@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_job_process_linux.go

@@ -0,0 +1,327 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"crypto/rand"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net"
+	"os"
+	"os/exec"
+	"reflect"
+	"strconv"
+	"syscall"
+	"time"
+)
+
+type sdkJobBootstrap struct {
+	Actor    operationBootstrap `json:"actor"`
+	Request  sdkJobRequest      `json:"request"`
+	Worker   jobcontract.Worker `json:"worker"`
+	RootPath string             `json:"rootPath"`
+}
+type sdkJobWire struct {
+	Binding  jobcontract.Binding `json:"binding"`
+	Token    string              `json:"token"`
+	Sequence uint64              `json:"sequence"`
+	Event    *sdkJobEvent        `json:"event,omitempty"`
+	Reply    *sdkJobReply        `json:"reply,omitempty"`
+	MountFD  *uint32             `json:"mountFd,omitempty"`
+	Mount    uint64              `json:"mount,omitempty"`
+}
+
+// Both sides are fixed SDK implementations and emit canonical JSON. Exact
+// re-encoding rejects duplicate/unknown/case aliases/null/invalid UTF-8 and
+// omitted required zero values; no permissive JSON decoder is a trust boundary.
+func readSDKJobPacket(c *net.UnixConn, dst any, timeout time.Duration) (*syscall.Ucred, error) {
+	if timeout <= 0 {
+		return nil, ErrTimeout
+	}
+	if err := c.SetReadDeadline(time.Now().Add(timeout)); err != nil {
+		return nil, err
+	}
+	raw := make([]byte, jobcontract.MaxControlBytes+1)
+	oob := make([]byte, syscall.CmsgSpace(syscall.SizeofUcred)+syscall.CmsgSpace(32*4))
+	n, on, flags, _, err := c.ReadMsgUnix(raw, oob)
+	if err != nil {
+		return nil, err
+	}
+	messages, e := syscall.ParseSocketControlMessage(oob[:on])
+	if e != nil {
+		return nil, errTrust
+	}
+	var cred *syscall.Ucred
+	bad := flags&(syscall.MSG_TRUNC|syscall.MSG_CTRUNC) != 0 || n > jobcontract.MaxControlBytes
+	for _, m := range messages {
+		if m.Header.Level == syscall.SOL_SOCKET && m.Header.Type == syscall.SCM_RIGHTS {
+			fds, _ := syscall.ParseUnixRights(&m)
+			for _, fd := range fds {
+				syscall.Close(fd)
+			}
+			bad = true
+		} else if m.Header.Level == syscall.SOL_SOCKET && m.Header.Type == syscall.SCM_CREDENTIALS {
+			if cred != nil {
+				bad = true
+			}
+			cred, e = syscall.ParseUnixCredentials(&m)
+			if e != nil {
+				bad = true
+			}
+		} else {
+			bad = true
+		}
+	}
+	if bad || json.Unmarshal(raw[:n], dst) != nil {
+		return nil, errTrust
+	}
+	canonical, e := json.Marshal(dst)
+	if e != nil || !bytes.Equal(raw[:n], canonical) {
+		return nil, errTrust
+	}
+	return cred, nil
+}
+func sdkJobPeer(cred *syscall.Ucred, pid int, uid, gid uint32) bool {
+	return cred != nil && int(cred.Pid) == pid && cred.Uid == uid && cred.Gid == gid
+}
+func sdkJobWireBound(p sdkJobWire, b sdkJobBootstrap, seq uint64) bool {
+	return p.Token == b.Actor.Token && p.Sequence == seq && jobcontract.CompareBinding(p.Binding, b.Request.Control.Binding) == ""
+}
+
+type linuxSDKJob struct {
+	child                         *ownedLinuxChild
+	control                       *net.UnixConn
+	events                        chan sdkJobEvent
+	replies                       chan sdkJobReply
+	stop                          chan struct{}
+	done                          chan error
+	closed, receiverDone, success bool
+	err                           error
+}
+
+func (p *linuxSDKJob) next() (sdkJobEvent, bool) {
+	select {
+	case e := <-p.events:
+		return e, true
+	default:
+		return sdkJobEvent{}, false
+	}
+}
+func (p *linuxSDKJob) reply(r sdkJobReply) error {
+	if p.closed {
+		return errTrust
+	}
+	select {
+	case p.replies <- r:
+		return nil
+	default:
+		return ErrBusy
+	}
+}
+func (p *linuxSDKJob) chunk(uint32) error { return ErrDenied } // cannot become an M2 data lease
+func (p *linuxSDKJob) idle() (bool, error) {
+	if !p.receiverDone {
+		select {
+		case err := <-p.done:
+			p.receiverDone = true
+			if !p.closed {
+				p.err = err
+			}
+		default:
+		}
+	}
+	return true, p.err
+}
+func (p *linuxSDKJob) stopRelay() {
+	if !p.closed {
+		p.closed = true
