@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_linux_test.go

@@ -0,0 +1,130 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"github.com/godbus/dbus/v5"
+	"io"
+	"strings"
+	"testing"
+	"time"
+)
+
+func diagnosticObserver(t *testing.T) *unitObserver {
+	t.Helper()
+	o := &unitObserver{owner: ":1.1", unit: "pkgctl-root.service", path: systemdUnitPath("pkgctl-root.service"), gate: newAdmission(testBinding())}
+	if err := o.observeValues(testBinding(), activeUnitValues(o), 0, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	return o
+}
+func TestLinuxObserverSignalSubReasons(t *testing.T) {
+	cases := []struct {
+		detail, name string
+		body         []interface{}
+		path         dbus.ObjectPath
+		sender       string
+	}{
+		{"reload-shape", managerInterface + ".Reloading", nil, "/org/freedesktop/systemd1", ":1.1"},
+		{"reload-type", managerInterface + ".Reloading", []interface{}{"secret"}, "/org/freedesktop/systemd1", ":1.1"},
+		{"unit-removed-shape", managerInterface + ".UnitRemoved", []interface{}{"pkgctl-root.service"}, "/org/freedesktop/systemd1", ":1.1"},
+		{"properties-map", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, "secret", []string{}}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
+		{"property-invalidated-InvocationID", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, map[string]dbus.Variant{}, []string{"InvocationID", "secret"}}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
+		{"properties-invalidated-type", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, map[string]dbus.Variant{}, "secret"}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
+		{"owner-signal", "org.freedesktop.DBus.NameOwnerChanged", []interface{}{systemdName, ":1.1", ":1.2"}, "/org/freedesktop/DBus", "org.freedesktop.DBus"},
+		{"property-ActiveState", propertiesInterface + ".PropertiesChanged", []interface{}{unitInterface, map[string]dbus.Variant{"ActiveState": dbus.MakeVariant("inactive")}, []string{}}, systemdUnitPath("pkgctl-root.service"), ":1.1"},
+	}
+	for _, c := range cases {
+		t.Run(c.detail, func(t *testing.T) {
+			o := diagnosticObserver(t)
+			s := &dbus.Signal{Sender: c.sender, Name: c.name, Path: c.path, Body: c.body, Sequence: dbus.Sequence(99)}
+			o.DeliverSignal("", "", s)
+			d := o.gate.observerDiagnostic("")
+			if d.Fence.Detail != c.detail || d.Fence.Signal != c.name || d.Fence.Sender != c.sender || d.Fence.SignalSequence != 99 || d.Fence.At.IsZero() {
+				t.Fatalf("wrong diagnostic: %+v", d)
+			}
+			if strings.Contains(d.Fence.Detail, "secret") {
+				t.Fatal("body leaked")
+			}
+		})
+	}
+	o := diagnosticObserver(t)
+	o.Terminate()
+	if o.gate.observerDiagnostic("").Fence.Detail != "subscription-terminated" {
+		t.Fatal("terminate unclassified")
+	}
+}
+func TestLinuxObserverQueryErrorClassification(t *testing.T) {
+	for _, c := range []struct {
+		err  error
+		want string
+	}{{context.Canceled, "canceled"}, {context.DeadlineExceeded, "deadline"}, {io.EOF, "eof"}, {errTrust, "trust"}, {dbus.Error{Name: "org.freedesktop.systemd1.NoSuchUnit", Body: []interface{}{"secret"}}, "dbus-no-unit"}, {errors.New("secret"), "other"}} {
+		o := diagnosticObserver(t)
+		err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+			return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: c.err, phase: "get-unit"}
+		})
+		d := o.gate.observerDiagnostic("")
+		if c.want == "deadline" {
+			if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" {
+				t.Fatalf("deadline not pending: %+v %v", d, err)
+			}
+			continue
+		}
+		if err == nil || d.Fence.Phase != "get-unit" || d.Fence.ErrorClass != c.want || d.Fence.Detail != "query-failed" {
