@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/revoke.go

@@ -1,109 +0,0 @@
-package helper
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"net"
-	"os"
-	"path/filepath"
-	"syscall"
-	"time"
-)
-
-// Called by the already approved root child after SO_PEERCRED authorization.
-// This endpoint can only withdraw the exact installed build's authority. It
-// cannot start a process, select a path, signal a PID, or replace an inventory.
-func packageRevoke(c Client, req Request) error {
-	if req.Op != "revoke" || req.Inventory != c.Expected || !c.Expected.Valid() || !digestPattern.MatchString(req.Nonce) {
-		return errTrust
-	}
-	if err := protected(c.StateDir, c.Owner, true); err != nil {
-		return err
-	}
-	f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	if err := protected(f.Name(), c.Owner, false); err != nil {
-		return err
-	}
-	if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
-		return errBusy
-	}
-	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
-	return policyUpdate(c, func(r *Record) error {
-		if r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" || !r.Enabled {
-			return errTrust
-		}
-		r.Enabled = false
-		r.Residual = true
-		r.Lifecycle.Phase = "fenced"
-		r.Lifecycle.Completion = ""
-		r.Lifecycle.Reason = "package-revoke"
-		return nil
-	})
-}
-
-// Revoke runs as the package UID. A socket acknowledgement proves only durable
-// withdrawal; success additionally requires the owning supervisor's sealed
-// terminal publication and absent runtime. No missing-socket shortcut.
-func (c Client) Revoke(ctx context.Context) error {
-	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	r, err := readRecord(c.StateDir, c.Owner)
-	if errors.Is(err, fs.ErrNotExist) {
-		return c.CheckStopped(ctx)
-	}
-	// The new build may manage the old disabled terminal publication without
-	// acquiring its authority or mutating it. This keeps uninstall possible
-	// before the user has approved the upgraded build.
-	if err == nil && !r.Enabled && c.managementStopped(r) {
-		return nil
-	}
-	if err != nil || r.Inventory != c.Expected {
-		return errTrust
-	}
-	if !r.Enabled {
-		if c.managementStopped(r) {
-			return nil
-		}
-		return errTrust
-	}
-	if r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
-		return errTrust
-	}
-	dialer := net.Dialer{Timeout: time.Second}
-	conn, err := dialer.DialContext(ctx, "unix", filepath.Join(c.RunDir, "helper.sock"))
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	if c.Peer == nil || c.Peer(conn.(*net.UnixConn)) != nil {
-		return errTrust
-	}
-	conn.SetDeadline(time.Now().Add(time.Second))
-	var nonce [32]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return err
-	}
-	req := Request{Inventory: c.Expected, Op: "revoke", Nonce: hex.EncodeToString(nonce[:])}
-	if err := json.NewEncoder(conn).Encode(req); err != nil {
-		return err
-	}
-	var res Response
-	d := json.NewDecoder(io.LimitReader(conn, 4097))
-	d.DisallowUnknownFields()
-	if d.Decode(&res) != nil || res.Inventory != c.Expected || res.Nonce != req.Nonce || !res.OK || res.Error != "" {
-		return errTrust
-	}
-	return waitHealthy(ctx, func(context.Context) bool {
-		r, err := readRecord(c.StateDir, c.Owner)
-		return err == nil && r.Inventory == c.Expected && !r.Enabled && c.managementStopped(r)
-	})
-}

package/templates/native-go/backend/internal/helper/revoke_test.go

@@ -1,121 +0,0 @@
-package helper
