@synopackageland/cli 0.3.10 → 0.4.1

package/dist/templates/native-go/backend/internal/dsmprobe/collector_linux.go

@@ -0,0 +1,335 @@
+package dsmprobe
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"debug/elf"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// root is test-only filesystem injection. The executable exposes no path/root
+// option or environment override. It reads no shadow, native DB, or data file.
+type collector struct{ root string }
+
+func (c *collector) path(p string) string {
+	if c.root != "" {
+		return c.root + p
+	}
+	return p
+}
+func openObserved(path string, flags int) (*os.File, error) {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return nil, ErrInvalid
+	}
+	fd, e := unix.Open("/", unix.O_PATH|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if e != nil {
+		return nil, e
+	}
+	parts := strings.Split(path[1:], "/")
+	for i, p := range parts {
+		f := unix.O_PATH | unix.O_DIRECTORY
+		if i == len(parts)-1 {
+			f = flags
+		}
+		next, e := unix.Openat(fd, p, f|unix.O_NOFOLLOW|unix.O_CLOEXEC|unix.O_NONBLOCK, 0)
+		unix.Close(fd)
+		if e != nil {
+			return nil, e
+		}
+		fd = next
+	}
+	return os.NewFile(uintptr(fd), "observation"), nil
+}
+func (c *collector) read(ctx context.Context, path string, maximum int) ([]byte, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	f, e := openObserved(c.path(path), unix.O_RDONLY)
+	if e != nil {
+		return nil, e
+	}
+	defer f.Close()
+	var st unix.Stat_t
+	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Size > int64(maximum) {
+		return nil, ErrInvalid
+	}
+	out, e := io.ReadAll(io.LimitReader(f, int64(maximum+1)))
+	if len(out) > maximum {
+		return nil, ErrInvalid
+	}
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	return out, e
+}
+func hash(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
+func version(b []byte) string {
+	values := map[string]string{}
+	for _, line := range strings.Split(string(b), "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		if k != "productversion" && k != "buildnumber" {
+			continue
+		}
+		if _, ok := values[k]; ok {
+			return ""
+		}
+		values[k] = strings.Trim(v, "\"")
+	}
+	if values["productversion"] == "" || values["buildnumber"] == "" {
+		return ""
+	}
+	return values["productversion"] + "-" + values["buildnumber"]
+}
+func (c *collector) runtime(ctx context.Context) (Runtime, error) {
+	r := Runtime{Architecture: runtime.GOARCH, Libraries: []LibraryEvidence{}}
+	var u unix.Utsname
+	if unix.Uname(&u) != nil {
+		return r, ErrInvalid
+	}
+	r.Kernel = unix.ByteSliceToString(u.Release[:])
+	b, e := c.read(ctx, "/etc.defaults/VERSION", 4096)
+	if e == nil {
+		r.DSMBuild = version(b)
+		r.VersionDigest = hash(b)
+	}
+	boot, e := c.read(ctx, "/proc/sys/kernel/random/boot_id", 128)
+	if e == nil && len(strings.TrimSpace(string(boot))) == 36 {
+		r.BootRef = hash(bytes.TrimSpace(boot))
+	}
+	modules, _ := c.read(ctx, "/proc/modules", 1<<20)
+	for _, line := range strings.Split(string(modules), "\n") {
+		if strings.HasPrefix(line, "synoacl_vfs ") {
+			r.ACLModule = true
+		}
+	}
+	for _, name := range []string{"libsynoacl.so", "libsynosdk.so.7", "libsynolocalaccount.so.7"} {
+		b, e := c.read(ctx, "/usr/lib/"+name, 32<<20)
+		if e != nil {
+			continue
+		}
+		evidence := LibraryEvidence{Name: name, SHA256: hash(b), Exports: []string{}}
+		image, e := elf.NewFile(bytes.NewReader(b))
+		if e != nil {
+			r.Libraries = append(r.Libraries, evidence)
+			continue
+		}
+		symbols, _ := image.DynamicSymbols()
+		image.Close()
+		for _, s := range symbols {
+			switch s.Name {
+			case "SYNOACLPermCheck", "SYNOACLIsSupport", "SYNOUserGetLocal", "SYNOServiceUserHomeStatusGet", "SYNOShareGet", "SYNOShareUGPrivGetLocalInt":
+				if s.Section != elf.SHN_UNDEF {
+					evidence.Exports = append(evidence.Exports, s.Name)
+				}
+			}
+		}
+		slices.Sort(evidence.Exports)
+		r.Libraries = append(r.Libraries, evidence)
+	}
+	// Deterministic fingerprint binds actual bytes and kernel/build/architecture;
+	// it is an observation, NOT a source-to-build or native semantics certificate.
