@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_supervisor_linux.go

@@ -0,0 +1,414 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"syscall"
+	"time"
+)
+
+func setParentDeath() error {
+	_, _, err := syscall.Syscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0, 0, 0, 0)
+	if err != 0 {
+		return err
+	}
+	return nil
+}
+
+type ownedLinuxChild struct {
+	process *os.Process
+	reaped  bool
+}
+
+func (c *ownedLinuxChild) exited() (bool, error) {
+	if c.reaped {
+		return true, nil
+	}
+	var status syscall.WaitStatus
+	pid, err := syscall.Wait4(c.process.Pid, &status, syscall.WNOHANG, nil)
+	if errors.Is(err, syscall.EINTR) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	} // ECHILD never permits signalling.
+	if pid == c.process.Pid {
+		c.reaped = true
+		c.process.Release()
+	}
+	return c.reaped, nil
+}
+func (c *ownedLinuxChild) signal(s syscall.Signal) error {
+	if c.reaped {
+		return errTrust
+	}
+	// This PID came from our own Start, and ONLY this event loop calls Wait4.
+	// Even if it exits here it remains an unreaped zombie, pinning its PID.
+	return syscall.Kill(c.process.Pid, s)
+}
+
+// The thread creating the child must remain alive: PDEATHSIG is tied to that
+// Linux thread, not merely the supervisor's thread group / Go process.
+func superviseLinux(c Client, binary string) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	lease, err := acquireLifetime(c, r.Lifecycle)
+	if err != nil {
+		return err
+	}
+	processLifetime = lease
+	// Recheck under the witness: repair may have fenced between the first
+	// approval read and lock acquisition. No child exists before this point.
+	current, err := readRecord(c.StateDir, 0)
+	if err != nil || !current.Enabled || current.Inventory != r.Inventory || current.Lifecycle == nil || current.Lifecycle.Epoch != r.Lifecycle.Epoch || current.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	o, err := openUnitObserver(context.Background(), c.Expected)
+	if err != nil {
+		return err
+	}
+	defer o.conn.Close()
+	if o.gate.binding != r.Lifecycle.Binding {
+		return errTrust
+	}
+	watcher, cancelWatcher := context.WithCancel(context.Background())
+	defer cancelWatcher()
+	go o.watch(watcher)
+	epoch := r.Lifecycle.Epoch
+	stopDiagnostics := startObserverDiagnostics(c, epoch, o.gate)
+	defer stopDiagnostics()
+	identity, err := inspectSupervisor(os.Getpid(), c.Expected)
+	if err != nil {
+		return err
+	}
+	if err := writeProcess(c.RunDir, identity); err != nil {
+		return err
+	}
+	socket := filepath.Join(c.RunDir, "supervisor.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		return err
+	}
+	l.SetUnlinkOnClose(false)
+	defer l.Close()
+	if err := os.Chmod(socket, 0600); err != nil {
+		return err
+	}
+	cmd := exec.Command(binary, "serve-child")
+	cmd.ExtraFiles = []*os.File{lease}
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
+	// Go sets prctl before exec and rechecks the parent immediately afterward.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	child := &ownedLinuxChild{process: cmd.Process}
+	cohort := newOperationCohort(c.Expected, epoch, child.process.Pid, o.gate, func() bool { return !child.reaped })
+	defer func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		_ = cohort.drain(ctx, time.Second)
+		_ = stopChild(ctx, child, time.Second)
+	}()
+	var grants *supervisorGrants
+	var jobs *sdkJobOwner
+	var grantRepo *FileGrantRepository
+	defer func() {
+		if jobs != nil && jobs.session != nil {
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			defer cancel()
+			_ = jobs.session.shutdown(ctx)
+		}
+
+		if grantRepo != nil {
+			grantRepo.Close()
+		}
+	}()
+	// M1 Start first observes the health handshake, then finalizeStart clears
+	// residual under policy.lock. Pin S3's COMPLETE approval only after that
+	// handoff; constructing against residual=true would permanently fence it.
+	initializeGrants := func() {
+		if c.Expected.Protocol != DataProtocol || grants != nil || !o.gate.allow(time.Now()) {
+			return
+		}
+		approval, e := readRecord(c.StateDir, 0)
