@synopackageland/cli 0.4.0 → 0.5.0

package/templates/_daemon/main_test.go

@@ -0,0 +1,242 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func fixture(t *testing.T, mode string) (string, string, string) {
+	t.Helper()
+	root, err := os.MkdirTemp("/tmp", "c1-runtime-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(root) })
+	dest, data := filepath.Join(root, "target"), filepath.Join(root, "var")
+	if err := os.MkdirAll(filepath.Join(dest, "daemon/payload"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(data, 0700); err != nil {
+		t.Fatal(err)
+	}
+	control, child := os.Getenv("DAEMON_CONTROL_BIN"), os.Getenv("DAEMON_CHILD_BIN")
+	if control == "" {
+		control, child = filepath.Join(root, "control"), filepath.Join(root, "child")
+		for _, spec := range [][]string{{"build", "-o", control, "."}, {"build", "-o", child, "./testdata/child.go"}} {
+			if raw, err := exec.Command("go", spec...).CombinedOutput(); err != nil {
+				t.Fatalf("%v: %s", err, raw)
+			}
+		}
+	}
+	raw, err := os.ReadFile(child)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dest, "daemon/payload/app"), raw, 0755); err != nil {
+		t.Fatal(err)
+	}
+	cfg := config{Package: "DaemonFixture", Exec: "app", Args: []string{"${SYNOPKG_PKGVAR}/a space", "$(touch BAD)'", "${SYNOPKG_PKGDEST}"}, Env: map[string]string{"APP_MODE": mode}, Timeouts: deadlines{Start: 2, Stop: 2, Status: 1}}
+	if os.Geteuid() == 0 {
+		cfg.Package = "nobody"
+	} else {
+		u, err := user.Current()
+		if err != nil {
+			t.Fatal(err)
+		}
+		cfg.Package = u.Username
+	}
+	raw, _ = json.Marshal(cfg)
+	if err := os.WriteFile(filepath.Join(dest, "daemon/config.json"), raw, 0644); err != nil {
+		t.Fatal(err)
+	}
+	if os.Geteuid() == 0 {
+		// Only inside the disposable root VM: run the shipped manager as nobody.
+		if runtime.GOOS != "linux" {
+			t.Fatal("root fixture requires Linux VM")
+		}
+		filepath.Walk(root, func(path string, _ os.FileInfo, err error) error {
+			if err == nil {
+				return os.Chown(path, 65534, 65534)
+			}
+			return err
+		})
+		os.Chmod(root, 0755)
+	}
+	t.Cleanup(func() { runControl(control, "stop", dest, data) })
+	return control, dest, data
+}
+
+func runControl(control, action, dest, data string) (int, string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, control, action, dest, data)
+	cmd.Env = append(os.Environ(), "UNLISTED_SECRET=must-not-leak", "LD_PRELOAD=must-not-leak")
+	dropFixtureUser(cmd)
+	raw, err := cmd.CombinedOutput()
+	if err == nil {
+		return 0, string(raw)
+	}
+	if e, ok := err.(*exec.ExitError); ok {
+		return e.ExitCode(), string(raw)
+	}
+	return -1, err.Error()
+}
+
+func TestDaemonLifecycle(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	for _, step := range []struct {
+		action string
+		want   int
+	}{{"status", 3}, {"stop", 0}, {"start", 0}, {"status", 0}, {"start", 0}, {"restart", 0}, {"stop", 0}, {"stop", 0}, {"status", 3}, {"unknown", 1}} {
+		if rc, out := runControl(control, step.action, dest, data); rc != step.want {
+			t.Fatalf("%s rc=%d want=%d: %s", step.action, rc, step.want, out)
+		}
+	}
+	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.log"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Count(string(raw), `"uid":`) != 2 {
+		t.Fatalf("duplicate start spawned another child: %s", raw)
+	}
+	if strings.Contains(string(raw), "must-not-leak") {
+		t.Fatalf("ambient environment leaked: %s", raw)
+	}
+	if !strings.Contains(string(raw), "$(touch BAD)'") || !strings.Contains(string(raw), "/a space") {
+		t.Fatalf("argv changed: %s", raw)
+	}
+	stat, _ := os.Stat(filepath.Join(data, "daemon/daemon.log"))
+	if stat.Mode().Perm() != 0600 {
+		t.Fatal("log permissions")
+	}
+	stat, err = os.Stat(filepath.Join(data, "daemon/tmp"))
