@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/sdk_job_process_linux.go

@@ -1,327 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"crypto/rand"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"os/exec"
-	"reflect"
-	"strconv"
-	"syscall"
-	"time"
-)
-
-type sdkJobBootstrap struct {
-	Actor    operationBootstrap `json:"actor"`
-	Request  sdkJobRequest      `json:"request"`
-	Worker   jobcontract.Worker `json:"worker"`
-	RootPath string             `json:"rootPath"`
-}
-type sdkJobWire struct {
-	Binding  jobcontract.Binding `json:"binding"`
-	Token    string              `json:"token"`
-	Sequence uint64              `json:"sequence"`
-	Event    *sdkJobEvent        `json:"event,omitempty"`
-	Reply    *sdkJobReply        `json:"reply,omitempty"`
-	MountFD  *uint32             `json:"mountFd,omitempty"`
-	Mount    uint64              `json:"mount,omitempty"`
-}
-
-// Both sides are fixed SDK implementations and emit canonical JSON. Exact
-// re-encoding rejects duplicate/unknown/case aliases/null/invalid UTF-8 and
-// omitted required zero values; no permissive JSON decoder is a trust boundary.
-func readSDKJobPacket(c *net.UnixConn, dst any, timeout time.Duration) (*syscall.Ucred, error) {
-	if timeout <= 0 {
-		return nil, ErrTimeout
-	}
-	if err := c.SetReadDeadline(time.Now().Add(timeout)); err != nil {
-		return nil, err
-	}
-	raw := make([]byte, jobcontract.MaxControlBytes+1)
-	oob := make([]byte, syscall.CmsgSpace(syscall.SizeofUcred)+syscall.CmsgSpace(32*4))
-	n, on, flags, _, err := c.ReadMsgUnix(raw, oob)
-	if err != nil {
-		return nil, err
-	}
-	messages, e := syscall.ParseSocketControlMessage(oob[:on])
-	if e != nil {
-		return nil, errTrust
-	}
-	var cred *syscall.Ucred
-	bad := flags&(syscall.MSG_TRUNC|syscall.MSG_CTRUNC) != 0 || n > jobcontract.MaxControlBytes
-	for _, m := range messages {
-		if m.Header.Level == syscall.SOL_SOCKET && m.Header.Type == syscall.SCM_RIGHTS {
-			fds, _ := syscall.ParseUnixRights(&m)
-			for _, fd := range fds {
-				syscall.Close(fd)
-			}
-			bad = true
-		} else if m.Header.Level == syscall.SOL_SOCKET && m.Header.Type == syscall.SCM_CREDENTIALS {
-			if cred != nil {
-				bad = true
-			}
-			cred, e = syscall.ParseUnixCredentials(&m)
-			if e != nil {
-				bad = true
-			}
-		} else {
-			bad = true
-		}
-	}
-	if bad || json.Unmarshal(raw[:n], dst) != nil {
-		return nil, errTrust
-	}
-	canonical, e := json.Marshal(dst)
-	if e != nil || !bytes.Equal(raw[:n], canonical) {
-		return nil, errTrust
-	}
-	return cred, nil
-}
-func sdkJobPeer(cred *syscall.Ucred, pid int, uid, gid uint32) bool {
-	return cred != nil && int(cred.Pid) == pid && cred.Uid == uid && cred.Gid == gid
-}
-func sdkJobWireBound(p sdkJobWire, b sdkJobBootstrap, seq uint64) bool {
-	return p.Token == b.Actor.Token && p.Sequence == seq && jobcontract.CompareBinding(p.Binding, b.Request.Control.Binding) == ""
-}
-
-type linuxSDKJob struct {
-	child                         *ownedLinuxChild
-	control                       *net.UnixConn
-	events                        chan sdkJobEvent
-	replies                       chan sdkJobReply
-	stop                          chan struct{}
-	done                          chan error
-	closed, receiverDone, success bool
-	err                           error
-}
-
-func (p *linuxSDKJob) next() (sdkJobEvent, bool) {
-	select {
-	case e := <-p.events:
-		return e, true
-	default:
-		return sdkJobEvent{}, false
-	}
-}
-func (p *linuxSDKJob) reply(r sdkJobReply) error {
-	if p.closed {
-		return errTrust
-	}
-	select {
-	case p.replies <- r:
-		return nil
-	default:
-		return ErrBusy
-	}
-}
-func (p *linuxSDKJob) chunk(uint32) error { return ErrDenied } // cannot become an M2 data lease
-func (p *linuxSDKJob) idle() (bool, error) {
-	if !p.receiverDone {
-		select {
-		case err := <-p.done:
-			p.receiverDone = true
-			if !p.closed {
-				p.err = err
-			}
-		default:
-		}
-	}
-	return true, p.err
-}
-func (p *linuxSDKJob) stopRelay() {
-	if !p.closed {
-		p.closed = true
