@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/supervisor_linux.go

@@ -1,367 +0,0 @@
-//go:build !synopkgland_sdk_workers
-
-//line dsmapp/internal/helper/supervisor_linux.go:1
-package helper
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"syscall"
-	"time"
-)
-
-func setParentDeath() error {
-	_, _, err := syscall.Syscall6(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0, 0, 0, 0)
-	if err != 0 {
-		return err
-	}
-	return nil
-}
-
-type ownedLinuxChild struct {
-	process *os.Process
-	reaped  bool
-}
-
-func (c *ownedLinuxChild) exited() (bool, error) {
-	if c.reaped {
-		return true, nil
-	}
-	var status syscall.WaitStatus
-	pid, err := syscall.Wait4(c.process.Pid, &status, syscall.WNOHANG, nil)
-	if errors.Is(err, syscall.EINTR) {
-		return false, nil
-	}
-	if err != nil {
-		return false, err
-	} // ECHILD never permits signalling.
-	if pid == c.process.Pid {
-		c.reaped = true
-		c.process.Release()
-	}
-	return c.reaped, nil
-}
-func (c *ownedLinuxChild) signal(s syscall.Signal) error {
-	if c.reaped {
-		return errTrust
-	}
-	// This PID came from our own Start, and ONLY this event loop calls Wait4.
-	// Even if it exits here it remains an unreaped zombie, pinning its PID.
-	return syscall.Kill(c.process.Pid, s)
-}
-
-// The thread creating the child must remain alive: PDEATHSIG is tied to that
-// Linux thread, not merely the supervisor's thread group / Go process.
-func superviseLinux(c Client, binary string) error {
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	r, err := readRecord(c.StateDir, 0)
-	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
-		return errTrust
-	}
-	lease, err := acquireLifetime(c, r.Lifecycle)
-	if err != nil {
-		return err
-	}
-	processLifetime = lease
-	// Recheck under the witness: repair may have fenced between the first
-	// approval read and lock acquisition. No child exists before this point.
-	current, err := readRecord(c.StateDir, 0)
-	if err != nil || !current.Enabled || current.Inventory != r.Inventory || current.Lifecycle == nil || current.Lifecycle.Epoch != r.Lifecycle.Epoch || current.Lifecycle.Phase != "running" {
-		return errTrust
-	}
-	o, err := openUnitObserver(context.Background(), c.Expected)
-	if err != nil {
-		return err
-	}
-	defer o.conn.Close()
-	if o.gate.binding != r.Lifecycle.Binding {
-		return errTrust
-	}
-	watcher, cancelWatcher := context.WithCancel(context.Background())
-	defer cancelWatcher()
-	go o.watch(watcher)
-	epoch := r.Lifecycle.Epoch
-	stopDiagnostics := startObserverDiagnostics(c, epoch, o.gate)
-	defer stopDiagnostics()
-	identity, err := inspectSupervisor(os.Getpid(), c.Expected)
-	if err != nil {
-		return err
-	}
-	if err := writeProcess(c.RunDir, identity); err != nil {
-		return err
-	}
-	socket := filepath.Join(c.RunDir, "supervisor.sock")
-	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
-	if err != nil {
-		return err
-	}
-	l.SetUnlinkOnClose(false)
-	defer l.Close()
-	if err := os.Chmod(socket, 0600); err != nil {
-		return err
-	}
-	cmd := exec.Command(binary, "serve-child")
-	cmd.ExtraFiles = []*os.File{lease}
-	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
-	// Go sets prctl before exec and rechecks the parent immediately afterward.
-	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	child := &ownedLinuxChild{process: cmd.Process}
-	cohort := newOperationCohort(c.Expected, epoch, child.process.Pid, o.gate, func() bool { return !child.reaped })
-	defer func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-		defer cancel()
-		_ = cohort.drain(ctx, time.Second)
-		_ = stopChild(ctx, child, time.Second)
-	}()
-	var grants *supervisorGrants
-	var grantRepo *FileGrantRepository
-	defer func() {
-		if grantRepo != nil {
-			grantRepo.Close()
-		}
-	}()
-	// M1 Start first observes the health handshake, then finalizeStart clears
-	// residual under policy.lock. Pin S3's COMPLETE approval only after that
-	// handoff; constructing against residual=true would permanently fence it.
