@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/dsm_probe_transport_linux.go

@@ -1,151 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"debug/elf"
-	"dsmapp/internal/dsmprobe"
-	"encoding/hex"
-	"encoding/json"
-	"golang.org/x/sys/unix"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"syscall"
-	"time"
-)
-
-// Private root-selected static artifact. No PATH search, shell, inherited
-// environment, script interpreter, dlopen, or original pathname reopen.
-type dsmStaticProbeTransport struct{ path, digest string }
-
-func (p *dsmStaticProbeTransport) pin(ctx context.Context) (*os.File, Code) {
-	if p == nil || !digestPattern.MatchString(p.digest) || !filepath.IsAbs(p.path) || filepath.Clean(p.path) != p.path {
-		return nil, ErrUnsupported
-	}
-	dir, e := openGrantDirectory(filepath.Dir(p.path))
-	if e != nil {
-		return nil, ErrDenied
-	}
-	defer dir.Close()
-	fd, e := unix.Openat(int(dir.Fd()), filepath.Base(p.path), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC|unix.O_NONBLOCK, 0)
-	if e != nil {
-		return nil, ErrUnavailable
-	}
-	f := os.NewFile(uintptr(fd), "verified-probe")
-	fail := func(c Code) (*os.File, Code) { f.Close(); return nil, c }
-	var st unix.Stat_t
-	if unix.Fstat(fd, &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Uid != 0 || st.Gid != 0 || st.Nlink != 1 || st.Mode&0022 != 0 || st.Mode&0111 == 0 || st.Mode&06000 != 0 || st.Size <= 0 || st.Size > 32<<20 {
-		return fail(ErrDenied)
-	}
-	h := sha256.New()
-	buf := make([]byte, 65536)
-	for {
-		if c := nativeContextCode(ctx); c != "" {
-			return fail(c)
-		}
-		n, e := f.Read(buf)
-		h.Write(buf[:n])
-		if e == io.EOF {
-			break
-		}
-		if e != nil {
-			return fail(ErrUnavailable)
-		}
-	}
-	if hex.EncodeToString(h.Sum(nil)) != p.digest {
-		return fail(ErrDenied)
-	}
-	image, e := elf.NewFile(f)
-	if e != nil {
-		return fail(ErrUnsupported)
-	}
-	if image.Class != elf.ELFCLASS64 || image.Data != elf.ELFDATA2LSB || (runtime.GOARCH == "amd64" && image.Machine != elf.EM_X86_64) || (runtime.GOARCH == "arm64" && image.Machine != elf.EM_AARCH64) || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") {
-		return fail(ErrUnsupported)
-	}
-	for _, prog := range image.Progs {
-		if prog.Type == elf.PT_INTERP {
-			return fail(ErrUnsupported)
-		}
-	}
-	deps, e := image.DynString(elf.DT_NEEDED)
-	if e != nil || len(deps) != 0 {
-		return fail(ErrUnsupported)
-	}
-	var after unix.Stat_t
-	if unix.Fstat(fd, &after) != nil || !sameReadOnlyObject(st, after) || st.Size != after.Size || st.Mtim != after.Mtim || st.Ctim != after.Ctim {
-		return fail(ErrStale)
-	}
-	if c := nativeContextCode(ctx); c != "" {
-		return fail(c)
-	}
-	return f, ""
-}
-
-type probeBoundedOutput struct {
-	buf     bytes.Buffer
-	maximum int
-}
-
-func (b *probeBoundedOutput) Write(p []byte) (int, error) {
-	if len(p) > b.maximum-b.buf.Len() {
-		return 0, io.ErrShortBuffer
-	}
-	return b.buf.Write(p)
-}
-func (p *dsmStaticProbeTransport) Observe(ctx context.Context, r dsmprobe.Request) (dsmprobe.Response, Code) {
-	var out dsmprobe.Response
-	if r.Kind == "acl" {
-		return out, ErrUnsupported
-	}
-	if r.Validate() != nil {
-		return out, ErrInvalid
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	f, c := p.pin(ctx)
-	if c != "" {
-		return out, c
-	}
-	defer f.Close()
-	return runPinnedDSMProbe(ctx, f, r)
-}
-func runPinnedDSMProbe(ctx context.Context, f *os.File, r dsmprobe.Request) (dsmprobe.Response, Code) {
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	var out dsmprobe.Response
-	var c Code
-	data, e := json.Marshal(r)
-	if e != nil || len(data) > dsmprobe.MaxRequestBytes {
-		return out, ErrLimit
-	}
-	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", "--wire-v1")
-	cmd.ExtraFiles = []*os.File{f}
-	cmd.Env = []string{"LANG=C", "TZ=UTC"}
-	cmd.Stdin = bytes.NewReader(data)
-	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
-	// No helper-side credential switching. Existing S2 operation credentials and
-	// lease must own the invocation; the response independently checks the actor.
-	cmd.WaitDelay = 250 * time.Millisecond
-	stdout := &probeBoundedOutput{maximum: dsmprobe.MaxResponseBytes}
-	stderr := &probeBoundedOutput{maximum: 1024}
-	cmd.Stdout = stdout
-	cmd.Stderr = stderr
-	e = cmd.Run()
-	if c = nativeContextCode(ctx); c != "" {
-		return out, c
-	}
-	if e != nil || stderr.buf.Len() != 0 {
-		return out, ErrUnavailable
-	}
-	if c = decodeDataObject(bytes.NewReader(stdout.buf.Bytes()), &out, dsmprobe.MaxResponseBytes); c != "" {
-		return dsmprobe.Response{}, c
-	}
-	if out.Version != dsmprobe.Protocol || out.Nonce != r.Nonce {
-		return dsmprobe.Response{}, ErrStale
-	}
-	return out, ""
-}

