@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/readonly_mount_proxy_linux.go

@@ -0,0 +1,113 @@
+package helper
+
+import (
+	"golang.org/x/sys/unix"
+	"net"
+	"os"
+	"strconv"
+	"time"
+)
+
+const maxReadOnlyMountQueries = (MaxTransferBytes/MaxChunkBytes + 1) * (8*MaxPathSegments + 32)
+
+// Linux 4.4's non-dumpable actor may not read its own fdinfo. Keep it
+// non-dumpable: ask ONLY the exact root parent over the existing private socket.
+// The parent reads kernel mount metadata, never business data or ACL decisions.
+func operationMountIDProxy(control *net.UnixConn, boot operationBootstrap) func(int) (uint64, Code) {
+	var sequence uint64
+	return func(fd int) (uint64, Code) {
+		if fd < 0 || fd > 1<<20 || sequence >= maxReadOnlyMountQueries {
+			return 0, ErrLimit
+		}
+		sequence++
+		number := uint32(fd)
+		packet := readOnlyPacket{Binding: boot.Binding, Token: boot.Token, MountFD: &number, MountSequence: sequence}
+		if writeOperationPacketBound(control, packet, MaxControlBytes) != nil {
+			return 0, ErrUnavailable
+		}
+		var reply readOnlyMountReply
+		if _, err := readOperationPacketBound(control, &reply, MaxHealthBytes, ControlTimeout); err != nil || reply.Token != boot.Token || reply.Sequence != sequence {
+			return 0, ErrUnavailable
+		}
+		if reply.Code != "" {
+			if reply.Code.Valid() {
+				return 0, reply.Code
+			}
+			return 0, ErrUnavailable
+		}
+		if reply.Mount == 0 {
+			return 0, ErrUnsupported
+		}
+		return reply.Mount, ""
+	}
+}
+func openOperationFDInfo(pid int) (*os.File, error) {
+	fd, err := unix.Open("/proc/"+strconv.Itoa(pid)+"/fdinfo", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	return os.NewFile(uintptr(fd), "owned-operation-fdinfo"), nil
+}
+func operationFDInfoMount(info *os.File, number uint32) (uint64, Code) {
+	if number > 1<<20 {
+		return 0, ErrInvalid
+	}
+	// Pinned proc directory belongs to this child instance; after reap, numeric PID
+	// reuse cannot redirect this openat to another process's fdinfo directory.
+	fd, err := unix.Openat(int(info.Fd()), strconv.FormatUint(uint64(number), 10), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return 0, ErrUnsupported
+	}
+	f := os.NewFile(uintptr(fd), "owned-operation-mount")
+	defer f.Close()
+	return parseReadOnlyMountID(f)
+}
+func receiveReadOnlyResult(control *net.UnixConn, info *os.File, boot operationBootstrap, w readOnlyWork, pid int) readOnlyPacketOutcome {
+	return receiveReadOnlyProof(control, info, boot, w, pid, 0, 0, 0, BoundedTimeout)
+}
+
+func receiveReadOnlyProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w readOnlyWork, pid int, sequence, chunkSequence uint64, chunkBytes uint32, timeout time.Duration) readOnlyPacketOutcome {
+	deadline := time.Now().Add(timeout)
+	for {
+		var packet readOnlyPacket
+		remaining := time.Until(deadline)
+		if remaining <= 0 {
+			return readOnlyPacketOutcome{err: ErrTimeout}
+		}
+		cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, remaining)
+		if err != nil {
+			return readOnlyPacketOutcome{err: err}
+		}
+		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		if packet.Result != nil {
+			valid := packet.Result.validFor(w)
+			if chunkSequence > 0 {
+				valid = packet.Result.Entry == nil && packet.Result.List == nil && ((packet.Result.Code == "" && packet.Result.Bytes == uint64(chunkBytes)) || (packet.Result.Code.Valid() && packet.Result.Bytes == 0))
+			}
+			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != chunkSequence || !valid {
+				return readOnlyPacketOutcome{err: errTrust}
+			}
+			return readOnlyPacketOutcome{result: packet.Result, mountSequence: sequence}
+		}
+		if packet.ChunkSequence != 0 || packet.MountFD == nil || sequence >= maxReadOnlyMountQueries || packet.MountSequence != sequence+1 {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		sequence++
+		id, code := operationFDInfoMount(info, *packet.MountFD)
+		if err := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
+			return readOnlyPacketOutcome{err: err}
+		}
+	}
+}
+
+func runReadOnlyResultReceiver(done chan<- readOnlyPacketOutcome, receive func() readOnlyPacketOutcome, closeInfo func() error) {
+	// Publish the observation only AFTER closing the proc witness. A buffered
+	// send followed by deferred Close would let the owner certify Q too early.