+	seed, _ := json.Marshal(struct {
+		Architecture, DSMBuild, Kernel, VersionDigest string
+		Libraries                                     []LibraryEvidence
+		ACLModule                                     bool
+	}{r.Architecture, r.DSMBuild, r.Kernel, r.VersionDigest, r.Libraries, r.ACLModule})
+	r.Fingerprint = hash(seed)
+	if ctx.Err() != nil {
+		return r, ctx.Err()
+	}
+	return r, nil
+}
+func identity() Identity {
+	groups, _ := os.Getgroups()
+	g := make([]uint32, 0, len(groups))
+	for _, v := range groups {
+		g = append(g, uint32(v))
+	}
+	slices.Sort(g)
+	g = slices.Compact(g)
+	n, e := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	d, de := unix.PrctlRetInt(unix.PR_GET_DUMPABLE, 0, 0, 0, 0)
+	return Identity{UID: uint32(os.Geteuid()), GID: uint32(os.Getegid()), Groups: g, NoNewPrivs: e == nil && n == 1, NonDumpable: de == nil && d == 0}
+}
+func (c *collector) account(ctx context.Context, r Request) (Account, error) {
+	b, e := c.read(ctx, "/etc/passwd", 128<<10)
+	if e != nil {
+		return Account{}, e
+	}
+	var found *Account
+	for _, line := range strings.Split(string(b), "\n") {
+		fields := strings.Split(line, ":")
+		if len(fields) != 7 || fields[0] != r.Username {
+			continue
+		}
+		if found != nil {
+			return Account{}, ErrInvalid
+		}
+		uid, e := strconv.ParseUint(fields[2], 10, 32)
+		if e != nil {
+			return Account{}, ErrInvalid
+		}
+		gid, e := strconv.ParseUint(fields[3], 10, 32)
+		if e != nil {
+			return Account{}, ErrInvalid
+		}
+		found = &Account{Username: r.Username, UID: uint32(uid), GID: uint32(gid), Home: fields[5], Groups: []uint32{}}
+	}
+	if found == nil {
+		return Account{}, os.ErrNotExist
+	}
+	if found.UID != r.UID || found.GID != r.GID || found.Home != "/var/services/homes/"+r.Username {
+		return Account{}, ErrInvalid
+	}
+	// passwd is metadata only. Enabled/local/group/service/share native proofs
+	// remain false; no UID/name fingerprint is advertised as incarnation.
+	return *found, nil
+}
+func (c *collector) home(ctx context.Context, r Request) (Home, *os.File, error) {
+	var h Home
+	if ctx.Err() != nil {
+		return h, nil, ctx.Err()
+	}
+	link := c.path("/var/services/homes")
+	before, e := os.Lstat(link)
+	if e != nil || before.Mode()&os.ModeSymlink == 0 {
+		return h, nil, ErrInvalid
+	}
+	target, e := os.Readlink(link)
+	if e != nil || !filepath.IsAbs(target) || filepath.Clean(target) != target || !strings.HasPrefix(target, "/volume") || !strings.HasSuffix(target, "/homes") {
+		return h, nil, ErrInvalid
+	}
+	h.HomesPath = target
+	f, e := openObserved(c.path(target+"/"+r.Username), unix.O_PATH|unix.O_DIRECTORY)
+	if e != nil {
+		return h, nil, e
+	}
+	var st unix.Stat_t
+	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFDIR {
+		f.Close()
+		return h, nil, ErrInvalid
+	}
+	after, e := os.Lstat(link)
+	again, re := os.Readlink(link)
+	if e != nil || re != nil || !os.SameFile(before, after) || target != again {
+		f.Close()
+		return h, nil, ErrInvalid
+	}
+	h.Existing = true
+	h.Device = uint64(st.Dev)
+	h.Inode = st.Ino
+	h.Owner = st.Uid
+	return h, f, nil
+}
+func sampleACL(ctx context.Context, r Request, out Response, fd int) ACLSample {
+	sample := ACLSample{Mask: 0x105, SupportErrno: []uint32{}}
+	// Exact source-reviewed candidate only, explicitly requested for evidence.
+	// Never feed this result into bridge certification or a production Allow.
