmd.Process.Pid, Birth: processBirth(cmd.Process.Pid), Digest: c.digest}
-	raw, _ := json.Marshal(r)
-	f, err := safeFile(filepath.Join(c.dir, "daemon.pid"))
-	if err != nil {
-		stop()
-		return err
-	}
-	err = f.Truncate(0)
-	if err == nil {
-		_, err = f.Write(raw)
-	}
-	if err == nil {
-		err = f.Sync()
-	}
-	f.Close()
-	if err != nil {
-		stop()
-		return err
-	}
-	socket := filepath.Join(c.dir, "ctl.sock")
-	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
-	if err != nil {
-		stop()
-		os.Remove(filepath.Join(c.dir, "daemon.pid"))
-		return err
-	}
-	ln.SetUnlinkOnClose(false)
-	defer ln.Close()
-	clean := false
-	defer func() {
-		os.Remove(socket)
-		if clean {
-			os.Remove(filepath.Join(c.dir, "daemon.pid"))
-		}
-	}()
-	if err := os.Chmod(socket, 0600); err != nil {
-		stop()
-		return err
-	}
-	if _, err := ready.WriteString("ready\n"); err != nil {
-		clean = stop() == nil
-		return err
-	}
-	ready.Close()
-	connections := make(chan *net.UnixConn)
-	go func() {
-		for {
-			conn, err := ln.AcceptUnix()
-			if err != nil {
-				return
-			}
-			select {
-			case connections <- conn:
-			case <-time.After(time.Second):
-				conn.Close()
-			}
-		}
-	}()
-	tick := time.NewTicker(time.Second)
-	defer tick.Stop()
-	for {
-		select {
-		case <-tick.C:
-			if err := checkNetwork("/proc/net", os.Geteuid(), c.Network); err != nil {
-				clean = stop() == nil
-				return err
-			}
-		case <-done:
-			return nil
-		case <-signals:
-			err := stop()
-			clean = err == nil
-			return err
-		case conn := <-connections:
-			conn.SetDeadline(time.Now().Add(time.Duration(c.Timeouts.Status) * time.Second))
-			raw, err := bufio.NewReader(io.LimitReader(conn, 256)).ReadString('\n')
-			if err != nil {
-				conn.Close()
-				continue
-			}
-			if raw == "status "+c.digest+"\n" {
-				select {
-				case <-done:
-					conn.Write([]byte("failed\n"))
-					conn.Close()
-					return nil
-				default:
-					conn.Write([]byte("ok\n"))
-					conn.Close()
-				}
-			} else if raw == "stop "+c.digest+"\n" {
-				conn.SetDeadline(time.Now().Add(time.Duration(c.Timeouts.Stop+1) * time.Second))
-				err := stop()
-				clean = err == nil
-				if err == nil {
-					conn.Write([]byte("ok\n"))
-				} else {
-					conn.Write([]byte("failed\n"))
-				}
-				conn.Close()
-				return err
-			} else {
-				conn.Write([]byte("refused\n"))
-				conn.Close()
-			}
-		}
-	}
-}
-
-// The proc parser handles spaces and ')' inside Linux executable names.
-func parseBirth(raw string) (string, bool) {
-	end := strings.LastIndex(raw, ")")
-	if end < 0 {
-		return "", false
-	}
-	fields := strings.Fields(raw[end+1:])
-	if len(fields) < 20 {
-		return "", false
-	}
-	_, err := strconv.ParseUint(fields[19], 10, 64)
-	return fields[19], err == nil && fields[0] != "Z" && fields[0] != "X"
-}