@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/s1r_actor_acl_linux_test.go

@@ -0,0 +1,303 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"slices"
+	"strings"
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func TestS1RKernelPermissionMatrix(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	for _, c := range []struct {
+		name, scenario string
+		uid, gid       uint32
+		groups         []uint32
+	}{
+		{"alice-own", "alice/allow", s1rAlice, s1rAliceGID, []uint32{}},
+		{"bob-own", "bob/allow", s1rBob, s1rBobGID, []uint32{}},
+		{"alice-denied-bob", "bob/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"bob-denied-alice", "alice/deny", s1rBob, s1rBobGID, []uint32{}},
+		{"supplementary-only", "supplementary/allow", s1rAlice, s1rAliceGID, []uint32{s1rExtra, s1rShared}},
+		{"supplementary-omitted", "supplementary/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"primary-group-only", "supplementary/allow", s1rAlice, s1rShared, []uint32{}},
+		{"acl-named-user", "acl-allow/allow", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-other-user", "acl-allow/deny", s1rBob, s1rBobGID, []uint32{}},
+		{"acl-directory-mask", "acl-mask/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-file-mask", "acl-file-mask/file-mask", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-named-group", "acl-group/allow", s1rAlice, s1rAliceGID, []uint32{s1rShared}},
+		{"acl-named-group-omitted", "acl-group/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-group-mask-read-only", "acl-group-mask/read-only", s1rAlice, s1rAliceGID, []uint32{s1rShared}},
+		{"default-acl-writer", "inherit/allow", s1rAlice, s1rAliceGID, []uint32{}},
+		{"default-acl-reader", "inherit/read-only", s1rBob, s1rBobGID, []uint32{}},
+		{"readonly-directory", "readonly/read-only", s1rAlice, s1rAliceGID, []uint32{}},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			s1rRunActor(t, s1rActorSpec{UID: c.uid, GID: c.gid, Groups: c.groups, Root: s1rFixture(t), Scenario: c.scenario})
+		})
+	}
+}
+
+func s1rAssertCredentials(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	u, e, s := unix.Getresuid()
+	g, eg, sg := unix.Getresgid()
+	if u != int(spec.UID) || e != u || s != u || g != int(spec.GID) || eg != g || sg != g {
+		t.Fatalf("UID/GID triplets: %d/%d/%d %d/%d/%d", u, e, s, g, eg, sg)
+	}
+	groups, err := syscall.Getgroups()
+	s1rMust(t, err)
+	want := make([]int, len(spec.Groups))
+	for i, v := range spec.Groups {
+		want[i] = int(v)
+	}
+	slices.Sort(groups)
+	slices.Sort(want)
+	if !slices.Equal(groups, want) {
+		t.Fatalf("setgroups got %v want %v", groups, want)
+	}
+	header := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	var caps [2]unix.CapUserData
+	s1rMust(t, unix.Capget(&header, &caps[0]))
+	if caps != ([2]unix.CapUserData{}) {
+		t.Fatalf("retained capabilities: %+v", caps)
+	}
+	nnp, err := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	s1rMust(t, err)
+	if nnp != 1 {
+		t.Fatal("no_new_privs", nnp)
+	}
+	keep, err := unix.PrctlRetInt(unix.PR_GET_KEEPCAPS, 0, 0, 0, 0)
+	s1rMust(t, err)
+	if keep != 0 {
+		t.Fatal("keepcaps", keep)
+	}
+	for _, attempt := range []struct {
+		name string
+		run  func() error
+	}{
+		{"setuid-root", func() error { return syscall.Setuid(0) }},
+		{"setresuid-root", func() error { return syscall.Setresuid(0, 0, 0) }},