+			t.Fatalf("classification %s: %+v %v", c.want, d, err)
+		}
+	}
+}
+func TestLinuxObserverDeadlineAndInvalidSnapshot(t *testing.T) {
+	o := diagnosticObserver(t)
+	now := time.Now()
+	o.gate.requestUnitCheck(true, now)
+	o.gate.fenced(now.Add(unitReloadBudget))
+	if o.gate.observerDiagnostic("").Fence.Detail != "reload-deadline" {
+		t.Fatal("budget unclassified")
+	}
+	for _, key := range []string{"Id", "LoadState", "ActiveState", "SubState", "Job", "ActiveEnterTimestampMonotonic", "InvocationID"} {
+		o := diagnosticObserver(t)
+		v := activeUnitValues(o)
+		v[key] = dbus.MakeVariant("secret")
+		_ = o.observeValues(testBinding(), v, 0, time.Now())
+		d := o.gate.observerDiagnostic("")
+		if d.Fence.Detail != "snapshot-"+key || d.Fence.Phase != "validate-values" {
+			t.Fatalf("property %s: %+v", key, d.Fence)
+		}
+	}
+}
+
+func TestLinuxObserverWireSerialAndPrivacy(t *testing.T) {
+	o := diagnosticObserver(t)
+	m := &dbus.Message{Type: dbus.TypeSignal, Headers: map[dbus.HeaderField]dbus.Variant{
+		dbus.FieldInterface: dbus.MakeVariant(managerInterface), dbus.FieldMember: dbus.MakeVariant("Reloading"), dbus.FieldSender: dbus.MakeVariant(o.owner), dbus.FieldPath: dbus.MakeVariant(dbus.ObjectPath("/org/freedesktop/systemd1")), dbus.FieldSignature: dbus.MakeVariant(dbus.SignatureOf(true))}, Body: []interface{}{true}}
+	var wire bytes.Buffer
+	if err := m.EncodeTo(&wire, binary.LittleEndian); err != nil {
+		t.Fatal(err)
+	}
+	b := wire.Bytes()
+	binary.LittleEndian.PutUint32(b[8:12], 321)
+	parsed, err := dbus.DecodeMessage(bytes.NewReader(b))
+	if err != nil {
+		t.Fatal(err)
+	}
+	o.incomingObserverMessage(parsed)
+	o.DeliverSignal("", "", &dbus.Signal{Name: managerInterface + ".Reloading", Sender: o.owner, Path: "/org/freedesktop/systemd1", Body: []interface{}{"secret-session-password-path"}, Sequence: dbus.Sequence(123)})
+	d := o.gate.observerDiagnostic("")
+	if d.Fence.WireSerial != 321 || d.Fence.SignalSequence != 123 {
+		t.Fatalf("wire/receive counters confused: %+v", d)
+	}
+	payload, _ := json.Marshal(d)
+	if bytes.Contains(payload, []byte("secret")) {
+		t.Fatal("body persisted")
+	}
+	for _, sender := range []string{"session-secret", ":" + strings.Repeat("1", 40), ":1.password"} {
+		if safeBusSender(sender) != "" {
+			t.Fatal("untrusted sender persisted")
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_test.go

@@ -0,0 +1,98 @@
+package helper
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestObserverDiagnosticFirstFenceAndBound(t *testing.T) {
+	g := newAdmission(testBinding())
+	for n := 0; n < observerEventLimit+20; n++ {
+		g.recordObserver(observerEvent{Kind: "query-ok", QuerySerial: uint64(n)})
+	}
+	g.fenceObserver("observation-unavailable", observerEvent{Kind: "fence", Detail: "query-failed", Phase: "get-unit", ErrorClass: "canceled"})
+	g.fenceObserver("bus-owner-changed", observerEvent{Kind: "fence", Detail: "owner-signal"})
+	d := g.observerDiagnostic(strings.Repeat("e", 64))
+	if d.Fence.Detail != "query-failed" || d.Fence.Phase != "get-unit" || d.Reason != "observation-unavailable" {
+		t.Fatalf("wrong first cause: %+v", d)
+	}
+	if len(d.Events) != observerEventLimit || d.Events[0].QuerySerial != 22 {
+		t.Fatalf("bad bounded order: %+v", d.Events)
+	}
+	d.Events[0].Kind = "mutated"
+	if g.observerDiagnostic(d.Epoch).Events[0].Kind == "mutated" {
+		t.Fatal("snapshot aliases ring")
+	}
+	b, err := json.Marshal(d)
+	if err != nil || len(b) > observerDiagnosticLimit {
+		t.Fatalf("size %d err %v", len(b), err)
+	}
+}
+func TestObserverDiagnosticConcurrentAdmission(t *testing.T) {