+	if err != nil || stat.Mode().Perm() != 0700 {
+		t.Fatal("private TMPDIR missing", err)
+	}
+}
+
+func TestImmediateExitAndEscalation(t *testing.T) {
+	for _, mode := range []string{"exit", "ignore"} {
+		t.Run(mode, func(t *testing.T) {
+			control, dest, data := fixture(t, mode)
+			rc, out := runControl(control, "start", dest, data)
+			if mode == "exit" {
+				if rc != 1 {
+					t.Fatalf("false readiness: %d %s", rc, out)
+				}
+			} else {
+				if rc != 0 {
+					t.Fatalf("start: %d %s", rc, out)
+				}
+				if rc, out = runControl(control, "stop", dest, data); rc != 0 {
+					t.Fatalf("escalation: %d %s", rc, out)
+				}
+			}
+			if rc, out = runControl(control, "status", dest, data); rc != 3 {
+				t.Fatalf("residue: %d %s", rc, out)
+			}
+		})
+	}
+}
+
+func TestForeignStateAndRootRefusal(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	if os.Geteuid() == 0 {
+		raw, err := exec.Command(control, "start", dest, data).CombinedOutput()
+		if err == nil || !strings.Contains(string(raw), "package account") {
+			t.Fatalf("root accepted: %s %v", raw, err)
+		}
+	}
+	os.Mkdir(filepath.Join(data, "daemon"), 0700)
+	if os.Geteuid() == 0 {
+		os.Chown(filepath.Join(data, "daemon"), 65534, 65534)
+	}
+	os.Symlink(filepath.Join(data, "victim"), filepath.Join(data, "daemon/daemon.log"))
+	if rc, out := runControl(control, "start", dest, data); rc != 1 {
+		t.Fatalf("symlink accepted: %d %s", rc, out)
+	}
+	if _, err := os.Stat(filepath.Join(data, "victim")); !os.IsNotExist(err) {
+		t.Fatal("followed log symlink")
+	}
+}
+
+func TestUninstallCleanup(t *testing.T) {
+	for _, mode := range []string{"cleanup", "cleanup-fail", "cleanup-hang"} {
+		t.Run(mode, func(t *testing.T) {
+			control, dest, data := fixture(t, "normal")
+			path := filepath.Join(dest, "daemon/config.json")
+			raw, _ := os.ReadFile(path)
+			var cfg config
+			json.Unmarshal(raw, &cfg)
+			cfg.UninstallArgs = []string{mode, "${SYNOPKG_PKGVAR}"}
+			raw, _ = json.Marshal(cfg)
+			os.WriteFile(path, raw, 0644)
+			if rc, out := runControl(control, "start", dest, data); rc != 0 {
+				t.Fatalf("start: %d %s", rc, out)
+			}
+			want := 1
+			if mode == "cleanup" {
+				want = 0
+			}
+			if rc, out := runControl(control, "uninstall", dest, data); rc != want {
+				t.Fatalf("cleanup rc=%d want=%d: %s", rc, want, out)
+			}
+			if rc, out := runControl(control, "status", dest, data); rc != 3 {
+				t.Fatalf("cleanup must not restart daemon: %d %s", rc, out)
+			}
+		})
+	}
+}
+
+func TestPackageAccountIdentity(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	path := filepath.Join(dest, "daemon/config.json")
+	raw, _ := os.ReadFile(path)
+	var cfg config
+	json.Unmarshal(raw, &cfg)
+	cfg.Package = "root"
+	raw, _ = json.Marshal(cfg)
+	os.WriteFile(path, raw, 0644)
+	rc, out := runControl(control, "start", dest, data)
+	if rc == 0 {
+		runControl(control, "stop", dest, data)
+	}
+	if rc != 1 {
+		t.Fatalf("other account accepted: %d %s", rc, out)
+	}
+}
+
+func TestFIFOInventoryCannotBlockStatus(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	state := filepath.Join(data, "daemon")
+	os.Mkdir(state, 0700)
+	path := filepath.Join(state, "daemon.pid")
+	t.Cleanup(func() { os.Remove(path) })
+	if err := syscall.Mkfifo(path, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if os.Geteuid() == 0 {
+		os.Chown(state, 65534, 65534)
+		os.Chown(path, 65534, 65534)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, control, "status", dest, data)
+	dropFixtureUser(cmd)
+	raw, err := cmd.CombinedOutput()
+	if ctx.Err() != nil {
+		t.Fatal("status blocked on FIFO")
+	}
+	if e, ok := err.(*exec.ExitError); !ok || e.ExitCode() != 1 {
+		t.Fatalf("FIFO status: %s %v", raw, err)
+	}
+}

