@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/s1r_actor_fixture_linux_test.go

@@ -0,0 +1,184 @@
+package helper
+
+// Disposable Linux VM fixtures only. No account lookup or ACL adapter is
+// installed into the shipped helper, and no business FD is opened by the parent.
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	s1rAlice    = 23001
+	s1rBob      = 23002
+	s1rAliceGID = 24001
+	s1rBobGID   = 24002
+	s1rShared   = 24003
+	s1rExtra    = 24004
+)
+
+func s1rMust(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func s1rACL(t *testing.T, path, acl string) {
+	t.Helper()
+	b, err := exec.Command("/usr/bin/setfacl", "-m", acl, path).CombinedOutput()
+	if err != nil {
+		t.Fatalf("setfacl %s: %v %s", path, err, b)
+	}
+}
+
+func s1rFixture(t *testing.T) string {
+	t.Helper()
+	root, err := os.MkdirTemp("/tmp", "s1r-vm-")
+	s1rMust(t, err)
+	t.Cleanup(func() { s1rMust(t, os.RemoveAll(root)) })
+	s1rMust(t, os.Chmod(root, 0755))
+	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "acl-group", "acl-group-mask", "inherit", "readonly", "race"} {
+		dir := root + "/" + name
+		s1rMust(t, os.Mkdir(dir, 0700))
+		s1rMust(t, os.WriteFile(dir+"/file", []byte("canary:"+name), 0600))
+	}
+	for _, p := range []struct {
+		name     string
+		uid, gid int
+	}{{"alice", s1rAlice, s1rAliceGID}, {"bob", s1rBob, s1rBobGID}, {"race", s1rAlice, s1rAliceGID}} {
+		for _, path := range []string{root + "/" + p.name, root + "/" + p.name + "/file"} {
+			s1rMust(t, os.Chown(path, p.uid, p.gid))
+		}
+	}
+	for _, path := range []string{root + "/supplementary", root + "/supplementary/file"} {
+		s1rMust(t, os.Chown(path, 0, s1rShared))
+	}
+	s1rMust(t, unix.Chmod(root+"/supplementary", 02770))
+	s1rMust(t, os.Chmod(root+"/supplementary/file", 0660))
+	for _, name := range []string{"acl-allow", "acl-file-mask", "inherit"} {
+		s1rACL(t, root+"/"+name, fmt.Sprintf("u:%d:rwx,m::rwx", s1rAlice))
+		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("u:%d:rw-,m::rw-", s1rAlice))
+	}
+	s1rACL(t, root+"/acl-mask", fmt.Sprintf("u:%d:rwx,m::---", s1rAlice))
+	s1rACL(t, root+"/acl-mask/file", fmt.Sprintf("u:%d:rw-,m::---", s1rAlice))
+	s1rACL(t, root+"/acl-file-mask/file", "m::---")
+	for _, name := range []string{"acl-group", "acl-group-mask"} {
+		s1rACL(t, root+"/"+name, fmt.Sprintf("g:%d:rwx,m::rwx", s1rShared))
+		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("g:%d:rw-,m::rw-", s1rShared))
+	}
+	s1rACL(t, root+"/acl-group-mask", "m::r-x")
+	s1rACL(t, root+"/acl-group-mask/file", "m::r--")
+	s1rACL(t, root+"/inherit", fmt.Sprintf("u:%d:r-x,d:u::rwx,d:u:%d:rwx,d:u:%d:r-x,d:g::---,d:m::rwx,d:o::---", s1rBob, s1rAlice, s1rBob))
+	s1rACL(t, root+"/inherit/file", fmt.Sprintf("u:%d:r--,m::rw-", s1rBob))
+	s1rMust(t, os.Chmod(root+"/readonly", 0555))
+	s1rMust(t, os.Chmod(root+"/readonly/file", 0444))
+	return root
+}
+
+type s1rActorSpec struct {
+	UID, GID       uint32
+	Groups         []uint32
+	Root, Scenario string
+}
+
+// Run a fresh test process as root, invoke the REAL permanent drop routine, and
+// proxy ONLY mount metadata using the production packet/FD routines. The parent
+// pins the child's proc directory before permitting its credential transition.