+	if ctx.Err() != nil || runtime.GOARCH != "amd64" || out.Runtime.DSMBuild != "7.4-90069" || out.Runtime.Kernel != "4.4.302+" || !out.Runtime.ACLModule || len(out.Runtime.Libraries) != 3 || r.ExpectedRuntime != out.Runtime.Fingerprint || out.Identity.UID != r.UID || out.Identity.GID != r.GID || !slices.Equal(out.Identity.Groups, r.Groups) || !out.Identity.NoNewPrivs || !out.Identity.NonDumpable || out.Home.Owner != r.UID {
+		return sample
+	}
+	ru, eu, su := unix.Getresuid()
+	rg, eg, sg := unix.Getresgid()
+	if ru != int(r.UID) || eu != ru || su != ru || rg != int(r.GID) || eg != rg || sg != rg {
+		return sample
+	}
+	var caps [2]unix.CapUserData
+	head := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	if unix.Capget(&head, &caps[0]) != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
+		return sample
+	}
+	var before unix.Stat_t
+	if unix.Fstat(fd, &before) != nil {
+		return sample
+	}
+	alias, e := unix.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", fd))
+	if e != nil {
+		return sample
+	}
+	defer runtime.KeepAlive(alias)
+	sample.Attempted = true
+	for _, tag := range []uintptr{1, 2} {
+		result, _, errno := unix.Syscall(813, uintptr(unsafe.Pointer(alias)), uintptr(fd), tag)
+		sample.SupportErrno = append(sample.SupportErrno, uint32(errno))
+		if tag == 1 {
+			sample.FilesystemSupport = int64(result)
+		} else {
+			sample.ObjectSupport = int64(result)
+		}
+		if errno != 0 || result != 1 {
+			return sample
+		}
+		if ctx.Err() != nil {
+			return sample
+		}
+	}
+	result, _, errno := unix.Syscall(812, uintptr(unsafe.Pointer(alias)), uintptr(sample.Mask), 0)
+	sample.CheckResult = int64(result)
+	sample.CheckErrno = uint32(errno)
+	runtime.KeepAlive(alias)
+	var after unix.Stat_t
+	if unix.Fstat(fd, &after) != nil || before.Dev != after.Dev || before.Ino != after.Ino || before.Uid != after.Uid || before.Mode != after.Mode {
+		sample.CheckErrno = uint32(unix.ESTALE)
+	}
+	return sample
+}
+func (c *collector) collect(ctx context.Context, r Request) (Response, error) {
+	out := Response{Version: Protocol, Nonce: r.Nonce, Status: "unsupported", Identity: identity(), Account: Account{Groups: []uint32{}}, ACL: ACLSample{SupportErrno: []uint32{}}}
+	if r.Validate() != nil {
+		return out, ErrInvalid
+	}
+	rt, e := c.runtime(ctx)
+	out.Runtime = rt
+	if e != nil {
+		return out, e
+	}
+	if rt.DSMBuild != "" && rt.BootRef != "" {
+		out.Status = "ok"
+	}
+	if r.Kind == "runtime" {
+		return out, nil
+	}
+	a, e := c.account(ctx, r)
+	out.Account = a
+	if e != nil {
+		return out, e
+	}
+	h, f, e := c.home(ctx, r)
+	out.Home = h
+	out.Share = Share{Name: "homes", Path: h.HomesPath}
+	if e != nil {
+		return out, e
+	}
+	defer f.Close()
+	if r.Kind == "acl" {
+		out.ACL = sampleACL(ctx, r, out, int(f.Fd()))
+	}
+	if ctx.Err() != nil {
+		return out, ctx.Err()
+	}
+	return out, nil
+}
+func Collect(ctx context.Context, r Request) (Response, error) {
+	out, e := (&collector{}).collect(ctx, r)
+	if e != nil && !errors.Is(e, context.Canceled) && !errors.Is(e, context.DeadlineExceeded) {
+		out.Status = "unsupported"
+	}
+	return out, e
+}

package/dist/templates/native-go/backend/internal/dsmprobe/collector_linux_test.go

@@ -0,0 +1,41 @@
+package dsmprobe
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestCollectorMetadataNeverCertifiesNativePolicyOrCreatesHome(t *testing.T) {
+	root := t.TempDir()
+	for _, p := range []string{"etc.defaults", "etc", "proc/sys/kernel/random", "volume1/homes", "var/services"} {
+		if e := os.MkdirAll(filepath.Join(root, p), 0755); e != nil {
+			t.Fatal(e)
+		}
+	}
+	os.WriteFile(root+"/etc/passwd", []byte("normal3:x:1217:100::/var/services/homes/normal3:/sbin/nologin\n"), 0644)
+	os.WriteFile(root+"/etc.defaults/VERSION", []byte("productversion=\"7.4\"\nbuildnumber=\"90069\"\n"), 0644)
