@synopackageland/cli 0.3.10 → 0.4.0

package/dist/templates/native-go/backend/internal/helper/process_linux.go

@@ -0,0 +1,167 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func executableDigest(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return "", err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != 0 || st.Mode().Perm()&0022 != 0 || !st.Mode().IsRegular() || st.Size() > 64<<20 {
+		return "", errTrust
+	}
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func inspectSupervisor(pid int, i Inventory) (Process, error) {
+	base := fmt.Sprintf("/proc/%d/", pid)
+	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if err != nil {
+		return Process{}, err
+	}
+	stat, err := os.ReadFile(base + "stat")
+	if err != nil {
+		return Process{}, err
+	}
+	end := strings.LastIndex(string(stat), ") ")
+	if end < 0 {
+		return Process{}, errTrust
+	}
+	fields := strings.Fields(string(stat)[end+2:])
+	if len(fields) < 20 {
+		return Process{}, errTrust
+	}
+	status, err := os.ReadFile(base + "status")
+	if err != nil {
+		return Process{}, err
+	}
+	root := false
+	for _, line := range strings.Split(string(status), "\n") {
+		if strings.HasPrefix(line, "Uid:") {
+			u := strings.Fields(line)
+			root = len(u) == 5 && u[1] == "0" && u[2] == "0" && u[3] == "0" && u[4] == "0"
+		}
+	}
+	if !root {
+		return Process{}, errTrust
+	}
+	cmd, err := os.ReadFile(base + "cmdline")
+	if err != nil {
+		return Process{}, err
+	}
+	wantExe := "/var/lib/synopkgland-" + i.Package + "/payload-" + i.PayloadDigest
+	if string(cmd) != wantExe+"\x00supervise\x00" {
+		return Process{}, errTrust
+	}
+	st, err := os.Stat(base + "exe")
+	if err != nil {
+		return Process{}, err
+	}
+	s := st.Sys().(*syscall.Stat_t)
+	digest, err := executableDigest(base + "exe")
+	if err != nil || digest != i.PayloadDigest {
+		return Process{}, errTrust
+	}
+	return Process{Inventory: i, Mode: "supervised", PID: pid, Boot: strings.TrimSpace(string(b)), Start: fields[19], Device: uint64(s.Dev), Inode: s.Ino}, nil
+}
+
+type LinuxProcesses struct {
+	Client
+	Binary string
+}
+
+func (p LinuxProcesses) Start(i Inventory) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if i != p.Expected {
+		return errTrust
+	}
+	if err := protected(p.RunDir, 0, true); err != nil {
+		return err
+	}
+	cmd := exec.Command(p.Binary, "supervise")
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	go cmd.Wait()
+	if waitHealthy(ctx, func(ctx context.Context) bool {
+		state, _ := p.probe(ctx, filepath.Join(p.RunDir, "helper.sock"))
+		return state == "ready"
+	}) == nil {
+		return nil
+	}
+	return errors.New("helper start timeout; residual preserved")
+}
+
+// RunLinux runs a fixed control action or the health-only server. Its caller
+// must be the hash-verified, root-owned copy, never the SPK staging executable.
+func RunLinux(base Inventory, action string) error {
+	if os.Geteuid() != 0 {
+		return errTrust
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	digest, err := executableDigest(exe)
+	if err != nil {
+		return err
+	}
+	base.PayloadDigest = digest
+	if !base.Valid() || exe != "/var/lib/synopkgland-"+base.Package+"/payload-"+digest {
+		return errTrust
+	}
+	c := NewClient(base)
+	if err := protected(c.StateDir, 0, true); err != nil {
+		return err
+	}
+	if err := protected(c.RunDir, 0, true); err != nil {
+		return err
+	}
+	switch action {
+	case "supervise":
+		return superviseLinux(c, exe)
+	case "serve-child":
+		parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
+		if err != nil {
+			return errTrust
+		}
+		runtime.LockOSThread()
+		defer runtime.UnlockOSThread()
+		if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
+			return err
+		}
+		if _, err := inspectSupervisor(parent, base); err != nil {
+			return err
+		}
+		return serveLinux(c)
+	}
+	return (Controller{Client: c, Processes: LinuxProcesses{Client: c, Binary: exe}}).Control(context.Background(), action)
+}