+		if e != nil || !approval.Enabled || approval.Inventory != c.Expected || approval.Lifecycle == nil || approval.Lifecycle.Epoch != epoch || approval.Lifecycle.Phase != "running" {
+			o.gate.fence("grant-approval-unavailable")
+			return
+		}
+		if approval.Residual {
+			return
+		} // health-only handshake; no grant authority yet
+		var code Code
+		stage := "grants-open"
+		grants, grantRepo, code = openSupervisorGrants(c, binary, cohort)
+		if code == "" && len(sdkCompiledRegistry) > 0 {
+			jobs, code, stage = openSDKJobs(c, binary, grants, grantRepo)
+		}
+		if code != "" {
+			o.gate.fenceStartup(stage, code)
+		}
+	}
+	fenceRetryExhausted := false
+	// No cmd.Wait goroutine: reaping and signalling are serialized below.
+	for {
+		current, readErr := readRecord(c.StateDir, 0)
+		if readErr != nil || current.Lifecycle == nil || current.Lifecycle.Epoch != epoch {
+			o.gate.fence("approval-unavailable")
+		} else if !current.Enabled || current.Lifecycle.Phase != "running" {
+			o.gate.fence("admin-stop")
+		}
+		initializeGrants()
+		// Reload verification denies requests without retiring this epoch.
+		if o.gate.fenced(time.Now()) {
+			if grants != nil {
+				grants.authority.Fence()
+			}
+			cohort.deny()
+			// NB policy.lock keeps the owner loop and admin stop responsive. No
+			// graceful stop before the irreversible durable fence transaction.
+			err := errBusy
+			if !fenceRetryExhausted {
+				ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+				err = retryCohortPolicy(ctx, func() error {
+					return fenceRecord(c, epoch, o.gate.reason(), o.gate.observerDiagnostic(epoch).Fence.Detail)
+				})
+				cancel()
+			}
+			if err == nil {
+				ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+				if jobs != nil && jobs.session != nil {
+					if code := jobs.session.shutdown(ctx); code != "" {
+						err = code
+					}
+				}
+				if err == nil {
+					err = cohort.drain(ctx, time.Second)
+				}
+				if err == nil {
+					err = stopChild(ctx, child, time.Second)
+				}
+				cancel()
+				if err != nil {
+					return err
+				}
+				if err = l.Close(); err != nil {
+					return err
+				}
+				p, e := readProcess(c.RunDir, 0)
+				if e != nil || p != identity {
+					return errTrust
+				}
+				if err = cleanRuntime(c, true); err != nil {
+					return err
+				}
+				q, err := cohort.proof()
+				if err != nil {
+					return err
+				}
+				// Completion is quiescence proof, published after close/reap/unlink.
+				ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+				defer cancel()
+				return retryCohortPolicy(ctx, func() error { return completeRecord(c, epoch, identity, q) })
+			}
+			if !errors.Is(err, errBusy) {
+				return err
+			}
+			// Budget expiry parks the fenced owner, retaining the lifetime
+			// witness. Do not exit (PDEATHSIG), poll/signal canceled children,
+			// or restart automatic retries. An explicit root stop retries below.
+			fenceRetryExhausted = true
+		}
+		if !fenceRetryExhausted {
+			if jobs != nil {
+				ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+				code := jobs.poll(ctx)
+				cancel()
+				if code == ErrCleanupRequired {
+					o.gate.fence("sdk-job-cleanup-required")
+					continue
+				}
+			}
+			if err := cohort.poll(); err != nil {
+				return err
+			}
+			if done, err := child.exited(); err != nil {
+				return err
+			} else if done && (cohort.started > 0 || jobs != nil && jobs.session != nil) {
+				o.gate.fence("helper-exited")
+				continue
+			}
+		}
+		l.SetDeadline(time.Now().Add(20 * time.Millisecond))
+		conn, err := l.AcceptUnix()
+		if err != nil {
+			if e, ok := err.(net.Error); ok && e.Timeout() {
+				continue
+			}
+			return err
+		}
+		peer, err := peerCredentials(conn)
+		if err != nil || peer.Uid != 0 {
+			conn.Close()
+			continue
+		}
+		req, code := receiveSupervisorRequest(conn)
+		if code != "" || req.Process != identity {
+			conn.Close()
+			continue
+		}
+
+		if req.Op == "jobs" {
+			initializeGrants()
+			conn.SetDeadline(time.Now().Add(3 * time.Second))
+			res := sdkWireResponse{Inventory: c.Expected, Nonce: req.Nonce, Code: ErrUnavailable}
+			if jobs != nil {
+				ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+				res = jobs.dispatchSDK(ctx, operationPeer{int(peer.Pid), peer.Uid}, req.Data)