package/templates/_daemon/process_linux.go

@@ -0,0 +1,55 @@
+//go:build linux
+
+package main
+
+import (
+	"errors"
+	"net"
+	"os"
+	"strconv"
+	"syscall"
+)
+
+func childAttributes() *syscall.SysProcAttr { return &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL} }
+func processBirth(pid int) string {
+	raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
+	if err != nil {
+		return ""
+	}
+	birth, _ := parseBirth(string(raw))
+	return birth
+}
+func recordedChildAlive(pid int, birth string) bool {
+	raw, err := os.ReadFile("/proc/" + strconv.Itoa(pid) + "/stat")
+	if os.IsNotExist(err) {
+		return false
+	}
+	if err != nil {
+		return true
+	}
+	actual, alive := parseBirth(string(raw))
+	if actual == "" {
+		return true
+	}
+	return alive && (birth == "" || actual == birth)
+}
+func checkPeer(conn *net.UnixConn, pid int) error {
+	fd, err := conn.SyscallConn()
+	if err != nil {
+		return err
+	}
+	var peer *syscall.Ucred
+	var getErr error
+	if err := fd.Control(func(raw uintptr) {
+		peer, getErr = syscall.GetsockoptUcred(int(raw), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
+	}); err != nil {
+		return err
+	}
+	if getErr != nil {
+		return getErr
+	}
+	if peer.Uid != uint32(os.Geteuid()) || peer.Pid != int32(pid) {
+		return errors.New("foreign daemon supervisor")
+	}
+	return nil
+}

