@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/dsm_probe_transport_linux.go

@@ -0,0 +1,151 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"debug/elf"
+	"dsmapp/internal/dsmprobe"
+	"encoding/hex"
+	"encoding/json"
+	"golang.org/x/sys/unix"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"syscall"
+	"time"
+)
+
+// Private root-selected static artifact. No PATH search, shell, inherited
+// environment, script interpreter, dlopen, or original pathname reopen.
+type dsmStaticProbeTransport struct{ path, digest string }
+
+func (p *dsmStaticProbeTransport) pin(ctx context.Context) (*os.File, Code) {
+	if p == nil || !digestPattern.MatchString(p.digest) || !filepath.IsAbs(p.path) || filepath.Clean(p.path) != p.path {
+		return nil, ErrUnsupported
+	}
+	dir, e := openGrantDirectory(filepath.Dir(p.path))
+	if e != nil {
+		return nil, ErrDenied
+	}
+	defer dir.Close()
+	fd, e := unix.Openat(int(dir.Fd()), filepath.Base(p.path), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC|unix.O_NONBLOCK, 0)
+	if e != nil {
+		return nil, ErrUnavailable
+	}
+	f := os.NewFile(uintptr(fd), "verified-probe")
+	fail := func(c Code) (*os.File, Code) { f.Close(); return nil, c }
+	var st unix.Stat_t
+	if unix.Fstat(fd, &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Uid != 0 || st.Gid != 0 || st.Nlink != 1 || st.Mode&0022 != 0 || st.Mode&0111 == 0 || st.Mode&06000 != 0 || st.Size <= 0 || st.Size > 32<<20 {
+		return fail(ErrDenied)
+	}
+	h := sha256.New()
+	buf := make([]byte, 65536)
+	for {
+		if c := nativeContextCode(ctx); c != "" {
+			return fail(c)
+		}
+		n, e := f.Read(buf)
+		h.Write(buf[:n])
+		if e == io.EOF {
+			break
+		}
+		if e != nil {
+			return fail(ErrUnavailable)
+		}
+	}
+	if hex.EncodeToString(h.Sum(nil)) != p.digest {
+		return fail(ErrDenied)
+	}
+	image, e := elf.NewFile(f)
+	if e != nil {
+		return fail(ErrUnsupported)
+	}
+	if image.Class != elf.ELFCLASS64 || image.Data != elf.ELFDATA2LSB || (runtime.GOARCH == "amd64" && image.Machine != elf.EM_X86_64) || (runtime.GOARCH == "arm64" && image.Machine != elf.EM_AARCH64) || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") {
+		return fail(ErrUnsupported)
+	}
+	for _, prog := range image.Progs {
+		if prog.Type == elf.PT_INTERP {
+			return fail(ErrUnsupported)
+		}
+	}
+	deps, e := image.DynString(elf.DT_NEEDED)
+	if e != nil || len(deps) != 0 {
+		return fail(ErrUnsupported)
+	}
+	var after unix.Stat_t
+	if unix.Fstat(fd, &after) != nil || !sameReadOnlyObject(st, after) || st.Size != after.Size || st.Mtim != after.Mtim || st.Ctim != after.Ctim {
+		return fail(ErrStale)
+	}
+	if c := nativeContextCode(ctx); c != "" {
+		return fail(c)
+	}
+	return f, ""
+}
+
+type probeBoundedOutput struct {
+	buf     bytes.Buffer
+	maximum int
+}
+
+func (b *probeBoundedOutput) Write(p []byte) (int, error) {
+	if len(p) > b.maximum-b.buf.Len() {
+		return 0, io.ErrShortBuffer
+	}
+	return b.buf.Write(p)
+}
+func (p *dsmStaticProbeTransport) Observe(ctx context.Context, r dsmprobe.Request) (dsmprobe.Response, Code) {
+	var out dsmprobe.Response
+	if r.Kind == "acl" {
+		return out, ErrUnsupported
+	}
+	if r.Validate() != nil {
+		return out, ErrInvalid
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	f, c := p.pin(ctx)
+	if c != "" {
+		return out, c
+	}
+	defer f.Close()
+	return runPinnedDSMProbe(ctx, f, r)
+}
+func runPinnedDSMProbe(ctx context.Context, f *os.File, r dsmprobe.Request) (dsmprobe.Response, Code) {
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	var out dsmprobe.Response
+	var c Code
+	data, e := json.Marshal(r)
+	if e != nil || len(data) > dsmprobe.MaxRequestBytes {
+		return out, ErrLimit
+	}
+	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", "--wire-v1")
+	cmd.ExtraFiles = []*os.File{f}
+	cmd.Env = []string{"LANG=C", "TZ=UTC"}
+	cmd.Stdin = bytes.NewReader(data)
+	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
+	// No helper-side credential switching. Existing S2 operation credentials and
+	// lease must own the invocation; the response independently checks the actor.
+	cmd.WaitDelay = 250 * time.Millisecond
+	stdout := &probeBoundedOutput{maximum: dsmprobe.MaxResponseBytes}
+	stderr := &probeBoundedOutput{maximum: 1024}
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+	e = cmd.Run()
+	if c = nativeContextCode(ctx); c != "" {
+		return out, c
+	}
+	if e != nil || stderr.buf.Len() != 0 {
+		return out, ErrUnavailable
+	}
+	if c = decodeDataObject(bytes.NewReader(stdout.buf.Bytes()), &out, dsmprobe.MaxResponseBytes); c != "" {
+		return dsmprobe.Response{}, c
+	}
+	if out.Version != dsmprobe.Protocol || out.Nonce != r.Nonce {
+		return dsmprobe.Response{}, ErrStale
+	}
+	return out, ""
+}