+				cancel()
+			}
+			json.NewEncoder(conn).Encode(res)
+			conn.Close()
+			continue
+		}
+		if req.Op == "grants" {
+			initializeGrants()
+			conn.SetDeadline(time.Now().Add(3 * time.Second))
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			res := dispatchSupervisorGrant(ctx, grants, operationPeer{int(peer.Pid), peer.Uid}, req)
+			cancel()
+			json.NewEncoder(conn).Encode(res)
+			conn.Close()
+			if grants != nil {
+				grants.authority.mu.Lock()
+				fenced := grants.authority.fenced
+				grants.authority.mu.Unlock()
+				if fenced {
+					o.gate.fence("grant-authority-fenced")
+				}
+			}
+			continue
+		}
+		if req.Op == "admit" {
+			current, e := readRecord(c.StateDir, 0)
+			allowed := e == nil && current.Enabled && current.Inventory == c.Expected && current.Lifecycle != nil && current.Lifecycle.Epoch == epoch && current.Lifecycle.Phase == "running" && !child.reaped && int(peer.Pid) == child.process.Pid
+			readiness := "fenced"
+			if allowed {
+				readiness = o.gate.readiness(time.Now())
+			}
+			res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: readiness == "ready"}
+			if !res.OK {
+				res.Error = readiness
+			}
+			json.NewEncoder(conn).Encode(res)
+			conn.Close()
+			continue
+		}
+		conn.SetDeadline(time.Now().Add(3 * time.Second))
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		err = nil
+		if c.Expected.Protocol == DataProtocol || cohort.started > 0 || fenceRetryExhausted {
+			if grants != nil {
+				grants.authority.Fence()
+			}
+			cohort.deny()
+			fenceCtx, fenceCancel := context.WithTimeout(ctx, time.Second)
+			err = retryCohortPolicy(fenceCtx, func() error { return fenceRecord(c, epoch, "admin-stop") })
+			fenceCancel()
+		}
+		if err == nil {
+			if jobs != nil && jobs.session != nil {
+				if code := jobs.session.shutdown(ctx); code != "" {
+					err = code
+				}
+			}
+			if err == nil {
+				err = cohort.drain(ctx, time.Second)
+			}
+		}
+		if err == nil {
+			err = stopChild(ctx, child, time.Second)
+		}
+		if err == nil {
+			_, err = cohort.proof()
+		}
+		cancel()
+		// Kernel process-exit fd cleanup is not ordered: close the listener
+		// before ACK, so connection EOF cannot race a still-listening socket.
+		if err == nil {
+			err = l.Close()
+		}
+		res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
+		if err != nil {
+			res.Error = "cleanup-required"
+		}
+		json.NewEncoder(conn).Encode(res)
+		if err == nil {
+			// Keep this connection open until OS exit. An ACK plus EOF proves both
+			// that the child was reaped and this supervisor finished cooperatively.
+			os.Exit(0)
+		}
+		conn.Close()
+	}
+}
+
+func (p LinuxProcesses) Stop(want Process) error {
+	if want.Mode != "supervised" {
+		return errTrust
+	}
+	// Loss/reboot/PID reuse is not sufficient proof of child teardown. Preserve
+	// the record for fixed admin repair; never signal this recorded PID.
+	actual, err := inspectSupervisor(want.PID, want.Inventory)
+	if err != nil || actual != want {
+		return errTrust
+	}
+	socket := filepath.Join(p.RunDir, "supervisor.sock")
+	st, err := os.Lstat(socket)
+	if err != nil {
+		return err
+	}
+	stat, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || stat.Uid != 0 || st.Mode()&os.ModeSocket == 0 || st.Mode().Perm() != 0600 {
+		return errTrust
+	}
+	conn, err := net.DialTimeout("unix", socket, time.Second)
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn.(*net.UnixConn))
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
+		return errTrust
+	}
+	// Recheck after binding the connection too. A connected socket cannot be
+	// substituted by a later process that reused the path or PID.
+	actual, err = inspectSupervisor(want.PID, want.Inventory)
+	if err != nil || actual != want {
+		return errTrust
+	}
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return err
+	}
+	req := supervisorRequest{Process: want, Op: "stop", Nonce: hex.EncodeToString(nonce[:])}
+	if err := json.NewEncoder(conn).Encode(req); err != nil {
+		return err
+	}
+	return readSupervisorReply(conn, want.Inventory, req.Nonce)
+}