+		{"setgid-root", func() error { return syscall.Setgid(0) }},
+		{"setresgid-root", func() error { return syscall.Setresgid(0, 0, 0) }},
+		{"setgroups-root", func() error { return syscall.Setgroups([]int{0}) }},
+		{"cap-dac-override", func() error {
+			c := [2]unix.CapUserData{{Effective: 2, Permitted: 2}}
+			return unix.Capset(&header, &c[0])
+		}},
+	} {
+		if err := attempt.run(); err != unix.EPERM {
+			t.Fatalf("privilege regain %s: %v", attempt.name, err)
+		}
+	}
+	u, e, s = unix.Getresuid()
+	g, eg, sg = unix.Getresgid()
+	if u != int(spec.UID) || e != u || s != u || g != int(spec.GID) || eg != g || sg != g {
+		t.Fatal("regain changed credentials")
+	}
+	t.Logf("credentials UID=%d/%d/%d GID=%d/%d/%d groups=%v caps=0 NNP=1; six regain attempts=EPERM", u, e, s, g, eg, sg, groups)
+}
+
+func s1rActorMatrix(t *testing.T, spec s1rActorSpec) {
+	parts := strings.Split(spec.Scenario, "/")
+	if parts[0] == "races" {
+		s1rActorRaces(t, spec, parts[1])
+		return
+	}
+	if parts[0] == "inherited" {
+		s1rCheckInherited(t, spec)
+		return
+	}
+	root := spec.Root + "/" + parts[0]
+	mode := parts[1]
+	for _, op := range []string{"stat", "list", "read", "stream", "create", "write", "publish"} {
+		t.Run(op, func(t *testing.T) {
+			allow := mode == "allow" || (mode == "read-only" && slices.Contains([]string{"stat", "list", "read", "stream"}, op)) || (mode == "file-mask" && slices.Contains([]string{"list", "create", "write", "publish"}, op))
+			pin, code := pinReadOnlyRoot(root)
+			if code != "" {
+				if allow || code != ErrDenied {
+					t.Fatal("root search", code, "allow", allow)
+				}
+				t.Log("kernel denies root search")
+				return
+			}
+			defer pin.Close()
+			ctx := context.Background()
+			var result readOnlyResult
+			var data []byte
+			switch op {
+			case "stat", "list", "read":
+				work := readWork(pin, "file")
+				if op == "stat" {
+					work.Action = ActionStat
+					work.MaxBytes = 0
+				}
+				if op == "list" {
+					work.Action = ActionList
+					work.Segments = []string{}
+					work.MaxBytes = 0
+					work.Limit = 20
+				}
+				result, data = executeReadOnly(ctx, pin, work, fixtureReadOnlyACL{})
+				code = result.Code
+				if allow {
+					if op == "read" && string(data) != "canary:"+parts[0] {
+						t.Fatal("read canary", string(data))
+					}
+					if op == "stat" && result.Entry == nil {
+						t.Fatal("missing stat")
+					}
+					if op == "list" {
+						found := false
+						if result.List != nil {
+							for _, e := range result.List.Entries {
+								if e.Name == "file" {
+									found = true
+								}
+							}
+						}
+						if found != (mode != "file-mask") {
+							t.Fatal("list filtered file", result)
+						}
+					}
+				} else if len(data) > 0 || result.Entry != nil || result.List != nil {
+					t.Fatal("denial leaked bytes/metadata", result)
+				}
+			case "stream":
+				work := readWork(pin, "file")
+				work.Action = ActionReadStream
+				x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+				code = r.Code
+				if x != nil {
+					defer x.Close()
+					for x.remaining > 0 {
+						n := uint32(3)
+						if uint64(n) > x.remaining {
+							n = uint32(x.remaining)
+						}
+						b, c := x.ReadChunk(ctx, n)
+						if c != "" {
+							code = c
+							break
+						}
+						data = append(data, b...)