+	os.WriteFile(root+"/proc/sys/kernel/random/boot_id", []byte("11111111-2222-3333-4444-555555555555\n"), 0644)
+	os.Symlink("/volume1/homes", root+"/var/services/homes")
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "metadata"}
+	c := collector{root: root}
+	out, e := c.collect(context.Background(), r)
+	if !os.IsNotExist(e) || out.Account.UID != 1217 || out.Account.Home != "/var/services/homes/normal3" {
+		t.Fatal(e, out)
+	}
+	if out.Account.NativeKnown || out.Account.GroupsKnown || out.Home.StatusKnown || out.Share.NativeKnown || out.Share.PermissionKnown || out.ACL.Certified || out.ACL.Attempted {
+		t.Fatal("metadata became authority")
+	}
+	if _, e := os.Stat(root + "/volume1/homes/normal3"); !os.IsNotExist(e) {
+		t.Fatal("missing home created")
+	}
+}
+func TestCollectorACLRefusesDifferentActorAndFingerprint(t *testing.T) {
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "acl", ExpectedRuntime: strings.Repeat("b", 64)}
+	out, _ := (&collector{}).collect(context.Background(), r)
+	if out.ACL.Attempted || out.ACL.Certified {
+		t.Fatal("unproven ABI or actor reached raw syscall")
+	}
+}

package/dist/templates/native-go/backend/internal/dsmprobe/protocol.go

@@ -0,0 +1,179 @@
+// Package dsmprobe defines a bounded, non-secret observation protocol. It is
+// private to the helper/probe; neither browser nor package RPC exposes it.
+package dsmprobe
+
+import (
+	"bytes"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+)
+
+const MaxRequestBytes = 4096
+const MaxResponseBytes = 32768
+const Protocol = 1
+
+var ErrInvalid = errors.New("invalid probe request")
+
+type Request struct {
+	Version         int      `json:"version"`
+	Nonce           string   `json:"nonce"`
+	Kind            string   `json:"kind"`
+	Username        string   `json:"username"`
+	UID             uint32   `json:"uid"`
+	GID             uint32   `json:"gid"`
+	Groups          []uint32 `json:"groups"`
+	ExpectedRuntime string   `json:"expectedRuntime"`
+}
+type LibraryEvidence struct {
+	Name    string   `json:"name"`
+	SHA256  string   `json:"sha256"`
+	Exports []string `json:"exports"`
+}
+type Runtime struct {
+	VersionDigest string            `json:"versionDigest"`
+	Architecture  string            `json:"architecture"`
+	DSMBuild      string            `json:"dsmBuild"`
+	Kernel        string            `json:"kernel"`
+	BootRef       string            `json:"bootRef"`
+	Fingerprint   string            `json:"fingerprint"`
+	Libraries     []LibraryEvidence `json:"libraries"`
+	ACLModule     bool              `json:"aclModule"`
+}
+type Identity struct {
+	UID         uint32   `json:"uid"`
+	GID         uint32   `json:"gid"`
+	Groups      []uint32 `json:"groups"`
+	NoNewPrivs  bool     `json:"noNewPrivs"`
+	NonDumpable bool     `json:"nonDumpable"`
+}
+type Account struct {
+	Username    string   `json:"username"`
+	UID         uint32   `json:"uid"`
+	GID         uint32   `json:"gid"`
+	Groups      []uint32 `json:"groups"`
+	Home        string   `json:"home"`
+	NativeKnown bool     `json:"nativeKnown"`
+	Local       bool     `json:"local"`
+	Enabled     bool     `json:"enabled"`
+	GroupsKnown bool     `json:"groupsKnown"`
+}
+type Home struct {
+	HomesPath   string `json:"homesPath"`
+	StatusKnown bool   `json:"statusKnown"`
+	Enabled     bool   `json:"enabled"`
+	Existing    bool   `json:"existing"`
+	Device      uint64 `json:"device"`
+	Inode       uint64 `json:"inode"`
+	Owner       uint32 `json:"owner"`
+}
+type Share struct {
+	Name            string `json:"name"`
+	Path            string `json:"path"`
+	NativeKnown     bool   `json:"nativeKnown"`
+	Available       bool   `json:"available"`
+	VolumeKnown     bool   `json:"volumeKnown"`
+	PermissionKnown bool   `json:"permissionKnown"`