package/dist/templates/native-go/backend/internal/helper/dsm_probe_transport_linux_test.go

@@ -1,66 +0,0 @@
-package helper
-
-import (
-	"context"
-	"crypto/sha256"
-	"dsmapp/internal/dsmprobe"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestDSMProductionTransportNeverRunsExperimentalACLProbe(t *testing.T) {
-	p := &dsmStaticProbeTransport{path: "/not-a-probe", digest: grantRef('a')}
-	r := dsmprobe.Request{Version: 1, Nonce: grantRef('b'), Kind: "acl", Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, ExpectedRuntime: grantRef('c')}
-	if _, c := p.Observe(context.Background(), r); c != ErrUnsupported {
-		t.Fatal("experimental syscall request accepted by production transport", c)
-	}
-}
-
-func TestDSMPinnedStaticProbeIntegrityAndRename(t *testing.T) {
-	dir, _, _ := rootGrantFixture(t)
-	binary, e := os.ReadFile("/probe-bin")
-	if e != nil {
-		t.Fatal("VM static probe fixture missing", e)
-	}
-	path := filepath.Join(dir, "static-probe")
-	if e = os.WriteFile(path, binary, 0755); e != nil {
-		t.Fatal(e)
-	}
-	digest := fmt.Sprintf("%x", sha256.Sum256(binary))
-	p := &dsmStaticProbeTransport{path: path, digest: digest}
-	r := dsmprobe.Request{Version: 1, Nonce: grantRef('a'), Kind: "runtime", Groups: []uint32{}}
-	out, c := p.Observe(context.Background(), r)
-	if c != "" || out.Nonce != r.Nonce || out.Account.NativeKnown || out.ACL.Certified {
-		t.Fatal(c, out)
-	}
-	pin, c := p.pin(context.Background())
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer pin.Close()
-	if e = os.Rename(path, path+"-old"); e != nil {
-		t.Fatal(e)
-	}
-	if e = os.WriteFile(path, []byte("#!/bin/sh\nexit 0\n"), 0755); e != nil {
-		t.Fatal(e)
-	}
-	out, c = runPinnedDSMProbe(context.Background(), pin, r)
-	if c != "" || out.Nonce != r.Nonce {
-		t.Fatal("reopened replaced pathname", c)
-	}
-	if _, c = p.Observe(context.Background(), r); c == "" {
-		t.Fatal("digest mismatch accepted")
-	}
-	p.digest = fmt.Sprintf("%x", sha256.Sum256([]byte("#!/bin/sh\nexit 0\n")))
-	if _, c = p.Observe(context.Background(), r); c != ErrUnsupported {
-		t.Fatal("script accepted", c)
-	}
-	if e = os.Chmod(path, 0777); e != nil {
-		t.Fatal(e)
-	}
-	if _, c = p.Observe(context.Background(), r); c != ErrDenied {
-		t.Fatal("writable binary accepted", c)
-	}
-}