package/templates/native-go/backend/internal/helper/sdk_transport.go

@@ -0,0 +1,79 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"path/filepath"
+	"time"
+)
+
+// SDKJobs is the bounded package-side client. Native authority is established
+// again by the root owner; the CGI's username/admin flag is never forwarded.
+func (c Client) SDKJobs(ctx context.Context, method string, carriers SessionCarriers, args json.RawMessage) (json.RawMessage, Code) {
+	if _, code := sdkArgs(method, args); code != "" {
+		return nil, code
+	}
+	if !c.Expected.Valid() || c.Expected.Protocol != DataProtocol || c.Expected.DataAccess != "relaxed" {
+		return nil, ErrIncompatible
+	}
+	if len(carriers.Cookie) > 4096 || len(carriers.SynoToken) > 4096 || len(carriers.ClientAddress) > 256 {
+		return nil, ErrLimit
+	}
+	nonce, code := sdkRandomRef()
+	if code != "" {
+		return nil, code
+	}
+	r := sdkWireRequest{c.Expected, nonce, method, grantCarriers{carriers.Cookie, carriers.SynoToken, carriers.ClientAddress}, args}
+	raw, e := json.Marshal(r)
+	if e != nil || len(raw) > MaxControlBytes {
+		return nil, ErrLimit
+	}
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	deadline, _ := ctx.Deadline()
+	conn, e := (&net.Dialer{Deadline: deadline}).DialContext(ctx, "unix", filepath.Join(c.RunDir, "helper.sock"))
+	if e != nil {
+		return nil, ErrUnavailable
+	}
+	defer conn.Close()
+	unix, ok := conn.(*net.UnixConn)
+	if !ok || c.Peer == nil || c.Peer(unix) != nil {
+		return nil, ErrDenied
+	}
+	conn.SetDeadline(deadline)
+	// Cancel bounded I/O too; this is not the job's attach lease or Q witness.
+	done := make(chan struct{})
+	ended := make(chan struct{})
+	go func() {
+		defer close(ended)
+		select {
+		case <-ctx.Done():
+			conn.Close()
+		case <-done:
+		}
+	}()
+	defer func() { close(done); <-ended }()
+	if _, e = conn.Write(raw); e != nil {
+		return nil, ErrUnavailable
+	}
+	if e = unix.CloseWrite(); e != nil {
+		return nil, ErrUnavailable
+	}
+	var res sdkWireResponse
+	if code = decodeDataObject(conn, &res, MaxControlBytes); code != "" {
+		return nil, code
+	}
+	if res.Inventory != c.Expected || res.Nonce != nonce {
+		return nil, ErrIncompatible
+	}
+	if res.Code != "" {
+		return nil, safeGrantCode(res.Code)
+	}
+	if len(res.Data) == 0 {
+		return nil, ErrInvalid
+	}
+	return res.Data, ""
+}