package/dist/templates/native-go/backend/internal/helper/process_other.go

@@ -0,0 +1,5 @@
+//go:build !linux
+
+package helper
+
+func RunLinux(Inventory, string) error { return errTrust }

package/dist/templates/native-go/backend/internal/helper/server_linux.go

@@ -0,0 +1,83 @@
+package helper
+
+import (
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"time"
+)
+
+func serveLinux(c Client) error {
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || !r.Enabled || r.Inventory != c.Expected {
+		return errTrust
+	}
+	// Only the supervisor writes process.json.
+	// The package group can connect; ordinary users reach only the authenticated
+	// CGI status route. SO_PEERCRED also checks the package's current numeric UID.
+	u, err := user.Lookup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	uid, err := strconv.ParseUint(u.Uid, 10, 32)
+	if err != nil {
+		return err
+	}
+	group, err := user.LookupGroup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	gid, err := strconv.Atoi(group.Gid)
+	if err != nil {
+		return err
+	}
+	socket := filepath.Join(c.RunDir, "helper.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		return err
+	}
+	l.SetUnlinkOnClose(false)
+	defer l.Close()
+	if err := os.Chown(socket, 0, gid); err != nil {
+		return err
+	}
+	if err := os.Chmod(socket, 0660); err != nil {
+		return err
+	}
+	// Bound concurrency and each frame's size/time. No privileged mutations are
+	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	slots := make(chan struct{}, 8)
+	for {
+		conn, err := l.AcceptUnix()
+		if err != nil {
+			return err
+		}
+		select {
+		case slots <- struct{}{}:
+		default:
+			conn.Close()
+			continue
+		}
+		go func() {
+			defer func() { conn.Close(); <-slots }()
+			peer, err := peerUID(conn)
+			if err != nil || (peer != 0 && peer != uint32(uid)) {
+				return
+			}
+			conn.SetDeadline(time.Now().Add(time.Second))
+			var req Request
+			d := json.NewDecoder(io.LimitReader(conn, 4097))
+			d.DisallowUnknownFields()
+			if d.Decode(&req) != nil {
+				return
+			}
+			r, err := readRecord(c.StateDir, 0)
+			disabled := err != nil || !r.Enabled || r.Inventory != c.Expected
+			json.NewEncoder(conn).Encode(Respond(c.Expected, disabled, req))
+		}()
+	}
+}