+func s1rRunActor(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	s1rMust(t, err)
+	left := os.NewFile(uintptr(pair[0]), "s1r-parent")
+	right := os.NewFile(uintptr(pair[1]), "s1r-child")
+	defer left.Close()
+	defer right.Close()
+	control, err := operationSocket(left)
+	s1rMust(t, err)
+	defer control.Close()
+	s1rMust(t, enableCredentials(control))
+	exe, err := os.Executable()
+	s1rMust(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, exe, "-test.run=^TestS1RActorProcess$", "-test.v")
+	b, err := json.Marshal(spec)
+	s1rMust(t, err)
+	cmd.Env = append(os.Environ(), "S1R_ACTOR_SPEC="+string(b))
+	cmd.ExtraFiles = []*os.File{right}
+	// Deliberately inherit unrelated/root/supplementary groups. The production
+	// Setgroups call must replace these, including when the requested set is empty.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 0, Gid: 0, Groups: []uint32{0, s1rShared, 24005}}}
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	s1rMust(t, cmd.Start())
+	defer func() {
+		if cmd.ProcessState == nil {
+			cmd.Process.Kill()
+			cmd.Wait()
+		}
+	}()
+	info, err := openOperationFDInfo(cmd.Process.Pid)
+	s1rMust(t, err)
+	defer info.Close()
+	s1rMust(t, writeOperationPacket(control, true))
+	done := make(chan error, 1)
+	go func() {
+		var sequence uint64
+		for {
+			var packet readOnlyPacket
+			cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, 30*time.Second)
+			if err != nil {
+				done <- nil
+				return
+			} // process exit closes the private socket
+			if cred == nil || int(cred.Pid) != cmd.Process.Pid || cred.Uid != spec.UID || cred.Gid != spec.GID || packet.Token != strings.Repeat("a", 64) || packet.MountFD == nil || packet.MountSequence != sequence+1 {
+				done <- fmt.Errorf("invalid actor mount query")
+				return
+			}
+			sequence++
+			id, code := operationFDInfoMount(info, *packet.MountFD)
+			if err := writeOperationPacket(control, readOnlyMountReply{Token: packet.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
+				done <- err
+				return
+			}
+		}
+	}()
+	err = cmd.Wait()
+	control.Close()
+	proxyErr := <-done
+	if err != nil || proxyErr != nil {
+		t.Fatalf("actor %s: %v proxy=%v\n%s", spec.Scenario, err, proxyErr, out.String())
+	}
+	t.Log(out.String())
+}
+
+func s1rDropActor(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	runtime.LockOSThread() // like operationChildLinux; subprocess exits when finished
+	f := os.NewFile(3, "s1r-control")
+	defer f.Close()
+	control, err := operationSocket(f)
+	s1rMust(t, err)
+	t.Cleanup(func() { control.Close() })
+	var ready bool
+	_, err = readOperationPacketBound(control, &ready, MaxHealthBytes, 5*time.Second)
+	s1rMust(t, err)
+	if !ready {
+		t.Fatal("parent did not pin proc witness")
+	}
+	boot := operationBootstrap{UID: spec.UID, GID: spec.GID, Groups: spec.Groups, Token: strings.Repeat("a", 64)}
+	s1rMust(t, dropOperationCredentials(os.Getppid(), boot))
+	operationMountIDFallback = operationMountIDProxy(control, boot)
+}

package/templates/native-go/backend/internal/helper/s1r_actor_races_linux_test.go

@@ -0,0 +1,231 @@
+package helper
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+)
+
+func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
+	root := spec.Root + "/race"
+	pin, code := pinReadOnlyRoot(root)
+	if code != "" {
+		t.Fatal(code)
+	}
+	defer pin.Close()
+	ctx := context.Background()
+	switch kind {
+	case "symlink":
+		for _, link := range []struct{ name, target string }{{"inside-link", "file"}, {"outside-link", "../bob/file"}, {"dir-link", "../bob"}} {
+			s1rMust(t, os.Symlink(link.target, root+"/"+link.name))
+		}
+		for _, action := range []Action{ActionStat, ActionRead, ActionList, ActionReadStream} {
+			segments := []string{"outside-link"}
+			if action == ActionList {
+				segments = []string{"dir-link"}
+			}
+			work := readWork(pin, segments...)
