@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/_executor/tasks.go

@@ -0,0 +1,283 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strconv"
+	"synopkgland/executor/internal/taskscript"
+)
+
+type approvedTask struct {
+	Kind         string `json:"kind"`
+	Name         string `json:"name"`
+	ScriptDigest string `json:"script_digest"`
+}
+type taskInventory struct {
+	Package        string         `json:"package"`
+	ExecutorDigest string         `json:"executor_digest"`
+	PolicyDigest   string         `json:"policy_digest"`
+	Tasks          []approvedTask `json:"tasks"`
+}
+
+func hashBytes(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
+func validInventory(pkg string, inventory taskInventory) bool {
+	if inventory.Package != pkg || len(inventory.Tasks) != 2 || !idRE.MatchString(inventory.ExecutorDigest) || !idRE.MatchString(inventory.PolicyDigest) {
+		return false
+	}
+	seen := map[string]bool{}
+	for _, t := range inventory.Tasks {
+		if !contains([]string{"boot", "control"}, t.Kind) || seen[t.Kind] || t.Name != pkg+" executor "+t.Kind || !idRE.MatchString(t.ScriptDigest) {
+			return false
+		}
+		seen[t.Kind] = true
+	}
+	return true
+}
+func rootOwner(raw json.RawMessage, boot bool) bool {
+	var owner string
+	if json.Unmarshal(raw, &owner) == nil {
+		return owner == "root"
+	}
+	var owners map[string]string
+	return boot && json.Unmarshal(raw, &owners) == nil && len(owners) == 1 && owners["0"] == "root"
+}
+func taskReference(ctx context.Context, d *liveDSM, task approvedTask, expected string) (string, string, map[string]any, error) {
+	api, version := "SYNO.Core.EventScheduler", "1"
+	ref := map[string]any{"task_name": task.Name}
+	boot := task.Kind == "boot"
+	if !boot {
+		api = "SYNO.Core.TaskScheduler"
+		version = "4"
+		b, err := d.call(ctx, api, "list", "3", "", map[string]any{"start": 0, "limit": 500})
+		if err != nil {
+			return "", "", nil, err
+		}
+		var list struct {
+			Tasks []struct {
+				Name string      `json:"name"`
+				ID   json.Number `json:"id"`
+			} `json:"tasks"`
+			Total *int `json:"total"`
+		}
+		if json.Unmarshal(b, &list) != nil || list.Total == nil || *list.Total != len(list.Tasks) || len(list.Tasks) > 500 {
+			return "", "", nil, errors.New("incomplete scheduler list")
+		}
+		count := 0
+		var id int
+		for _, t := range list.Tasks {
+			if t.Name == task.Name {
+				count++
+				n, e := strconv.Atoi(string(t.ID))
+				if e != nil || n < 0 {
+					return "", "", nil, errors.New("task id")
+				}
+				id = n
+			}
+		}
+		if count != 1 {
+			return "", "", nil, errors.New("missing or duplicate task")
+		}
+		ref = map[string]any{"id": id, "real_owner": "root"}
+	}
+	b, err := d.call(ctx, api, "get", version, "", ref)
+	if err != nil {
+		return "", "", nil, err
+	}
+	var got struct {
+		Name          string          `json:"name"`
+		TaskName      string          `json:"task_name"`
+		ID            json.Number     `json:"id"`
+		Owner         json.RawMessage `json:"owner"`
+		RealOwner     string          `json:"real_owner"`
+		Enable        *bool           `json:"enable"`
+		Type          string          `json:"type"`
+		Event         string          `json:"event"`
+		OperationType string          `json:"operation_type"`
+		Operation     string          `json:"operation"`
+		Extra         struct {
+			Script string `json:"script"`
+		} `json:"extra"`
+	}
+	if json.Unmarshal(b, &got) != nil || !rootOwner(got.Owner, boot) || got.Enable == nil {
+		return "", "", nil, errors.New("task owner")
+	}
+	script := got.Operation
+	if boot {
+		if got.TaskName != task.Name || !*got.Enable || got.Event != "bootup" || got.OperationType != "script" {
+			return "", "", nil, errors.New("boot definition")
+		}
+	} else {
+		if got.Name != task.Name || string(got.ID) != strconv.Itoa(ref["id"].(int)) || got.RealOwner != "root" || *got.Enable || got.Type != "script" {
+			return "", "", nil, errors.New("control definition")
+		}
+		script = got.Extra.Script
+	}
+	if script != expected || hashBytes([]byte(script)) != task.ScriptDigest {
+		return "", "", nil, errors.New("task script mismatch")
+	}
+	if !boot {
+		version = "2"
+		ref = map[string]any{"tasks": []map[string]any{ref}}
+	}
+	return api, version, ref, nil
+}
+
+// Setup records are copied into root state only after exact scheduler readback.