+		close(p.stop)
+		p.control.Close()
+	}
+}
+func (p *linuxSDKJob) relayStopped() bool            { p.idle(); return p.closed && p.receiverDone }
+func (p *linuxSDKJob) exitSuccess() bool             { return p.child.reaped && p.success }
+func (p *linuxSDKJob) signal(s syscall.Signal) error { return p.child.signal(s) }
+func (p *linuxSDKJob) exited() (bool, error) {
+	if p.child.reaped {
+		return true, nil
+	}
+	var status syscall.WaitStatus
+	pid, err := syscall.Wait4(p.child.process.Pid, &status, syscall.WNOHANG, nil)
+	if errors.Is(err, syscall.EINTR) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	if pid == p.child.process.Pid {
+		p.child.reaped = true
+		p.success = status.Exited() && status.ExitStatus() == 0
+		p.child.process.Release()
+	}
+	return p.child.reaped, nil
+}
+
+func (p *linuxSDKJob) publish(e sdkJobEvent, deadline time.Time) (sdkJobReply, error) {
+	timer := time.NewTimer(time.Until(deadline))
+	defer timer.Stop()
+	select {
+	case p.events <- e:
+	case <-p.stop:
+		return sdkJobReply{}, ErrCanceled
+	case <-timer.C:
+		return sdkJobReply{}, ErrTimeout
+	}
+	select {
+	case r := <-p.replies:
+		return r, nil
+	case <-p.stop:
+		return sdkJobReply{}, ErrCanceled
+	case <-timer.C:
+		return sdkJobReply{}, ErrTimeout
+	}
+}
+func (p *linuxSDKJob) receive(boot sdkJobBootstrap) error {
+	if err := writeOperationPacketBound(p.control, boot, MaxControlBytes); err != nil {
+		return err
+	}
+	var ready sdkJobBootstrap
+	cred, err := readSDKJobPacket(p.control, &ready, 300*time.Millisecond)
+	if err != nil || !sdkJobPeer(cred, p.child.process.Pid, boot.Actor.UID, boot.Actor.GID) || !reflect.DeepEqual(ready, boot) {
+		return errTrust
+	}
+	info, err := openOperationFDInfo(p.child.process.Pid)
+	if err != nil {
+		return err
+	}
+	// Return is observed only after this pinned proc directory is closed.
+	defer info.Close()
+	deadline := time.Now().Add(time.Duration(boot.Worker.Limits.TotalMS) * time.Millisecond)
+	idle := time.Duration(boot.Worker.Limits.IdleMS) * time.Millisecond
+	reply, err := p.publish(sdkJobEvent{Kind: "ready"}, minSDKDeadline(deadline, time.Now().Add(idle)))
+	if err != nil {
+		return err
+	}
+	if err = writeOperationPacketBound(p.control, sdkJobWire{Binding: boot.Request.Control.Binding, Token: boot.Actor.Token, Reply: &reply}, MaxControlBytes); err != nil {
+		return err
+	}
+	var seq, mounts uint64
+	for {
+		limit := minSDKDeadline(deadline, time.Now().Add(idle))
+		var packet sdkJobWire
+		cred, err := readSDKJobPacket(p.control, &packet, time.Until(limit))
+		if err != nil || !sdkJobPeer(cred, p.child.process.Pid, boot.Actor.UID, boot.Actor.GID) || !sdkJobWireBound(packet, boot, seq+1) || packet.Reply != nil || packet.Mount != 0 {
+			return errTrust
+		}
+		seq++
+		if packet.MountFD != nil {
+			if packet.Event != nil || mounts >= maxReadOnlyMountQueries {
+				return errTrust
+			}
+			mounts++
+			id, code := operationFDInfoMount(info, *packet.MountFD)
+			if code != "" {
+				return code
+			}
+			if err = writeOperationPacketBound(p.control, sdkJobWire{Binding: boot.Request.Control.Binding, Token: boot.Actor.Token, Sequence: seq, Mount: id}, MaxControlBytes); err != nil {
+				return err
+			}
+			continue
+		}
+		if packet.Event == nil || packet.Event.Kind == "ready" {
+			return errTrust
+		}
+		reply, err = p.publish(*packet.Event, limit)
+		if err != nil {
+			return err
+		}
+		if err = writeOperationPacketBound(p.control, sdkJobWire{Binding: boot.Request.Control.Binding, Token: boot.Actor.Token, Sequence: seq, Reply: &reply}, MaxControlBytes); err != nil {
+			return err
+		}
+		if packet.Event.Kind == "result" {
+			return nil
+		}
+	}
+}
+func minSDKDeadline(a, b time.Time) time.Time {
+	if a.Before(b) {
+		return a
+	}
+	return b
+}
+
+// No caller executable, arguments or environment. Called only from the locked
+// owner thread; returns immediately after Start so slow bootstrap cannot hold
+// admission/disk locks or hide a live child. Even setup failure returns ownership.