+			work.Action = action
+			if action == ActionList {
+				work.MaxBytes = 0
+				work.Limit = 20
+			}
+			if action == ActionStat {
+				work.MaxBytes = 0
+			}
+			if action == ActionReadStream {
+				x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+				if x != nil {
+					x.Close()
+				}
+				if r.Code != ErrDenied || r.Bytes != 0 {
+					t.Fatal("symlink stream", r)
+				}
+			} else {
+				r, b := executeReadOnly(ctx, pin, work, fixtureReadOnlyACL{})
+				if r.Code != ErrDenied || len(b) > 0 || r.Entry != nil || r.List != nil {
+					t.Fatal("symlink metadata/read", action, r)
+				}
+			}
+		}
+		r, b := executeReadOnly(ctx, pin, readWork(pin, "inside-link"), fixtureReadOnlyACL{})
+		if r.Code != ErrDenied || len(b) > 0 {
+			t.Fatal("internal symlink followed", r)
+		}
+		r, _ = executeReadOnly(ctx, pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 20}, fixtureReadOnlyACL{})
+		if r.Code != "" || r.List == nil || len(r.List.Entries) != 1 || r.List.Entries[0].Name != "file" {
+			t.Fatal("symlink names leaked by list", r)
+		}
+		for _, segments := range [][]string{{"outside-link"}, {"dir-link", "new"}} {
+			x, c := openActorWriteTransfer(ctx, pin, writeWork{RootPath: root, Action: ActionCreate, Segments: segments, MaxBytes: 3}, fixtureReadOnlyACL{})
+			if x != nil {
+				x.Close()
+			}
+			if c != ErrDenied {
+				t.Fatal("symlink create", c)
+			}
+		}
+		t.Log("stat/list/read/stream/create reject symlinks; list filters symlink names")
+	case "stat-rename", "list-rename", "read-rename":
+		s1rMust(t, os.Mkdir(root+"/sub", 0700))
+		s1rMust(t, os.WriteFile(root+"/sub/file", []byte("original"), 0600))
+		mutated := false
+		acl := fixtureReadOnlyACL{hook: func() {
+			if mutated {
+				return
+			}
+			mutated = true
+			s1rMust(t, os.Rename(root+"/sub", root+"/moved"))
+			s1rMust(t, os.Mkdir(root+"/sub", 0700))
+			s1rMust(t, os.WriteFile(root+"/sub/file", []byte("foreign"), 0600))
+		}}
+		work := readWork(pin, "sub", "file")
+		if kind == "stat-rename" {
+			work.Action = ActionStat
+			work.MaxBytes = 0
+		}
+		if kind == "list-rename" {
+			work.Action = ActionList
+			work.MaxBytes = 0
+			work.Segments = []string{"sub"}
+			work.Limit = 20
+		}
+		r, b := executeReadOnly(ctx, pin, work, acl)
+		if r.Code != ErrStale || len(b) != 0 || r.Entry != nil || r.List != nil {
+			t.Fatal("renamed ancestry released bytes", r, string(b))
+		}
+		t.Log(kind + ": replacement after resolver open refuses bytes and metadata with stale")
+	case "stream-rename":
+		work := readWork(pin, "file")
+		work.Action = ActionReadStream
+		x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if r.Code != "" {
+			t.Fatal(r)
+		}
+		defer x.Close()
+		b, c := x.ReadChunk(ctx, 3)
+		if c != "" || string(b) != "can" {
+			t.Fatal(c, string(b))
+		}
+		s1rMust(t, os.Rename(root+"/file", root+"/old"))
