@synopackageland/cli 0.3.10 → 0.4.1

package/templates/_daemon/main.go

@@ -0,0 +1,608 @@
+// Package-account supervisor for one fixed foreground executable. The pidfile
+// is inventory, never authority for kill(pid). Only the parent signals its child.
+package main
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"os/signal"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+type deadlines struct {
+	Start  int `json:"start"`
+	Stop   int `json:"stop"`
+	Status int `json:"status"`
+}
+type config struct {
+	Package       string            `json:"package"`
+	Exec          string            `json:"exec"`
+	Args          []string          `json:"args"`
+	UninstallArgs []string          `json:"uninstall_args,omitempty"`
+	Env           map[string]string `json:"env"`
+	Timeouts      deadlines         `json:"timeouts"`
+}
+type record struct {
+	Supervisor int    `json:"supervisor"`
+	Child      int    `json:"child"`
+	Birth      string `json:"birth"`
+	Digest     string `json:"digest"`
+}
+type controller struct {
+	config
+	dest, data, dir, digest string
+}
+
+func main() {
+	if len(os.Args) != 4 {
+		os.Exit(1)
+	}
+	c, err := load(os.Args[2], os.Args[3])
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	rc, err := c.run(os.Args[1])
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+	}
+	os.Exit(rc)
+}
+
+func load(dest, data string) (*controller, error) {
+	if os.Geteuid() == 0 || os.Getuid() != os.Geteuid() {
+		return nil, errors.New("daemon requires a non-root package account")
+	}
+	if !filepath.IsAbs(dest) || !filepath.IsAbs(data) {
+		return nil, errors.New("daemon paths must be absolute")
+	}
+	raw, err := os.ReadFile(filepath.Join(dest, "daemon/config.json"))
+	if err != nil || len(raw) > 512*1024 {
+		return nil, errors.New("invalid daemon config")
+	}
+	var cfg config
+	d := json.NewDecoder(strings.NewReader(string(raw)))
+	d.DisallowUnknownFields()
+	if err := d.Decode(&cfg); err != nil {
+		return nil, err
+	}
+	account, err := user.Lookup(cfg.Package)
+	if err != nil || account.Uid != strconv.Itoa(os.Geteuid()) {
+		return nil, errors.New("daemon requires its configured package account")
+	}
+	if cfg.Exec == "" || filepath.IsAbs(cfg.Exec) || filepath.Clean(cfg.Exec) != cfg.Exec || strings.HasPrefix(cfg.Exec, "../") {
+		return nil, errors.New("invalid fixed executable")
+	}
+	if cfg.Timeouts.Start < 2 || cfg.Timeouts.Start > 120 || cfg.Timeouts.Stop < 2 || cfg.Timeouts.Stop > 120 || cfg.Timeouts.Status < 1 || cfg.Timeouts.Status > 10 {
+		return nil, errors.New("invalid daemon deadlines")
+	}
+	hash := sha256.Sum256(raw)
+	c := &controller{config: cfg, dest: dest, data: data, dir: filepath.Join(data, "daemon"), digest: hex.EncodeToString(hash[:])}
+	if err := os.Mkdir(c.dir, 0700); err != nil && !os.IsExist(err) {
+		return nil, err
+	}
+	st, err := os.Lstat(c.dir)
+	if err != nil || !st.IsDir() || st.Mode().Perm() != 0700 || !owned(st) {
+		return nil, errors.New("foreign daemon state directory")
+	}
+	tmp := filepath.Join(c.dir, "tmp")
+	if err := os.Mkdir(tmp, 0700); err != nil && !os.IsExist(err) {
+		return nil, err
+	}
+	st, err = os.Lstat(tmp)
+	if err != nil || !st.IsDir() || st.Mode().Perm() != 0700 || !owned(st) {
+		return nil, errors.New("foreign daemon temporary directory")
+	}
+	return c, nil
+}
+
+func owned(st os.FileInfo) bool {
+	s, ok := st.Sys().(*syscall.Stat_t)
+	return ok && s.Uid == uint32(os.Geteuid())
+}
+
+func safeFile(path string) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0600)
+	if err != nil {
+		return nil, err
+	}
+	st, err := f.Stat()
+	if err != nil || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || !owned(st) || st.Sys().(*syscall.Stat_t).Nlink != 1 {
+		f.Close()
+		return nil, errors.New("foreign daemon file")
+	}
+	return f, nil
+}
+
+func (c *controller) lock(name string, until time.Time) (*os.File, error) {
+	f, err := safeFile(filepath.Join(c.dir, name))
