@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/_executor/platform_linux_test.go

@@ -0,0 +1,247 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+type switchStub struct {
+	calls []string
+	fail  string
+	s     Subject
+	wrong bool
+}
+
+func (s *switchStub) step(name string) error {
+	s.calls = append(s.calls, name)
+	if s.fail == name {
+		return errors.New("fail")
+	}
+	return nil
+}
+func (s *switchStub) Setgroups([]int) error         { return s.step("groups") }
+func (s *switchStub) Setresgid(int, int, int) error { return s.step("gid") }
+func (s *switchStub) Setresuid(int, int, int) error { return s.step("uid") }
+func (s *switchStub) IDs() (int, int, int, int) {
+	if s.wrong {
+		return 0, 0, 0, 0
+	}
+	return s.s.UID, s.s.UID, s.s.GID, s.s.GID
+}
+func (s *switchStub) Groups() ([]int, error) { return s.s.Groups, nil }
+func TestDropOrderAndFailures(t *testing.T) {
+	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 123}}
+	for _, fail := range []string{"", "groups", "gid", "uid"} {
+		s := &switchStub{fail: fail, s: subject}
+		err := dropIdentity(s, subject)
+		if (err == nil) != (fail == "") {
+			t.Fatal(err)
+		}
+		expected := []string{"groups", "gid", "uid"}
+		if fail != "" {
+			for i, n := range expected {
+				if n == fail {
+					expected = expected[:i+1]
+					break
+				}
+			}
+		}
+		if !reflect.DeepEqual(s.calls, expected) {
+			t.Fatal(s.calls)
+		}
+	}
+	s := &switchStub{s: subject, wrong: true}
+	if dropIdentity(s, subject) == nil {
+		t.Fatal("identity not verified")
+	}
+}
+func TestLinuxStagingSymlinks(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	os.WriteFile(filepath.Join(outside, "source"), []byte("secret"), 0600)
+	os.Symlink(outside, filepath.Join(root, "escape"))
+	os.Symlink(filepath.Join(outside, "source"), filepath.Join(root, "file"))
+	for _, p := range []string{"escape/source", "file", "../source"} {
+		if f, err := openBeneath(root, p, syscall.O_RDONLY, 0); err == nil {
+			f.Close()
+			t.Fatal("symlink", p)
+		}
+	}
+}
+func TestLinuxCopyScopeAndNoOverwrite(t *testing.T) {
+	root := t.TempDir()
+	out := t.TempDir()
+	src, err := os.CreateTemp(t.TempDir(), "source")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer src.Close()
+	src.WriteString("content")
+	src.Seek(0, 0)
+	pinned, _ := os.Open(root)
+	defer pinned.Close()
+	if err = copyDestination(src, root, "new", root, ".synopkgland-job1-test.part", pinned); err != nil {
+		t.Fatal(err)
+	}
+	src.Seek(0, 0)
+	if err = copyDestination(src, root, "new", root, ".synopkgland-job1-test.part", pinned); err == nil {
+		t.Fatal("overwrite")
+	}
+	b, _ := os.ReadFile(filepath.Join(root, "new"))
+	if string(b) != "content" {
+		t.Fatal(string(b))
+	}
+	os.Symlink(out, filepath.Join(root, "escape"))
+	src.Seek(0, 0)
+	if err = copyDestination(src, filepath.Join(root, "escape"), "new", root, ".synopkgland-job1-test.part", pinned); err == nil {
+		t.Fatal("escape")
+	}
+	if _, err = os.Stat(filepath.Join(out, "new")); !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"..", "../a", "a/b", "a\x00b", "a\nb"} {
+		if copyDestination(src, root, name, root, ".synopkgland-job1-test.part", pinned) == nil {
+			t.Fatal(name)
+		}
+	}
+}
+func TestLinuxPeerCredential(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "sock")
+	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	done := make(chan error, 1)
+	go func() {
+		c, err := ln.AcceptUnix()
+		if err != nil {
+			done <- err
+			return
+		}
+		defer c.Close()
+		uid, err := peerUID(c)
+		if err == nil && uid != os.Getuid() {
+			err = errors.New("uid mismatch")
+		}
+		done <- err
+	}()