package/templates/native-go/backend/internal/helper/dsm_probe_transport_linux_test.go

@@ -0,0 +1,66 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/dsmprobe"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDSMProductionTransportNeverRunsExperimentalACLProbe(t *testing.T) {
+	p := &dsmStaticProbeTransport{path: "/not-a-probe", digest: grantRef('a')}
+	r := dsmprobe.Request{Version: 1, Nonce: grantRef('b'), Kind: "acl", Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, ExpectedRuntime: grantRef('c')}
+	if _, c := p.Observe(context.Background(), r); c != ErrUnsupported {
+		t.Fatal("experimental syscall request accepted by production transport", c)
+	}
+}
+
+func TestDSMPinnedStaticProbeIntegrityAndRename(t *testing.T) {
+	dir, _, _ := rootGrantFixture(t)
+	binary, e := os.ReadFile("/probe-bin")
+	if e != nil {
+		t.Fatal("VM static probe fixture missing", e)
+	}
+	path := filepath.Join(dir, "static-probe")
+	if e = os.WriteFile(path, binary, 0755); e != nil {
+		t.Fatal(e)
+	}
+	digest := fmt.Sprintf("%x", sha256.Sum256(binary))
+	p := &dsmStaticProbeTransport{path: path, digest: digest}
+	r := dsmprobe.Request{Version: 1, Nonce: grantRef('a'), Kind: "runtime", Groups: []uint32{}}
+	out, c := p.Observe(context.Background(), r)
+	if c != "" || out.Nonce != r.Nonce || out.Account.NativeKnown || out.ACL.Certified {
+		t.Fatal(c, out)
+	}
+	pin, c := p.pin(context.Background())
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer pin.Close()
+	if e = os.Rename(path, path+"-old"); e != nil {
+		t.Fatal(e)
+	}
+	if e = os.WriteFile(path, []byte("#!/bin/sh\nexit 0\n"), 0755); e != nil {
+		t.Fatal(e)
+	}
+	out, c = runPinnedDSMProbe(context.Background(), pin, r)
+	if c != "" || out.Nonce != r.Nonce {
+		t.Fatal("reopened replaced pathname", c)
+	}
+	if _, c = p.Observe(context.Background(), r); c == "" {
+		t.Fatal("digest mismatch accepted")
+	}
+	p.digest = fmt.Sprintf("%x", sha256.Sum256([]byte("#!/bin/sh\nexit 0\n")))
+	if _, c = p.Observe(context.Background(), r); c != ErrUnsupported {
+		t.Fatal("script accepted", c)
+	}
+	if e = os.Chmod(path, 0777); e != nil {
+		t.Fatal(e)
+	}
+	if _, c = p.Observe(context.Background(), r); c != ErrDenied {
+		t.Fatal("writable binary accepted", c)
+	}
+}