package/dist/templates/native-go/backend/internal/helper/status.go

@@ -0,0 +1,271 @@
+// Package helper implements the opt-in per-package lifecycle contract. It has
+// no file/grant/job API: all unimplemented operations fail closed.
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"regexp"
+	"syscall"
+	"time"
+)
+
+type Inventory struct {
+	Package        string `json:"package"`
+	Version        string `json:"version"`
+	Protocol       int    `json:"protocol"`
+	PayloadDigest  string `json:"payloadDigest"`
+	RegistryDigest string `json:"registryDigest"`
+}
+
+var digestPattern = regexp.MustCompile(`^[a-f0-9]{64}$`)
+var packagePattern = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
+var versionPattern = regexp.MustCompile(`^\d+(\.\d+){0,3}-\d{4}$`)
+
+func (i Inventory) Valid() bool {
+	return packagePattern.MatchString(i.Package) && versionPattern.MatchString(i.Version) && i.Protocol > 0 && digestPattern.MatchString(i.PayloadDigest) && digestPattern.MatchString(i.RegistryDigest)
+}
+
+type Record struct {
+	Inventory Inventory `json:"inventory"`
+	Enabled   bool      `json:"enabled"`
+	Residual  bool      `json:"residual,omitempty"`
+}
+type Request struct {
+	Inventory Inventory `json:"inventory"`
+	Op        string    `json:"op"`
+	Nonce     string    `json:"nonce"`
+}
+type Response struct {
+	Inventory Inventory `json:"inventory"`
+	Nonce     string    `json:"nonce"`
+	OK        bool      `json:"ok"`
+	Error     string    `json:"error,omitempty"`
+}
+
+func Respond(i Inventory, disabled bool, req Request) Response {
+	r := Response{Inventory: i, Nonce: req.Nonce}
+	switch {
+	case disabled:
+		r.Error = "disabled"
+	case !i.Valid() || req.Inventory != i:
+		r.Error = "incompatible"
+	case req.Op != "health":
+		r.Error = "unsupported"
+	default:
+		r.OK = true
+	}
+	return r
+}
+
+// State is safe to expose to any authenticated DSM user. Paths, PIDs, worker
+// internals, scheduler definitions and raw errors never enter this envelope.
+type State struct {
+	State          string `json:"state"`
+	Reason         string `json:"reason"`
+	PackageRunning string `json:"packageRunning"`
+	Scheduler      string `json:"scheduler"`
+	Cleanup        string `json:"cleanup,omitempty"`
+}
+
+type Client struct {
+	Expected         Inventory
+	StateDir, RunDir string
+	// Production uses UID 0 and RootPeer. Tests inject only local fixture identity.
+	Owner uint32
+	Peer  func(*net.UnixConn) error
+}
+
+func NewClient(i Inventory) Client {
+	return Client{Expected: i, StateDir: "/var/lib/synopkgland-" + i.Package, RunDir: "/run/synopkgland-helper-" + i.Package, Peer: RootPeer}
+}
+
+// LocalClient is a nonprivileged diagnostic entry point for package hooks.
+// Hashing the local executable establishes only the expected build inventory;
+// readiness still requires the protected record and root socket handshake.
+func LocalClient(i Inventory) (Client, error) {
+	exe, err := os.Executable()
+	if err != nil {
+		return Client{}, err
+	}
+	f, err := os.Open(exe)
+	if err != nil {
+		return Client{}, err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, io.LimitReader(f, (64<<20)+1)); err != nil {
+		return Client{}, err
+	}
+	i.PayloadDigest = hex.EncodeToString(h.Sum(nil))
+	if !i.Valid() {
+		return Client{}, errTrust
+	}
+	return NewClient(i), nil
+}
+
+func (c Client) CheckStopped(ctx context.Context) error {
+	s := c.Status(ctx)
+	if s.Cleanup != "" || (s.State != "not-enabled" && s.State != "stopped" && s.State != "needs-approval") {
+		return errors.New("approved helper teardown required")
+	}
+	for _, file := range []string{"process.json", "helper.sock", "supervisor.sock"} {
+		if _, err := os.Lstat(filepath.Join(c.RunDir, file)); !errors.Is(err, fs.ErrNotExist) {
+			return errors.New("helper residue; approved teardown required")
+		}
+	}
+	return nil
+}
+
+var errTrust = errors.New("untrusted helper state")
+
+func protected(path string, owner uint32, directory bool) error {
+	st, err := os.Lstat(path)
+	if err != nil {
+		return err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != owner || st.Mode().Perm()&0022 != 0 || (directory && !st.IsDir()) || (!directory && !st.Mode().IsRegular()) {
