@synopackageland/cli 0.3.10 → 0.4.0

package/templates/native-go/backend/internal/helper/control_test.go

@@ -0,0 +1,242 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func staleSocket(t *testing.T, p string) {
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: p, Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	l.SetUnlinkOnClose(false)
+	l.Close()
+}
+
+type fakeProcesses struct {
+	current          Process
+	stopped, started int
+	stopErr          error
+}
+
+func (f *fakeProcesses) Stop(want Process) error {
+	if f.stopErr != nil {
+		return f.stopErr
+	}
+	if want != f.current {
+		return errTrust
+	}
+	f.stopped++
+	return nil
+}
+func (f *fakeProcesses) Start(Inventory) error { f.started++; return nil }
+
+func controlFixture(t *testing.T) (Controller, *fakeProcesses) {
+	c := fixture(t)
+	p := Process{Inventory: c.Expected, Mode: "supervised", PID: 1234, Boot: "fixture-boot", Start: "100", Device: 1, Inode: 2}
+	f := &fakeProcesses{current: p}
+	ctl := Controller{Client: c, Processes: f}
+	record(t, c, Record{Inventory: c.Expected, Enabled: true})
+	if err := writeProcess(c.RunDir, p); err != nil {
+		t.Fatal(err)
+	}
+	return ctl, f
+}
+
+func TestTeardownAndRecoveryVerifyOwnedProcess(t *testing.T) {
+	for _, kind := range []string{"pid", "boot", "start", "inode", "digest", "package"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f := controlFixture(t)
+			switch kind {
+			case "pid":
+				f.current.PID++
+			case "boot":
+				f.current.Boot = "new-boot"
+			case "start":
+				f.current.Start = "reused"
+			case "inode":
+				f.current.Inode++
+			case "digest":
+				f.current.Inventory.PayloadDigest = "foreign"
+			case "package":
+				f.current.Inventory.Package = "Other"
+			}
+			if c.Control(context.Background(), "recover") == nil || f.stopped != 0 || f.started != 0 {
+				t.Fatal("foreign process touched")
+			}
+			if _, err := os.Stat(filepath.Join(c.RunDir, "process.json")); err != nil {
+				t.Fatal("failure evidence removed")
+			}
+		})
+	}
+	c, f := controlFixture(t)
+	if err := c.Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	if f.stopped != 1 || f.started != 0 {
+		t.Fatal(f)
+	}
+	if _, err := os.Stat(filepath.Join(c.RunDir, "process.json")); !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+	if err := c.Control(context.Background(), "recover"); err != nil || f.started != 1 {
+		t.Fatalf("%v %+v", err, f)
+	}
+}
+
+func TestDisableIsDurableAndPrecedesFailedCleanup(t *testing.T) {
+	c, f := controlFixture(t)
+	f.stopErr = errors.New("fixture stop failed")
+	if c.Control(context.Background(), "disable") == nil {
+		t.Fatal("cleanup falsely succeeded")
+	}
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || !r.Residual {
+		t.Fatalf("%+v %v", r, err)
+	}
+	s := c.Status(context.Background())
+	if s.State != "not-enabled" || s.Cleanup != "required" {
+		t.Fatal(s)
+	}
+	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+		t.Fatal("old recovery resurrected disabled integration")
+	}
+	f.stopErr = nil
+	if err := c.Control(context.Background(), "disable"); err != nil {
+		t.Fatal(err)
+	}
+	r, _ = readRecord(c.StateDir, c.Owner)
+	if r.Enabled || r.Residual {
+		t.Fatal(r)
+	}
+	if err := c.Control(context.Background(), "enable"); err != nil || f.started != 1 {
+		t.Fatalf("%v %+v", err, f)
+	}
+}
+
+func TestMissingApprovalAndUnknownActionCannotStart(t *testing.T) {
+	c, f := controlFixture(t)
+	os.Remove(filepath.Join(c.StateDir, "approval.json"))
+	if c.Control(context.Background(), "recover") == nil {
+		t.Fatal("recover without approval")
+	}
+	if c.Control(context.Background(), "arbitrary-command") == nil || f.started != 0 {
+		t.Fatal("arbitrary action accepted")
+	}
+}
+
+func TestSocketResidueCannotUnlinkForeignFilesOrLiveListeners(t *testing.T) {
+	for _, kind := range []string{"file", "symlink", "live", "stale"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f := controlFixture(t)
+			os.Remove(filepath.Join(c.RunDir, "process.json"))
+			p := filepath.Join(c.RunDir, "helper.sock")
+			switch kind {
+			case "file":
+				os.WriteFile(p, []byte("foreign"), 0600)
+			case "symlink":
+				os.Symlink("foreign", p)
+			case "live":
+				live(t, c.Client, c.Expected, nil)
+			case "stale":
+				staleSocket(t, p)
+			}
+			err := c.Control(context.Background(), "teardown")
+			if kind == "stale" {
+				if err != nil {
+					t.Fatal(err)
+				}
+				if _, err := os.Lstat(p); !os.IsNotExist(err) {
+					t.Fatal("stale socket not removed")
+				}
+			} else {
+				if err == nil {
+					t.Fatal("foreign residue accepted")
+				}
+				if _, err := os.Lstat(p); err != nil {
+					t.Fatal("foreign residue removed")
+				}
+			}
+			if f.stopped != 0 {
+				t.Fatal("unrecorded process signalled")
+			}
+		})
+	}
+}
+
+func TestLifecycleGateBlocksResidueAndAllowsCleanStoppedState(t *testing.T) {
+	c, _ := controlFixture(t)
+	if c.CheckStopped(context.Background()) == nil {
+		t.Fatal("process residue accepted")
+	}
+	if err := c.Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.CheckStopped(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Inventory: c.Expected, Enabled: false, Residual: true})
+	if c.CheckStopped(context.Background()) == nil {
+		t.Fatal("failed disable accepted")
+	}
+}
+
+func TestStartupProbesShareOneDeadline(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+	defer cancel()
+	err := waitHealthy(ctx, func(probeCtx context.Context) bool {
+		if probeCtx != ctx {
+			t.Fatal("probe got an independent deadline")
+		}
+		<-probeCtx.Done()
+		return false
+	})
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatal(err)
+	}
+	if err := waitHealthy(context.Background(), func(context.Context) bool { return true }); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestSupervisorSocketResidueAlsoBlocksLifecycle(t *testing.T) {
+	c, _ := controlFixture(t)
+	os.Remove(filepath.Join(c.RunDir, "process.json"))
+	p := filepath.Join(c.RunDir, "supervisor.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: p, Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer l.Close()
+	if c.CheckStopped(context.Background()) == nil {
+		t.Fatal("unidentified supervisor accepted")
+	}
+	if c.Control(context.Background(), "teardown") == nil {
+		t.Fatal("live supervisor ignored")
+	}
+}
+
+func TestOnlySupervisedProcessRecordsAreReadable(t *testing.T) {
+	for _, mode := range []string{"", "supervised", "unknown"} {
+		c, f := controlFixture(t)
+		p := f.current
+		p.Mode = mode
+		if err := writeProcess(c.RunDir, p); err != nil {
+			t.Fatal(err)
+		}
+		got, err := readProcess(c.RunDir, c.Owner)
+		if mode != "supervised" {
+			if err == nil {
+				t.Fatal("unsupervised process mode accepted")
+			}
+		} else if err != nil || got != p {
+			t.Fatalf("mode %q: %+v %v", mode, got, err)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/peer_linux.go