package/templates/_daemon/process_linux_test.go

@@ -0,0 +1,161 @@
+//go:build linux
+
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func waitDead(t *testing.T, pid int, birth string) {
+	t.Helper()
+	until := time.Now().Add(3 * time.Second)
+	for time.Now().Before(until) {
+		if !recordedChildAlive(pid, birth) {
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	t.Fatalf("PID %d remained alive", pid)
+}
+func readFixtureRecord(t *testing.T, data string) record {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(data, "daemon/daemon.pid"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var r record
+	if err := json.Unmarshal(raw, &r); err != nil {
+		t.Fatal(err)
+	}
+	return r
+}
+
+func TestLinuxSupervisorDeathAndConcurrentStart(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	var wg sync.WaitGroup
+	results := make(chan int, 6)
+	for i := 0; i < 6; i++ {
+		wg.Add(1)
+		go func() { defer wg.Done(); rc, _ := runControl(control, "start", dest, data); results <- rc }()
+	}
+	wg.Wait()
+	close(results)
+	for rc := range results {
+		if rc != 0 {
+			t.Fatalf("concurrent start: %d", rc)
+		}
+	}
+	r := readFixtureRecord(t, data)
+	if err := syscall.Kill(r.Supervisor, syscall.SIGKILL); err != nil {
+		t.Fatal(err)
+	}
+	waitDead(t, r.Child, r.Birth)
+	if rc, out := runControl(control, "status", dest, data); rc != 1 {
+		t.Fatalf("lost-supervisor status: %d %s", rc, out)
+	}
+	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
+		t.Fatalf("retire dead child: %d %s", rc, out)
+	}
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("restart after death: %d %s", rc, out)
+	}
+	if r2 := readFixtureRecord(t, data); r2.Child == r.Child {
+		t.Fatal("did not start fresh child")
+	}
+}
+
+func TestLinuxInventoryNeverSignalsForeignPID(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("start: %d %s", rc, out)
+	}
+	r := readFixtureRecord(t, data)
+	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
+		t.Fatalf("stop: %d %s", rc, out)
+	}
+	foreign := exec.Command("/bin/sleep", "30")
+	if err := foreign.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() { foreign.Process.Kill(); foreign.Wait() }()
+	r.Supervisor = foreign.Process.Pid
+	r.Child = foreign.Process.Pid
+	r.Birth = processBirth(r.Child)
+	raw, _ := json.Marshal(r)
+	path := filepath.Join(data, "daemon/daemon.pid")
+	if err := os.WriteFile(path, raw, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if os.Geteuid() == 0 {
+		os.Chown(path, 65534, 65534)
+	}
+	for _, action := range []string{"stop", "start", "restart"} {
+		if rc, out := runControl(control, action, dest, data); rc != 1 {
+			t.Fatalf("%s accepted live unwitnessed PID: %d %s", action, rc, out)
+		}
+		if !recordedChildAlive(r.Child, r.Birth) {
+			t.Fatal("signalled inventory PID")
+		}
+	}
+	// A reused numeric PID with a different birth can be retired without killing it.
+	r.Birth = "1"
+	raw, _ = json.Marshal(r)
+	os.WriteFile(path, raw, 0600)
+	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
+		t.Fatalf("retire reused PID: %d %s", rc, out)
+	}
+	if !recordedChildAlive(foreign.Process.Pid, processBirth(foreign.Process.Pid)) {
+		t.Fatal("killed reused PID")
+	}
+}
+
+func TestLinuxChildSelfExitAndDeadlines(t *testing.T) {
+	control, dest, data := fixture(t, "normal")
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("start: %d %s", rc, out)
+	}
+	r := readFixtureRecord(t, data)
+	if err := syscall.Kill(r.Child, syscall.SIGTERM); err != nil {
+		t.Fatal(err)
+	}
+	waitDead(t, r.Child, r.Birth)
+	time.Sleep(100 * time.Millisecond)
+	if rc, out := runControl(control, "status", dest, data); rc != 1 {
+		t.Fatalf("self exit: %d %s", rc, out)
+	}
+	control, dest, data = fixture(t, "ignore")
+	if rc, out := runControl(control, "start", dest, data); rc != 0 {
+		t.Fatalf("start: %d %s", rc, out)
+	}
+	r = readFixtureRecord(t, data)
+	began := time.Now()
+	if rc, out := runControl(control, "stop", dest, data); rc != 0 {
+		t.Fatalf("stop: %d %s", rc, out)
+	}
+	if elapsed := time.Since(began); elapsed < time.Second || elapsed > 3*time.Second {
+		t.Fatalf("stop deadline: %s", elapsed)
+	}
+	waitDead(t, r.Child, r.Birth)
+}
+
+func TestParseLinuxProcBirth(t *testing.T) {
+	fields := []string{"S", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "1234"}
+	raw := "42 (a ) tricky name)"
+	for _, f := range fields {
+		raw += " " + f
+	}
+	if birth, alive := parseBirth(raw); birth != "1234" || !alive {
+		t.Fatal(birth, alive)
+	}
+	if recordedChildAlive(os.Getpid(), strconv.Itoa(os.Getpid())) {
+		t.Fatal("different process birth matched")
+	}
+}

package/templates/_daemon/process_other.go

@@ -0,0 +1,14 @@
+//go:build !linux
+
+package main
+
+import (
+	"net"
+	"syscall"
+)
+
+// Host-only tests exercise lifecycle/quoting; published controllers target Linux.
+func childAttributes() *syscall.SysProcAttr     { return &syscall.SysProcAttr{} }
+func processBirth(int) string                   { return "host-fixture" }
+func recordedChildAlive(pid int, _ string) bool { return syscall.Kill(pid, 0) == nil }
+func checkPeer(*net.UnixConn, int) error        { return nil }