+// Package-controlled names can never expand deletion beyond this package's pair.
+func snapshotTasks(ctx context.Context, d *liveDSM, pkg, ed, pd, setupPath, runtime string) error {
+	b, _, err := readLifecycleFile(setupPath, 16384)
+	if err != nil {
+		return err
+	}
+	var setup struct {
+		Package        string          `json:"package"`
+		ExecutorDigest string          `json:"executorDigest"`
+		PolicyDigest   string          `json:"policyDigest"`
+		Policy         json.RawMessage `json:"policy"`
+		Implementation string          `json:"implementation"`
+		Tasks          []struct {
+			Kind   string `json:"kind"`
+			Name   string `json:"name"`
+			Header string `json:"header"`
+			Script string `json:"script"`
+		} `json:"tasks"`
+	}
+	if strictJSON(b, &setup) != nil || setup.Package != pkg || setup.ExecutorDigest != ed || setup.PolicyDigest != pd || setup.Implementation != "executor" {
+		return errors.New("setup pins")
+	}
+	generated, err := taskscript.Generate(pkg, ed, pd)
+	if err != nil || len(setup.Tasks) != len(generated) {
+		return errors.New("setup task inventory")
+	}
+	inv := taskInventory{Package: pkg, ExecutorDigest: ed, PolicyDigest: pd}
+	for i, task := range generated {
+		hint := setup.Tasks[i]
+		if hint.Kind != task.Kind || hint.Name != task.Name || hint.Header != task.Header || hint.Script != task.Script {
+			return errors.New("setup task mismatch")
+		}
+		inv.Tasks = append(inv.Tasks, approvedTask{Kind: task.Kind, Name: task.Name, ScriptDigest: hashBytes([]byte(task.Script))})
+	}
+	if !validInventory(pkg, inv) {
+		return errors.New("setup task inventory")
+	}
+	for i, task := range inv.Tasks {
+		if _, _, _, err = taskReference(ctx, d, task, generated[i].Script); err != nil {
+			return err
+		}
+	}
+	b, err = json.Marshal(inv)
+	if err != nil {
+		return err
+	}
+	f, err := os.CreateTemp(runtime, ".tasks-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	if _, err = f.Write(b); err == nil {
+		err = f.Sync()
+	}
+	closeErr := f.Close()
+	if err != nil {
+		return err
+	}
+	if closeErr != nil {
+		return closeErr
+	}
+	return os.Rename(f.Name(), filepath.Join(runtime, "tasks.json"))
+}
+func readTaskInventory(runtime string) (taskInventory, error) {
+	var inv taskInventory
+	f, err := openRegular(filepath.Join(runtime, "tasks.json"))
+	if err != nil {
+		return inv, err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || !ownedByRoot(info) || info.Mode().Perm() != 0600 {
+		return inv, errors.New("untrusted task inventory")
+	}
+	b, err := readLimited(f, 16384)
+	if err != nil {
+		return inv, err
+	}
+	err = strictJSON(b, &inv)
+	return inv, err
+}
+func purgeTasks(ctx context.Context, d *liveDSM, pkg string, inv taskInventory, log func(string)) {
+	if !validInventory(pkg, inv) {
+		log("task cleanup skipped: invalid protected inventory")
+		return
+	}
+	generated, err := taskscript.Generate(pkg, inv.ExecutorDigest, inv.PolicyDigest)
+	if err != nil {
+		log("task cleanup skipped: invalid protected pins")
+		return
+	}
+	for _, task := range inv.Tasks {
+		expected := ""
+		for _, canonical := range generated {
+			if canonical.Kind == task.Kind {
+				expected = canonical.Script
+			}
+		}
+		api, version, ref, err := taskReference(ctx, d, task, expected)
+		if err != nil {
+			log("task cleanup skipped: " + task.Kind + " definition mismatch or unavailable")
+			continue
+		}
+		if _, err = d.call(ctx, api, "delete", version, "", ref); err != nil {
+			log("task cleanup unconfirmed: " + task.Kind)
+		}
+		// The scheduler has no conditional delete. Accept the admin edit window,
+		// delete exactly once, and observe the name afterward without another delete.
