@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/datamigrate/migrate_test.go

@@ -0,0 +1,177 @@
+package datamigrate
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func readState(t *testing.T, dir string) State {
+	t.Helper()
+	got, err := Load(dir)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	return got
+}
+
+func TestMissingStateIsZero(t *testing.T) {
+	got, err := Load(t.TempDir())
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if got != (State{}) {
+		t.Fatalf("missing state = %+v, want zero", got)
+	}
+}
+
+func TestRunAppliesEveryMigrationInVersionOrderAndRecordsSchema(t *testing.T) {
+	dir := t.TempDir()
+	var order []int
+	migrations := []Migration{
+		{Version: 2, Name: "second", Apply: func(Context) error { order = append(order, 2); return nil }},
+		{Version: 1, Name: "first", Apply: func(Context) error { order = append(order, 1); return nil }},
+	}
+	got, err := Run(dir, Info{NewPkgVer: "1.1.0-0002"}, migrations)
+	if err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	if want := []int{1, 2}; !reflect.DeepEqual(order, want) {
+		t.Fatalf("migration order = %v, want %v", order, want)
+	}
+	if got.Schema != 2 {
+		t.Fatalf("returned schema = %d, want 2", got.Schema)
+	}
+	if reread := readState(t, dir); reread.Schema != 2 || reread.PackageVersion != "1.1.0-0002" {
+		t.Fatalf("recorded state = %+v", reread)
+	}
+}
+
+func TestRunSkipsMigrationsAlreadyRecorded(t *testing.T) {
+	dir := t.TempDir()
+	runs := 0
+	migration := Migration{Version: 1, Name: "once", Apply: func(Context) error { runs++; return nil }}
+	for range 2 {
+		if _, err := Run(dir, Info{}, []Migration{migration}); err != nil {
+			t.Fatalf("Run: %v", err)
+		}
+	}
+	if runs != 1 {
+		t.Fatalf("migration applied %d times, want 1", runs)
+	}
+}
+
+func TestRunStopsAtFailureAndKeepsEarlierVersion(t *testing.T) {
+	dir := t.TempDir()
+	sentinel := errors.New("boom")
+	applied := 0
+	migrations := []Migration{
+		{Version: 1, Name: "ok", Apply: func(Context) error { applied++; return nil }},
+		{Version: 2, Name: "bad", Apply: func(Context) error { applied++; return sentinel }},
+		{Version: 3, Name: "later", Apply: func(Context) error { applied++; return nil }},
+	}
+	_, err := Run(dir, Info{}, migrations)
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("Run error = %v, want the migration error", err)
+	}
+	if applied != 2 {
+		t.Fatalf("applied %d migrations, want 2", applied)
+	}
+	if got := readState(t, dir); got.Schema != 1 {
+		t.Fatalf("recorded schema = %d, want 1 (last success)", got.Schema)
+	}
+}
+
+func TestRunLeavesOldDataWhenAMigrationFails(t *testing.T) {
+	dir := t.TempDir()
+	keep := filepath.Join(dir, "old.db")
+	if err := os.WriteFile(keep, []byte("old"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Run(dir, Info{}, []Migration{{Version: 1, Name: "bad", Apply: func(Context) error { return errors.New("nope") }}}); err == nil {
+		t.Fatal("want error")
+	}
+	if data, err := os.ReadFile(keep); err != nil || string(data) != "old" {
+		t.Fatalf("old data = %q, %v", data, err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, StateFile)); !os.IsNotExist(err) {
+		t.Fatalf("a failed first migration must not record a version: %v", err)
+	}
+}
+
+func TestRunGivesMigrationsTheOldAndNewPackageVersion(t *testing.T) {
+	dir := t.TempDir()
+	var first Context
+	if _, err := Run(dir, Info{OldPkgVer: "1.0.0-0001", NewPkgVer: "1.1.0-0002"}, []Migration{
+		{Version: 1, Name: "m1", Apply: func(ctx Context) error { first = ctx; return nil }},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if first.OldPkgVer != "1.0.0-0001" || first.NewPkgVer != "1.1.0-0002" || first.DataDir != dir {
+		t.Fatalf("context = %+v", first)
+	}
+	var second Context
+	if _, err := Run(dir, Info{NewPkgVer: "1.2.0-0003"}, []Migration{
+		{Version: 2, Name: "m2", Apply: func(ctx Context) error { second = ctx; return nil }},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if second.OldPkgVer != "1.1.0-0002" {