+	g := newAdmission(testBinding())
+	var wg sync.WaitGroup
+	for n := 0; n < 8; n++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 100; i++ {
+				g.recordObserver(observerEvent{Kind: "query-start"})
+				g.fenceObserver("observation-unavailable", observerEvent{Detail: "subscription-terminated"})
+				g.allow(time.Now())
+				g.observerDiagnostic(strings.Repeat("e", 64))
+			}
+		}()
+	}
+	wg.Wait()
+	if g.allow(time.Now()) || g.observerDiagnostic("").Fence.Detail != "subscription-terminated" {
+		t.Fatal("fence changed")
+	}
+}
+func TestObserverDiagnosticPersistenceCannotBlockCompletion(t *testing.T) {
+	for _, unwritable := range []bool{false, true} {
+		t.Run(map[bool]string{false: "root-private", true: "write-failure"}[unwritable], func(t *testing.T) {
+			c := fixture(t)
+			b := testBinding()
+			l, err := newLifecycle(b)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err = writeProtected(c.StateDir, "approval.json", Record{Schema: 2, Inventory: c.Expected, Enabled: true, Lifecycle: l}); err != nil {
+				t.Fatal(err)
+			}
+			g := newAdmission(b)
+			g.fenceObserver("observation-unavailable", observerEvent{Detail: "verification-deadline"})
+			if unwritable {
+				if err = os.Mkdir(filepath.Join(c.StateDir, "observer-diagnostic.json"), 0700); err != nil {
+					t.Fatal(err)
+				}
+			}
+			persistObserverDiagnostic(c, l.Epoch, g)
+			if err = fenceRecord(c, l.Epoch, g.reason(), g.observerDiagnostic(l.Epoch).Fence.Detail); err != nil {
+				t.Fatal(err)
+			}
+			p := Process{Inventory: c.Expected, Mode: "supervised", Boot: b.Boot, PID: 42, Start: "123", Inode: 9}
+			if err = completeRecord(c, l.Epoch, p); err != nil {
+				t.Fatal(err)
+			}
+			r, err := readRecord(c.StateDir, c.Owner)
+			if err != nil || r.Lifecycle.SubReason != "verification-deadline" || r.Lifecycle.Phase != "stopped" {
+				t.Fatalf("record %+v %v", r, err)
+			}
+			if _, err = completionRecord(c, r); err != nil {
+				t.Fatal(err)
+			}
+			if !unwritable {
+				st, err := os.Stat(filepath.Join(c.StateDir, "observer-diagnostic.json"))
+				if err != nil || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
+					t.Fatalf("private file %v %v", st, err)
+				}
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_writer.go

@@ -0,0 +1,40 @@
+package helper
+
+import "sync"
+
+// Diagnostics are independent of approval/completion authority. A single
+// worker does live writes; the signal/admission ordering point never does I/O.
+// Shutdown retains the existing best-effort final snapshot after teardown.
+func startObserverDiagnostics(c Client, epoch string, g *admission) func() {
+	return startObserverDiagnosticWriter(g, func() { persistObserverDiagnostic(c, epoch, g) })
+}
+
+func startObserverDiagnosticWriter(g *admission, persist func()) func() {
+	wake, stop, done := make(chan struct{}, 1), make(chan struct{}), make(chan struct{})
+	g.mu.Lock()
+	g.diagnosticWake = wake
+	g.mu.Unlock()
+	go func() {
+		defer close(done)
+		persist()
+		for {
+			select {
+			case <-wake:
+				persist()
+			case <-stop:
+				persist()
+				return
+			}
+		}
+	}()
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			g.mu.Lock()
+			g.diagnosticWake = nil
+			g.mu.Unlock()
+			close(stop)
+			<-done
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/operation_bootstrap_linux.go

@@ -0,0 +1,193 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"runtime"
+	"strconv"
+	"time"
+)
+
+// Root bootstrap accepts only an anonymous descriptor bound to its root parent.
+// After permanent credential drop there is no root-side business filesystem I/O.