+		if taskRemains(ctx, d, task) {
+			log("task cleanup: " + task.Kind + " same-named task remains after delete")
+		}
+
+	}
+}
+
+func purgeWithInventory(ctx context.Context, d *liveDSM, pkg string, inv taskInventory, state, runtime, socket string, log func(string)) error {
+	if runtime != filepath.Join(state, "runtime") {
+		return errors.New("runtime outside package protected state")
+	}
+	purgeTasks(ctx, d, pkg, inv, log)
+	return finishControl(state, runtime, socket, true)
+}
+
+func taskRemains(ctx context.Context, d *liveDSM, task approvedTask) bool {
+	if task.Kind == "boot" {
+		b, err := d.call(ctx, "SYNO.Core.EventScheduler", "get", "1", "", map[string]any{"task_name": task.Name})
+		if err != nil {
+			return false
+		}
+		var got struct {
+			Name string `json:"task_name"`
+		}
+		return json.Unmarshal(b, &got) == nil && got.Name == task.Name
+	}
+	b, err := d.call(ctx, "SYNO.Core.TaskScheduler", "list", "3", "", map[string]any{"start": 0, "limit": 500})
+	if err != nil {
+		return false
+	}
+	var list struct {
+		Tasks []struct {
+			Name string `json:"name"`
+		} `json:"tasks"`
+	}
+	if json.Unmarshal(b, &list) != nil {
+		return false
+	}
+	for _, t := range list.Tasks {
+		if t.Name == task.Name {
+			return true
+		}
+	}
+	return false
+}

package/dist/templates/_executor/tasks_review_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestReviewSnapshotRejectsUnrelatedSameNamedRootTasks(t *testing.T) {
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	ed, pd := strings.Repeat("a", 64), strings.Repeat("b", 64)
+	tasks := []map[string]string{}
+	for _, kind := range []string{"boot", "control"} {
+		header := "#!/bin/sh\n# synopkgland executor " + kind + "\n"
+		// Another admin's script merely happens to carry these marker comments.
+		script := header + "# " + ed + " " + pd + "\necho unrelated-backup-task\n"
+		tasks = append(tasks, map[string]string{"kind": kind, "name": "TestApp executor " + kind, "header": header, "script": script})
+	}
+	setup := map[string]any{"package": "TestApp", "executorDigest": ed, "policyDigest": pd, "implementation": "executor", "tasks": tasks}
+	b, _ := json.Marshal(setup)
+	path := filepath.Join(dir, "setup.json")
+	os.WriteFile(path, b, 0600)
+	err = snapshotTasks(context.Background(), &liveDSM{Command: &snapshotFixture{tasks: tasks}}, "TestApp", ed, pd, path, dir)
+	if err == nil {
+		t.Fatal("unrelated root tasks accepted into protected deletion inventory")
+	}
+}
+
+func TestReviewPurgeRejectsUnrelatedSameNamedRootTasks(t *testing.T) {
+	script := "#!/bin/sh\n# synopkgland executor boot\n# " + strings.Repeat("a", 64) + strings.Repeat("b", 64) + "\necho unrelated-backup-task\n"
+	cmd := &schedulerFixture{script: script}
+	inv := taskInventory{Package: "TestApp", ExecutorDigest: strings.Repeat("a", 64), PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: hashBytes([]byte(script))}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: hashBytes([]byte(script))}}}
+	purgeTasks(context.Background(), &liveDSM{Command: cmd}, "TestApp", inv, func(string) {})
+	if len(cmd.deleted) != 0 {
+		t.Fatal("deleted unrelated tasks", cmd.deleted)
+	}
+}

package/dist/templates/_executor/tasks_test.go

@@ -0,0 +1,166 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"synopkgland/executor/internal/taskscript"
+	"testing"
+)
+
+type schedulerFixture struct {
+	changed, foreignOwner, duplicate bool