+func startLinuxSDKJob(c Client, binary string, a NativeActor, b operationBinding, plan sdkJobPlan) (sdkJobProcess, error) {
+	if binary != "/var/lib/synopkgland-"+c.Expected.Package+"/payload-"+c.Expected.PayloadDigest || !a.valid || a.IdentityBasis() != "uid-username" || a.UID() == 0 || a.GID() == 0 || a.account.Groups == nil || processLifetime == nil || b.Inventory != c.Expected {
+		return nil, errTrust
+	}
+	actual, err := inspectSupervisor(os.Getpid(), c.Expected)
+	if err != nil || actual.Inventory != b.Inventory {
+		return nil, errTrust
+	}
+	pin, ok := plan.Root.(*pinnedReadOnlyRoot)
+	if !ok || pin == nil || pin.file == nil {
+		return nil, ErrUnavailable
+	}
+	if code := validateSDKJobPlan(plan, b); code != "" {
+		return nil, code
+	}
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	parent := os.NewFile(uintptr(pair[0]), "sdk-job-parent")
+	child := os.NewFile(uintptr(pair[1]), "sdk-job-child")
+	defer parent.Close()
+	defer child.Close()
+	control, err := operationSocket(parent)
+	if err != nil {
+		return nil, err
+	}
+	if err = enableCredentials(control); err != nil {
+		control.Close()
+		return nil, err
+	}
+	var token [32]byte
+	if _, err = rand.Read(token[:]); err != nil {
+		control.Close()
+		return nil, err
+	}
+	boot := sdkJobBootstrap{Actor: operationBootstrap{Binding: b, Token: hex.EncodeToString(token[:]), UID: a.UID(), GID: a.GID(), Groups: a.Groups(), SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef()}, Request: plan.Request, Worker: plan.Worker, RootPath: pin.path}
+	cmd := exec.Command(binary, "sdk-job-child")
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
+	cmd.ExtraFiles = []*os.File{processLifetime, child, pin.file}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
+	if err = cmd.Start(); err != nil {
+		control.Close()
+		return nil, err
+	}
+	p := &linuxSDKJob{child: &ownedLinuxChild{process: cmd.Process}, control: control, events: make(chan sdkJobEvent, 1), replies: make(chan sdkJobReply, 1), stop: make(chan struct{}), done: make(chan error, 1)}
+	go func() { err := p.receive(boot); control.Close(); p.done <- err }()
+	return p, nil
+}
+func validateSDKJobPlan(p sdkJobPlan, b operationBinding) Code {
+	r := p.Request
+	w := p.Worker
+	j := r.Control.Binding
+	if jobcontract.ValidateControl(r.Control) != "" || r.Control.Op != "jobs.submit" || j.Mode != jobcontract.Interactive || j.Inventory != sdkInventory(b.Inventory) || j.Epoch != b.Epoch || j.Job.ID != b.OperationID || j.ParentGrant.ID != b.GrantID || j.ParentGrant.Revision != b.GrantRevision || r.Control.Nonce != b.Nonce || j.Worker.ID != w.ID || j.Worker.Revision != w.Revision || j.InputSchemaDigest != w.InputSchemaDigest {
+		return ErrInvalid
+	}
+	bindings := SDKWorkerBindings()
+	if w.HandlerBinding != bindings.HandlerBinding || w.InputSchemaDigest != bindings.InputSchemaDigest || w.OutputSchemaDigest != bindings.OutputSchemaDigest {
+		return ErrIncompatible
+	}
+	if why := jobcontract.ValidatePlan(w, r.Input, jobcontract.Interactive); why != "" {
+		return sdkCode(why)
+	}
+	digest, why := jobcontract.InputDigest(r.Input, w.InputSchemaDigest)
+	if why != "" || digest != j.InputDigest {
+		return ErrInvalid
+	}
+	return ""
+}