+	ReadAllowed     bool   `json:"readAllowed"`
+}
+type ACLSample struct {
+	Attempted         bool     `json:"attempted"`
+	FilesystemSupport int64    `json:"filesystemSupport"`
+	ObjectSupport     int64    `json:"objectSupport"`
+	SupportErrno      []uint32 `json:"supportErrno"`
+	CheckResult       int64    `json:"checkResult"`
+	CheckErrno        uint32   `json:"checkErrno"`
+	Mask              uint32   `json:"mask"`
+	Certified         bool     `json:"certified"`
+}
+type Response struct {
+	Version  int       `json:"version"`
+	Nonce    string    `json:"nonce"`
+	Status   string    `json:"status"`
+	Runtime  Runtime   `json:"runtime"`
+	Identity Identity  `json:"identity"`
+	Account  Account   `json:"account"`
+	Home     Home      `json:"home"`
+	Share    Share     `json:"share"`
+	ACL      ACLSample `json:"acl"`
+}
+
+func DigestValid(s string) bool {
+	b, e := hex.DecodeString(s)
+	return e == nil && len(b) == 32 && len(s) == 64
+}
+func (r Request) Validate() error {
+	if r.Version != Protocol || !DigestValid(r.Nonce) || r.Groups == nil || len(r.Groups) > 512 {
+		return ErrInvalid
+	}
+	for i, g := range r.Groups {
+		if i > 0 && r.Groups[i-1] >= g {
+			return ErrInvalid
+		}
+	}
+	if r.Kind == "runtime" {
+		if r.Username != "" || r.ExpectedRuntime != "" {
+			return ErrInvalid
+		}
+		return nil
+	}
+	if (r.Username != "normal3" && r.Username != "admin") || r.UID == 0 {
+		return ErrInvalid
+	}
+	switch r.Kind {
+	case "metadata":
+		if r.ExpectedRuntime != "" {
+			return ErrInvalid
+		}
+	case "acl":
+		if !DigestValid(r.ExpectedRuntime) {
+			return ErrInvalid
+		}
+	default:
+		return ErrInvalid
+	}
+	return nil
+}
+func DecodeRequest(b []byte) (Request, error) {
+	var out Request
+	if len(b) > MaxRequestBytes {
+		return out, ErrInvalid
+	}
+	d := json.NewDecoder(bytes.NewReader(b))
+	token, e := d.Token()
+	if e != nil || token != json.Delim('{') {
+		return out, ErrInvalid
+	}
+	allowed := map[string]bool{"version": true, "nonce": true, "kind": true, "username": true, "uid": true, "gid": true, "groups": true, "expectedRuntime": true}
+	raw := map[string]json.RawMessage{}
+	for d.More() {
+		t, e := d.Token()
+		if e != nil {
+			return out, ErrInvalid
+		}
+		k, ok := t.(string)
+		if !ok || !allowed[k] {
+			return out, ErrInvalid
+		}
+		if _, ok := raw[k]; ok {
+			return out, ErrInvalid
+		}
+		var v json.RawMessage
+		if d.Decode(&v) != nil {
+			return out, ErrInvalid
+		}
+		raw[k] = v
+	}
+	if t, e := d.Token(); e != nil || t != json.Delim('}') {
+		return out, ErrInvalid
+	}
+	if _, e = d.Token(); e != io.EOF {
+		return out, ErrInvalid
+	}
+	data, _ := json.Marshal(raw)
+	if json.Unmarshal(data, &out) != nil {
+		return Request{}, ErrInvalid
+	}
+	return out, out.Validate()
+}

package/dist/templates/native-go/backend/internal/dsmprobe/protocol_test.go

@@ -0,0 +1,29 @@
+package dsmprobe
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRequestRejectsUnknownDuplicateAndOversized(t *testing.T) {
+	for _, s := range []string{`{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","kind":"acl"}`, `{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","allow":true}`, strings.Repeat(" ", MaxRequestBytes+1)} {
+		if _, e := DecodeRequest([]byte(s)); e == nil {
+			t.Fatal("invalid request accepted")
+		}
+	}
+}
+func TestRequestRestrictsFixtureAndNeverCarriesSession(t *testing.T) {
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Kind: "metadata", Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}}
+	if r.Validate() != nil {
+		t.Fatal("valid fixture refused")
+	}
+	r.Username = "normal1"
+	if r.Validate() == nil {
+		t.Fatal("reserved account accepted")
+	}
+	r.Username = "normal3"
+	r.Kind = "acl"
+	if r.Validate() == nil {
+		t.Fatal("ACL without runtime fingerprint accepted")
+	}
+}