+	script                           string
+	deleted                          []string
+}
+
+func (s *schedulerFixture) Exec(_ context.Context, _ string, args []string) ([]byte, error) {
+	api, method := "", ""
+	for _, a := range args {
+		if strings.HasPrefix(a, "api=") {
+			api = strings.TrimPrefix(a, "api=")
+		}
+		if strings.HasPrefix(a, "method=") {
+			method = strings.TrimPrefix(a, "method=")
+		}
+	}
+	owner := "root"
+	if s.foreignOwner {
+		owner = "other"
+	}
+	generated, _ := taskscript.Generate("TestApp", strings.Repeat("a", 64), strings.Repeat("b", 64))
+	script := generated[1].Script
+	if api == "SYNO.Core.EventScheduler" {
+		script = generated[0].Script
+	}
+	if s.script != "" {
+		script = s.script
+	}
+	if s.changed {
+		script = "unrelated"
+	}
+	var data any
+	if method == "delete" {
+		s.deleted = append(s.deleted, api)
+		if api == "SYNO.Core.TaskScheduler" && !contains(args, `tasks=[{"id":7,"real_owner":"root"}]`) {
+			return nil, errors.New("wrong delete reference")
+		}
+		data = map[string]any{}
+	} else if api == "SYNO.Core.EventScheduler" {
+		data = map[string]any{"task_name": "TestApp executor boot", "owner": map[string]string{"0": owner}, "operation": script, "operation_type": "script", "event": "bootup", "enable": true}
+	} else if method == "list" {
+		tasks := []map[string]any{{"name": "TestApp executor control", "id": 7}, {"name": "TestApp executor boot", "id": 1000}}
+		if s.duplicate {
+			tasks = append(tasks, tasks[0])
+		}
+		data = map[string]any{"tasks": tasks, "total": len(tasks)}
+	} else {
+		data = map[string]any{"name": "TestApp executor control", "id": 7, "owner": owner, "real_owner": owner, "enable": false, "type": "script", "extra": map[string]any{"script": script}}
+	}
+	return json.Marshal(map[string]any{"success": true, "data": data})
+}
+func TestPurgeDeletesOnlyExactOwnRootTasksAndProtectedState(t *testing.T) {
+	for _, mode := range []string{"exact", "script changed", "owner changed", "duplicate control", "foreign name"} {
+		t.Run(mode, func(t *testing.T) {
+			cmd := &schedulerFixture{changed: mode == "script changed", foreignOwner: mode == "owner changed", duplicate: mode == "duplicate control"}
+			inventory := taskInventory{Package: "TestApp", ExecutorDigest: strings.Repeat("a", 64), PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
+			if mode == "foreign name" {
+				inventory.Tasks[0].Name = "OtherApp executor boot"
+			}
+			state := filepath.Join(t.TempDir(), "state")
+			socket := filepath.Join(t.TempDir(), "socket")
+			os.MkdirAll(filepath.Join(state, "runtime"), 0700)
+			os.MkdirAll(socket, 0700)
+			if err := purgeWithInventory(context.Background(), &liveDSM{Command: cmd}, "TestApp", inventory, state, filepath.Join(state, "runtime"), socket, func(string) {}); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := os.Stat(state); !os.IsNotExist(err) {
+				t.Fatal("state survived")
+			}
+			want := 0
+			if mode == "exact" {
+				want = 2
+			}
+			if mode == "duplicate control" {
+				want = 1
+			}
+			if len(cmd.deleted) != want {
+				t.Fatal("deleted mismatched tasks", cmd.deleted)
+			}
+		})
+	}
+}
+
+func TestSnapshotRequiresBothExactSchedulerDefinitionsBeforeWritingInventory(t *testing.T) {
+	for _, mismatch := range []bool{false, true} {
+		t.Run(map[bool]string{false: "exact setup", true: "changed root task"}[mismatch], func(t *testing.T) {