+		t.Fatalf("old package version without SYNOPKG_OLD_PKGVER = %q, want the recorded one", second.OldPkgVer)
+	}
+}
+
+func TestRunRecordsThePackageVersionWithoutMigrations(t *testing.T) {
+	dir := t.TempDir()
+	if _, err := Run(dir, Info{NewPkgVer: "1.0.0-0001"}, nil); err != nil {
+		t.Fatal(err)
+	}
+	if got := readState(t, dir); got.Schema != 0 || got.PackageVersion != "1.0.0-0001" {
+		t.Fatalf("state = %+v", got)
+	}
+	if _, err := Run(dir, Info{NewPkgVer: "1.1.0-0002"}, nil); err != nil {
+		t.Fatal(err)
+	}
+	if got := readState(t, dir); got.PackageVersion != "1.1.0-0002" {
+		t.Fatalf("state = %+v", got)
+	}
+}
+
+func TestRunRejectsInvalidMigrationLists(t *testing.T) {
+	dir := t.TempDir()
+	ok := func(Context) error { return nil }
+	for name, migrations := range map[string][]Migration{
+		"zero version": {{Version: 0, Name: "z", Apply: ok}},
+		"negative":     {{Version: -1, Name: "n", Apply: ok}},
+		"duplicate":    {{Version: 1, Name: "a", Apply: ok}, {Version: 1, Name: "b", Apply: ok}},
+		"nil apply":    {{Version: 1, Name: "a"}},
+	} {
+		if _, err := Run(dir, Info{}, migrations); err == nil {
+			t.Errorf("%s: want an error before anything runs", name)
+		}
+	}
+}
+
+func TestRunRejectsAnEmptyDataDirectory(t *testing.T) {
+	if _, err := Run("", Info{}, nil); err == nil {
+		t.Fatal("want an error")
+	}
+}
+
+func TestLoadRejectsCorruptState(t *testing.T) {
+	for name, body := range map[string]string{
+		"not json":     "{",
+		"negative":     `{"schema":-1}`,
+		"not a number": `{"schema":"one"}`,
+	} {
+		dir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(dir, StateFile), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := Load(dir); err == nil {
+			t.Errorf("%s: want an error", name)
+		}
+	}
+}

package/templates/native-go/backend/internal/dsmprobe/collector_linux.go

@@ -0,0 +1,335 @@
+package dsmprobe
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"debug/elf"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// root is test-only filesystem injection. The executable exposes no path/root
+// option or environment override. It reads no shadow, native DB, or data file.
+type collector struct{ root string }
+
+func (c *collector) path(p string) string {
+	if c.root != "" {
+		return c.root + p
+	}
+	return p
+}
+func openObserved(path string, flags int) (*os.File, error) {
+	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
+		return nil, ErrInvalid
+	}
+	fd, e := unix.Open("/", unix.O_PATH|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if e != nil {
+		return nil, e
+	}
+	parts := strings.Split(path[1:], "/")
+	for i, p := range parts {
+		f := unix.O_PATH | unix.O_DIRECTORY
+		if i == len(parts)-1 {
+			f = flags
+		}
+		next, e := unix.Openat(fd, p, f|unix.O_NOFOLLOW|unix.O_CLOEXEC|unix.O_NONBLOCK, 0)
+		unix.Close(fd)
+		if e != nil {
+			return nil, e
+		}
+		fd = next
+	}
+	return os.NewFile(uintptr(fd), "observation"), nil
+}
+func (c *collector) read(ctx context.Context, path string, maximum int) ([]byte, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	f, e := openObserved(c.path(path), unix.O_RDONLY)
+	if e != nil {
+		return nil, e
+	}
+	defer f.Close()
+	var st unix.Stat_t
+	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Size > int64(maximum) {
+		return nil, ErrInvalid
+	}
+	out, e := io.ReadAll(io.LimitReader(f, int64(maximum+1)))
+	if len(out) > maximum {
+		return nil, ErrInvalid
+	}
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	return out, e
+}
+func hash(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
+func version(b []byte) string {
+	values := map[string]string{}
+	for _, line := range strings.Split(string(b), "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		if k != "productversion" && k != "buildnumber" {
+			continue
+		}
+		if _, ok := values[k]; ok {
+			return ""
+		}
