@synopackageland/cli 0.5.0 → 0.6.0

package/templates/_executor/managed.go

@@ -0,0 +1,117 @@
+package main
+
+import (
+	"context"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"syscall"
+)
+
+func samePackagePins(ctx context.Context, dir, executorDigest, policyDigest string) bool {
+	dir, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return false
+	}
+	ed, err := digestFile(ctx, dir+"/executor", maxExecutorBytes)
+	if err != nil || ed != executorDigest {
+		return false
+	}
+	pd, err := digestFile(ctx, dir+"/policy.json", maxPolicyBytes)
+	return err == nil && pd == policyDigest
+}
+
+// The process and monitor outlive its listener. A package start can only expose
+// the already-approved runtime when the shipped bytes still match both pins.
+func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error, log func(string)) error {
+	var closeService func()
+	var checking <-chan bool
+	var cancelCheck context.CancelFunc
+	pause := func() {
+		if cancelCheck != nil {
+			cancelCheck()
+			cancelCheck = nil
+			checking = nil
+		}
+		if closeService != nil {
+			closeService()
+			closeService = nil
+		}
+	}
+	defer pause()
+	resume := func() {
+		if closeService != nil || checking != nil {
+			return
+		}
+		checkCtx, cancel := context.WithCancel(ctx)
+		cancelCheck = cancel
+		result := make(chan bool, 1)
+		checking = result
+		go func() { result <- samePins(checkCtx) }()
+	}
+	resume()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case matches := <-checking:
+			cancelCheck()
+			cancelCheck = nil
+			checking = nil
+			if ctx.Err() != nil {
+				return nil
+			}
+			if !matches {
+				log("executor paused: package pins require administrator approval")
+				continue
+			}
+			var err error
+			closeService, err = open()
+			if err != nil {
+				return err
+			}
+		case action, ok := <-actions:
+			if !ok {
+				return nil
+			}
+			switch action {
+			case "stop":
+				pause()
+			case "start":
+				resume()
+			case "purge":
+				pause()
+				return purge()
+			}
+		}
+	}
+}
+
+// Root task control never writes through the package-owned mailbox. Only a
+// process whose protected pid/executable was verified can receive these signals.
+func rootControlSignals(parent context.Context, actions chan<- string) func() {
+	ctx, cancel := context.WithCancel(parent)
+	signals := make(chan os.Signal, 2)
+	signal.Notify(signals, syscall.SIGUSR1, syscall.SIGUSR2)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case sig := <-signals:
+				action := "stop"
+				if sig == syscall.SIGUSR2 {
+					action = "purge"
+				}
+				select {
+				case <-ctx.Done():
+					return
+				case actions <- action:
+				}
+			}
+		}
+	}()
+	return func() { signal.Stop(signals); cancel(); <-done }
+}