+			dir := realTestPath(t, t.TempDir())
+			ed := strings.Repeat("a", 64)
+			pd := strings.Repeat("b", 64)
+			tasks := []map[string]string{}
+			generated, err := taskscript.Generate("TestApp", ed, pd)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, task := range generated {
+				tasks = append(tasks, map[string]string{"kind": task.Kind, "name": task.Name, "header": task.Header, "script": task.Script})
+			}
+			setup := map[string]any{"package": "TestApp", "executorDigest": ed, "policyDigest": pd, "implementation": "executor", "tasks": tasks}
+			b, _ := json.Marshal(setup)
+			path := filepath.Join(dir, "setup.json")
+			os.WriteFile(path, b, 0600)
+			command := &snapshotFixture{mismatch: mismatch, tasks: tasks}
+			err = snapshotTasks(context.Background(), &liveDSM{Command: command}, "TestApp", ed, pd, path, dir)
+			if (err != nil) != mismatch {
+				t.Fatal("snapshot validation", err)
+			}
+			b, readErr := os.ReadFile(filepath.Join(dir, "tasks.json"))
+			if mismatch {
+				if !os.IsNotExist(readErr) {
+					t.Fatal("unverified inventory persisted")
+				}
+				return
+			}
+			var inv taskInventory
+			if json.Unmarshal(b, &inv) != nil || !validInventory("TestApp", inv) {
+				t.Fatal("missing verified inventory")
+			}
+		})
+	}
+}
+
+type snapshotFixture struct {
+	mismatch bool
+	tasks    []map[string]string
+}
+
+func (s *snapshotFixture) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
+	f := &schedulerFixture{changed: s.mismatch}
+	for _, a := range args {
+		if a == "api=SYNO.Core.EventScheduler" {
+			f.script = s.tasks[0]["script"]
+		}
+		if a == "api=SYNO.Core.TaskScheduler" {
+			f.script = s.tasks[1]["script"]
+		}
+	}
+	return f.Exec(ctx, path, args)
+}
+
+func canonicalTaskDigest(t *testing.T, kind string) string {
+	t.Helper()
+	tasks, err := taskscript.Generate("TestApp", strings.Repeat("a", 64), strings.Repeat("b", 64))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, task := range tasks {
+		if task.Kind == kind {
+			return hashBytes([]byte(task.Script))
+		}
+	}
+	t.Fatal("task kind")
+	return ""
+}

package/dist/templates/_executor/testdata/evidence/cleanup.json

@@ -0,0 +1,24 @@
+{
+  "accounts_present": {
+    "p2probe1": false,
+    "p2probe2": false,
+    "p2probeadm": false,
+    "p2probepkg": false
+  },
+  "paths_present": {
+    "/usr/local/etc/synopkgland/p2probepkg": false,
+    "/var/packages/p2probepkg": false,
+    "/run/synopkgland/p2probepkg": false,
+    "/var/services/homes/p2probe1": false,
+    "/var/services/homes/p2probe2": false,
+    "/var/services/homes/p2probeadm": false,
+    "/var/services/homes/p2probepkg": false,
+    "/tmp/p2probe-executor.test": false,
+    "/tmp/p2probe-executor-setup.py": false,
+    "/tmp/p2probe-executor-live.py": false,
+    "/tmp/p2probe-executor-final.py": false
+  },
+  "executor_processes": [],
+  "tasks_created": 0,
+  "administrators_probe_members": []
+}

package/dist/templates/_executor/testdata/evidence/final-smoke.jsonl

@@ -0,0 +1,9 @@
+{"scenario": "final status", "response": {"ok": true, "result": {"executor_digest": "bc6d66fb667abf19a2a15f45da3aa90fc84e26fceaf9198bf904b6f8daa1b960", "policy_digest": "ccd9a4932bedd460f7b4f4d54d64449241f510721c19daa9caa426a12415fd6c", "ready": true, "version": "1"}}}