@@ -0,0 +1,44 @@
+package helper
+
+import (
+	"net"
+	"syscall"
+)
+
+func peerCredentials(conn *net.UnixConn) (*syscall.Ucred, error) {
+	raw, err := conn.SyscallConn()
+	if err != nil {
+		return nil, err
+	}
+	var cred *syscall.Ucred
+	var sockErr error
+	err = raw.Control(func(fd uintptr) {
+		cred, sockErr = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
+	})
+	if err != nil {
+		return nil, err
+	}
+	if sockErr != nil {
+		return nil, sockErr
+	}
+	return cred, nil
+}
+
+func peerUID(conn *net.UnixConn) (uint32, error) {
+	cred, err := peerCredentials(conn)
+	if err != nil {
+		return 0, err
+	}
+	return cred.Uid, nil
+}
+
+func RootPeer(conn *net.UnixConn) error {
+	uid, err := peerUID(conn)
+	if err != nil {
+		return err
+	}
+	if uid != 0 {
+		return errTrust
+	}
+	return nil
+}

package/templates/native-go/backend/internal/helper/peer_other.go

@@ -0,0 +1,7 @@
+//go:build !linux
+
+package helper
+
+import "net"
+
+func RootPeer(*net.UnixConn) error { return errTrust }

package/templates/native-go/backend/internal/helper/process_linux.go

@@ -0,0 +1,167 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func executableDigest(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return "", err
+	}
+	s, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || s.Uid != 0 || st.Mode().Perm()&0022 != 0 || !st.Mode().IsRegular() || st.Size() > 64<<20 {
+		return "", errTrust
+	}
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func inspectSupervisor(pid int, i Inventory) (Process, error) {
+	base := fmt.Sprintf("/proc/%d/", pid)
+	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if err != nil {
+		return Process{}, err
+	}
+	stat, err := os.ReadFile(base + "stat")
+	if err != nil {
+		return Process{}, err
+	}
+	end := strings.LastIndex(string(stat), ") ")
+	if end < 0 {
+		return Process{}, errTrust
+	}
+	fields := strings.Fields(string(stat)[end+2:])
+	if len(fields) < 20 {
+		return Process{}, errTrust
+	}
+	status, err := os.ReadFile(base + "status")
+	if err != nil {
+		return Process{}, err
+	}
+	root := false
+	for _, line := range strings.Split(string(status), "\n") {
+		if strings.HasPrefix(line, "Uid:") {
+			u := strings.Fields(line)
+			root = len(u) == 5 && u[1] == "0" && u[2] == "0" && u[3] == "0" && u[4] == "0"
+		}
+	}
+	if !root {
+		return Process{}, errTrust
+	}
+	cmd, err := os.ReadFile(base + "cmdline")
+	if err != nil {
+		return Process{}, err
+	}
+	wantExe := "/var/lib/synopkgland-" + i.Package + "/payload-" + i.PayloadDigest
+	if string(cmd) != wantExe+"\x00supervise\x00" {
+		return Process{}, errTrust
+	}
+	st, err := os.Stat(base + "exe")
+	if err != nil {
+		return Process{}, err
+	}
+	s := st.Sys().(*syscall.Stat_t)
+	digest, err := executableDigest(base + "exe")
+	if err != nil || digest != i.PayloadDigest {
+		return Process{}, errTrust
+	}
+	return Process{Inventory: i, Mode: "supervised", PID: pid, Boot: strings.TrimSpace(string(b)), Start: fields[19], Device: uint64(s.Dev), Inode: s.Ino}, nil
+}
+
+type LinuxProcesses struct {
+	Client
+	Binary string
+}
+
+func (p LinuxProcesses) Start(i Inventory) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if i != p.Expected {
+		return errTrust
+	}
+	if err := protected(p.RunDir, 0, true); err != nil {
+		return err
+	}
+	cmd := exec.Command(p.Binary, "supervise")
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	go cmd.Wait()
+	if waitHealthy(ctx, func(ctx context.Context) bool {
+		state, _ := p.probe(ctx, filepath.Join(p.RunDir, "helper.sock"))
+		return state == "ready"
+	}) == nil {
+		return nil
+	}