-		close(p.stop)
-		p.control.Close()
-	}
-}
-func (p *linuxSDKJob) relayStopped() bool            { p.idle(); return p.closed && p.receiverDone }
-func (p *linuxSDKJob) exitSuccess() bool             { return p.child.reaped && p.success }
-func (p *linuxSDKJob) signal(s syscall.Signal) error { return p.child.signal(s) }
-func (p *linuxSDKJob) exited() (bool, error) {
-	if p.child.reaped {
-		return true, nil
-	}
-	var status syscall.WaitStatus
-	pid, err := syscall.Wait4(p.child.process.Pid, &status, syscall.WNOHANG, nil)
-	if errors.Is(err, syscall.EINTR) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	}
-	if pid == p.child.process.Pid {
-		p.child.reaped = true
-		p.success = status.Exited() && status.ExitStatus() == 0
-		p.child.process.Release()
-	}
-	return p.child.reaped, nil
-}
-
-func (p *linuxSDKJob) publish(e sdkJobEvent, deadline time.Time) (sdkJobReply, error) {
-	timer := time.NewTimer(time.Until(deadline))
-	defer timer.Stop()
-	select {
-	case p.events <- e:
-	case <-p.stop:
-		return sdkJobReply{}, ErrCanceled
-	case <-timer.C:
-		return sdkJobReply{}, ErrTimeout
-	}
-	select {
-	case r := <-p.replies:
-		return r, nil
-	case <-p.stop:
-		return sdkJobReply{}, ErrCanceled
-	case <-timer.C:
-		return sdkJobReply{}, ErrTimeout
-	}
-}
-func (p *linuxSDKJob) receive(boot sdkJobBootstrap) error {
-	if err := writeOperationPacketBound(p.control, boot, MaxControlBytes); err != nil {
-		return err
-	}
-	var ready sdkJobBootstrap
-	cred, err := readSDKJobPacket(p.control, &ready, 300*time.Millisecond)
-	if err != nil || !sdkJobPeer(cred, p.child.process.Pid, boot.Actor.UID, boot.Actor.GID) || !reflect.DeepEqual(ready, boot) {
-		return errTrust
-	}
-	info, err := openOperationFDInfo(p.child.process.Pid)
-	if err != nil {
-		return err
-	}
-	// Return is observed only after this pinned proc directory is closed.
-	defer info.Close()
-	deadline := time.Now().Add(time.Duration(boot.Worker.Limits.TotalMS) * time.Millisecond)
-	idle := time.Duration(boot.Worker.Limits.IdleMS) * time.Millisecond
-	reply, err := p.publish(sdkJobEvent{Kind: "ready"}, minSDKDeadline(deadline, time.Now().Add(idle)))
-	if err != nil {
-		return err
-	}
-	if err = writeOperationPacketBound(p.control, sdkJobWire{Binding: boot.Request.Control.Binding, Token: boot.Actor.Token, Reply: &reply}, MaxControlBytes); err != nil {
-		return err
-	}
-	var seq, mounts uint64
-	for {
-		limit := minSDKDeadline(deadline, time.Now().Add(idle))
-		var packet sdkJobWire
-		cred, err := readSDKJobPacket(p.control, &packet, time.Until(limit))
-		if err != nil || !sdkJobPeer(cred, p.child.process.Pid, boot.Actor.UID, boot.Actor.GID) || !sdkJobWireBound(packet, boot, seq+1) || packet.Reply != nil || packet.Mount != 0 {
-			return errTrust
-		}
-		seq++
-		if packet.MountFD != nil {
-			if packet.Event != nil || mounts >= maxReadOnlyMountQueries {
-				return errTrust
-			}
-			mounts++
-			id, code := operationFDInfoMount(info, *packet.MountFD)
-			if code != "" {
-				return code
-			}
-			if err = writeOperationPacketBound(p.control, sdkJobWire{Binding: boot.Request.Control.Binding, Token: boot.Actor.Token, Sequence: seq, Mount: id}, MaxControlBytes); err != nil {
-				return err
-			}
-			continue
-		}
-		if packet.Event == nil || packet.Event.Kind == "ready" {
-			return errTrust
-		}
-		reply, err = p.publish(*packet.Event, limit)
-		if err != nil {
-			return err
-		}
-		if err = writeOperationPacketBound(p.control, sdkJobWire{Binding: boot.Request.Control.Binding, Token: boot.Actor.Token, Sequence: seq, Reply: &reply}, MaxControlBytes); err != nil {
-			return err
-		}
-		if packet.Event.Kind == "result" {
-			return nil
-		}
-	}
-}
-func minSDKDeadline(a, b time.Time) time.Time {
-	if a.Before(b) {
-		return a
-	}
-	return b
-}
-
-// No caller executable, arguments or environment. Called only from the locked
-// owner thread; returns immediately after Start so slow bootstrap cannot hold
-// admission/disk locks or hide a live child. Even setup failure returns ownership.