package/templates/native-go/backend/internal/helper/sdk_transport_linux.go

@@ -0,0 +1,82 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Only the exact owned helper may forward the package request. This is a fixed
+// jobs control, not a caller-selected supervisor operation or process identity.
+func forwardSDKJobs(c Client, raw []byte) sdkWireResponse {
+	res := sdkWireResponse{Inventory: c.Expected}
+	var request sdkWireRequest
+	if res.Code = decodeDataObject(bytes.NewReader(raw), &request, MaxControlBytes); res.Code != "" {
+		return res
+	}
+	res.Nonce = request.Nonce
+	if request.Inventory != c.Expected {
+		res.Code = ErrIncompatible
+		return res
+	}
+	if _, code := sdkArgs(request.Method, request.Args); code != "" {
+		res.Code = code
+		return res
+	}
+	want, err := readProcess(c.RunDir, 0)
+	if err != nil || want.PID != os.Getppid() || want.Inventory != c.Expected {
+		res.Code = ErrDenied
+		return res
+	}
+	actual, err := inspectSupervisor(want.PID, c.Expected)
+	if err != nil || actual != want {
+		res.Code = ErrDenied
+		return res
+	}
+	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(c.RunDir, "supervisor.sock"), Net: "unix"})
+	if err != nil {
+		res.Code = ErrUnavailable
+		return res
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn)
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
+		res.Code = ErrDenied
+		return res
+	}
+	actual, err = inspectSupervisor(want.PID, c.Expected)
+	if err != nil || actual != want {
+		res.Code = ErrDenied
+		return res
+	}
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+	req := supervisorRequest{Process: want, Op: "jobs", Nonce: request.Nonce, Data: raw}
+	frame, err := json.Marshal(req)
+	if err != nil || len(frame) > MaxControlBytes {
+		res.Code = ErrLimit
+		return res
+	}
+	if _, err = conn.Write(frame); err != nil {
+		res.Code = ErrUnavailable
+		return res
+	}
+	if err = conn.CloseWrite(); err != nil {
+		res.Code = ErrUnavailable
+		return res
+	}
+	var reply sdkWireResponse
+	if code := decodeDataObject(conn, &reply, MaxControlBytes); code != "" {
+		res.Code = code
+		return res
+	}
+	if reply.Inventory != c.Expected || reply.Nonce != request.Nonce {
+		res.Code = ErrIncompatible
+		return res
+	}
+	return reply
+}

package/templates/native-go/backend/internal/helper/sdk_transport_test.go

@@ -0,0 +1,64 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestSDKPublicTransportPinsInventoryNonceAndStrictArgs(t *testing.T) {
+	f := sdkJobFixture(t)
+	for _, bad := range []string{"", "inventory", "nonce"} {
+		t.Run(bad, func(t *testing.T) {
+			dir, e := os.MkdirTemp("/tmp", "s7-wire-")
+			if e != nil {
+				t.Fatal(e)
+			}
+			defer os.RemoveAll(dir)
+			ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: filepath.Join(dir, "helper.sock"), Net: "unix"})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer ln.Close()
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				conn, e := ln.AcceptUnix()
+				if e != nil {
+					return
+				}
+				defer conn.Close()
+				var r sdkWireRequest
+				if decodeDataObject(conn, &r, MaxControlBytes) != "" {
+					return
+				}
+				response := sdkWireResponse{Inventory: r.Inventory, Nonce: r.Nonce, Data: json.RawMessage(`{"fixture":true}`)}
+				if bad == "inventory" {
+					response.Inventory.Version = "99.0.0-0001"
+				}
+				if bad == "nonce" {
+					response.Nonce = grantRef('f')
+				}
+				json.NewEncoder(conn).Encode(response)
+			}()
+			c := Client{Expected: f.c.inventory, RunDir: dir, Peer: func(*net.UnixConn) error { return nil }}
+			_, code := c.SDKJobs(context.Background(), "jobs.status", f.carriers, json.RawMessage(`{}`))
+			<-done
+			if bad == "" && code != "" || bad != "" && code != ErrIncompatible {
+				t.Fatal(code)
+			}
+		})
+	}
+	c := NewClient(f.c.inventory)
+	if _, code := c.SDKJobs(context.Background(), "jobs.status", f.carriers, json.RawMessage(`{"actor":"root"}`)); code != ErrInvalid {
+		t.Fatal(code)
+	}
+	if _, code := c.SDKJobs(context.Background(), "jobs.exec", f.carriers, json.RawMessage(`{}`)); code != ErrUnsupported {
+		t.Fatal(code)
+	}
+}

package/templates/native-go/backend/internal/helper/server_linux.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/server_linux.go:1
 package helper
 
 import (