-
-import (
-	"context"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func TestPackageRevokeDurablyDisablesExactInventory(t *testing.T) {
-	c, _ := controlFixture(t)
-	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
-	record(t, c.Client, r)
-	if err := packageRevoke(c.Client, Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}); err != nil {
-		t.Fatal(err)
-	}
-	got, err := readRecord(c.StateDir, c.Owner)
-	if err != nil || got.Enabled || !got.Residual || got.Lifecycle.Phase != "fenced" {
-		t.Fatalf("not durably revoked: %+v %v", got, err)
-	}
-	if c.CheckStopped(context.Background()) == nil {
-		t.Fatal("revocation acknowledgement accepted as completion")
-	}
-	if err := c.Control(context.Background(), "recover"); err == nil {
-		t.Fatal("revoked approval recovered")
-	}
-}
-
-func TestRevokeAcknowledgementCannotCertifyQuiescence(t *testing.T) {
-	c, _ := controlFixture(t)
-	live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: req.Nonce, OK: true} })
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-	if c.Revoke(ctx) == nil {
-		t.Fatal("socket acknowledgement certified live process")
-	}
-}
-
-func TestRevokeRejectsUntrustedPeerAndWrongNonce(t *testing.T) {
-	for _, which := range []string{"peer", "nonce"} {
-		t.Run(which, func(t *testing.T) {
-			c, _ := controlFixture(t)
-			live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: "wrong", OK: true} })
-			if which == "peer" {
-				c.Peer = func(*net.UnixConn) error { return errTrust }
-			}
-			if c.Revoke(context.Background()) == nil {
-				t.Fatal("untrusted response accepted")
-			}
-		})
-	}
-}
-
-func TestRevokeNewBuildConsumesOldDisabledTerminalWithoutMutation(t *testing.T) {
-	c, f := controlFixture(t)
-	l := testLifecycle("fenced")
-	if err := createLifetime(c.Client, l); err != nil {
-		t.Fatal(err)
-	}
-	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
-	if err := cleanRuntime(c.Client, true); err != nil {
-		t.Fatal(err)
-	}
-	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
-		t.Fatal(err)
-	}
-	before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	c.Expected.Version = "1.0.0-0002"
-	if err := c.Revoke(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	if string(before) != string(after) {
-		t.Fatal("new build rewrote old publication")
-	}
-	if err := os.Remove(filepath.Join(c.StateDir, "completion-"+l.Epoch+".json")); err != nil {
-		t.Fatal(err)
-	}
-	if c.Revoke(context.Background()) == nil {
-		t.Fatal("missing terminal proof accepted")
-	}
-}
-
-func TestPackageRevokeRejectsWrongBuildInvalidFrameAndConcurrentEnable(t *testing.T) {
-	for _, kind := range []string{"build", "nonce", "operation", "busy"} {
-		t.Run(kind, func(t *testing.T) {
-			c, _ := controlFixture(t)
-			r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
-			record(t, c.Client, r)
-			req := Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}
-			switch kind {
-			case "build":
-				req.Inventory.Version = "0.1.0-0002"
-			case "nonce":
-				req.Nonce = ""
-			case "operation":
-				req.Op = "enable"
-			case "busy":
-				f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR, 0600)
-				if err != nil {
-					t.Fatal(err)
-				}
-				defer f.Close()
-				if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
-					t.Fatal(err)
-				}
-			}
-			if packageRevoke(c.Client, req) == nil {
-				t.Fatal("unsafe revoke accepted")
-			}