+	if err != nil {
+		return nil, err
+	}
+	for {
+		err = syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
+		if err == nil {
+			return f, nil
+		}
+		if !errors.Is(err, syscall.EWOULDBLOCK) && !errors.Is(err, syscall.EAGAIN) || !time.Now().Before(until) {
+			f.Close()
+			return nil, errors.New("daemon lock busy")
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}
+
+func (c *controller) run(action string) (int, error) {
+	if action == "supervise" {
+		return 1, c.supervise()
+	}
+	budget := c.Timeouts.Status
+	if action == "start" {
+		budget = c.Timeouts.Start
+	}
+	if action == "stop" || action == "restart" || action == "uninstall" {
+		budget = c.Timeouts.Stop + 1
+	}
+	if action == "restart" {
+		budget += c.Timeouts.Start
+	}
+	if action == "uninstall" {
+		budget += c.Timeouts.Stop + 1
+	}
+	if action != "start" && action != "stop" && action != "status" && action != "restart" && action != "uninstall" {
+		return 1, errors.New("unsupported daemon action")
+	}
+	until := time.Now().Add(time.Duration(budget) * time.Second)
+	lock, err := c.lock("command.lock", until)
+	if err != nil {
+		return 1, err
+	}
+	defer lock.Close()
+	if action == "status" {
+		if err := c.request("status", until); err == nil {
+			return 0, nil
+		}
+		if _, err := os.Lstat(filepath.Join(c.dir, "daemon.pid")); os.IsNotExist(err) {
+			owner, err := c.lock("owner.lock", time.Now())
+			if err == nil {
+				owner.Close()
+				return 3, nil
+			}
+		}
+		return 1, errors.New("daemon failed or supervisor unavailable")
+	}
+	if action == "stop" || action == "restart" || action == "uninstall" {
+		stopUntil := time.Now().Add(time.Duration(c.Timeouts.Stop+1) * time.Second)
+		if until.Before(stopUntil) {
+			stopUntil = until
+		}
+		if err := c.stop(stopUntil); err != nil {
+			return 1, err
+		}
+		if action == "stop" {
+			return 0, nil
+		}
+		if action == "uninstall" {
+			if len(c.UninstallArgs) == 0 {
+				return 0, nil
+			}
+			if err := c.uninstall(); err != nil {
+				return 1, err
+			}
+			return 0, nil
+		}
+	}
+	if err := c.request("status", time.Now().Add(time.Duration(c.Timeouts.Status)*time.Second)); err == nil {
+		return 0, nil
+	}
+	if err := c.start(until); err != nil {
+		return 1, err
+	}
+	return 0, nil
+}
+
+func (c *controller) readRecord() (record, error) {
+	var r record
+	f, err := safeFileExisting(filepath.Join(c.dir, "daemon.pid"))
+	if err != nil {
+		return r, err
+	}
+	defer f.Close()
+	err = json.NewDecoder(io.LimitReader(f, 4096)).Decode(&r)
+	if err == nil && (r.Supervisor < 1 || r.Child < 1 || r.Digest != c.digest) {
+		err = errors.New("daemon inventory mismatch")
+	}
+	return r, err
+}
+
+func safeFileExisting(path string) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+	st, err := f.Stat()
+	if err != nil || !st.Mode().IsRegular() || !owned(st) || st.Mode().Perm() != 0600 || st.Size() > 4096 || st.Sys().(*syscall.Stat_t).Nlink != 1 {
+		f.Close()
+		return nil, errors.New("foreign daemon record")
+	}
+	return f, nil
+}
+
+func (c *controller) request(action string, until time.Time) error {
+	r, err := c.readRecord()
+	if err != nil {
+		return err
+	}
+	conn, err := net.DialTimeout("unix", filepath.Join(c.dir, "ctl.sock"), time.Until(until))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	if err := checkPeer(conn.(*net.UnixConn), r.Supervisor); err != nil {
+		return err
+	}
+	conn.SetDeadline(until)
+	if _, err := fmt.Fprintf(conn, "%s %s\n", action, c.digest); err != nil {
+		return err
+	}
+	raw, err := bufio.NewReader(io.LimitReader(conn, 256)).ReadString('\n')
+	if err != nil {
+		return err
+	}
+	if raw != "ok\n" {
+		return errors.New("daemon operation refused")
+	}
+	return nil
+}
+
+// With no supervisor lock held, never signal a PID read from inventory. A live
+// witnessed child means cleanup-required. Dead/zombie/reused PIDs can be retired.