-func startLinuxSDKJob(c Client, binary string, a NativeActor, b operationBinding, plan sdkJobPlan) (sdkJobProcess, error) {
-	if binary != "/var/lib/synopkgland-"+c.Expected.Package+"/payload-"+c.Expected.PayloadDigest || !a.valid || a.IdentityBasis() != "uid-username" || a.UID() == 0 || a.GID() == 0 || a.account.Groups == nil || processLifetime == nil || b.Inventory != c.Expected {
-		return nil, errTrust
-	}
-	actual, err := inspectSupervisor(os.Getpid(), c.Expected)
-	if err != nil || actual.Inventory != b.Inventory {
-		return nil, errTrust
-	}
-	pin, ok := plan.Root.(*pinnedReadOnlyRoot)
-	if !ok || pin == nil || pin.file == nil {
-		return nil, ErrUnavailable
-	}
-	if code := validateSDKJobPlan(plan, b); code != "" {
-		return nil, code
-	}
-	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	parent := os.NewFile(uintptr(pair[0]), "sdk-job-parent")
-	child := os.NewFile(uintptr(pair[1]), "sdk-job-child")
-	defer parent.Close()
-	defer child.Close()
-	control, err := operationSocket(parent)
-	if err != nil {
-		return nil, err
-	}
-	if err = enableCredentials(control); err != nil {
-		control.Close()
-		return nil, err
-	}
-	var token [32]byte
-	if _, err = rand.Read(token[:]); err != nil {
-		control.Close()
-		return nil, err
-	}
-	boot := sdkJobBootstrap{Actor: operationBootstrap{Binding: b, Token: hex.EncodeToString(token[:]), UID: a.UID(), GID: a.GID(), Groups: a.Groups(), SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef()}, Request: plan.Request, Worker: plan.Worker, RootPath: pin.path}
-	cmd := exec.Command(binary, "sdk-job-child")
-	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
-	cmd.ExtraFiles = []*os.File{processLifetime, child, pin.file}
-	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
-	if err = cmd.Start(); err != nil {
-		control.Close()
-		return nil, err
-	}
-	p := &linuxSDKJob{child: &ownedLinuxChild{process: cmd.Process}, control: control, events: make(chan sdkJobEvent, 1), replies: make(chan sdkJobReply, 1), stop: make(chan struct{}), done: make(chan error, 1)}
-	go func() { err := p.receive(boot); control.Close(); p.done <- err }()
-	return p, nil
-}
-func validateSDKJobPlan(p sdkJobPlan, b operationBinding) Code {
-	r := p.Request
-	w := p.Worker
-	j := r.Control.Binding
-	if jobcontract.ValidateControl(r.Control) != "" || r.Control.Op != "jobs.submit" || j.Mode != jobcontract.Interactive || j.Inventory != sdkInventory(b.Inventory) || j.Epoch != b.Epoch || j.Job.ID != b.OperationID || j.ParentGrant.ID != b.GrantID || j.ParentGrant.Revision != b.GrantRevision || r.Control.Nonce != b.Nonce || j.Worker.ID != w.ID || j.Worker.Revision != w.Revision || j.InputSchemaDigest != w.InputSchemaDigest {
-		return ErrInvalid
-	}
-	bindings := SDKWorkerBindings()
-	if w.HandlerBinding != bindings.HandlerBinding || w.InputSchemaDigest != bindings.InputSchemaDigest || w.OutputSchemaDigest != bindings.OutputSchemaDigest {
-		return ErrIncompatible
-	}
-	if why := jobcontract.ValidatePlan(w, r.Input, jobcontract.Interactive); why != "" {
-		return sdkCode(why)
-	}
-	digest, why := jobcontract.InputDigest(r.Input, w.InputSchemaDigest)
-	if why != "" || digest != j.InputDigest {
-		return ErrInvalid
-	}
-	return ""
-}