-			got, _ := readRecord(c.StateDir, c.Owner)
-			if !got.Enabled || got.Residual || got.Lifecycle.Phase != "running" {
-				t.Fatal("rejected request changed approval")
-			}
-		})
-	}
-}

package/templates/native-go/backend/internal/helper/s1r_actor_acl_linux_test.go

@@ -1,303 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"slices"
-	"strings"
-	"syscall"
-	"testing"
-
-	"golang.org/x/sys/unix"
-)
-
-func TestS1RKernelPermissionMatrix(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("disposable root VM only")
-	}
-	for _, c := range []struct {
-		name, scenario string
-		uid, gid       uint32
-		groups         []uint32
-	}{
-		{"alice-own", "alice/allow", s1rAlice, s1rAliceGID, []uint32{}},
-		{"bob-own", "bob/allow", s1rBob, s1rBobGID, []uint32{}},
-		{"alice-denied-bob", "bob/deny", s1rAlice, s1rAliceGID, []uint32{}},
-		{"bob-denied-alice", "alice/deny", s1rBob, s1rBobGID, []uint32{}},
-		{"supplementary-only", "supplementary/allow", s1rAlice, s1rAliceGID, []uint32{s1rExtra, s1rShared}},
-		{"supplementary-omitted", "supplementary/deny", s1rAlice, s1rAliceGID, []uint32{}},
-		{"primary-group-only", "supplementary/allow", s1rAlice, s1rShared, []uint32{}},
-		{"acl-named-user", "acl-allow/allow", s1rAlice, s1rAliceGID, []uint32{}},
-		{"acl-other-user", "acl-allow/deny", s1rBob, s1rBobGID, []uint32{}},
-		{"acl-directory-mask", "acl-mask/deny", s1rAlice, s1rAliceGID, []uint32{}},
-		{"acl-file-mask", "acl-file-mask/file-mask", s1rAlice, s1rAliceGID, []uint32{}},
-		{"acl-named-group", "acl-group/allow", s1rAlice, s1rAliceGID, []uint32{s1rShared}},
-		{"acl-named-group-omitted", "acl-group/deny", s1rAlice, s1rAliceGID, []uint32{}},
-		{"acl-group-mask-read-only", "acl-group-mask/read-only", s1rAlice, s1rAliceGID, []uint32{s1rShared}},
-		{"default-acl-writer", "inherit/allow", s1rAlice, s1rAliceGID, []uint32{}},
-		{"default-acl-reader", "inherit/read-only", s1rBob, s1rBobGID, []uint32{}},
-		{"readonly-directory", "readonly/read-only", s1rAlice, s1rAliceGID, []uint32{}},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			s1rRunActor(t, s1rActorSpec{UID: c.uid, GID: c.gid, Groups: c.groups, Root: s1rFixture(t), Scenario: c.scenario})
-		})
-	}
-}
-
-func s1rAssertCredentials(t *testing.T, spec s1rActorSpec) {
-	t.Helper()
-	u, e, s := unix.Getresuid()
-	g, eg, sg := unix.Getresgid()
-	if u != int(spec.UID) || e != u || s != u || g != int(spec.GID) || eg != g || sg != g {
-		t.Fatalf("UID/GID triplets: %d/%d/%d %d/%d/%d", u, e, s, g, eg, sg)
-	}
-	groups, err := syscall.Getgroups()
-	s1rMust(t, err)
-	want := make([]int, len(spec.Groups))
-	for i, v := range spec.Groups {
-		want[i] = int(v)
-	}
-	slices.Sort(groups)
-	slices.Sort(want)
-	if !slices.Equal(groups, want) {
-		t.Fatalf("setgroups got %v want %v", groups, want)
-	}
-	header := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
-	var caps [2]unix.CapUserData
-	s1rMust(t, unix.Capget(&header, &caps[0]))
-	if caps != ([2]unix.CapUserData{}) {
-		t.Fatalf("retained capabilities: %+v", caps)
-	}
-	nnp, err := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
-	s1rMust(t, err)
-	if nnp != 1 {
-		t.Fatal("no_new_privs", nnp)
-	}
-	keep, err := unix.PrctlRetInt(unix.PR_GET_KEEPCAPS, 0, 0, 0, 0)
-	s1rMust(t, err)
-	if keep != 0 {
-		t.Fatal("keepcaps", keep)
-	}
-	for _, attempt := range []struct {
-		name string
-		run  func() error
-	}{
-		{"setuid-root", func() error { return syscall.Setuid(0) }},