+		s1rMust(t, os.Symlink("../bob/file", root+"/file"))
+		b, c = x.ReadChunk(ctx, 3)
+		if c != ErrDenied || len(b) != 0 {
+			t.Fatal("stream followed replacement", c, string(b))
+		}
+		t.Log("first fixed-FD stream chunk succeeds; symlink replacement refuses next chunk")
+	case "create-rename", "publish-rename", "publish-symlink":
+		s1rMust(t, os.Mkdir(root+"/sub", 0700))
+		staged := kind != "create-rename"
+		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"sub", "result"}, MaxBytes: 6}
+		if staged {
+			work.Action = ActionWriteStream
+			work.Staged = true
+		}
+		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if c != "" {
+			t.Fatal(c)
+		}
+		defer x.Close()
+		receipt, c := x.WriteChunk(ctx, []byte("abc"))
+		if c != "" || receipt.BytesWritten != 3 {
+			t.Fatal(receipt, c)
+		}
+		if kind == "publish-symlink" {
+			s1rMust(t, os.Symlink("../file", root+"/sub/result"))
+			receipt, c = x.Commit(ctx)
+			if c != ErrDenied || receipt.Published || receipt.Committed {
+				t.Fatal("publish replaced symlink", receipt, c)
+			}
+			target, e := os.Readlink(root + "/sub/result")
+			s1rMust(t, e)
+			if target != "../file" {
+				t.Fatal(target)
+			}
+		} else {
+			s1rMust(t, os.Rename(root+"/sub", root+"/moved"))
+			s1rMust(t, os.Mkdir(root+"/sub", 0700))
+			s1rMust(t, os.WriteFile(root+"/sub/result", []byte("foreign"), 0600))
+			if staged {
+				receipt, c = x.Commit(ctx)
+				if c != ErrStale || receipt.Published {
+					t.Fatal("publish after rename", receipt, c)
+				}
+			} else {
+				receipt, c = x.WriteChunk(ctx, []byte("def"))
+				if c != ErrPartial || receipt.BytesWritten != 3 {
+					t.Fatal("write after rename", receipt, c)
+				}
+			}
+			b, e := os.ReadFile(root + "/sub/result")
+			s1rMust(t, e)
+			if string(b) != "foreign" {
+				t.Fatal("foreign destination overwritten", string(b))
+			}
+			if staged {
+				if _, e := os.Stat(root + "/moved/result"); !os.IsNotExist(e) {
+					t.Fatal("anonymous stage became visible", e)
+				}
+			} else {
+				b, e = os.ReadFile(root + "/moved/result")
+				s1rMust(t, e)
+				if string(b) != "abc" {
+					t.Fatal("partial bytes changed", string(b))
+				}
+			}
+		}
+		t.Logf("%s: refusal=%s receipt=%+v; foreign destination preserved", kind, c, receipt)
+	case "publish-permission-loss":
+		work := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"result"}, MaxBytes: 3, Staged: true}
+		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if c != "" {
+			t.Fatal(c)
+		}
+		defer x.Close()
+		_, c = x.WriteChunk(ctx, []byte("abc"))
+		if c != "" {
+			t.Fatal(c)
+		}
+		s1rMust(t, os.Chmod(root, 0500))
+		defer os.Chmod(root, 0700)
+		r, c := x.Commit(ctx)
+		// Current S7 maps linkat EACCES to unsupported; require the exact behavior,
+		// report it, and preserve the fail-closed publish gate.