+					}
+				}
+				if allow && string(data) != "canary:"+parts[0] {
+					t.Fatal("stream canary", string(data))
+				}
+				if !allow && (x != nil || len(data) > 0 || r.Bytes != 0) {
+					t.Fatal("denied stream", r)
+				}
+			default:
+				staged := op == "publish"
+				work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new-" + op}, MaxBytes: 3}
+				if staged {
+					work.Action = ActionWriteStream
+					work.Staged = true
+				}
+				x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+				code = c
+				if x != nil {
+					defer x.Close()
+				}
+				if code == "" {
+					if op == "create" {
+						if !x.Receipt().Created || x.Receipt().BytesWritten != 0 {
+							t.Fatal(x.Receipt())
+						}
+					} else {
+						r, c := x.WriteChunk(ctx, []byte("abc"))
+						code = c
+						if c == "" {
+							r, code = x.Commit(ctx)
+						}
+						if allow && (!r.Committed || !r.Published || r.BytesWritten != 3) {
+							t.Fatal("write receipt", r, code)
+						}
+					}
+				}
+				if !allow {
+					if _, err := os.Stat(root + "/new-" + op); err == nil {
+						t.Fatal("denied write created destination")
+					}
+				}
+			}
+			if allow && code != "" || !allow && code != ErrDenied {
+				t.Fatalf("%s mode=%s expected allow=%v got=%s", op, mode, allow, code)
+			}
+			t.Logf("%s allow=%v code=%q", op, allow, code)
+		})
+	}
+}
+
+func s1rCheckInherited(t *testing.T, spec s1rActorSpec) {
+	root := spec.Root + "/inherit"
+	pin, code := pinReadOnlyRoot(root)
+	if code != "" {
+		t.Fatal(code)
+	}
+	defer pin.Close()
+	for _, name := range []string{"new-create", "new-write", "new-publish"} {
+		result, data := executeReadOnly(context.Background(), pin, readWork(pin, name), fixtureReadOnlyACL{})
+		want := "abc"
+		if name == "new-create" {
+			want = ""
+		}
+		if result.Code != "" || string(data) != want {
+			t.Fatal("inherited read", name, result, string(data))
+		}
+	}
+	if _, code := openActorWriteTransfer(context.Background(), pin, writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"bob-must-not-create"}, MaxBytes: 1}, fixtureReadOnlyACL{}); code != ErrDenied {
+		t.Fatal("inherited directory write", code)
+	}
+	t.Log("Bob reads Alice's created/written/published files via inherited ACL; cannot create")
+}
+
+func TestS1RDefaultACLInheritance(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	root := s1rFixture(t)
+	s1rRunActor(t, s1rActorSpec{UID: s1rAlice, GID: s1rAliceGID, Groups: []uint32{}, Root: root, Scenario: "inherit/allow"})
+	for _, name := range []string{"new-create", "new-write", "new-publish"} {
+		b, err := exec.Command("/usr/bin/getfacl", "-cpn", root+"/inherit/"+name).CombinedOutput()
+		s1rMust(t, err)
+		if !strings.Contains(string(b), "user:23002:r-x") || !strings.Contains(string(b), "mask::rw-") {
+			t.Fatalf("missing inherited ACL: %s\n%s", name, b)
+		}
+		t.Logf("%s inherited ACL:\n%s", name, b)
+	}
+	s1rRunActor(t, s1rActorSpec{UID: s1rBob, GID: s1rBobGID, Groups: []uint32{}, Root: root, Scenario: "inherited/check"})
+}
+
+func TestS1RSymlinkAndRenameRaces(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	for _, kind := range []string{"symlink", "stat-rename", "list-rename", "read-rename", "stream-rename", "create-rename", "publish-rename", "publish-symlink", "publish-permission-loss", "open-fd-write-permission-loss"} {
+		t.Run(kind, func(t *testing.T) {
+			s1rRunActor(t, s1rActorSpec{UID: s1rAlice, GID: s1rAliceGID, Groups: []uint32{}, Root: s1rFixture(t), Scenario: "races/" + kind})
+		})
+	}
+}
+
+func TestS1RActorProcess(t *testing.T) {
+	raw := os.Getenv("S1R_ACTOR_SPEC")
+	if raw == "" {
+		t.Skip("isolated actor subprocess only")
+	}
+	var spec s1rActorSpec
+	s1rMust(t, json.Unmarshal([]byte(raw), &spec))
+	s1rDropActor(t, spec)
+	s1rAssertCredentials(t, spec)
+	s1rActorMatrix(t, spec)
+}

package/dist/templates/native-go/backend/internal/helper/s1r_actor_fixture_linux_test.go

@@ -0,0 +1,184 @@
+package helper
+
+// Disposable Linux VM fixtures only. No account lookup or ACL adapter is
+// installed into the shipped helper, and no business FD is opened by the parent.