+	outcome := receive()
+	if err := closeInfo(); err != nil && outcome.err == nil {
+		outcome.err = err
+	}
+	done <- outcome
+}

package/templates/native-go/backend/internal/helper/readonly_operations_linux.go

@@ -0,0 +1,168 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"golang.org/x/sys/unix"
+	"io"
+	"path"
+)
+
+func authorizeReadOnly(ctx context.Context, o *readOnlyObject, w readOnlyWork, acl readOnlyACL) Code {
+	if code := nativeContextCode(ctx); code != "" {
+		return code
+	}
+	if acl == nil {
+		return ErrUnsupported
+	}
+	for _, fd := range []int{int(o.nodes[o.root].file.Fd()), int(o.data.Fd())} {
+		if code := nativeObservationCode(ctx, acl.Authorize(ctx, w.Action, fd)); code != "" {
+			return code
+		}
+	}
+	return o.check()
+}
+func readOnlyUnchanged(fd int, before unix.Stat_t) Code {
+	var after unix.Stat_t
+	if code := readOnlyInspect(fd, &after); code != "" {
+		return code
+	}
+	if !sameReadOnlyObject(before, after) || before.Size != after.Size || before.Mtim != after.Mtim || before.Ctim != after.Ctim {
+		return ErrStale
+	}
+	return ""
+}
+func readOnlyEntry(name string, st unix.Stat_t) (Entry, Code) {
+	var id [32]byte
+	if _, err := rand.Read(id[:]); err != nil {
+		return Entry{}, ErrUnavailable
+	}
+	kind := "regular"
+	size := uint64(st.Size)
+	if st.Mode&unix.S_IFMT == unix.S_IFDIR {
+		kind = "directory"
+		size = 0
+	}
+	return Entry{EntryID: hex.EncodeToString(id[:]), Name: name, Kind: kind, Bytes: size}, ""
+}
+func executeReadOnly(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, acl readOnlyACL) (readOnlyResult, []byte) {
+	fail := func(c Code) (readOnlyResult, []byte) { return readOnlyResult{Code: c}, nil }
+	if c := nativeContextCode(ctx); c != "" {
+		return fail(c)
+	}
+	if c := w.validate(); c != "" {
+		return fail(c)
+	}
+	if acl == nil || w.Action == ActionReadStream {
+		return fail(ErrUnsupported)
+	}
+	timeout := MetadataTimeout
+	if w.Action == ActionRead {
+		timeout = BoundedTimeout
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	o, c := resolveReadOnly(ctx, pin, w)
+	if c != "" {
+		return fail(c)
+	}
+	defer o.Close()
+	if c = authorizeReadOnly(ctx, o, w, acl); c != "" {
+		return fail(c)
+	}
+	result := readOnlyResult{}
+	var data []byte
+	switch w.Action {
+	case ActionRead:
+		if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
+			return fail(ErrDenied)
+		}
+		if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
+			return fail(ErrLimit)
+		}
+		var err error
+		data, err = io.ReadAll(io.LimitReader(o.data, int64(w.MaxBytes)+1))
+		if err != nil {
+			return fail(readOnlyError(err))
+		}
+		if uint64(len(data)) > w.MaxBytes {
+			return fail(ErrLimit)
+		}
+		result.Bytes = uint64(len(data))
+	case ActionStat:
+		e, c := readOnlyEntry(path.Base(w.RootPath), o.before)
+		if len(w.Segments) > 0 {
+			e.Name = w.Segments[len(w.Segments)-1]
+		}
+		if c != "" {
+			return fail(c)
+		}
+		result.Entry = &e
+	case ActionList:
+		if o.before.Mode&unix.S_IFMT != unix.S_IFDIR {
+			return fail(ErrDenied)
+		}
+		// No unbound cursor or unbounded sort/scan. Oversized/changed directories
+		// refuse without metadata; pagination is a separate server-bound extension.