package/templates/_executor/managed_test.go

@@ -0,0 +1,137 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
+	for _, changed := range []bool{false, true} {
+		t.Run(map[bool]string{false: "same pins", true: "different policy"}[changed], func(t *testing.T) {
+			dir := t.TempDir()
+			os.WriteFile(filepath.Join(dir, "executor"), []byte("approved executable"), 0600)
+			os.WriteFile(filepath.Join(dir, "policy.json"), []byte("approved policy"), 0600)
+			ed, _ := digestFile(context.Background(), filepath.Join(dir, "executor"), maxExecutorBytes)
+			pd, _ := digestFile(context.Background(), filepath.Join(dir, "policy.json"), maxPolicyBytes)
+			actions := make(chan string)
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			var opened, closed, purged atomic.Int32
+			socket := filepath.Join(realTestPath(t, t.TempDir()), "s")
+			done := make(chan error, 1)
+			go func() {
+				done <- manageService(ctx, actions, func() (func(), error) {
+					listener, err := net.Listen("unix", socket)
+					if err != nil {
+						return nil, err
+					}
+					opened.Add(1)
+					return func() { listener.Close(); closed.Add(1) }, nil
+				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil }, func(string) {})
+			}()
+			await := func(v *atomic.Int32, want int32) {
+				t.Helper()
+				for v.Load() != want {
+					select {
+					case <-ctx.Done():
+						t.Fatal("lifecycle timeout")
+					default:
+						time.Sleep(time.Millisecond)
+					}
+				}
+			}
+			await(&opened, 1)
+			actions <- "stop"
+			await(&closed, 1)
+			if _, err := os.Stat(socket); !os.IsNotExist(err) {
+				t.Fatal("paused socket remains")
+			}
+			select {
+			case err := <-done:
+				t.Fatal("stop ended monitor", err)
+			default:
+			}
+			if changed {
+				os.WriteFile(filepath.Join(dir, "policy.json"), []byte("new policy"), 0600)
+			}
+			actions <- "start"
+			if changed {
+				time.Sleep(15 * time.Millisecond)
+				if opened.Load() != 1 {
+					t.Fatal("unapproved policy resumed")
+				}
+			} else {
+				await(&opened, 2)
+				conn, err := net.Dial("unix", socket)
+				if err != nil {
+					t.Fatal("approved socket did not resume", err)
+				}
+				conn.Close()
+			}
+			actions <- "purge"
+			if err := <-done; err != nil {
+				t.Fatal(err)
+			}
+			if purged.Load() != 1 || opened.Load() != closed.Load() {
+				t.Fatal("purge did not close service and clear state")
+			}
+		})
+	}
+}
+
+func TestPausedRequestCannotReachDSMOrWriter(t *testing.T) {
+	e, d, w := setup(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	out := e.Handle(ctx, Request{Version: 1, Op: "delegate.create", Auth: Auth{Cookie: "session", SynoToken: "token"}, Params: json.RawMessage(`{"job_id":"job","ops":["files.write"],"scope":"home","path":"/home","ttl_seconds":60}`)})
+	if out.Code != "EXECUTOR_PAUSED" || d.apiCalls != 0 || w.calls != 0 {
+		t.Fatal("paused request reached execution", out)
+	}
+}
+
+func TestRootControlSignalsPauseThenPurgeWithoutMailbox(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	actions := make(chan string, 1)
+	stop := rootControlSignals(ctx, actions)
+	defer stop()
+	var opened, closed, purged atomic.Int32
+	done := make(chan error, 1)
+	go func() {
+		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil }, func(string) {})
+	}()
+	wait := func(value *atomic.Int32) {
+		t.Helper()
+		for value.Load() == 0 {
+			select {
+			case <-ctx.Done():
+				t.Fatal("signal timeout")
+			default:
+				time.Sleep(time.Millisecond)
+			}
+		}
+	}
+	wait(&opened)
+	if err := syscall.Kill(os.Getpid(), syscall.SIGUSR1); err != nil {
+		t.Fatal(err)
+	}
+	wait(&closed)
+	select {
+	case <-done:
+		t.Fatal("root stop terminated monitor")
+	default:
+	}
+	if err := syscall.Kill(os.Getpid(), syscall.SIGUSR2); err != nil {
+		t.Fatal(err)
+	}
+	if err := <-done; err != nil || purged.Load() != 1 {
+		t.Fatal("root purge failed", err)
+	}
+}

package/templates/_executor/path_test.go

@@ -0,0 +1,17 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func realTestPath(t *testing.T, p string) string {
+	t.Helper()
+	p, err := filepath.EvalSymlinks(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+func makeTestDir(p string) error { return os.Mkdir(p, 0700) }