+		return errTrust
+	}
+	return nil
+}
+
+func readRecord(dir string, owner uint32) (Record, error) {
+	var r Record
+	if err := protected(dir, owner, true); err != nil {
+		return r, err
+	}
+	f, err := os.OpenFile(filepath.Join(dir, "approval.json"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return r, err
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return r, err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != owner || st.Mode().Perm()&0022 != 0 || !st.Mode().IsRegular() || st.Size() > 4096 {
+		return r, errTrust
+	}
+	d := json.NewDecoder(io.LimitReader(f, 4097))
+	d.DisallowUnknownFields()
+	var decoded struct {
+		Inventory Inventory `json:"inventory"`
+		Enabled   *bool     `json:"enabled"`
+		Residual  bool      `json:"residual,omitempty"`
+	}
+	if d.Decode(&decoded) != nil || d.Decode(new(any)) != io.EOF || !decoded.Inventory.Valid() || decoded.Enabled == nil {
+		return r, errTrust
+	}
+	r = Record{Inventory: decoded.Inventory, Enabled: *decoded.Enabled, Residual: decoded.Residual}
+	return r, nil
+}
+
+func (c Client) Status(ctx context.Context) State {
+	result := func(state, reason string) State {
+		return State{State: state, Reason: reason, PackageRunning: "unknown", Scheduler: "not-probed"}
+	}
+	if c.Expected.Package == "" {
+		return result("not-enabled", "not-requested")
+	}
+	if !c.Expected.Valid() {
+		return result("incompatible", "invalid-inventory")
+	}
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return result("incompatible", "untrusted-approval")
+	}
+	if err == nil && !r.Enabled {
+		s := result("not-enabled", "disabled")
+		if r.Residual {
+			s.Cleanup = "required"
+		}
+		return s
+	}
+	if err == nil && r.Inventory != c.Expected {
+		return result("incompatible", "inventory-mismatch")
+	}
+	if err == nil && r.Residual {
+		s := result("failed", "incomplete-transition")
+		s.Cleanup = "required"
+		return s
+	}
+	// Conflict has precedence over missing approval. Even an unapproved leftover
+	// socket is probed before claiming that authorization alone can fix it.
+	if e := protected(c.RunDir, c.Owner, true); e != nil && !errors.Is(e, fs.ErrNotExist) {
+		return result("incompatible", "untrusted-runtime")
+	}
+	socket := filepath.Join(c.RunDir, "helper.sock")
+	st, e := os.Lstat(socket)
+	if e == nil {
+		s, ok := st.Sys().(*syscall.Stat_t)
+		if !ok || s.Uid != c.Owner || st.Mode()&os.ModeSocket == 0 || st.Mode().Perm()&0002 != 0 {
+			return result("incompatible", "untrusted-socket")
+		}
+		state, reason := c.probe(ctx, socket)
+		if state != "ready" {
+			return result(state, reason)
+		}
+	} else if !errors.Is(e, fs.ErrNotExist) {
+		return result("failed", "runtime-unreadable")
+	}
+	if err != nil {
+		return result("needs-approval", "approval-missing")
+	}
+	if e != nil {
+		return result("stopped", "runtime-missing")
+	}
+	return result("ready", "live-handshake")
+}
+
+func (c Client) probe(ctx context.Context, socket string) (string, string) {
+	deadline := time.Now().Add(time.Second)
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	dialer := net.Dialer{Deadline: deadline}
+	conn, err := dialer.DialContext(ctx, "unix", socket)
+	if err != nil {
+		if errors.Is(err, syscall.ECONNREFUSED) || errors.Is(err, fs.ErrNotExist) {
+			return "stopped", "runtime-not-listening"
+		}
+		return "failed", "probe-failed"
+	}
+	defer conn.Close()
+	if c.Peer == nil || c.Peer(conn.(*net.UnixConn)) != nil {
+		return "incompatible", "untrusted-peer"
+	}
+	conn.SetDeadline(deadline)
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return "failed", "probe-failed"
+	}
+	req := Request{c.Expected, "health", hex.EncodeToString(nonce[:])}
+	if json.NewEncoder(conn).Encode(req) != nil {
+		return "failed", "probe-failed"
+	}
+	var res Response
+	d := json.NewDecoder(io.LimitReader(conn, 4097))
+	d.DisallowUnknownFields()
+	if d.Decode(&res) != nil {
+		return "failed", "invalid-handshake"
+	}
+	if res.Nonce != req.Nonce || res.Inventory != c.Expected || res.Error == "incompatible" {
+		return "incompatible", "handshake-mismatch"
+	}
+	if !res.OK || res.Error != "" {
+		return "failed", "health-refused"
+	}
+	return "ready", "live-handshake"
+}