@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/operation_linux.go

@@ -0,0 +1,480 @@
+package helper
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"reflect"
+	"slices"
+	"strconv"
+	"syscall"
+	"time"
+)
+
+type operationBootstrap struct {
+	Binding    operationBinding `json:"binding"`
+	Token      string           `json:"token"`
+	UID        uint32           `json:"uid"`
+	GID        uint32           `json:"gid"`
+	Groups     []uint32         `json:"groups"`
+	SubjectRef string           `json:"subjectRef,omitempty"`
+	SessionRef string           `json:"sessionRef,omitempty"`
+	Write      *writeWork       `json:"write,omitempty"`
+	ReadOnly   *readOnlyWork    `json:"readOnly,omitempty"`
+}
+type operationRelayOutcome struct {
+	err           error
+	mountSequence uint64
+}
+
+type operationLease struct {
+	Commit        bool   `json:"commit,omitempty"`
+	Token         string `json:"token"`
+	Sequence      uint64 `json:"sequence"`
+	Bytes         uint32 `json:"bytes"`
+	SubjectRef    string `json:"subjectRef,omitempty"`
+	SessionRef    string `json:"sessionRef,omitempty"`
+	ProofDeadline int64  `json:"proofDeadline,omitempty"`
+}
+type linuxOperation struct {
+	*ownedLinuxChild
+	control                    *net.UnixConn
+	data                       *os.File
+	output                     net.Conn
+	token                      string
+	sequence                   uint64
+	pending                    chan operationRelayOutcome
+	relayErr                   error
+	closed                     bool
+	result                     *readOnlyResult
+	resultPending              chan readOnlyPacketOutcome
+	readOnly                   bool
+	remaining                  uint64
+	finishSent                 bool
+	metadataReleased           bool
+	bootstrap                  operationBootstrap
+	work                       readOnlyWork
+	mountSequence              uint64
+	proofDeadline              time.Time
+	proofSubject, proofSession string
+	outputWatch                chan error
+	outputWatchDone            bool
+}
+
+func newLinuxOperationRelay(child *ownedLinuxChild, control *net.UnixConn, data *os.File, out net.Conn) *linuxOperation {
+	p := &linuxOperation{ownedLinuxChild: child, control: control, data: data, output: out, outputWatchDone: out == nil}
+	if out != nil {
+		p.outputWatch = make(chan error, 1)
+		done := p.outputWatch
+		// Binary output is one-way. EOF (or unexpected inbound data) cancels it
+		// even when the caller requests no next lease. Q also waits for this reader.
+		go func() {
+			var b [1]byte
+			_, err := out.Read(b[:])
+			if err == nil {
+				err = errTrust
+			}
+			done <- err
+		}()
+	}
+	return p
+}
+func (p *linuxOperation) beginRelay(n uint32) error { return p.beginRelayFinish(n, false) }
+func (p *linuxOperation) beginRelayFinish(n uint32, finish bool) error {
+	if p.closed || p.pending != nil || p.output == nil {
+		return errTrust
+	}
+	p.pending = make(chan operationRelayOutcome, 1)
+	done := p.pending
+	sequence := p.sequence + 1
+	mounts := p.mountSequence
+	deadline := p.proofDeadline
+	var info *os.File
+	if p.readOnly {
+		var err error
+		info, err = openOperationFDInfo(p.process.Pid)
+		if err != nil {
+			p.pending = nil
+			return err
+		}
+	}
+	go func() {
+		var err error
+		if p.readOnly {
+			outcome := receiveReadOnlyProof(p.control, info, p.bootstrap, p.work, p.process.Pid, mounts, sequence, n, time.Until(deadline))
+			mounts = outcome.mountSequence
+			err = outcome.err
+			if err == nil && outcome.result.Code != "" {
+				err = outcome.result.Code
+			}
+			if closeErr := info.Close(); err == nil {
+				err = closeErr
+			}
+		}
+		b := make([]byte, n)
+		if err == nil {
+			_, err = io.ReadFull(p.data, b)
+		}
+		if err == nil {