+		names, err := o.data.Readdirnames(MaxPageEntries + 1)
+		if err != nil && err != io.EOF {
+			return fail(readOnlyError(err))
+		}
+		if len(names) > MaxPageEntries {
+			return fail(ErrLimit)
+		}
+		entries := []Entry{}
+		for _, name := range names {
+			if c := nativeContextCode(ctx); c != "" {
+				return fail(c)
+			}
+			child := w
+			child.Action = ActionStat
+			child.Limit = 0
+			child.Segments = append(append([]string{}, w.Segments...), name)
+			if child.validate() != "" {
+				continue
+			}
+			object, code := resolveReadOnly(ctx, pin, child)
+			if code == ErrDenied {
+				continue
+			}
+			if code != "" {
+				return fail(code)
+			}
+			code = authorizeReadOnly(ctx, object, w, acl)
+			if code == "" {
+				var entry Entry
+				entry, code = readOnlyEntry(name, object.before)
+				if code == "" {
+					entries = append(entries, entry)
+				}
+			}
+			object.Close()
+			if code == ErrDenied {
+				continue
+			}
+			if code != "" {
+				return fail(code)
+			}
+			if len(entries) > int(w.Limit) {
+				return fail(ErrLimit)
+			}
+		}
+		result.List = &ListResult{Entries: entries}
+	}
+	if c := authorizeReadOnly(ctx, o, w, acl); c != "" {
+		return fail(c)
+	}
+	if c := readOnlyUnchanged(int(o.data.Fd()), o.before); c != "" {
+		return fail(c)
+	}
+	// Metadata travels only over the private seqpacket, bulk read bytes never JSON.
+	b, err := json.Marshal(result)
+	if err != nil || len(b) > MaxControlBytes-2048 {
+		return fail(ErrLimit)
+	}
+	return result, data
+}

package/templates/native-go/backend/internal/helper/readonly_resolver_linux.go

@@ -0,0 +1,241 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"golang.org/x/sys/unix"
+	"os"
+	"strings"
+)
+
+type pinnedReadOnlyRoot struct {
+	path string
+	file *os.File
+}
+
+func (r *pinnedReadOnlyRoot) readOnlyRootPath() string                        { return r.path }
+func (r *pinnedReadOnlyRoot) sameReadOnlyRoot(other readOnlyRootWitness) bool { return r == other }
+
+func (r *pinnedReadOnlyRoot) Close() error { return r.file.Close() }
+
+type readOnlyNode struct {
+	file  *os.File
+	name  string
+	stat  unix.Stat_t
+	mount uint64
+}
+type readOnlyObject struct {
+	nodes  []readOnlyNode
+	root   int
+	data   *os.File
+	before unix.Stat_t
+}
+
+func (o *readOnlyObject) Close() {
+	if o.data != nil {
+		o.data.Close()
+	}
+	for _, n := range o.nodes {
+		n.file.Close()
+	}
+}
+func readOnlyError(err error) Code {
+	if errors.Is(err, unix.EACCES) || errors.Is(err, unix.EPERM) {
+		return ErrDenied
+	}
+	if errors.Is(err, unix.ENOENT) || errors.Is(err, unix.ENOTDIR) || errors.Is(err, unix.ELOOP) {
+		return ErrStale
+	}
+	return ErrUnavailable
+}
+func readOnlyNodeAt(parent int, name string) (readOnlyNode, Code) {
+	fd, err := unix.Openat(parent, name, unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return readOnlyNode{}, readOnlyError(err)
+	}
+	n := readOnlyNode{file: os.NewFile(uintptr(fd), "readonly-object"), name: name}
+	code := readOnlyInspect(fd, &n.stat)
+	if code == "" {
+		n.mount, code = readOnlyMountID(fd)
+	}
+	if code != "" {
+		n.file.Close()
+		return readOnlyNode{}, code
+	}
+	// O_PATH alone does not require search permission. Resolve '.' under actor
+	// credentials to require execute/search on every directory, including root.