+func (c *controller) retired() error {
+	r, err := c.readRecord()
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err == nil && recordedChildAlive(r.Child, r.Birth) {
+		return errors.New("daemon cleanup-required: live child without supervisor")
+	}
+	if err != nil {
+		if _, socketErr := os.Lstat(filepath.Join(c.dir, "ctl.sock")); !os.IsNotExist(socketErr) {
+			return errors.New("foreign daemon socket")
+		}
+	}
+	for _, name := range []string{"daemon.pid", "ctl.sock"} {
+		if err := os.Remove(filepath.Join(c.dir, name)); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *controller) stop(until time.Time) error {
+	if err := c.request("stop", until); err != nil {
+		owner, lockErr := c.lock("owner.lock", time.Now())
+		if lockErr != nil {
+			return err
+		}
+		defer owner.Close()
+		return c.retired()
+	}
+	owner, err := c.lock("owner.lock", until)
+	if err != nil {
+		return err
+	}
+	defer owner.Close()
+	return c.retired()
+}
+
+func (c *controller) start(until time.Time) error {
+	if !time.Now().Before(until) {
+		return errors.New("daemon start timeout")
+	}
+	owner, err := c.lock("owner.lock", time.Now())
+	if err != nil {
+		return err
+	}
+	if err := c.retired(); err != nil {
+		owner.Close()
+		return err
+	}
+	// Pass the already-held lifetime lock to the new supervisor. No handoff gap.
+	log, err := safeFile(filepath.Join(c.dir, "daemon.log"))
+	if err != nil {
+		owner.Close()
+		return err
+	}
+	defer log.Close()
+	if _, err := log.Seek(0, io.SeekEnd); err != nil {
+		owner.Close()
+		return err
+	}
+	reader, writer, err := os.Pipe()
+	if err != nil {
+		owner.Close()
+		return err
+	}
+	defer reader.Close()
+	self, err := os.Executable()
+	if err != nil {
+		owner.Close()
+		writer.Close()
+		return err
+	}
+	cmd := exec.Command(self, "supervise", c.dest, c.data)
+	cmd.Env = []string{"PATH=/usr/bin:/bin"}
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = nil, log, log
+	cmd.ExtraFiles = []*os.File{writer, owner}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	err = cmd.Start()
+	writer.Close()
+	owner.Close()
+	if err != nil {
+		return err
+	}
+	// Wait in a goroutine to reap if startup fails. Successful supervisors are
+	// detached when this command exits; their directly-owned child stays attached.
+	go cmd.Wait()
+	ready := make(chan error, 1)
+	go func() {
+		raw, err := bufio.NewReader(io.LimitReader(reader, 32)).ReadString('\n')
+		if err == nil && raw != "ready\n" {
+			err = errors.New("daemon startup refused")
+		}
+		ready <- err
+	}()
+	select {
+	case err := <-ready:
+		return err
+	case <-time.After(time.Until(until)):
+		// Only our own still-retained supervisor can be signalled, never inventory.
+		cmd.Process.Signal(syscall.SIGTERM)
+		return errors.New("daemon start timeout")
+	}
+}
+
+func (c *controller) expand(v string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(v, "${SYNOPKG_PKGDEST}", c.dest), "${SYNOPKG_PKGVAR}", c.data)
+}
+
+func (c *controller) child(args []string) *exec.Cmd {
+	expanded := make([]string, len(args))
+	for i, v := range args {
+		expanded[i] = c.expand(v)
+	}
+	cmd := exec.Command(filepath.Join(c.dest, "daemon/payload", c.Exec), expanded...)
+	cmd.Dir = c.data
+	cmd.Env = []string{"PATH=/usr/bin:/bin", "HOME=" + c.data, "TMPDIR=" + filepath.Join(c.dir, "tmp")}
+	keys := make([]string, 0, len(c.Env))
+	for key := range c.Env {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	for _, key := range keys {
+		cmd.Env = append(cmd.Env, key+"="+c.expand(c.Env[key]))
+	}
+	cmd.SysProcAttr = childAttributes()
+	return cmd
+}
+
+func (c *controller) uninstall() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	cmd := c.child(c.UninstallArgs)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+	select {
+	case err := <-done:
+		return err
+	case <-time.After(time.Duration(c.Timeouts.Stop-1) * time.Second):
+		cmd.Process.Signal(syscall.SIGTERM)
+	}
+	select {
+	case <-done:
+		return errors.New("daemon uninstall timeout")
+	case <-time.After(time.Second):
+		cmd.Process.Kill()
+	}
+	select {
+	case <-done:
+		return errors.New("daemon uninstall timeout")
+	case <-time.After(time.Second):
+		return errors.New("daemon uninstall cleanup-required")
+	}
+}
+
+func (c *controller) supervise() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	ready, owner := os.NewFile(3, "ready"), os.NewFile(4, "owner.lock")
+	if ready == nil || owner == nil {
+		return errors.New("missing supervisor bootstrap")
+	}
+	defer ready.Close()
+	defer owner.Close()
+	syscall.CloseOnExec(3)
+	syscall.CloseOnExec(4)
+	// These descriptors must be the private pipe and exactly our already-held lock.