package/templates/_executor/platform_linux.go

@@ -0,0 +1,336 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+)
+
+func ownedByRoot(info os.FileInfo) bool {
+	st, ok := info.Sys().(*syscall.Stat_t)
+	return ok && st.Uid == 0
+}
+
+// O_PATH allows fstat on the bound filesystem socket inode, rather than the
+// anonymous socket descriptor (which has different metadata).
+func verifySocket(path string, uid, gid int, mode os.FileMode) error {
+	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), 0x200000, 0)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || info.Mode()&os.ModeSocket == 0 || info.Mode().Perm() != mode || int(st.Uid) != uid || int(st.Gid) != gid {
+		return errors.New("socket permissions")
+	}
+	return nil
+}
+
+func configureProcess(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error {
+		if cmd.Process == nil {
+			return os.ErrProcessDone
+		}
+		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		if err == syscall.ESRCH {
+			return os.ErrProcessDone
+		}
+		return err
+	}
+}
+func peerUID(c net.Conn) (int, error) {
+	u, ok := c.(*net.UnixConn)
+	if !ok {
+		return -1, errors.New("unix peer")
+	}
+	raw, err := u.SyscallConn()
+	if err != nil {
+		return -1, err
+	}
+	uid := -1
+	var sockErr error
+	err = raw.Control(func(fd uintptr) {
+		cred, e := syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
+		sockErr = e
+		if e == nil {
+			uid = int(cred.Uid)
+		}
+	})
+	if err != nil {
+		return -1, err
+	}
+	return uid, sockErr
+}
+
+// openBeneath rejects symlinks in every untrusted component, including parent
+// directories. Directory descriptors pin the lookup despite concurrent renames.
+func openBeneath(root, relative string, flags int, mode uint32) (*os.File, error) {
+	if !validRelative(relative) {
+		return nil, errors.New("relative path")
+	}
+	var dir *os.File
+	var err error
+	if root == "/" {
+		dir, err = os.Open(root)
+	} else if cleanPath(root) {
+		dir, err = openBeneath("/", strings.TrimPrefix(root, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+	} else {
+		return nil, errors.New("root path")
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer func() { dir.Close() }()
+	parts := strings.Split(relative, "/")
+	for i, part := range parts {
+		f := flags
+		if i < len(parts)-1 {
+			f = syscall.O_RDONLY | syscall.O_DIRECTORY
+		}
+		fd, err := syscall.Openat(int(dir.Fd()), part, f|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, mode)
+		if err != nil {
+			return nil, err
+		}
+		next := os.NewFile(uintptr(fd), part)
+		if i == len(parts)-1 {
+			return next, nil
+		}
+		dir.Close()
+		dir = next
+	}
+	return nil, errors.New("path")
+}
+func openRegular(path string) (*os.File, error) {
+	if !cleanPath(path) {
+		return nil, errors.New("path")
+	}
+	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY, 0)
+	if err != nil {
+		return nil, err
+	}
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		f.Close()
+		return nil, errors.New("regular file required")
+	}
+	return f, nil
+}
+
+type subprocessWriter struct {
+	Staging, Executable string
+	PackageUID          int
+}
+type childSpec struct {
+	Subject   Subject `json:"subject"`
+	Dest      string  `json:"dest_dir"`
+	Name      string  `json:"name"`
+	Root      string  `json:"root"`
+	Temporary string  `json:"temporary"`
+}
+
+func (w subprocessWriter) Write(ctx context.Context, s Subject, staging, dest, name, root string) error {
+	parent, err := filepath.EvalSymlinks(filepath.Dir(w.Staging))
+	if err != nil {
+		return err
+	}
+	stagingRoot := filepath.Join(parent, filepath.Base(w.Staging))
+	f, err := openBeneath(stagingRoot, staging, syscall.O_RDONLY, 0)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		return errors.New("staging file")
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || int(st.Uid) != w.PackageUID || st.Nlink != 1 {
+		return errors.New("staging owner or hardlink")
+	}
+	job, _ := ctx.Value(writeJobKey{}).(string)
+	if !tokenRE.MatchString(job) {
+		return errors.New("write job")
+	}
+	random := make([]byte, 16)
+	if _, err = rand.Read(random); err != nil {
+		return err
+	}
+	temporary := ".synopkgland-" + job + "-" + hex.EncodeToString(random) + ".part"
+	// Retain this directory solely for cleanup. The writer opens it again after
+	// dropping identity and verifies the inode before creating any file.
+	dir, err := os.Open(dest)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	spec, err := json.Marshal(childSpec{Subject: s, Dest: dest, Name: name, Root: root, Temporary: temporary})
+	if err != nil {
+		return err
+	}
+	runChild := func(childCtx context.Context, mode string) error {
+		cmd := command(childCtx, w.Executable, []string{mode})
+		cmd.ExtraFiles = []*os.File{f, dir}
+		cmd.Stdin = strings.NewReader(string(spec))
+		cmd.Stdout = io.Discard
+		cmd.Stderr = io.Discard
+		return cmd.Run()
+	}
+	writeErr := runChild(ctx, "write-child")