+{"scenario": "delegate.create /home", "response": {"ok": true, "result": {"delegation_id": "eb56c3b83d12021ad31958a51fb2a79007455f5511fab79c2e2a501041d22821", "expires_at": "2026-10-08T01:37:34.700143938Z", "subject": {"uid": 1231, "username": "p2probe1"}}}}
+{"scenario": "final list", "response": {"ok": true, "result": {"files": [{"isdir": true, "name": "p2probe-folder", "path": "/home/p2probe-folder"}, {"isdir": false, "name": "p2probe-output", "path": "/home/p2probe-output"}], "offset": 0, "total": 2}}}
+{"scenario": "final info", "response": {"ok": true, "result": {"files": [{"isdir": false, "name": "p2probe-output", "path": "/home/p2probe-output"}]}}}
+{"scenario": "final createFolder", "response": {"ok": true, "result": {"folders": [{"isdir": true, "name": "p2probe-final-folder", "path": "/home/p2probe-final-folder"}]}}}
+{"scenario": "final checkPermission", "response": {"ok": true, "result": {"blSkip": false}}}
+{"scenario": "kernel ACL denies other home", "exit_code": 1, "stderr": "executor: open /volume1/homes/p2probe2: no such file or directory\n", "note": "Target had already been deleted. This establishes missing-path refusal only; see separate existing-home kernel probe."}
+{"scenario": "duplicate serve", "exit_code": 1, "stderr": "executor: already running\n"}
+{"scenario": "final revoke", "response": {"ok": true, "result": {"revoked": true}}}

package/dist/templates/_executor/testdata/evidence/kernel-acl.json

@@ -0,0 +1,6 @@
+{
+  "scenario": "kernel ACL denies existing other home",
+  "target_exists": true,
+  "exit_code": 1,
+  "stderr": "executor: open /volume1/homes/p2probeadm: permission denied\n"
+}

package/dist/templates/_executor/testdata/evidence/linux-tests.log

@@ -0,0 +1,123 @@
+=== RUN   TestDSMAccountFailClosed
+=== RUN   TestDSMAccountFailClosed/valid
+=== RUN   TestDSMAccountFailClosed/success_empty
+=== RUN   TestDSMAccountFailClosed/success_no_user
+=== RUN   TestDSMAccountFailClosed/missing_expiry
+=== RUN   TestDSMAccountFailClosed/disabled
+=== RUN   TestDSMAccountFailClosed/uid_mismatch
+=== RUN   TestDSMAccountFailClosed/name_mismatch
+--- PASS: TestDSMAccountFailClosed (0.00s)
+    --- PASS: TestDSMAccountFailClosed/valid (0.00s)
+    --- PASS: TestDSMAccountFailClosed/success_empty (0.00s)
+    --- PASS: TestDSMAccountFailClosed/success_no_user (0.00s)
+    --- PASS: TestDSMAccountFailClosed/missing_expiry (0.00s)
+    --- PASS: TestDSMAccountFailClosed/disabled (0.00s)
+    --- PASS: TestDSMAccountFailClosed/uid_mismatch (0.00s)
+    --- PASS: TestDSMAccountFailClosed/name_mismatch (0.00s)
+=== RUN   TestDSMAppPrivilege
+=== RUN   TestDSMAppPrivilege/allow
+=== RUN   TestDSMAppPrivilege/deny
+=== RUN   TestDSMAppPrivilege/custom
+=== RUN   TestDSMAppPrivilege/missing
+=== RUN   TestDSMAppPrivilege/duplicate
+--- PASS: TestDSMAppPrivilege (0.01s)
+    --- PASS: TestDSMAppPrivilege/allow (0.00s)
+    --- PASS: TestDSMAppPrivilege/deny (0.00s)
+    --- PASS: TestDSMAppPrivilege/custom (0.00s)
+    --- PASS: TestDSMAppPrivilege/missing (0.00s)
+    --- PASS: TestDSMAppPrivilege/duplicate (0.00s)
+=== RUN   TestDSMVerify
+--- PASS: TestDSMVerify (0.00s)
+=== RUN   TestDSMArgvAndEmbeddedError
+--- PASS: TestDSMArgvAndEmbeddedError (0.00s)
+=== RUN   TestRootRequiresVerifiedAdmin
+--- PASS: TestRootRequiresVerifiedAdmin (0.00s)
+=== RUN   TestSubdirectoryBinding
+--- PASS: TestSubdirectoryBinding (0.00s)
+=== RUN   TestDSMEmptyOperationDataDenied