+	st, err := owner.Stat()
+	if err != nil {
+		return err
+	}
+	pathStat, err := os.Lstat(filepath.Join(c.dir, "owner.lock"))
+	if err != nil || !os.SameFile(st, pathStat) || !owned(st) {
+		return errors.New("invalid supervisor lock")
+	}
+	pipeStat, err := ready.Stat()
+	if err != nil || pipeStat.Mode()&os.ModeNamedPipe == 0 {
+		return errors.New("invalid supervisor pipe")
+	}
+	if err := syscall.Flock(int(owner.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+		return err
+	}
+	signals := make(chan os.Signal, 1)
+	signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
+	defer signal.Stop(signals)
+	cmd := c.child(c.Args)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+	stop := func() error {
+		cmd.Process.Signal(syscall.SIGTERM)
+		select {
+		case <-done:
+			return nil
+		case <-time.After(time.Duration(c.Timeouts.Stop-1) * time.Second):
+			cmd.Process.Kill()
+		}
+		select {
+		case <-done:
+			return nil
+		case <-time.After(time.Second):
+			return errors.New("daemon child stop timeout")
+		}
+	}
+	// Process stability is the readiness contract; it is not app HTTP readiness.
+	select {
+	case <-done:
+		return errors.New("daemon exited during startup")
+	case <-signals:
+		return stop()
+	case <-time.After(time.Second):
+	}
+	r := record{Supervisor: os.Getpid(), Child: cmd.Process.Pid, Birth: processBirth(cmd.Process.Pid), Digest: c.digest}
+	raw, _ := json.Marshal(r)
+	f, err := safeFile(filepath.Join(c.dir, "daemon.pid"))
+	if err != nil {
+		stop()
+		return err
+	}
+	err = f.Truncate(0)
+	if err == nil {
+		_, err = f.Write(raw)
+	}
+	if err == nil {
+		err = f.Sync()
+	}
+	f.Close()
+	if err != nil {
+		stop()
+		return err
+	}
+	socket := filepath.Join(c.dir, "ctl.sock")
+	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		stop()
+		os.Remove(filepath.Join(c.dir, "daemon.pid"))
+		return err
+	}
+	ln.SetUnlinkOnClose(false)
+	defer ln.Close()
+	clean := false
+	defer func() {
+		os.Remove(socket)
+		if clean {
+			os.Remove(filepath.Join(c.dir, "daemon.pid"))
+		}
+	}()
+	if err := os.Chmod(socket, 0600); err != nil {
+		stop()
+		return err
+	}
+	if _, err := ready.WriteString("ready\n"); err != nil {
+		clean = stop() == nil
+		return err
+	}
+	ready.Close()
+	connections := make(chan *net.UnixConn)
+	go func() {
+		for {
+			conn, err := ln.AcceptUnix()
+			if err != nil {
+				return
+			}
+			select {
+			case connections <- conn:
+			case <-time.After(time.Second):
+				conn.Close()
+			}
+		}
+	}()
+	for {
+		select {
+		case <-done:
+			return nil
+		case <-signals:
+			err := stop()
+			clean = err == nil
+			return err
+		case conn := <-connections:
+			conn.SetDeadline(time.Now().Add(time.Duration(c.Timeouts.Status) * time.Second))
+			raw, err := bufio.NewReader(io.LimitReader(conn, 256)).ReadString('\n')
+			if err != nil {
+				conn.Close()
+				continue
+			}
+			if raw == "status "+c.digest+"\n" {
+				select {
+				case <-done:
+					conn.Write([]byte("failed\n"))
+					conn.Close()
+					return nil
+				default:
+					conn.Write([]byte("ok\n"))
+					conn.Close()
+				}
+			} else if raw == "stop "+c.digest+"\n" {
+				conn.SetDeadline(time.Now().Add(time.Duration(c.Timeouts.Stop+1) * time.Second))
+				err := stop()
+				clean = err == nil
+				if err == nil {
+					conn.Write([]byte("ok\n"))
+				} else {
+					conn.Write([]byte("failed\n"))
+				}
+				conn.Close()
+				return err
+			} else {
+				conn.Write([]byte("refused\n"))
+				conn.Close()
+			}
+		}
+	}
+}
+
+// The proc parser handles spaces and ')' inside Linux executable names.
+func parseBirth(raw string) (string, bool) {
+	end := strings.LastIndex(raw, ")")
+	if end < 0 {
+		return "", false
+	}
+	fields := strings.Fields(raw[end+1:])
+	if len(fields) < 20 {
+		return "", false
+	}
+	_, err := strconv.ParseUint(fields[19], 10, 64)
+	return fields[19], err == nil && fields[0] != "Z" && fields[0] != "X"
+}