+	if n.stat.Mode&unix.S_IFMT == unix.S_IFDIR {
+		probe, err := unix.Openat(fd, ".", unix.O_PATH|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		if err != nil {
+			n.file.Close()
+			return readOnlyNode{}, readOnlyError(err)
+		}
+		unix.Close(probe)
+	}
+	return n, ""
+}
+func readOnlyInspect(fd int, st *unix.Stat_t) Code {
+	if err := unix.Fstat(fd, st); err != nil {
+		return readOnlyError(err)
+	}
+	switch st.Mode & unix.S_IFMT {
+	case unix.S_IFDIR:
+		return ""
+	case unix.S_IFREG:
+		if st.Nlink != 1 {
+			return ErrDenied
+		}
+		return ""
+	}
+	return ErrDenied // never open a FIFO, device, socket or symlink for data
+}
+func sameReadOnlyObject(a, b unix.Stat_t) bool {
+	return a.Dev == b.Dev && a.Ino == b.Ino && a.Mode&unix.S_IFMT == b.Mode&unix.S_IFMT
+}
+func (o *readOnlyObject) check() Code {
+	for i, n := range o.nodes {
+		var st unix.Stat_t
+		if code := readOnlyInspect(int(n.file.Fd()), &st); code != "" {
+			return code
+		}
+		if !sameReadOnlyObject(st, n.stat) {
+			return ErrStale
+		}
+		if i == 0 {
+			continue
+		}
+		current, code := readOnlyNodeAt(int(o.nodes[i-1].file.Fd()), n.name)
+		if code != "" {
+			return code
+		}
+		match := sameReadOnlyObject(current.stat, n.stat) && current.mount == n.mount
+		current.file.Close()
+		if !match {
+			return ErrStale
+		}
+	}
+	var current unix.Stat_t
+	if code := readOnlyInspect(int(o.data.Fd()), &current); code != "" {
+		return code
+	}
+	target := o.nodes[len(o.nodes)-1]
+	if !sameReadOnlyObject(current, target.stat) {
+		return ErrStale
+	}
+	return ""
+}
+
+// A pin is an O_PATH continuity witness, NOT a root-opened data/ACL capability.
+// It remains live for one approved epoch only; never reconstruct it from inode.
+func pinReadOnlyRoot(path string) (*pinnedReadOnlyRoot, Code) {
+	w := readOnlyWork{RootPath: path, Action: ActionStat, Segments: []string{}}
+	if code := w.validate(); code != "" {
+		return nil, code
+	}
+	slash, code := readOnlyNodeAt(unix.AT_FDCWD, "/")
+	if code != "" {
+		return nil, code
+	}
+	current := slash
+	for _, segment := range strings.Split(path[1:], "/") {
+		next, c := readOnlyNodeAt(int(current.file.Fd()), segment)
+		current.file.Close()
+		if c != "" {
+			return nil, c
+		}
+		current = next
+		if current.stat.Mode&unix.S_IFMT != unix.S_IFDIR {
+			current.file.Close()
+			return nil, ErrDenied
+		}
+	}
+	if code := readOnlyLocalMount(int(current.file.Fd())); code != "" {
+		current.file.Close()
+		return nil, code
+	}
+	return &pinnedReadOnlyRoot{path: path, file: current.file}, ""
+}
+
+// Always uses the 4.4-compatible walk; openat2 is not a dependency. All ancestry
+// FDs stay pinned. No realpath, Clean, pathname ACL-then-open or proc data alias.