package/templates/_daemon/testdata/child.go

@@ -0,0 +1,41 @@
+// Linux/host fixture: a foreground process; never installed on a NAS.
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+)
+
+func main() {
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "cleanup":
+			os.Exit(0)
+		case "cleanup-fail":
+			os.Exit(2)
+		case "cleanup-hang":
+			signal.Ignore(syscall.SIGTERM, syscall.SIGINT)
+			for {
+				time.Sleep(time.Second)
+			}
+		}
+	}
+	if os.Getenv("APP_MODE") == "exit" {
+		os.Exit(2)
+	}
+	raw, _ := json.Marshal(map[string]any{"uid": os.Geteuid(), "args": os.Args[1:], "env": os.Environ()})
+	fmtOutput := append(raw, '\n')
+	os.Stdout.Write(fmtOutput)
+	if os.Getenv("APP_MODE") == "ignore" {
+		signal.Ignore(syscall.SIGTERM, syscall.SIGINT)
+		for {
+			time.Sleep(time.Second)
+		}
+	}
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, syscall.SIGTERM, syscall.SIGINT)
+	<-c
+}

package/templates/_gateway/auth.go

@@ -0,0 +1,101 @@
+package main
+
+// DSM runs a package's CGI as the package account and forwards the browser's
+// cookies. The authenticator hands only the session carriers (cookie,
+// SynoToken, client address) to DSM's own authenticate.cgi, which prints the
+// signed-in user name, then resolves local groups or directory groups through DSM NSS.
+// It never parses the session cookie or trusts a user name from the request.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os/exec"
+	"regexp"
+	"strings"
+	"time"
+)
+
+// authenticateCGI is DSM's session check for third-party CGIs.
+const authenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
+
+var errNoSession = errors.New("no valid DSM session")
+
+type identity struct {
+	User   string
+	Groups []string
+}
+
+type authenticator interface {
+	Authenticate(r *http.Request) (identity, error)
+}
+
+type dsmAuthenticator struct {
+	groupFile       string
+	passwdFile      string
+	directoryGroups func(context.Context, string) ([]string, error)
+	timeout         time.Duration
+	run             func(ctx context.Context, path string, env []string) ([]byte, error)
+}
+
+func newDSMAuthenticator() *dsmAuthenticator {
+	return &dsmAuthenticator{groupFile: "/etc/group", passwdFile: "/etc/passwd", timeout: 10 * time.Second, run: runCGI, directoryGroups: (directoryLookup{timeout: 2 * time.Second, run: runDirectoryCommand}).groups}
+}
+
+var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,193}$`)
+
+func (a *dsmAuthenticator) Authenticate(r *http.Request) (identity, error) {
+	cookie := r.Header.Get("Cookie")
+	if cookie == "" {
+		return identity{}, errNoSession
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), a.timeout)
+	defer cancel()
+	out, err := a.run(ctx, authenticateCGI, sessionEnv(r, cookie))
+	var exit interface{ ExitCode() int }
+	if errors.As(err, &exit) {
+		return identity{}, errNoSession
+	}
+	if err != nil {
+		return identity{}, fmt.Errorf("run %s: %w", authenticateCGI, err)
+	}
+	user := strings.TrimSpace(string(out))
+	if !userName.MatchString(user) {
+		return identity{}, errNoSession
+	}
+	groups, err := a.groupsOf(ctx, user)
+	if err != nil {
+		return identity{}, err
+	}
+	return identity{User: user, Groups: groups}, nil
+}
+
+// sessionEnv is the complete environment authenticate.cgi sees: nothing from
+// this process and no request header besides the session carriers.
+func sessionEnv(r *http.Request, cookie string) []string {
+	token := r.Header.Get("X-SYNO-TOKEN")
+	if token == "" {
+		// A navigation or iframe cannot send the header; DSM's front end appends ?SynoToken= instead.
+		token = r.URL.Query().Get("SynoToken")
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	return []string{
+		"REQUEST_METHOD=GET",
+		"HTTP_COOKIE=" + cookie,
+		"HTTP_X_SYNO_TOKEN=" + token,
+		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
+		"REMOTE_ADDR=" + host,
+	}
+}
+
+func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path)
+	cmd.Env = env
+	return cmd.Output()
+}