+func operationChildLinux(c Client) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
+	if err != nil {
+		return errTrust
+	}
+	if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
+		return err
+	}
+	if _, err := inspectSupervisor(parent, c.Expected); err != nil {
+		return err
+	}
+	if err := inheritLifetime(c); err != nil {
+		return err
+	}
+	f := os.NewFile(4, "operation-control")
+	if f == nil {
+		return errTrust
+	}
+	defer f.Close()
+	control, err := operationSocket(f)
+	if err != nil {
+		return err
+	}
+	defer control.Close()
+	peer, err := peerCredentials(control)
+	if err != nil || int(peer.Pid) != parent || peer.Uid != 0 {
+		return errTrust
+	}
+	var boot operationBootstrap
+	if _, err := readOperationPacketBound(control, &boot, MaxControlBytes, 300*time.Millisecond); err != nil {
+		return err
+	}
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || r.Lifecycle == nil || boot.Binding.Inventory != c.Expected || boot.Binding.Epoch != r.Lifecycle.Epoch || !digestPattern.MatchString(boot.Token) || !digestPattern.MatchString(boot.Binding.OperationID) || boot.UID == 0 || boot.GID == 0 || boot.Groups == nil || len(boot.Groups) > 65536 {
+		return errTrust
+	}
+	if boot.ReadOnly != nil && (boot.ReadOnly.validate() != "" || !allReferences(boot.SubjectRef, boot.SessionRef)) {
+		return errTrust
+	}
+	if boot.Write != nil && (boot.ReadOnly != nil || boot.Write.validate() != "" || !allReferences(boot.SubjectRef, boot.SessionRef)) {
+		return errTrust
+	}
+	if err := dropOperationCredentials(parent, boot); err != nil {
+		return err
+	}
+	packetLimit := MaxHealthBytes
+	if boot.ReadOnly != nil || boot.Write != nil {
+		packetLimit = MaxControlBytes
+	}
+	if err := writeOperationPacketBound(control, boot, packetLimit); err != nil {
+		return err
+	}
+	if boot.Write != nil {
+		timeout := BoundedTimeout
+		if boot.Write.Staged {
+			timeout = StreamTotalTimeout
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), timeout)
+		defer cancel()
+		return operationWriteChild(ctx, control, boot)
+	}
+	var source *actorReadTransfer
+	operationTimeout := BoundedTimeout
+	if boot.ReadOnly != nil && boot.ReadOnly.Action == ActionReadStream {
+		operationTimeout = StreamTotalTimeout
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), operationTimeout)
+	defer cancel()
+	if boot.ReadOnly != nil {
+		witness := os.NewFile(6, "readonly-root-witness")
+		if witness == nil {
+			return errTrust
+		}
+		defer witness.Close()
+		operationMountIDFallback = operationMountIDProxy(control, boot)
+		pin := &pinnedReadOnlyRoot{path: boot.ReadOnly.RootPath, file: witness}
+		var result readOnlyResult
+		if boot.ReadOnly.Action == ActionRead || boot.ReadOnly.Action == ActionReadStream {
+			source, result = openActorReadTransfer(ctx, pin, *boot.ReadOnly, operationReadOnlyACL)
+			if source != nil {
+				defer source.Close()
+			}
+		} else {
+			result, _ = executeReadOnly(ctx, pin, *boot.ReadOnly, operationReadOnlyACL)
+		}
+		if err := writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, Result: &result}, MaxControlBytes); err != nil {
+			return err
+		}
+		if result.Code != "" || result.Bytes == 0 {
+			return awaitReadOnlyFinish(control, boot.Token)
+		}
+	}
+	output := os.NewFile(5, "operation-data")
+	if output == nil {
+		return errTrust
+	}
+	defer output.Close()
+	deadline, _ := ctx.Deadline()
+	ceiling := uint64(MaxBoundedBytes)
+	if boot.ReadOnly != nil {
+		ceiling = boot.ReadOnly.MaxBytes
+	}
+	var total, sequence uint64
+	for {
+		// Idle synthetic children are bounded by the future stream idle ceiling.