-		{"setresuid-root", func() error { return syscall.Setresuid(0, 0, 0) }},
-		{"setgid-root", func() error { return syscall.Setgid(0) }},
-		{"setresgid-root", func() error { return syscall.Setresgid(0, 0, 0) }},
-		{"setgroups-root", func() error { return syscall.Setgroups([]int{0}) }},
-		{"cap-dac-override", func() error {
-			c := [2]unix.CapUserData{{Effective: 2, Permitted: 2}}
-			return unix.Capset(&header, &c[0])
-		}},
-	} {
-		if err := attempt.run(); err != unix.EPERM {
-			t.Fatalf("privilege regain %s: %v", attempt.name, err)
-		}
-	}
-	u, e, s = unix.Getresuid()
-	g, eg, sg = unix.Getresgid()
-	if u != int(spec.UID) || e != u || s != u || g != int(spec.GID) || eg != g || sg != g {
-		t.Fatal("regain changed credentials")
-	}
-	t.Logf("credentials UID=%d/%d/%d GID=%d/%d/%d groups=%v caps=0 NNP=1; six regain attempts=EPERM", u, e, s, g, eg, sg, groups)
-}
-
-func s1rActorMatrix(t *testing.T, spec s1rActorSpec) {
-	parts := strings.Split(spec.Scenario, "/")
-	if parts[0] == "races" {
-		s1rActorRaces(t, spec, parts[1])
-		return
-	}
-	if parts[0] == "inherited" {
-		s1rCheckInherited(t, spec)
-		return
-	}
-	root := spec.Root + "/" + parts[0]
-	mode := parts[1]
-	for _, op := range []string{"stat", "list", "read", "stream", "create", "write", "publish"} {
-		t.Run(op, func(t *testing.T) {
-			allow := mode == "allow" || (mode == "read-only" && slices.Contains([]string{"stat", "list", "read", "stream"}, op)) || (mode == "file-mask" && slices.Contains([]string{"list", "create", "write", "publish"}, op))
-			pin, code := pinReadOnlyRoot(root)
-			if code != "" {
-				if allow || code != ErrDenied {
-					t.Fatal("root search", code, "allow", allow)
-				}
-				t.Log("kernel denies root search")
-				return
-			}
-			defer pin.Close()
-			ctx := context.Background()
-			var result readOnlyResult
-			var data []byte
-			switch op {
-			case "stat", "list", "read":
-				work := readWork(pin, "file")
-				if op == "stat" {
-					work.Action = ActionStat
-					work.MaxBytes = 0
-				}
-				if op == "list" {
-					work.Action = ActionList
-					work.Segments = []string{}
-					work.MaxBytes = 0
-					work.Limit = 20
-				}
-				result, data = executeReadOnly(ctx, pin, work, fixtureReadOnlyACL{})
-				code = result.Code
-				if allow {
-					if op == "read" && string(data) != "canary:"+parts[0] {
-						t.Fatal("read canary", string(data))
-					}
-					if op == "stat" && result.Entry == nil {
-						t.Fatal("missing stat")
-					}
-					if op == "list" {
-						found := false
-						if result.List != nil {
-							for _, e := range result.List.Entries {
-								if e.Name == "file" {
-									found = true
-								}
-							}
-						}
-						if found != (mode != "file-mask") {
-							t.Fatal("list filtered file", result)
-						}
-					}
-				} else if len(data) > 0 || result.Entry != nil || result.List != nil {
-					t.Fatal("denial leaked bytes/metadata", result)
-				}
-			case "stream":
-				work := readWork(pin, "file")
-				work.Action = ActionReadStream
-				x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-				code = r.Code
-				if x != nil {
-					defer x.Close()
-					for x.remaining > 0 {
-						n := uint32(3)
-						if uint64(n) > x.remaining {
-							n = uint32(x.remaining)
-						}
-						b, c := x.ReadChunk(ctx, n)
-						if c != "" {
-							code = c
-							break
-						}
-						data = append(data, b...)