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	s1rAlice    = 23001
+	s1rBob      = 23002
+	s1rAliceGID = 24001
+	s1rBobGID   = 24002
+	s1rShared   = 24003
+	s1rExtra    = 24004
+)
+
+func s1rMust(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func s1rACL(t *testing.T, path, acl string) {
+	t.Helper()
+	b, err := exec.Command("/usr/bin/setfacl", "-m", acl, path).CombinedOutput()
+	if err != nil {
+		t.Fatalf("setfacl %s: %v %s", path, err, b)
+	}
+}
+
+func s1rFixture(t *testing.T) string {
+	t.Helper()
+	root, err := os.MkdirTemp("/tmp", "s1r-vm-")
+	s1rMust(t, err)
+	t.Cleanup(func() { s1rMust(t, os.RemoveAll(root)) })
+	s1rMust(t, os.Chmod(root, 0755))
+	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "acl-group", "acl-group-mask", "inherit", "readonly", "race"} {
+		dir := root + "/" + name
+		s1rMust(t, os.Mkdir(dir, 0700))
+		s1rMust(t, os.WriteFile(dir+"/file", []byte("canary:"+name), 0600))
+	}
+	for _, p := range []struct {
+		name     string
+		uid, gid int
+	}{{"alice", s1rAlice, s1rAliceGID}, {"bob", s1rBob, s1rBobGID}, {"race", s1rAlice, s1rAliceGID}} {
+		for _, path := range []string{root + "/" + p.name, root + "/" + p.name + "/file"} {
+			s1rMust(t, os.Chown(path, p.uid, p.gid))
+		}
+	}
+	for _, path := range []string{root + "/supplementary", root + "/supplementary/file"} {
+		s1rMust(t, os.Chown(path, 0, s1rShared))
+	}
+	s1rMust(t, unix.Chmod(root+"/supplementary", 02770))
+	s1rMust(t, os.Chmod(root+"/supplementary/file", 0660))
+	for _, name := range []string{"acl-allow", "acl-file-mask", "inherit"} {
+		s1rACL(t, root+"/"+name, fmt.Sprintf("u:%d:rwx,m::rwx", s1rAlice))
+		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("u:%d:rw-,m::rw-", s1rAlice))
+	}
+	s1rACL(t, root+"/acl-mask", fmt.Sprintf("u:%d:rwx,m::---", s1rAlice))
+	s1rACL(t, root+"/acl-mask/file", fmt.Sprintf("u:%d:rw-,m::---", s1rAlice))
+	s1rACL(t, root+"/acl-file-mask/file", "m::---")
+	for _, name := range []string{"acl-group", "acl-group-mask"} {
+		s1rACL(t, root+"/"+name, fmt.Sprintf("g:%d:rwx,m::rwx", s1rShared))
+		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("g:%d:rw-,m::rw-", s1rShared))
+	}
+	s1rACL(t, root+"/acl-group-mask", "m::r-x")
+	s1rACL(t, root+"/acl-group-mask/file", "m::r--")
+	s1rACL(t, root+"/inherit", fmt.Sprintf("u:%d:r-x,d:u::rwx,d:u:%d:rwx,d:u:%d:r-x,d:g::---,d:m::rwx,d:o::---", s1rBob, s1rAlice, s1rBob))
+	s1rACL(t, root+"/inherit/file", fmt.Sprintf("u:%d:r--,m::rw-", s1rBob))
+	s1rMust(t, os.Chmod(root+"/readonly", 0555))
+	s1rMust(t, os.Chmod(root+"/readonly/file", 0444))
+	return root
+}
+
+type s1rActorSpec struct {
+	UID, GID       uint32
+	Groups         []uint32
+	Root, Scenario string
+}
+
+// Run a fresh test process as root, invoke the REAL permanent drop routine, and
+// proxy ONLY mount metadata using the production packet/FD routines. The parent
+// pins the child's proc directory before permitting its credential transition.