+		values[k] = strings.Trim(v, "\"")
+	}
+	if values["productversion"] == "" || values["buildnumber"] == "" {
+		return ""
+	}
+	return values["productversion"] + "-" + values["buildnumber"]
+}
+func (c *collector) runtime(ctx context.Context) (Runtime, error) {
+	r := Runtime{Architecture: runtime.GOARCH, Libraries: []LibraryEvidence{}}
+	var u unix.Utsname
+	if unix.Uname(&u) != nil {
+		return r, ErrInvalid
+	}
+	r.Kernel = unix.ByteSliceToString(u.Release[:])
+	b, e := c.read(ctx, "/etc.defaults/VERSION", 4096)
+	if e == nil {
+		r.DSMBuild = version(b)
+		r.VersionDigest = hash(b)
+	}
+	boot, e := c.read(ctx, "/proc/sys/kernel/random/boot_id", 128)
+	if e == nil && len(strings.TrimSpace(string(boot))) == 36 {
+		r.BootRef = hash(bytes.TrimSpace(boot))
+	}
+	modules, _ := c.read(ctx, "/proc/modules", 1<<20)
+	for _, line := range strings.Split(string(modules), "\n") {
+		if strings.HasPrefix(line, "synoacl_vfs ") {
+			r.ACLModule = true
+		}
+	}
+	for _, name := range []string{"libsynoacl.so", "libsynosdk.so.7", "libsynolocalaccount.so.7"} {
+		b, e := c.read(ctx, "/usr/lib/"+name, 32<<20)
+		if e != nil {
+			continue
+		}
+		evidence := LibraryEvidence{Name: name, SHA256: hash(b), Exports: []string{}}
+		image, e := elf.NewFile(bytes.NewReader(b))
+		if e != nil {
+			r.Libraries = append(r.Libraries, evidence)
+			continue
+		}
+		symbols, _ := image.DynamicSymbols()
+		image.Close()
+		for _, s := range symbols {
+			switch s.Name {
+			case "SYNOACLPermCheck", "SYNOACLIsSupport", "SYNOUserGetLocal", "SYNOServiceUserHomeStatusGet", "SYNOShareGet", "SYNOShareUGPrivGetLocalInt":
+				if s.Section != elf.SHN_UNDEF {
+					evidence.Exports = append(evidence.Exports, s.Name)
+				}
+			}
+		}
+		slices.Sort(evidence.Exports)
+		r.Libraries = append(r.Libraries, evidence)
+	}
+	// Deterministic fingerprint binds actual bytes and kernel/build/architecture;
+	// it is an observation, NOT a source-to-build or native semantics certificate.
+	seed, _ := json.Marshal(struct {
+		Architecture, DSMBuild, Kernel, VersionDigest string
+		Libraries                                     []LibraryEvidence
+		ACLModule                                     bool
+	}{r.Architecture, r.DSMBuild, r.Kernel, r.VersionDigest, r.Libraries, r.ACLModule})
+	r.Fingerprint = hash(seed)
+	if ctx.Err() != nil {
+		return r, ctx.Err()
+	}
+	return r, nil
+}
+func identity() Identity {
+	groups, _ := os.Getgroups()
+	g := make([]uint32, 0, len(groups))
+	for _, v := range groups {
+		g = append(g, uint32(v))
+	}
+	slices.Sort(g)
+	g = slices.Compact(g)
+	n, e := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	d, de := unix.PrctlRetInt(unix.PR_GET_DUMPABLE, 0, 0, 0, 0)
+	return Identity{UID: uint32(os.Geteuid()), GID: uint32(os.Getegid()), Groups: g, NoNewPrivs: e == nil && n == 1, NonDumpable: de == nil && d == 0}
+}
+func (c *collector) account(ctx context.Context, r Request) (Account, error) {
+	b, e := c.read(ctx, "/etc/passwd", 128<<10)
+	if e != nil {
+		return Account{}, e
+	}
+	var found *Account
+	for _, line := range strings.Split(string(b), "\n") {
+		fields := strings.Split(line, ":")
+		if len(fields) != 7 || fields[0] != r.Username {
+			continue
+		}
+		if found != nil {
+			return Account{}, ErrInvalid
+		}
+		uid, e := strconv.ParseUint(fields[2], 10, 32)
+		if e != nil {
+			return Account{}, ErrInvalid
+		}
+		gid, e := strconv.ParseUint(fields[3], 10, 32)
+		if e != nil {
+			return Account{}, ErrInvalid
+		}
+		found = &Account{Username: r.Username, UID: uint32(uid), GID: uint32(gid), Home: fields[5], Groups: []uint32{}}
+	}
+	if found == nil {
+		return Account{}, os.ErrNotExist
+	}
+	if found.UID != r.UID || found.GID != r.GID || found.Home != "/var/services/homes/"+r.Username {
+		return Account{}, ErrInvalid
+	}
+	// passwd is metadata only. Enabled/local/group/service/share native proofs
+	// remain false; no UID/name fingerprint is advertised as incarnation.