+			writeDeadline := time.Now().Add(ControlTimeout)
+			if p.readOnly && deadline.Before(writeDeadline) {
+				writeDeadline = deadline
+			}
+			err = p.output.SetWriteDeadline(writeDeadline)
+		}
+		for err == nil && len(b) > 0 {
+			var n int
+			n, err = p.output.Write(b)
+			if n == 0 && err == nil {
+				err = io.ErrNoProgress
+			}
+			b = b[n:]
+		}
+		if err == nil && finish {
+			err = writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
+		}
+		done <- operationRelayOutcome{err: err, mountSequence: mounts}
+	}()
+	return nil
+}
+func (p *linuxOperation) idle() (bool, error) {
+	if p.outputWatch != nil {
+		select {
+		case err := <-p.outputWatch:
+			p.outputWatch = nil
+			p.outputWatchDone = true
+			if !p.closed {
+				p.relayErr = err
+			}
+		default:
+		}
+	}
+
+	if p.resultPending != nil {
+		select {
+		case outcome := <-p.resultPending:
+			p.resultPending = nil
+			p.result = outcome.result
+			p.mountSequence = outcome.mountSequence
+			if p.relayErr == nil {
+				p.relayErr = outcome.err
+			}
+			if p.result != nil {
+				p.remaining = p.result.Bytes
+			}
+		default:
+			return false, nil
+		}
+	}
+
+	if p.pending != nil {
+		select {
+		case outcome := <-p.pending:
+			p.pending = nil
+			if p.relayErr == nil {
+				p.relayErr = outcome.err
+			}
+			if p.readOnly {
+				p.mountSequence = outcome.mountSequence
+			}
+		default:
+			return false, nil
+		}
+	}
+	return true, p.relayErr
+}
+func (p *linuxOperation) chunk(n uint32) error {
+	idle, err := p.idle()
+	if err != nil {
+		return err
+	}
+	if !idle || p.closed || n == 0 || n > MaxChunkBytes || p.readOnly && (p.result == nil || !p.metadataReleased || p.result.Code != "" || uint64(n) > p.remaining) {
+		return errTrust
+	}
+	finish := p.readOnly && uint64(n) == p.remaining
+	if err := p.beginRelayFinish(n, finish); err != nil {
+		return err
+	}
+	if p.readOnly {
+		p.remaining -= uint64(n)
+		if finish {
+			p.finishSent = true
+		}
+	}
+	p.sequence++
+	return writeOperationPacket(p.control, operationLease{Token: p.token, Sequence: p.sequence, Bytes: n, ProofDeadline: p.proofDeadline.UnixNano(), SubjectRef: p.proofSubject, SessionRef: p.proofSession})
+}
+func (p *linuxOperation) stopRelay() {
+	if p.closed {
+		return
+	}
+	p.closed = true
+	if p.output != nil {
+		p.output.Close()
+	}
+	if p.control != nil {
+		p.control.Close()
+	}
+	if p.data != nil {
+		p.data.Close()
+	}
+}
+func (p *linuxOperation) relayStopped() bool {
+	idle, _ := p.idle()
+	return p.closed && idle && (p.output == nil || p.outputWatchDone)
+}
+func writeOperationPacket(conn *net.UnixConn, v any) error {
+	return writeOperationPacketBound(conn, v, MaxHealthBytes)
+}
+func writeOperationPacketBound(conn *net.UnixConn, v any, limit int) error {
+	if err := conn.SetWriteDeadline(time.Now().Add(300 * time.Millisecond)); err != nil {
+		return err
+	}
+	b, err := json.Marshal(v)
+	if err != nil || len(b) > limit {
+		return errTrust
+	}
+	n, err := conn.Write(b)
+	if err == nil && n != len(b) {
+		return io.ErrShortWrite
+	}
+	return err
+}
+func readOperationPacket(conn *net.UnixConn, v any) (*syscall.Ucred, error) {
+	return readOperationPacketBound(conn, v, MaxHealthBytes, 300*time.Millisecond)
+}
+func readOperationPacketBound(conn *net.UnixConn, v any, limit int, timeout time.Duration) (*syscall.Ucred, error) {
+	if err := conn.SetReadDeadline(time.Now().Add(timeout)); err != nil {
+		return nil, err
+	}
+	b := make([]byte, limit+1)
+	oob := make([]byte, syscall.CmsgSpace(syscall.SizeofUcred))
+	n, on, flags, _, err := conn.ReadMsgUnix(b, oob)
+	if err != nil || n > limit || flags&(syscall.MSG_TRUNC|syscall.MSG_CTRUNC) != 0 {
+		return nil, errTrust
+	}
+	decoder := json.NewDecoder(bytes.NewReader(b[:n]))
+	decoder.DisallowUnknownFields()