+func s1rRunActor(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	s1rMust(t, err)
+	left := os.NewFile(uintptr(pair[0]), "s1r-parent")
+	right := os.NewFile(uintptr(pair[1]), "s1r-child")
+	defer left.Close()
+	defer right.Close()
+	control, err := operationSocket(left)
+	s1rMust(t, err)
+	defer control.Close()
+	s1rMust(t, enableCredentials(control))
+	exe, err := os.Executable()
+	s1rMust(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, exe, "-test.run=^TestS1RActorProcess$", "-test.v")
+	b, err := json.Marshal(spec)
+	s1rMust(t, err)
+	cmd.Env = append(os.Environ(), "S1R_ACTOR_SPEC="+string(b))
+	cmd.ExtraFiles = []*os.File{right}
+	// Deliberately inherit unrelated/root/supplementary groups. The production
+	// Setgroups call must replace these, including when the requested set is empty.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 0, Gid: 0, Groups: []uint32{0, s1rShared, 24005}}}
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	s1rMust(t, cmd.Start())
+	defer func() {
+		if cmd.ProcessState == nil {
+			cmd.Process.Kill()
+			cmd.Wait()
+		}
+	}()
+	info, err := openOperationFDInfo(cmd.Process.Pid)
+	s1rMust(t, err)
+	defer info.Close()
+	s1rMust(t, writeOperationPacket(control, true))
+	done := make(chan error, 1)
+	go func() {
+		var sequence uint64
+		for {
+			var packet readOnlyPacket
+			cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, 30*time.Second)
+			if err != nil {
+				done <- nil
+				return
+			} // process exit closes the private socket
+			if cred == nil || int(cred.Pid) != cmd.Process.Pid || cred.Uid != spec.UID || cred.Gid != spec.GID || packet.Token != strings.Repeat("a", 64) || packet.MountFD == nil || packet.MountSequence != sequence+1 {
+				done <- fmt.Errorf("invalid actor mount query")
+				return
+			}
+			sequence++
+			id, code := operationFDInfoMount(info, *packet.MountFD)
+			if err := writeOperationPacket(control, readOnlyMountReply{Token: packet.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
+				done <- err
+				return
+			}
+		}
+	}()
+	err = cmd.Wait()
+	control.Close()
+	proxyErr := <-done
+	if err != nil || proxyErr != nil {
+		t.Fatalf("actor %s: %v proxy=%v\n%s", spec.Scenario, err, proxyErr, out.String())
+	}
+	t.Log(out.String())
+}
+
+func s1rDropActor(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	runtime.LockOSThread() // like operationChildLinux; subprocess exits when finished
+	f := os.NewFile(3, "s1r-control")
+	defer f.Close()
+	control, err := operationSocket(f)
+	s1rMust(t, err)
+	t.Cleanup(func() { control.Close() })
+	var ready bool
+	_, err = readOperationPacketBound(control, &ready, MaxHealthBytes, 5*time.Second)
+	s1rMust(t, err)
+	if !ready {
+		t.Fatal("parent did not pin proc witness")
+	}
+	boot := operationBootstrap{UID: spec.UID, GID: spec.GID, Groups: spec.Groups, Token: strings.Repeat("a", 64)}
+	s1rMust(t, dropOperationCredentials(os.Getppid(), boot))
+	operationMountIDFallback = operationMountIDProxy(control, boot)
+}