+	return *found, nil
+}
+func (c *collector) home(ctx context.Context, r Request) (Home, *os.File, error) {
+	var h Home
+	if ctx.Err() != nil {
+		return h, nil, ctx.Err()
+	}
+	link := c.path("/var/services/homes")
+	before, e := os.Lstat(link)
+	if e != nil || before.Mode()&os.ModeSymlink == 0 {
+		return h, nil, ErrInvalid
+	}
+	target, e := os.Readlink(link)
+	if e != nil || !filepath.IsAbs(target) || filepath.Clean(target) != target || !strings.HasPrefix(target, "/volume") || !strings.HasSuffix(target, "/homes") {
+		return h, nil, ErrInvalid
+	}
+	h.HomesPath = target
+	f, e := openObserved(c.path(target+"/"+r.Username), unix.O_PATH|unix.O_DIRECTORY)
+	if e != nil {
+		return h, nil, e
+	}
+	var st unix.Stat_t
+	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFDIR {
+		f.Close()
+		return h, nil, ErrInvalid
+	}
+	after, e := os.Lstat(link)
+	again, re := os.Readlink(link)
+	if e != nil || re != nil || !os.SameFile(before, after) || target != again {
+		f.Close()
+		return h, nil, ErrInvalid
+	}
+	h.Existing = true
+	h.Device = uint64(st.Dev)
+	h.Inode = st.Ino
+	h.Owner = st.Uid
+	return h, f, nil
+}
+func sampleACL(ctx context.Context, r Request, out Response, fd int) ACLSample {
+	sample := ACLSample{Mask: 0x105, SupportErrno: []uint32{}}
+	// Exact source-reviewed candidate only, explicitly requested for evidence.
+	// Never feed this result into bridge certification or a production Allow.
+	if ctx.Err() != nil || runtime.GOARCH != "amd64" || out.Runtime.DSMBuild != "7.4-90069" || out.Runtime.Kernel != "4.4.302+" || !out.Runtime.ACLModule || len(out.Runtime.Libraries) != 3 || r.ExpectedRuntime != out.Runtime.Fingerprint || out.Identity.UID != r.UID || out.Identity.GID != r.GID || !slices.Equal(out.Identity.Groups, r.Groups) || !out.Identity.NoNewPrivs || !out.Identity.NonDumpable || out.Home.Owner != r.UID {
+		return sample
+	}
+	ru, eu, su := unix.Getresuid()
+	rg, eg, sg := unix.Getresgid()
+	if ru != int(r.UID) || eu != ru || su != ru || rg != int(r.GID) || eg != rg || sg != rg {
+		return sample
+	}
+	var caps [2]unix.CapUserData
+	head := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	if unix.Capget(&head, &caps[0]) != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
+		return sample
+	}
+	var before unix.Stat_t
+	if unix.Fstat(fd, &before) != nil {
+		return sample
+	}
+	alias, e := unix.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", fd))
+	if e != nil {
+		return sample
+	}
+	defer runtime.KeepAlive(alias)
+	sample.Attempted = true
+	for _, tag := range []uintptr{1, 2} {
+		result, _, errno := unix.Syscall(813, uintptr(unsafe.Pointer(alias)), uintptr(fd), tag)
+		sample.SupportErrno = append(sample.SupportErrno, uint32(errno))
+		if tag == 1 {
+			sample.FilesystemSupport = int64(result)
+		} else {
+			sample.ObjectSupport = int64(result)
+		}
+		if errno != 0 || result != 1 {
+			return sample
+		}
+		if ctx.Err() != nil {
+			return sample
+		}
+	}
+	result, _, errno := unix.Syscall(812, uintptr(unsafe.Pointer(alias)), uintptr(sample.Mask), 0)
+	sample.CheckResult = int64(result)
+	sample.CheckErrno = uint32(errno)
+	runtime.KeepAlive(alias)
+	var after unix.Stat_t