+	c, err := net.Dial("unix", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c.Close()
+	if err = <-done; err != nil {
+		t.Fatal(err)
+	}
+}
+func TestLinuxPIDLock(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pid")
+	a, _ := os.Create(path)
+	defer a.Close()
+	b, _ := os.OpenFile(path, os.O_RDWR, 0600)
+	defer b.Close()
+	if lockFile(a) != nil || lockFile(b) == nil {
+		t.Fatal("duplicate lock")
+	}
+}
+func TestScriptDigest(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("root-owned script test")
+	}
+	root := t.TempDir()
+	os.Mkdir(filepath.Join(root, "root"), 0700)
+	p := filepath.Join(root, "root/whoami.sh")
+	os.WriteFile(p, []byte("echo p2probe\n"), 0600)
+	digest, err := digestFile(context.Background(), p, maxExecutorBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := scriptRunner{Dir: root}
+	out, err := r.Run(context.Background(), "whoami", digest)
+	if err != nil || strings.TrimSpace(out) != "p2probe" {
+		t.Fatal(out, err)
+	}
+	os.WriteFile(p, []byte("echo changed\n"), 0600)
+	if _, err = r.Run(context.Background(), "whoami", digest); err == nil {
+		t.Fatal("digest")
+	}
+}
+
+func TestLinuxStagingRootSymlink(t *testing.T) {
+	root, outside := t.TempDir(), t.TempDir()
+	os.WriteFile(filepath.Join(outside, "source"), []byte("secret"), 0600)
+	os.Symlink(outside, filepath.Join(root, "stage"))
+	if f, err := openBeneath(filepath.Join(root, "stage"), "source", syscall.O_RDONLY, 0); err == nil {
+		f.Close()
+		t.Fatal("staging root symlink accepted")
+	}
+}
+func TestLinuxStagingHardlinkAndOwner(t *testing.T) {
+	root := t.TempDir()
+	p := filepath.Join(root, "source")
+	os.WriteFile(p, []byte("secret"), 0600)
+	subject := Subject{UID: 1200, GID: 100, Groups: []int{100}}
+	w := subprocessWriter{Staging: root, Executable: "/must-not-execute", PackageUID: os.Getuid() + 1}
+	if err := w.Write(context.WithValue(context.Background(), writeJobKey{}, "job1"), subject, "source", root, "new", root); err == nil || !strings.Contains(err.Error(), "owner or hardlink") {
+		t.Fatal(err)
+	}
+	w.PackageUID = os.Getuid()
+	os.Link(p, filepath.Join(root, "linked"))
+	if err := w.Write(context.WithValue(context.Background(), writeJobKey{}, "job1"), subject, "source", root, "new", root); err == nil || !strings.Contains(err.Error(), "owner or hardlink") {
+		t.Fatal(err)
+	}
+}
+
+func TestScriptTimeoutAndOutputLimit(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("root-owned script test")
+	}
+	dir := t.TempDir()
+	os.Mkdir(filepath.Join(dir, "root"), 0700)
+	p := filepath.Join(dir, "root/probe.sh")
+	r := scriptRunner{Dir: dir}
+	os.WriteFile(p, []byte("sleep 10\n"), 0600)
+	digest, _ := digestFile(context.Background(), p, maxExecutorBytes)
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if _, err := r.Run(ctx, "probe", digest); err == nil {
+		t.Fatal("timeout accepted")
+	}
+	os.WriteFile(p, []byte("head -c 1048577 /dev/zero\n"), 0600)
+	digest, _ = digestFile(context.Background(), p, maxExecutorBytes)
+	if _, err := r.Run(context.Background(), "probe", digest); err == nil {
+		t.Fatal("excessive output accepted")
+	}
+}
+
+func TestLinuxCopyFailureNeverPublishesPartialDestination(t *testing.T) {
+	root := t.TempDir()
+	pinned, err := os.Open(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pinned.Close()
+	src, err := os.CreateTemp(t.TempDir(), "source")
+	if err != nil {
+		t.Fatal(err)
+	}
+	src.Close()
+	if err = copyDestination(src, root, "final", root, ".synopkgland-job1-failed.part", pinned); err == nil {
+		t.Fatal("closed source succeeded")
+	}
+	entries, err := os.ReadDir(root)
+	if err != nil || len(entries) != 0 {
+		t.Fatal("failure published or leaked bytes", entries, err)
+	}
+}