+--- PASS: TestDSMEmptyOperationDataDenied (0.00s)
+=== RUN   TestRejections
+=== RUN   TestRejections/missing_account
+=== RUN   TestRejections/disabled
+=== RUN   TestRejections/unknown_disabled_state
+=== RUN   TestRejections/admin_runner
+=== RUN   TestRejections/system_runner
+=== RUN   TestRejections/uid_reuse
+=== RUN   TestRejections/app_deny
+=== RUN   TestRejections/expired
+=== RUN   TestRejections/revoked
+=== RUN   TestRejections/job
+=== RUN   TestRejections/scope
+=== RUN   TestRejections/dotdot
+=== RUN   TestRejections/name
+=== RUN   TestRejections/outside_staging
+--- PASS: TestRejections (0.01s)
+    --- PASS: TestRejections/missing_account (0.00s)
+    --- PASS: TestRejections/disabled (0.00s)
+    --- PASS: TestRejections/unknown_disabled_state (0.00s)
+    --- PASS: TestRejections/admin_runner (0.00s)
+    --- PASS: TestRejections/system_runner (0.00s)
+    --- PASS: TestRejections/uid_reuse (0.00s)
+    --- PASS: TestRejections/app_deny (0.00s)
+    --- PASS: TestRejections/expired (0.00s)
+    --- PASS: TestRejections/revoked (0.00s)
+    --- PASS: TestRejections/job (0.00s)
+    --- PASS: TestRejections/scope (0.00s)
+    --- PASS: TestRejections/dotdot (0.00s)
+    --- PASS: TestRejections/name (0.00s)
+    --- PASS: TestRejections/outside_staging (0.00s)
+=== RUN   TestUnknownAndPolicy
+--- PASS: TestUnknownAndPolicy (0.00s)
+=== RUN   TestSpoofedUsername
+--- PASS: TestSpoofedUsername (0.00s)
+=== RUN   TestScopeSymlink
+--- PASS: TestScopeSymlink (0.00s)
+=== RUN   TestOperationDelegation
+--- PASS: TestOperationDelegation (0.00s)
+=== RUN   TestListAndRevokeOwnership
+--- PASS: TestListAndRevokeOwnership (0.00s)
+=== RUN   TestProtocol
+=== RUN   TestProtocol/oversize
+=== RUN   TestProtocol/unknown_field
+=== RUN   TestProtocol/duplicate
+=== RUN   TestProtocol/utf8
+=== RUN   TestProtocol/version
+--- PASS: TestProtocol (0.00s)
+    --- PASS: TestProtocol/oversize (0.00s)
+    --- PASS: TestProtocol/unknown_field (0.00s)
+    --- PASS: TestProtocol/duplicate (0.00s)
+    --- PASS: TestProtocol/utf8 (0.00s)
+    --- PASS: TestProtocol/version (0.00s)
+=== RUN   TestWrongPeer
+--- PASS: TestWrongPeer (0.00s)
+=== RUN   TestStorePersistence
+--- PASS: TestStorePersistence (0.00s)
+=== RUN   TestFileStationPrivilegeRequiredSeparately
+--- PASS: TestFileStationPrivilegeRequiredSeparately (0.00s)
+=== RUN   TestSharedScope
+--- PASS: TestSharedScope (0.00s)
+=== RUN   TestPolicyValidation
+--- PASS: TestPolicyValidation (0.00s)
+=== RUN   TestFilenameAndTTL
+--- PASS: TestFilenameAndTTL (0.00s)
+=== RUN   TestStoreRejectSymlinkAndMode
+--- PASS: TestStoreRejectSymlinkAndMode (0.00s)
+=== RUN   TestDropOrderAndFailures
+--- PASS: TestDropOrderAndFailures (0.00s)
+=== RUN   TestLinuxStagingSymlinks
+--- PASS: TestLinuxStagingSymlinks (0.00s)
+=== RUN   TestLinuxCopyScopeAndNoOverwrite
+--- PASS: TestLinuxCopyScopeAndNoOverwrite (0.00s)
+=== RUN   TestLinuxPeerCredential
+--- PASS: TestLinuxPeerCredential (0.00s)
+=== RUN   TestLinuxPIDLock
+--- PASS: TestLinuxPIDLock (0.00s)
+=== RUN   TestScriptDigest
+--- PASS: TestScriptDigest (0.00s)
+=== RUN   TestLinuxStagingRootSymlink
+--- PASS: TestLinuxStagingRootSymlink (0.00s)
+=== RUN   TestLinuxStagingHardlinkAndOwner
+--- PASS: TestLinuxStagingHardlinkAndOwner (0.00s)
+=== RUN   TestScriptTimeoutAndOutputLimit
+--- PASS: TestScriptTimeoutAndOutputLimit (0.11s)
+PASS