-	initializeGrants := func() {
-		if c.Expected.Protocol != DataProtocol || grants != nil || !o.gate.allow(time.Now()) {
-			return
-		}
-		approval, e := readRecord(c.StateDir, 0)
-		if e != nil || !approval.Enabled || approval.Inventory != c.Expected || approval.Lifecycle == nil || approval.Lifecycle.Epoch != epoch || approval.Lifecycle.Phase != "running" {
-			o.gate.fence("grant-approval-unavailable")
-			return
-		}
-		if approval.Residual {
-			return
-		} // health-only handshake; no grant authority yet
-		var code Code
-		grants, grantRepo, code = openSupervisorGrants(c, binary, cohort)
-		if code != "" {
-			o.gate.fenceStartup("grants-open", code)
-		}
-	}
-	fenceRetryExhausted := false
-	// No cmd.Wait goroutine: reaping and signalling are serialized below.
-	for {
-		current, readErr := readRecord(c.StateDir, 0)
-		if readErr != nil || current.Lifecycle == nil || current.Lifecycle.Epoch != epoch {
-			o.gate.fence("approval-unavailable")
-		} else if !current.Enabled || current.Lifecycle.Phase != "running" {
-			o.gate.fence("admin-stop")
-		}
-		initializeGrants()
-		// Reload verification denies requests without retiring this epoch.
-		if o.gate.fenced(time.Now()) {
-			if grants != nil {
-				grants.authority.Fence()
-			}
-			cohort.deny()
-			// NB policy.lock keeps the owner loop and admin stop responsive. No
-			// graceful stop before the irreversible durable fence transaction.
-			err := errBusy
-			if !fenceRetryExhausted {
-				ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-				err = retryCohortPolicy(ctx, func() error {
-					return fenceRecord(c, epoch, o.gate.reason(), o.gate.observerDiagnostic(epoch).Fence.Detail)
-				})
-				cancel()
-			}
-			if err == nil {
-				ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-				err = cohort.drain(ctx, time.Second)
-				if err == nil {
-					err = stopChild(ctx, child, time.Second)
-				}
-				cancel()
-				if err != nil {
-					return err
-				}
-				if err = l.Close(); err != nil {
-					return err
-				}
-				p, e := readProcess(c.RunDir, 0)
-				if e != nil || p != identity {
-					return errTrust
-				}
-				if err = cleanRuntime(c, true); err != nil {
-					return err
-				}
-				q, err := cohort.proof()
-				if err != nil {
-					return err
-				}
-				// Completion is quiescence proof, published after close/reap/unlink.
-				ctx, cancel = context.WithTimeout(context.Background(), time.Second)
-				defer cancel()
-				return retryCohortPolicy(ctx, func() error { return completeRecord(c, epoch, identity, q) })
-			}
-			if !errors.Is(err, errBusy) {
-				return err
-			}
-			// Budget expiry parks the fenced owner, retaining the lifetime
-			// witness. Do not exit (PDEATHSIG), poll/signal canceled children,
-			// or restart automatic retries. An explicit root stop retries below.