+	// SIGKILL cannot execute a child defer. Cleanup uses the subject's identity
+	// and the retained directory, even if the subject has renamed that directory.
+	cleanup, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	cleanupErr := runChild(cleanup, "cleanup-child")
+	cancel()
+	if writeErr != nil || cleanupErr != nil {
+		return errors.New("write child refused")
+	}
+
+	// Unlink via the pinned staging parent; swapping staging never removes an
+	// unrelated object outside staging. A replacement is deliberately not deleted.
+	return removeStaging(stagingRoot, staging, info)
+}
+func removeStaging(root, relative string, original os.FileInfo) error {
+	parent := filepath.Dir(relative)
+	dir, err := os.Open(root)
+	if err != nil {
+		return err
+	}
+	if parent != "." {
+		dir.Close()
+		dir, err = openBeneath(root, parent, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+		if err != nil {
+			return err
+		}
+	}
+	defer dir.Close()
+	name := filepath.Base(relative)
+	fd, err := syscall.Openat(int(dir.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	now, err := f.Stat()
+	f.Close()
+	if err != nil || !os.SameFile(original, now) {
+		return errors.New("staging replaced")
+	}
+	return syscall.Unlinkat(int(dir.Fd()), name)
+}
+
+type realIdentity struct{}
+
+func (realIdentity) Setgroups(gs []int) error    { return syscall.Setgroups(gs) }
+func (realIdentity) Setresgid(a, b, c int) error { return syscall.Setresgid(a, b, c) }
+func (realIdentity) Setresuid(a, b, c int) error { return syscall.Setresuid(a, b, c) }
+func (realIdentity) IDs() (int, int, int, int) {
+	return os.Getuid(), os.Geteuid(), os.Getgid(), os.Getegid()
+}
+func (realIdentity) Groups() ([]int, error) { return os.Getgroups() }
+func writeChild() error                     { return runWriteChild(false) }
+func runWriteChild(cleanup bool) error {
+	if os.Geteuid() != 0 {
+		return errors.New("root required")
+	}
+	b, err := io.ReadAll(io.LimitReader(os.Stdin, maxRequest+1))
+	if err != nil || len(b) > maxRequest {
+		return errors.New("child spec")
+	}
+	var s childSpec
+	if strictJSON(b, &s) != nil {
+		return errors.New("child spec")
+	}
+	if !validTemporary(s.Temporary) || !validName(s.Name) || !cleanPath(s.Dest) || !cleanPath(s.Root) || !within(s.Root, s.Dest) {
+		return errors.New("scope")
+	}
+	if err = dropIdentity(realIdentity{}, s.Subject); err != nil {
+		return err
+	}
+	dir := os.NewFile(4, "destination")
+	defer dir.Close()
+	if cleanup {
+		info, err := dir.Stat()
+		if err != nil || !info.IsDir() {
+			return errors.New("cleanup directory")
+		}
+		err = syscall.Unlinkat(int(dir.Fd()), s.Temporary)
+		if err != nil && err != syscall.ENOENT {
+			return err
+		}
+		return dir.Sync()
+	}
+	return copyDestination(os.NewFile(3, "staging"), s.Dest, s.Name, s.Root, s.Temporary, dir)
+}
+func validTemporary(name string) bool {
+	return validName(name) && strings.HasPrefix(name, ".synopkgland-") && strings.HasSuffix(name, ".part")
+}
+func copyDestination(src *os.File, dest, name, root, temporary string, pinned *os.File) error {
+	if !validTemporary(temporary) || !validName(name) || !cleanPath(dest) || !cleanPath(root) {
+		return errors.New("path")
+	}
+	dir, err := os.Open(dest)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	info, err := dir.Stat()
+	if err != nil || !info.IsDir() {
+		return errors.New("directory")
+	}
+	expected, err := pinned.Stat()
+	if err != nil || !os.SameFile(info, expected) {
+		return errors.New("directory replaced")
+	}
+	actual, err := os.Readlink("/proc/self/fd/" + strconv.Itoa(int(dir.Fd())))
+	if err != nil || !within(root, actual) || strings.HasSuffix(actual, " (deleted)") {
+		return errors.New("scope")
+	}
+	fd, err := syscall.Openat(int(dir.Fd()), temporary, syscall.O_WRONLY|syscall.O_CREAT|syscall.O_EXCL|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600)
+	if err != nil {
+		return err
+	}
+	out := os.NewFile(uintptr(fd), temporary)
+	defer func() { out.Close(); syscall.Unlinkat(int(dir.Fd()), temporary) }()
+	// Recheck the pinned directory after creation, before copying any bytes.
+	actual, err = os.Readlink("/proc/self/fd/" + strconv.Itoa(int(dir.Fd())))
+	if err != nil || !within(root, actual) || strings.HasSuffix(actual, " (deleted)") {
+		return errors.New("scope")
+	}
+	if _, err = io.Copy(out, src); err != nil {
+		return err
+	}
+	if err = out.Sync(); err != nil {
+		return err
+	}
+	if err = out.Close(); err != nil {
+		return err
+	}
+	// link publishes complete fsynced bytes and atomically refuses any existing
+	// final file or symlink. Both paths resolve through the pinned directory.
+	procDir := "/proc/self/fd/" + strconv.Itoa(int(dir.Fd()))
+	if err = os.Link(procDir+"/"+temporary, procDir+"/"+name); err != nil {
+		return err
+	}
+	if err = syscall.Unlinkat(int(dir.Fd()), temporary); err != nil {
+		return err
+	}
+	return dir.Sync()
+}
+func lockFile(f *os.File) error { return syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) }