package/dist/templates/_executor/platform_other.go

@@ -0,0 +1,42 @@
+//go:build !linux
+
+package main
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"os/exec"
+)
+
+func verifySocket(string, int, int, os.FileMode) error { return errLinux }
+
+var errLinux = errors.New("executor requires Linux")
+
+func ownedByRoot(os.FileInfo) bool  { return false }
+func configureProcess(*exec.Cmd)    {}
+func peerUID(net.Conn) (int, error) { return -1, errLinux }
+func openRegular(path string) (*os.File, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() {
+		return nil, errLinux
+	}
+	return os.Open(path)
+}
+
+type subprocessWriter struct {
+	Staging, Executable string
+	PackageUID          int
+}
+
+func (subprocessWriter) Write(context.Context, Subject, string, string, string, string) error {
+	return errLinux
+}
+func writeChild() error       { return errLinux }
+func lockFile(*os.File) error { return errLinux }
+
+func runWriteChild(bool) error { return errLinux }

package/dist/templates/_executor/process.go

@@ -0,0 +1,139 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+const maxOutput = 1 << 20
+
+type cappedBuffer struct {
+	buf bytes.Buffer
+	n   int
+}
+
+func (b *cappedBuffer) Write(p []byte) (int, error) {
+	if len(p) > maxOutput-b.n {
+		return 0, errors.New("output limit")
+	}
+	n, err := b.buf.Write(p)
+	b.n += n
+	return n, err
+}
+
+type processCommand struct{}
+
+func command(ctx context.Context, path string, args []string) *exec.Cmd {
+	cmd := exec.CommandContext(ctx, path, args...)
+	cmd.Env = []string{"PATH=/usr/syno/bin:/usr/syno/sbin:/usr/bin:/bin", "LANG=C", "HOME=/"}
+	cmd.Dir = "/"
+	cmd.WaitDelay = time.Second
+	configureProcess(cmd)
+	return cmd
+}
+func (processCommand) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	cmd := command(ctx, path, args)
+	var out cappedBuffer
+	cmd.Stdout = &out
+	cmd.Stderr = io.Discard
+	if err := cmd.Run(); err != nil {
+		return nil, err
+	}
+	return out.buf.Bytes(), nil
+}
+
+type scriptRunner struct{ Dir string }
+
+func (r scriptRunner) Run(ctx context.Context, name, digest string) (string, error) {
+	if !tokenRE.MatchString(name) || !idRE.MatchString(digest) {
+		return "", errors.New("script")
+	}
+	path := filepath.Join(r.Dir, "root", name+".sh")
+	// Open once, hash and execute that same inode via an inherited descriptor.
+	f, err := openRegular(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || info.Mode().Perm()&0022 != 0 || !ownedByRoot(info) {
+		return "", errors.New("script ownership")
+	}
+	h := sha256.New()
+	if _, err = io.Copy(h, f); err != nil {
+		return "", err
+	}
+	if hex.EncodeToString(h.Sum(nil)) != digest {
+		return "", errors.New("digest")
+	}
+	if _, err = f.Seek(0, 0); err != nil {
+		return "", err
+	}
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	cmd := command(ctx, "/bin/sh", []string{"/proc/self/fd/3"})
+	cmd.ExtraFiles = []*os.File{f}
+	var out cappedBuffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	if err = cmd.Run(); err != nil {
+		return "", err
+	}
+	return out.buf.String(), nil
+}
+
+const maxExecutorBytes int64 = 128 << 20
+const maxPolicyBytes int64 = 1 << 20
+
+func digestFile(ctx context.Context, path string, limit int64) (string, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return "", err
+	}
+	if !info.Mode().IsRegular() || info.Size() > limit {
+		return "", errors.New("digest file limit")
+	}
+	f, err := openRegular(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	info, err = f.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() > limit {
+		return "", errors.New("digest file limit")
+	}
+	h := sha256.New()
+	buf := make([]byte, 64<<10)
+	var total int64
+	for {
+		if err := ctx.Err(); err != nil {
+			return "", err
+		}
+		n, err := f.Read(buf)
+		total += int64(n)
+		if total > limit {
+			return "", errors.New("digest file limit")
+		}
+		h.Write(buf[:n])
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return "", err
+		}
+	}
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}

package/dist/templates/_executor/socket_linux_test.go

@@ -0,0 +1,46 @@
+//go:build linux
+
+package main
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestBoundSocketPermissionsAreVerifiedOnFilesystemInode(t *testing.T) {
+	root := t.TempDir()
+	old := syscall.Umask(0077)
+	defer syscall.Umask(old)
+	socket := filepath.Join(root, "executor.sock")
+	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	if err = os.Chown(socket, os.Geteuid(), os.Getegid()); err != nil {
+		t.Fatal(err)
+	}
+	if err = os.Chmod(socket, 0660); err != nil {
+		t.Fatal(err)
+	}
+	if err = verifySocket(socket, os.Geteuid(), os.Getegid(), 0660); err != nil {
+		t.Fatal(err)
+	}
+	if verifySocket(socket, os.Geteuid()+1, os.Getegid(), 0660) == nil {
+		t.Fatal("wrong owner accepted")
+	}
+	if verifySocket(socket, os.Geteuid(), os.Getegid()+1, 0660) == nil {
+		t.Fatal("wrong group accepted")
+	}
+	if verifySocket(socket, os.Geteuid(), os.Getegid(), 0600) == nil {
+		t.Fatal("wrong mode accepted")
+	}
+	link := socket + "-link"
+	os.Symlink(socket, link)
+	if verifySocket(link, os.Geteuid(), os.Getegid(), 0660) == nil {
+		t.Fatal("symlink accepted")
+	}
+}