+	if decoder.Decode(v) != nil || decoder.Decode(new(any)) != io.EOF {
+		return nil, errTrust
+	}
+	messages, err := syscall.ParseSocketControlMessage(oob[:on])
+	if err != nil {
+		return nil, err
+	}
+	var cred *syscall.Ucred
+	for _, m := range messages {
+		if m.Header.Level == syscall.SOL_SOCKET && m.Header.Type == syscall.SCM_CREDENTIALS {
+			if cred != nil {
+				return nil, errTrust
+			}
+			cred, err = syscall.ParseUnixCredentials(&m)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	return cred, nil
+}
+func operationSocket(f *os.File) (*net.UnixConn, error) {
+	c, err := net.FileConn(f)
+	if err != nil {
+		return nil, err
+	}
+	u, ok := c.(*net.UnixConn)
+	if !ok {
+		c.Close()
+		return nil, errTrust
+	}
+	return u, nil
+}
+func enableCredentials(c *net.UnixConn) error {
+	raw, err := c.SyscallConn()
+	if err != nil {
+		return err
+	}
+	var setErr error
+	if err := raw.Control(func(fd uintptr) { setErr = syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_PASSCRED, 1) }); err != nil {
+		return err
+	}
+	return setErr
+}
+
+// Caller is the locked supervisor OS thread. Its own approved root-only payload
+// execs BEFORE dropping credentials; no package executable or arbitrary args.
+// On any post-Start failure return the owned child too, so Q cannot be fabricated.
+func startLinuxOperation(c Client, binary string, a NativeActor, b operationBinding, out net.Conn) (operationProcess, error) {
+	return startLinuxOperationWork(c, binary, a, b, out, nil, nil, nil)
+}
+
+// Invoked only by S3's factory after WithGrantAdmission has reserved fixed work.
+// The reservation and grant checks are S3-owned; there is no second authority.
+func startLinuxReadOnlyOperation(c Client, binary string, a NativeActor, b operationBinding, pin *pinnedReadOnlyRoot, w readOnlyWork, out net.Conn) (operationProcess, error) {
+	if code := w.validate(); code != "" {
+		return nil, code
+	}
+	if pin == nil || pin.file == nil || pin.path != w.RootPath {
+		return nil, ErrSuspended
+	}
+	w.Segments = append([]string{}, w.Segments...)
+	return startLinuxOperationWork(c, binary, a, b, out, pin, &w, nil)
+}
+func (p *linuxOperation) readOnlyMetadata() (*readOnlyResult, bool, error) {
+	_, err := p.idle()
+	if err != nil {
+		return nil, false, err
+	}
+	return p.result, p.readOnly && p.result != nil, nil
+}
+func (p *linuxOperation) releaseReadOnlyMetadata() error {
+	if p.closed || !p.readOnly || p.result == nil {
+		return errTrust
+	}
+	p.metadataReleased = true
+	if p.remaining == 0 && !p.finishSent {
+		p.finishSent = true
+		return writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
+	}
+	return nil
+}
+func (p *linuxOperation) readOnlyLeaseReady(n uint32) Code {
+	_, err := p.idle()
+	if err != nil {
+		return ErrCleanupRequired
+	}
+	if p.closed {
+		return ErrCanceled
+	}
+	if !p.metadataReleased || p.result == nil {
+		return ErrBusy
+	}
+	if p.result.Code != "" || n == 0 || uint64(n) > p.remaining {
+		return ErrLimit
+	}
+	return ""
+}
+func startLinuxOperationWork(c Client, binary string, a NativeActor, b operationBinding, out net.Conn, pin *pinnedReadOnlyRoot, work *readOnlyWork, write *writeWork) (operationProcess, error) {
+	if binary != "/var/lib/synopkgland-"+c.Expected.Package+"/payload-"+c.Expected.PayloadDigest || !a.valid || a.UID() == 0 || a.GID() == 0 || a.account.Groups == nil || processLifetime == nil {
+		return nil, errTrust
+	}
+	actual, err := inspectSupervisor(os.Getpid(), c.Expected)
+	if err != nil || actual.Inventory != b.Inventory {
+		return nil, errTrust
+	}
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	parent := os.NewFile(uintptr(pair[0]), "operation-parent")
+	child := os.NewFile(uintptr(pair[1]), "operation-child")
+	defer parent.Close()
+	defer child.Close()