+		readDeadline := deadline
+		if boot.ReadOnly != nil && boot.ReadOnly.Action == ActionReadStream && time.Now().Add(StreamIdleTimeout).Before(readDeadline) {
+			readDeadline = time.Now().Add(StreamIdleTimeout)
+		}
+		control.SetReadDeadline(readDeadline)
+		raw := make([]byte, MaxHealthBytes+1)
+		n, err := control.Read(raw)
+		if err != nil {
+			return err
+		}
+		var lease operationLease
+		d := json.NewDecoder(bytes.NewReader(raw[:n]))
+		d.DisallowUnknownFields()
+		if n > MaxHealthBytes || d.Decode(&lease) != nil || d.Decode(new(any)) != io.EOF || lease.Token != boot.Token || lease.Sequence != sequence+1 || lease.Bytes == 0 || lease.Bytes > MaxChunkBytes || uint64(lease.Bytes) > ceiling || total > ceiling-uint64(lease.Bytes) {
+			return errTrust
+		}
+		sequence++
+		total += uint64(lease.Bytes)
+		if boot.ReadOnly != nil {
+			if source == nil || lease.ProofDeadline == 0 || lease.SubjectRef != boot.SubjectRef || lease.SessionRef != boot.SessionRef {
+				return errTrust
+			}
+			proofDeadline := time.Unix(0, lease.ProofDeadline)
+			if !time.Now().Before(proofDeadline) || time.Until(proofDeadline) > NativeProofFreshness {
+				return ErrStale
+			}
+			proofCtx, proofCancel := context.WithDeadline(ctx, proofDeadline)
+			data, code := source.ReadChunk(proofCtx, lease.Bytes)
+			proofCancel()
+			result := readOnlyResult{Code: code}
+			if code == "" {
+				result.Bytes = uint64(len(data))
+			}
+			if err := writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, Result: &result, ChunkSequence: sequence}, MaxControlBytes); err != nil {
+				return err
+			}
+			if code != "" {
+				return code
+			}
+			if _, err := io.CopyN(output, bytes.NewReader(data), int64(lease.Bytes)); err != nil {
+				return err
+			}
+			if source.remaining == 0 {
+				return awaitReadOnlyFinish(control, boot.Token)
+			}
+		} else if _, err := io.CopyN(output, zeroReader{}, int64(lease.Bytes)); err != nil {
+			return err
+		}
+	}
+}
+
+// Unset until native share/home and object ACL obligations are proven on DSM.
+var operationReadOnlyACL readOnlyACL
+
+type zeroReader struct{}
+
+func (zeroReader) Read(b []byte) (int, error) { clear(b); return len(b), nil }
+
+// Keep the child and lifetime witness until the owner observes metadata/last
+// relay completion. Exiting at the last pipe write would race S2 poll's Close.
+func awaitReadOnlyFinish(control *net.UnixConn, token string) error {
+	var done operationReadOnlyFinish
+	if _, err := readOperationPacketBound(control, &done, MaxHealthBytes, BoundedTimeout); err != nil {
+		return err
+	}
+	if done.Token != token {
+		return errTrust
+	}
+	return nil
+}

package/dist/templates/native-go/backend/internal/helper/operation_credentials_linux.go

@@ -0,0 +1,56 @@
+package helper
+
+import (
+	"golang.org/x/sys/unix"
+	"os"
+	"slices"
+	"syscall"
+)
+
+// Runs on the pinned operation-child thread before any business filesystem I/O.
+func dropOperationCredentials(parent int, boot operationBootstrap) error {
+	if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+		return err
+	}
+	if err := unix.Prctl(unix.PR_SET_KEEPCAPS, 0, 0, 0, 0); err != nil {
+		return err
+	}
+	groups := make([]int, len(boot.Groups))
+	for n, g := range boot.Groups {
+		groups[n] = int(g)
+	}
+	if err := syscall.Setgroups(groups); err != nil {
+		return err
+	}
+	if err := syscall.Setresgid(int(boot.GID), int(boot.GID), int(boot.GID)); err != nil {
+		return err
+	}
+	if err := syscall.Setresuid(int(boot.UID), int(boot.UID), int(boot.UID)); err != nil {
+		return err
+	}
+	// Linux clears PDEATHSIG on credential changes. Re-arm while the creator
+	// thread is still pinned, then recheck parent on BOTH sides of prctl.
+	if err := armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
+		return err
+	}
+	ru, eu, su := unix.Getresuid()
+	rg, eg, sg := unix.Getresgid()
+	current, err := syscall.Getgroups()
+	if err != nil || ru != int(boot.UID) || eu != ru || su != ru || rg != int(boot.GID) || eg != rg || sg != rg {
+		return errTrust
+	}
+	slices.Sort(current)
+	slices.Sort(groups)
+	if !slices.Equal(current, groups) {
+		return errTrust
+	}
+	var caps [2]unix.CapUserData
+	header := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	if err := unix.Capset(&header, &caps[0]); err != nil {
+		return err
+	}
+	if err := unix.Capget(&header, &caps[0]); err != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
+		return errTrust
+	}
+	return nil
+}