package/dist/templates/_executor/store.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+)
+
+// Dir and its ancestors are validated root-owned at service startup. No client
+// supplies a store path. Atomic replacement + fsync persists revocations.
+type Store struct{ Dir string }
+
+func (s *Store) Put(d Delegation) error {
+	if !idRE.MatchString(d.ID) {
+		return errors.New("id")
+	}
+	b, err := json.Marshal(d)
+	if err != nil {
+		return err
+	}
+	f, err := os.CreateTemp(s.Dir, ".delegation-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	defer f.Close()
+	if err = f.Chmod(0600); err != nil {
+		return err
+	}
+	if _, err = f.Write(b); err != nil {
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		return err
+	}
+	if err = f.Close(); err != nil {
+		return err
+	}
+	if err = os.Rename(f.Name(), filepath.Join(s.Dir, d.ID+".json")); err != nil {
+		return err
+	}
+	dir, err := os.Open(s.Dir)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	return dir.Sync()
+}
+func (s *Store) Get(id string) (Delegation, error) {
+	var d Delegation
+	if !idRE.MatchString(id) {
+		return d, errors.New("id")
+	}
+	path := filepath.Join(s.Dir, id+".json")
+	info, err := os.Lstat(path)
+	if err != nil {
+		return d, err
+	}
+	if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || info.Size() > maxRequest {
+		return d, errors.New("store mode")
+	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return d, err
+	}
+	err = strictJSON(b, &d)
+	if d.ID != id {
+		return d, errors.New("id mismatch")
+	}
+	return d, err
+}
+func (s *Store) List() ([]Delegation, error) {
+	entries, err := os.ReadDir(s.Dir)
+	if err != nil {
+		return nil, err
+	}
+	ds := []Delegation{}
+	for _, ent := range entries {
+		if filepath.Ext(ent.Name()) != ".json" {
+			continue
+		}
+		d, err := s.Get(ent.Name()[:len(ent.Name())-5])
+		if err != nil {
+			return nil, err
+		}
+		ds = append(ds, d)
+	}
+	return ds, nil
+}

package/dist/templates/_executor/task_race_review_test.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+type reviewEditDuringDelete struct {
+	schedulerFixture
+	calls []string
+}
+
+func (s *reviewEditDuringDelete) Exec(ctx context.Context, path string, args []string) ([]byte, error) {
+	for _, a := range args {
+		if strings.HasPrefix(a, "method=") {
+			s.calls = append(s.calls, a)
+		}
+	}
+	if contains(args, "method=delete") {
+		s.changed = true
+	}
+	return s.schedulerFixture.Exec(ctx, path, args)
+}
+func TestReviewPurgeAcceptedAdminRaceLogsRemainingTasksWithoutRetry(t *testing.T) {
+	cmd := &reviewEditDuringDelete{}
+	inv := taskInventory{Package: "TestApp", ExecutorDigest: strings.Repeat("a", 64), PolicyDigest: strings.Repeat("b", 64), Tasks: []approvedTask{{Kind: "boot", Name: "TestApp executor boot", ScriptDigest: canonicalTaskDigest(t, "boot")}, {Kind: "control", Name: "TestApp executor control", ScriptDigest: canonicalTaskDigest(t, "control")}}}
+	logs := []string{}
+	purgeTasks(context.Background(), &liveDSM{Command: cmd}, "TestApp", inv, func(s string) { logs = append(logs, s) })
+	if len(cmd.deleted) != 1 {
+		t.Fatal("must delete immediately once, skip subsequent changed definition", cmd.deleted)
+	}
+	found := false
+	for _, s := range logs {
+		if strings.Contains(s, "boot") && strings.Contains(s, "remains") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("remaining replaced boot task not logged", logs)
+	}
+	for i, c := range cmd.calls {
+		if c == "method=delete" && (i == 0 || cmd.calls[i-1] != "method=get" || i+1 >= len(cmd.calls) || cmd.calls[i+1] != "method=get") {
+			t.Fatal("expected get/delete/readback without retry", cmd.calls)
+		}
+	}
+}