+func resolveReadOnly(ctx context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork) (*readOnlyObject, Code) {
+	if code := nativeContextCode(ctx); code != "" {
+		return nil, code
+	}
+	if pin == nil || pin.file == nil || pin.path != w.RootPath {
+		return nil, ErrSuspended
+	}
+	flags, err := unix.FcntlInt(pin.file.Fd(), unix.F_GETFL, 0)
+	if err != nil || flags&unix.O_PATH == 0 {
+		return nil, ErrDenied
+	}
+	var expected unix.Stat_t
+	if unix.Fstat(int(pin.file.Fd()), &expected) != nil || expected.Mode&unix.S_IFMT != unix.S_IFDIR {
+		return nil, ErrSuspended
+	}
+	mount, code := readOnlyMountID(int(pin.file.Fd()))
+	if code != "" {
+		return nil, code
+	}
+	o := &readOnlyObject{}
+	ok := false
+	defer func() {
+		if !ok {
+			o.Close()
+		}
+	}()
+	slash, code := readOnlyNodeAt(unix.AT_FDCWD, "/")
+	if code != "" {
+		return nil, code
+	}
+	o.nodes = append(o.nodes, slash)
+	parts := strings.Split(w.RootPath[1:], "/")
+	o.root = len(parts)
+	parts = append(parts, w.Segments...)
+	for i, segment := range parts {
+		if code := nativeContextCode(ctx); code != "" {
+			return nil, code
+		}
+		parent := o.nodes[len(o.nodes)-1]
+		if parent.stat.Mode&unix.S_IFMT != unix.S_IFDIR {
+			return nil, ErrDenied
+		}
+		next, code := readOnlyNodeAt(int(parent.file.Fd()), segment)
+		if code != "" {
+			return nil, code
+		}
+		o.nodes = append(o.nodes, next)
+		if i+1 >= o.root && (next.mount != mount || next.stat.Dev != expected.Dev) {
+			return nil, ErrSuspended
+		}
+		if i+1 == o.root && !sameReadOnlyObject(next.stat, expected) {
+			return nil, ErrSuspended
+		}
+	}
+	if code := readOnlyLocalMount(int(o.nodes[o.root].file.Fd())); code != "" {
+		return nil, code
+	}
+	target := o.nodes[len(o.nodes)-1]
+	parent := o.nodes[len(o.nodes)-2]
+	// Type-probe precedes nonblocking data open; compare both captured objects.
+	fd, err := unix.Openat(int(parent.file.Fd()), target.name, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, readOnlyError(err)
+	}
+	o.data = os.NewFile(uintptr(fd), "readonly-data")
+	if code := readOnlyInspect(fd, &o.before); code != "" {
+		return nil, code
+	}
+	m, code := readOnlyMountID(fd)
+	if code != "" {
+		return nil, code
+	}
+	if !sameReadOnlyObject(o.before, target.stat) || m != mount {
+		return nil, ErrStale
+	}
+	if code := o.check(); code != "" {
+		return nil, code
+	}
+	ok = true
+	return o, ""
+}

package/templates/native-go/backend/internal/helper/readonly_test.go

@@ -0,0 +1,40 @@
+package helper
+
+import "testing"
+
+func TestReadOnlyWorkClosedActionsAndBounds(t *testing.T) {
+	for _, action := range []Action{ActionStat, ActionList, ActionRead} {
+		w := readOnlyWork{RootPath: "/fixture", Action: action, Segments: []string{"file"}}
+		if action == ActionList {
+			w.Limit = 10
+		}
+		if action == ActionRead {
+			w.MaxBytes = MaxBoundedBytes
+		}
+		if c := w.validate(); c != "" {
+			t.Fatal(action, c)
+		}
+		for _, name := range []string{"path", "traverse", "symlink-name", "limit", "action", "extra"} {
+			t.Run(string(action)+name, func(t *testing.T) {
+				bad := w
+				switch name {
+				case "path":
+					bad.RootPath = "relative"
+				case "traverse":
+					bad.Segments = []string{".."}
+				case "symlink-name":
+					bad.Segments = []string{"a/b"}
+				case "limit":
+					bad.MaxBytes = MaxBoundedBytes + 1
+				case "action":
+					bad.Action = ActionCreate
+				case "extra":
+					bad.Limit = MaxPageEntries + 1
+				}
+				if bad.validate() == "" {
+					t.Fatal("invalid work accepted")
+				}
+			})
+		}
+	}
+}