-			fenceRetryExhausted = true
-		}
-		if !fenceRetryExhausted {
-			if err := cohort.poll(); err != nil {
-				return err
-			}
-			if done, err := child.exited(); err != nil {
-				return err
-			} else if done && cohort.started > 0 {
-				o.gate.fence("helper-exited")
-				continue
-			}
-		}
-		l.SetDeadline(time.Now().Add(20 * time.Millisecond))
-		conn, err := l.AcceptUnix()
-		if err != nil {
-			if e, ok := err.(net.Error); ok && e.Timeout() {
-				continue
-			}
-			return err
-		}
-		peer, err := peerCredentials(conn)
-		if err != nil || peer.Uid != 0 {
-			conn.Close()
-			continue
-		}
-		req, code := receiveSupervisorRequest(conn)
-		if code != "" || req.Process != identity {
-			conn.Close()
-			continue
-		}
-		if req.Op == "grants" {
-			initializeGrants()
-			conn.SetDeadline(time.Now().Add(3 * time.Second))
-			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-			res := dispatchSupervisorGrant(ctx, grants, operationPeer{int(peer.Pid), peer.Uid}, req)
-			cancel()
-			json.NewEncoder(conn).Encode(res)
-			conn.Close()
-			if grants != nil {
-				grants.authority.mu.Lock()
-				fenced := grants.authority.fenced
-				grants.authority.mu.Unlock()
-				if fenced {
-					o.gate.fence("grant-authority-fenced")
-				}
-			}
-			continue
-		}
-		if req.Op == "admit" {
-			current, e := readRecord(c.StateDir, 0)
-			allowed := e == nil && current.Enabled && current.Inventory == c.Expected && current.Lifecycle != nil && current.Lifecycle.Epoch == epoch && current.Lifecycle.Phase == "running" && !child.reaped && int(peer.Pid) == child.process.Pid
-			readiness := "fenced"
-			if allowed {
-				readiness = o.gate.readiness(time.Now())
-			}
-			res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: readiness == "ready"}
-			if !res.OK {
-				res.Error = readiness
-			}
-			json.NewEncoder(conn).Encode(res)
-			conn.Close()
-			continue
-		}
-		conn.SetDeadline(time.Now().Add(3 * time.Second))
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-		err = nil
-		if c.Expected.Protocol == DataProtocol || cohort.started > 0 || fenceRetryExhausted {
-			if grants != nil {
-				grants.authority.Fence()
-			}
-			cohort.deny()
-			fenceCtx, fenceCancel := context.WithTimeout(ctx, time.Second)
-			err = retryCohortPolicy(fenceCtx, func() error { return fenceRecord(c, epoch, "admin-stop") })
-			fenceCancel()
-		}
-		if err == nil {
-			err = cohort.drain(ctx, time.Second)
-		}
-		if err == nil {
-			err = stopChild(ctx, child, time.Second)
-		}
-		if err == nil {
-			_, err = cohort.proof()
-		}
-		cancel()
-		// Kernel process-exit fd cleanup is not ordered: close the listener
-		// before ACK, so connection EOF cannot race a still-listening socket.
-		if err == nil {
-			err = l.Close()
-		}
-		res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
-		if err != nil {
-			res.Error = "cleanup-required"
-		}
-		json.NewEncoder(conn).Encode(res)
-		if err == nil {
-			// Keep this connection open until OS exit. An ACK plus EOF proves both
-			// that the child was reaped and this supervisor finished cooperatively.
-			os.Exit(0)
-		}
-		conn.Close()
-	}
-}
-
-func (p LinuxProcesses) Stop(want Process) error {
-	if want.Mode != "supervised" {
-		return errTrust
-	}
-	// Loss/reboot/PID reuse is not sufficient proof of child teardown. Preserve
-	// the record for fixed admin repair; never signal this recorded PID.
-	actual, err := inspectSupervisor(want.PID, want.Inventory)
-	if err != nil || actual != want {
-		return errTrust
-	}
-	socket := filepath.Join(p.RunDir, "supervisor.sock")
-	st, err := os.Lstat(socket)
-	if err != nil {
-		return err
-	}
-	stat, ok := st.Sys().(*syscall.Stat_t)
-	if !ok || stat.Uid != 0 || st.Mode()&os.ModeSocket == 0 || st.Mode().Perm() != 0600 {
-		return errTrust
-	}
-	conn, err := net.DialTimeout("unix", socket, time.Second)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-	peer, err := peerCredentials(conn.(*net.UnixConn))
-	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
-		return errTrust
-	}
-	// Recheck after binding the connection too. A connected socket cannot be
-	// substituted by a later process that reused the path or PID.
-	actual, err = inspectSupervisor(want.PID, want.Inventory)
-	if err != nil || actual != want {
-		return errTrust
-	}
-	conn.SetDeadline(time.Now().Add(3 * time.Second))
-	var nonce [32]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return err
-	}
-	req := supervisorRequest{Process: want, Op: "stop", Nonce: hex.EncodeToString(nonce[:])}
-	if err := json.NewEncoder(conn).Encode(req); err != nil {
-		return err
-	}
-	return readSupervisorReply(conn, want.Inventory, req.Nonce)
-}