-					}
-				}
-				if allow && string(data) != "canary:"+parts[0] {
-					t.Fatal("stream canary", string(data))
-				}
-				if !allow && (x != nil || len(data) > 0 || r.Bytes != 0) {
-					t.Fatal("denied stream", r)
-				}
-			default:
-				staged := op == "publish"
-				work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new-" + op}, MaxBytes: 3}
-				if staged {
-					work.Action = ActionWriteStream
-					work.Staged = true
-				}
-				x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-				code = c
-				if x != nil {
-					defer x.Close()
-				}
-				if code == "" {
-					if op == "create" {
-						if !x.Receipt().Created || x.Receipt().BytesWritten != 0 {
-							t.Fatal(x.Receipt())
-						}
-					} else {
-						r, c := x.WriteChunk(ctx, []byte("abc"))
-						code = c
-						if c == "" {
-							r, code = x.Commit(ctx)
-						}
-						if allow && (!r.Committed || !r.Published || r.BytesWritten != 3) {
-							t.Fatal("write receipt", r, code)
-						}
-					}
-				}
-				if !allow {
-					if _, err := os.Stat(root + "/new-" + op); err == nil {
-						t.Fatal("denied write created destination")
-					}
-				}
-			}
-			if allow && code != "" || !allow && code != ErrDenied {
-				t.Fatalf("%s mode=%s expected allow=%v got=%s", op, mode, allow, code)
-			}
-			t.Logf("%s allow=%v code=%q", op, allow, code)
-		})
-	}
-}
-
-func s1rCheckInherited(t *testing.T, spec s1rActorSpec) {
-	root := spec.Root + "/inherit"
-	pin, code := pinReadOnlyRoot(root)
-	if code != "" {
-		t.Fatal(code)
-	}
-	defer pin.Close()
-	for _, name := range []string{"new-create", "new-write", "new-publish"} {
-		result, data := executeReadOnly(context.Background(), pin, readWork(pin, name), fixtureReadOnlyACL{})
-		want := "abc"
-		if name == "new-create" {
-			want = ""
-		}
-		if result.Code != "" || string(data) != want {
-			t.Fatal("inherited read", name, result, string(data))
-		}
-	}
-	if _, code := openActorWriteTransfer(context.Background(), pin, writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"bob-must-not-create"}, MaxBytes: 1}, fixtureReadOnlyACL{}); code != ErrDenied {
-		t.Fatal("inherited directory write", code)
-	}
-	t.Log("Bob reads Alice's created/written/published files via inherited ACL; cannot create")
-}
-
-func TestS1RDefaultACLInheritance(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("disposable root VM only")
-	}
-	root := s1rFixture(t)
-	s1rRunActor(t, s1rActorSpec{UID: s1rAlice, GID: s1rAliceGID, Groups: []uint32{}, Root: root, Scenario: "inherit/allow"})
-	for _, name := range []string{"new-create", "new-write", "new-publish"} {
-		b, err := exec.Command("/usr/bin/getfacl", "-cpn", root+"/inherit/"+name).CombinedOutput()
-		s1rMust(t, err)
-		if !strings.Contains(string(b), "user:23002:r-x") || !strings.Contains(string(b), "mask::rw-") {
-			t.Fatalf("missing inherited ACL: %s\n%s", name, b)
-		}
-		t.Logf("%s inherited ACL:\n%s", name, b)
-	}
-	s1rRunActor(t, s1rActorSpec{UID: s1rBob, GID: s1rBobGID, Groups: []uint32{}, Root: root, Scenario: "inherited/check"})
-}
-
-func TestS1RSymlinkAndRenameRaces(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("disposable root VM only")
-	}
-	for _, kind := range []string{"symlink", "stat-rename", "list-rename", "read-rename", "stream-rename", "create-rename", "publish-rename", "publish-symlink", "publish-permission-loss", "open-fd-write-permission-loss"} {
-		t.Run(kind, func(t *testing.T) {
-			s1rRunActor(t, s1rActorSpec{UID: s1rAlice, GID: s1rAliceGID, Groups: []uint32{}, Root: s1rFixture(t), Scenario: "races/" + kind})
-		})
-	}
-}
-
-func TestS1RActorProcess(t *testing.T) {
-	raw := os.Getenv("S1R_ACTOR_SPEC")
-	if raw == "" {
-		t.Skip("isolated actor subprocess only")
-	}
-	var spec s1rActorSpec
-	s1rMust(t, json.Unmarshal([]byte(raw), &spec))
-	s1rDropActor(t, spec)
-	s1rAssertCredentials(t, spec)
-	s1rActorMatrix(t, spec)
-}