+		if c != ErrUnsupported || r.Published || r.Committed || r.BytesWritten != 3 {
+			t.Fatal("publish after parent chmod", r, c)
+		}
+		if _, e := os.Stat(root + "/result"); !os.IsNotExist(e) {
+			t.Fatal("publish wrote forbidden directory", e)
+		}
+		t.Log("parent write permission removed: kernel denies linkat; receipt retains staged bytes, published=false")
+	case "open-fd-write-permission-loss":
+		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"result"}, MaxBytes: 6}
+		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if c != "" {
+			t.Fatal(c)
+		}
+		defer x.Close()
+		r, c := x.WriteChunk(ctx, []byte("abc"))
+		if c != "" {
+			t.Fatal(c)
+		}
+		s1rMust(t, x.file.Chmod(0000))
+		defer x.file.Chmod(0600)
+		r, c = x.WriteChunk(ctx, []byte("def"))
+		if c != "" || r.BytesWritten != 6 {
+			t.Fatal("Linux open-FD semantics", r, c)
+		}
+		r, c = x.Commit(ctx)
+		if c != "" || !r.Committed {
+			t.Fatal(r, c)
+		}
+		b, e := os.ReadFile(root + "/result")
+		if !os.IsPermission(e) || len(b) != 0 {
+			t.Fatal("new open bypassed chmod", e, string(b))
+		}
+		t.Log("chmod 000 denies a new open; previously opened writer FD still writes/commits under Linux semantics")
+	default:
+		t.Fatal("unknown race", strings.TrimSpace(kind))
+	}
+}

package/templates/native-go/backend/internal/helper/s1r_fixture_contract_linux_test.go

@@ -0,0 +1,18 @@
+package helper
+
+import (
+	"os"
+	"testing"
+)
+
+func TestS1RFixtureContract(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	root := s1rFixture(t)
+	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "inherit", "readonly", "race"} {
+		if _, err := os.Stat(root + "/" + name + "/file"); err != nil {
+			t.Fatal(name, err)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/server_linux.go

@@ -0,0 +1,124 @@
+package helper
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"time"
+)
+
+func serveLinux(c Client) error {
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	// Only the supervisor writes process.json.
+	// The package group can connect; ordinary users reach only the authenticated
+	// CGI status route. SO_PEERCRED also checks the package's current numeric UID.
+	u, err := user.Lookup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	uid, err := strconv.ParseUint(u.Uid, 10, 32)
+	if err != nil {
+		return err
+	}
+	group, err := user.LookupGroup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	gid, err := strconv.Atoi(group.Gid)
+	if err != nil {
+		return err
+	}
+	socket := filepath.Join(c.RunDir, "helper.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		return err
+	}
+	l.SetUnlinkOnClose(false)
+	defer l.Close()
+	if err := os.Chown(socket, 0, gid); err != nil {
+		return err
+	}
+	if err := os.Chmod(socket, 0660); err != nil {
+		return err
+	}
+	// Bound concurrency and each frame's size/time. No privileged mutations are
+	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	slots := make(chan struct{}, 8)
+	for {
+		conn, err := l.AcceptUnix()
+		if err != nil {
+			return err
+		}
+		select {
+		case slots <- struct{}{}:
+		default:
+			conn.Close()
+			continue
+		}
+		go func() {
+			defer func() { conn.Close(); <-slots }()
+			peer, err := peerUID(conn)
+			if err != nil || (peer != 0 && peer != uint32(uid)) {
+				return
+			}
+			conn.SetDeadline(time.Now().Add(time.Second))
+			var req Request
+			d := json.NewDecoder(io.LimitReader(conn, 4097))
+			d.DisallowUnknownFields()
+			if d.Decode(&req) != nil {
+				return
+			}
+			r, err := readRecord(c.StateDir, 0)
+			readiness := "fenced"
+			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {
+				readiness = parentReadiness(c)
+			}
+			res := Respond(c.Expected, readiness != "ready", req)
+			if readiness != "ready" {
+				res.Error = readiness
+			}
+			json.NewEncoder(conn).Encode(res)
+		}()
+	}
+}
+
+// No lifecycle mutations: only the exact owned child can request admission.
+func parentReadiness(c Client) string {
+	p, err := readProcess(c.RunDir, 0)
+	if err != nil || p.PID != os.Getppid() {
+		return "fenced"
+	}
+	actual, err := inspectSupervisor(p.PID, c.Expected)
+	if err != nil || actual != p {
+		return "fenced"
+	}
+	conn, err := net.DialTimeout("unix", filepath.Join(c.RunDir, "supervisor.sock"), 100*time.Millisecond)
+	if err != nil {
+		return "fenced"
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn.(*net.UnixConn))
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != p.PID {
+		return "fenced"
+	}
+	conn.SetDeadline(time.Now().Add(200 * time.Millisecond))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return "fenced"
+	}
+	req := supervisorRequest{Process: p, Op: "admit", Nonce: hex.EncodeToString(nonce[:])}
+	if json.NewEncoder(conn).Encode(req) != nil {
+		return "fenced"
+	}
+	res, err := decodeSupervisorReply(conn, c.Expected, req.Nonce)
+	return supervisorReadiness(res, err)
+}