+	if unix.Fstat(fd, &after) != nil || before.Dev != after.Dev || before.Ino != after.Ino || before.Uid != after.Uid || before.Mode != after.Mode {
+		sample.CheckErrno = uint32(unix.ESTALE)
+	}
+	return sample
+}
+func (c *collector) collect(ctx context.Context, r Request) (Response, error) {
+	out := Response{Version: Protocol, Nonce: r.Nonce, Status: "unsupported", Identity: identity(), Account: Account{Groups: []uint32{}}, ACL: ACLSample{SupportErrno: []uint32{}}}
+	if r.Validate() != nil {
+		return out, ErrInvalid
+	}
+	rt, e := c.runtime(ctx)
+	out.Runtime = rt
+	if e != nil {
+		return out, e
+	}
+	if rt.DSMBuild != "" && rt.BootRef != "" {
+		out.Status = "ok"
+	}
+	if r.Kind == "runtime" {
+		return out, nil
+	}
+	a, e := c.account(ctx, r)
+	out.Account = a
+	if e != nil {
+		return out, e
+	}
+	h, f, e := c.home(ctx, r)
+	out.Home = h
+	out.Share = Share{Name: "homes", Path: h.HomesPath}
+	if e != nil {
+		return out, e
+	}
+	defer f.Close()
+	if r.Kind == "acl" {
+		out.ACL = sampleACL(ctx, r, out, int(f.Fd()))
+	}
+	if ctx.Err() != nil {
+		return out, ctx.Err()
+	}
+	return out, nil
+}
+func Collect(ctx context.Context, r Request) (Response, error) {
+	out, e := (&collector{}).collect(ctx, r)
+	if e != nil && !errors.Is(e, context.Canceled) && !errors.Is(e, context.DeadlineExceeded) {
+		out.Status = "unsupported"
+	}
+	return out, e
+}

package/templates/native-go/backend/internal/dsmprobe/collector_linux_test.go

@@ -0,0 +1,41 @@
+package dsmprobe
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestCollectorMetadataNeverCertifiesNativePolicyOrCreatesHome(t *testing.T) {
+	root := t.TempDir()
+	for _, p := range []string{"etc.defaults", "etc", "proc/sys/kernel/random", "volume1/homes", "var/services"} {
+		if e := os.MkdirAll(filepath.Join(root, p), 0755); e != nil {
+			t.Fatal(e)
+		}
+	}
+	os.WriteFile(root+"/etc/passwd", []byte("normal3:x:1217:100::/var/services/homes/normal3:/sbin/nologin\n"), 0644)
+	os.WriteFile(root+"/etc.defaults/VERSION", []byte("productversion=\"7.4\"\nbuildnumber=\"90069\"\n"), 0644)
+	os.WriteFile(root+"/proc/sys/kernel/random/boot_id", []byte("11111111-2222-3333-4444-555555555555\n"), 0644)
+	os.Symlink("/volume1/homes", root+"/var/services/homes")
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "metadata"}
+	c := collector{root: root}
+	out, e := c.collect(context.Background(), r)
+	if !os.IsNotExist(e) || out.Account.UID != 1217 || out.Account.Home != "/var/services/homes/normal3" {
+		t.Fatal(e, out)
+	}
+	if out.Account.NativeKnown || out.Account.GroupsKnown || out.Home.StatusKnown || out.Share.NativeKnown || out.Share.PermissionKnown || out.ACL.Certified || out.ACL.Attempted {
+		t.Fatal("metadata became authority")
+	}
+	if _, e := os.Stat(root + "/volume1/homes/normal3"); !os.IsNotExist(e) {
+		t.Fatal("missing home created")
+	}
+}
+func TestCollectorACLRefusesDifferentActorAndFingerprint(t *testing.T) {
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "acl", ExpectedRuntime: strings.Repeat("b", 64)}
+	out, _ := (&collector{}).collect(context.Background(), r)
+	if out.ACL.Attempted || out.ACL.Certified {
+		t.Fatal("unproven ABI or actor reached raw syscall")
+	}
+}