+	return errors.New("helper start timeout; residual preserved")
+}
+
+// RunLinux runs a fixed control action or the health-only server. Its caller
+// must be the hash-verified, root-owned copy, never the SPK staging executable.
+func RunLinux(base Inventory, action string) error {
+	if os.Geteuid() != 0 {
+		return errTrust
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	digest, err := executableDigest(exe)
+	if err != nil {
+		return err
+	}
+	base.PayloadDigest = digest
+	if !base.Valid() || exe != "/var/lib/synopkgland-"+base.Package+"/payload-"+digest {
+		return errTrust
+	}
+	c := NewClient(base)
+	if err := protected(c.StateDir, 0, true); err != nil {
+		return err
+	}
+	if err := protected(c.RunDir, 0, true); err != nil {
+		return err
+	}
+	switch action {
+	case "supervise":
+		return superviseLinux(c, exe)
+	case "serve-child":
+		parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
+		if err != nil {
+			return errTrust
+		}
+		runtime.LockOSThread()
+		defer runtime.UnlockOSThread()
+		if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
+			return err
+		}
+		if _, err := inspectSupervisor(parent, base); err != nil {
+			return err
+		}
+		return serveLinux(c)
+	}
+	return (Controller{Client: c, Processes: LinuxProcesses{Client: c, Binary: exe}}).Control(context.Background(), action)
+}

package/templates/native-go/backend/internal/helper/process_other.go

@@ -0,0 +1,5 @@
+//go:build !linux
+
+package helper
+
+func RunLinux(Inventory, string) error { return errTrust }

package/templates/native-go/backend/internal/helper/server_linux.go

@@ -0,0 +1,83 @@
+package helper
+
+import (
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"time"
+)
+
+func serveLinux(c Client) error {
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || !r.Enabled || r.Inventory != c.Expected {
+		return errTrust
+	}
+	// Only the supervisor writes process.json.
+	// The package group can connect; ordinary users reach only the authenticated
+	// CGI status route. SO_PEERCRED also checks the package's current numeric UID.
+	u, err := user.Lookup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	uid, err := strconv.ParseUint(u.Uid, 10, 32)
+	if err != nil {
+		return err
+	}
+	group, err := user.LookupGroup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	gid, err := strconv.Atoi(group.Gid)
+	if err != nil {
+		return err
+	}
+	socket := filepath.Join(c.RunDir, "helper.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		return err
+	}
+	l.SetUnlinkOnClose(false)
+	defer l.Close()
+	if err := os.Chown(socket, 0, gid); err != nil {
+		return err
+	}
+	if err := os.Chmod(socket, 0660); err != nil {
+		return err
+	}
+	// Bound concurrency and each frame's size/time. No privileged mutations are
+	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	slots := make(chan struct{}, 8)
+	for {
+		conn, err := l.AcceptUnix()
+		if err != nil {
+			return err
+		}
+		select {
+		case slots <- struct{}{}:
+		default:
+			conn.Close()
+			continue
+		}
+		go func() {
+			defer func() { conn.Close(); <-slots }()
+			peer, err := peerUID(conn)
+			if err != nil || (peer != 0 && peer != uint32(uid)) {
+				return
+			}
+			conn.SetDeadline(time.Now().Add(time.Second))
+			var req Request
+			d := json.NewDecoder(io.LimitReader(conn, 4097))
+			d.DisallowUnknownFields()
+			if d.Decode(&req) != nil {
+				return
+			}
+			r, err := readRecord(c.StateDir, 0)
+			disabled := err != nil || !r.Enabled || r.Inventory != c.Expected
+			json.NewEncoder(conn).Encode(Respond(c.Expected, disabled, req))
+		}()
+	}
+}