+	control, err := operationSocket(parent)
+	if err != nil {
+		return nil, err
+	}
+	if err := enableCredentials(control); err != nil {
+		control.Close()
+		return nil, err
+	}
+	r, w, err := os.Pipe()
+	if err != nil {
+		control.Close()
+		return nil, err
+	}
+	parentData, childData := r, w
+	if write != nil {
+		parentData, childData = w, r
+	}
+	defer childData.Close()
+	token := make([]byte, 32)
+	if _, err := rand.Read(token); err != nil {
+		control.Close()
+		parentData.Close()
+		return nil, err
+	}
+	boot := operationBootstrap{Binding: b, Token: hex.EncodeToString(token), UID: a.UID(), GID: a.GID(), Groups: a.Groups(), ReadOnly: work, Write: write, SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef()}
+	cmd := exec.Command(binary, "operation-child")
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
+	cmd.ExtraFiles = []*os.File{processLifetime, child, childData}
+	if work != nil || write != nil {
+		cmd.ExtraFiles = append(cmd.ExtraFiles, pin.file)
+	}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
+	if err := cmd.Start(); err != nil {
+		control.Close()
+		parentData.Close()
+		return nil, err
+	}
+	relayOutput := out
+	if write != nil {
+		relayOutput = nil
+	}
+	p := newLinuxOperationRelay(&ownedLinuxChild{process: cmd.Process}, control, parentData, relayOutput)
+	if write != nil {
+		p.output = out
+	}
+	p.token = boot.Token
+	p.bootstrap = boot
+	if work != nil {
+		p.work = *work
+	}
+	packetLimit := MaxHealthBytes
+	if work != nil || write != nil {
+		packetLimit = MaxControlBytes
+	}
+	if err := writeOperationPacketBound(control, boot, packetLimit); err != nil {
+		return p, err
+	}
+	var ready operationBootstrap
+	cred, err := readOperationPacketBound(control, &ready, packetLimit, 300*time.Millisecond)
+	if err != nil || cred == nil || int(cred.Pid) != cmd.Process.Pid || cred.Uid != boot.UID || cred.Gid != boot.GID || ready.Binding != b || ready.Token != boot.Token || ready.SubjectRef != boot.SubjectRef || ready.SessionRef != boot.SessionRef || ready.UID != boot.UID || ready.GID != boot.GID || !slices.Equal(ready.Groups, boot.Groups) || !reflect.DeepEqual(ready.ReadOnly, work) || !reflect.DeepEqual(ready.Write, write) {
+		return p, errTrust
+	}
+	if write != nil {
+		info, e := openOperationFDInfo(cmd.Process.Pid)
+		if e != nil {
+			return p, e
+		}
+		p.resultPending = make(chan readOnlyPacketOutcome, 1)
+		done := p.resultPending
+		go runReadOnlyResultReceiver(done, func() readOnlyPacketOutcome {
+			outcome := receiveWriteProof(control, info, boot, *write, cmd.Process.Pid, 0, 0, BoundedTimeout)
+			if outcome.err == nil && (outcome.result.Mutation.BytesWritten != 0 || outcome.result.Mutation.Published || outcome.result.Mutation.Committed) {
+				outcome.err = errTrust
+			}
+			return outcome
+		}, info.Close)
+		return &linuxWriteOperation{linuxOperation: p, writeWork: *write}, nil
+	}
+	if work != nil {
+		fdinfo, err := openOperationFDInfo(cmd.Process.Pid)
+		if err != nil {
+			return p, err
+		}
+		p.readOnly = true
+		p.resultPending = make(chan readOnlyPacketOutcome, 1)
+		done := p.resultPending
+		go runReadOnlyResultReceiver(done, func() readOnlyPacketOutcome {
+			return receiveReadOnlyResult(control, fdinfo, boot, *work, cmd.Process.Pid)
+		}, fdinfo.Close)
+	}
+	return p, nil
+}
+
+// Bound each child ACL/read and relay to the freshly admitted subject proof.
+// Only the sole supervisor owner calls this after S3 chunk reservation.
+func (p *linuxOperation) chunkWithActor(n uint32, a NativeActor) error {
+	if !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) {
+		return ErrStale
+	}
+	p.proofDeadline = a.account.CheckedAt.Add(NativeProofFreshness)
+	p.proofSubject = a.Principal().SubjectRef
+	p.proofSession = a.SessionRef()
+	return p.chunk(n)
+}