@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/operation_linux.go

@@ -1,480 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"net"
-	"os"
-	"os/exec"
-	"reflect"
-	"slices"
-	"strconv"
-	"syscall"
-	"time"
-)
-
-type operationBootstrap struct {
-	Binding    operationBinding `json:"binding"`
-	Token      string           `json:"token"`
-	UID        uint32           `json:"uid"`
-	GID        uint32           `json:"gid"`
-	Groups     []uint32         `json:"groups"`
-	SubjectRef string           `json:"subjectRef,omitempty"`
-	SessionRef string           `json:"sessionRef,omitempty"`
-	Write      *writeWork       `json:"write,omitempty"`
-	ReadOnly   *readOnlyWork    `json:"readOnly,omitempty"`
-}
-type operationRelayOutcome struct {
-	err           error
-	mountSequence uint64
-}
-
-type operationLease struct {
-	Commit        bool   `json:"commit,omitempty"`
-	Token         string `json:"token"`
-	Sequence      uint64 `json:"sequence"`
-	Bytes         uint32 `json:"bytes"`
-	SubjectRef    string `json:"subjectRef,omitempty"`
-	SessionRef    string `json:"sessionRef,omitempty"`
-	ProofDeadline int64  `json:"proofDeadline,omitempty"`
-}
-type linuxOperation struct {
-	*ownedLinuxChild
-	control                    *net.UnixConn
-	data                       *os.File
-	output                     net.Conn
-	token                      string
-	sequence                   uint64
-	pending                    chan operationRelayOutcome
-	relayErr                   error
-	closed                     bool
-	result                     *readOnlyResult
-	resultPending              chan readOnlyPacketOutcome
-	readOnly                   bool
-	remaining                  uint64
-	finishSent                 bool
-	metadataReleased           bool
-	bootstrap                  operationBootstrap
-	work                       readOnlyWork
-	mountSequence              uint64
-	proofDeadline              time.Time
-	proofSubject, proofSession string
-	outputWatch                chan error
-	outputWatchDone            bool
-}
-
-func newLinuxOperationRelay(child *ownedLinuxChild, control *net.UnixConn, data *os.File, out net.Conn) *linuxOperation {
-	p := &linuxOperation{ownedLinuxChild: child, control: control, data: data, output: out, outputWatchDone: out == nil}
-	if out != nil {
-		p.outputWatch = make(chan error, 1)
-		done := p.outputWatch
-		// Binary output is one-way. EOF (or unexpected inbound data) cancels it
-		// even when the caller requests no next lease. Q also waits for this reader.
-		go func() {
-			var b [1]byte
-			_, err := out.Read(b[:])
-			if err == nil {
-				err = errTrust
-			}
-			done <- err
-		}()
-	}
-	return p
-}
-func (p *linuxOperation) beginRelay(n uint32) error { return p.beginRelayFinish(n, false) }
-func (p *linuxOperation) beginRelayFinish(n uint32, finish bool) error {
-	if p.closed || p.pending != nil || p.output == nil {
-		return errTrust
-	}
-	p.pending = make(chan operationRelayOutcome, 1)
-	done := p.pending
-	sequence := p.sequence + 1
-	mounts := p.mountSequence
-	deadline := p.proofDeadline
-	var info *os.File
-	if p.readOnly {
-		var err error
-		info, err = openOperationFDInfo(p.process.Pid)
-		if err != nil {
-			p.pending = nil
-			return err
-		}
-	}
-	go func() {
-		var err error
-		if p.readOnly {
-			outcome := receiveReadOnlyProof(p.control, info, p.bootstrap, p.work, p.process.Pid, mounts, sequence, n, time.Until(deadline))
-			mounts = outcome.mountSequence
-			err = outcome.err
-			if err == nil && outcome.result.Code != "" {
-				err = outcome.result.Code
-			}
-			if closeErr := info.Close(); err == nil {
-				err = closeErr
-			}
-		}
-		b := make([]byte, n)
-		if err == nil {
-			_, err = io.ReadFull(p.data, b)
-		}
-		if err == nil {
-			writeDeadline := time.Now().Add(ControlTimeout)
-			if p.readOnly && deadline.Before(writeDeadline) {
-				writeDeadline = deadline
-			}
-			err = p.output.SetWriteDeadline(writeDeadline)
-		}
-		for err == nil && len(b) > 0 {
-			var n int
-			n, err = p.output.Write(b)
-			if n == 0 && err == nil {
-				err = io.ErrNoProgress
-			}
-			b = b[n:]
-		}
-		if err == nil && finish {
-			err = writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
-		}
-		done <- operationRelayOutcome{err: err, mountSequence: mounts}
-	}()
-	return nil
-}
-func (p *linuxOperation) idle() (bool, error) {
-	if p.outputWatch != nil {
-		select {
-		case err := <-p.outputWatch:
-			p.outputWatch = nil
-			p.outputWatchDone = true
-			if !p.closed {
-				p.relayErr = err
-			}
-		default:
-		}
-	}
-
-	if p.resultPending != nil {
-		select {
-		case outcome := <-p.resultPending:
-			p.resultPending = nil
-			p.result = outcome.result
-			p.mountSequence = outcome.mountSequence
-			if p.relayErr == nil {
-				p.relayErr = outcome.err
-			}
-			if p.result != nil {
-				p.remaining = p.result.Bytes
-			}
-		default:
-			return false, nil
-		}
-	}
-
-	if p.pending != nil {
-		select {
-		case outcome := <-p.pending:
-			p.pending = nil
-			if p.relayErr == nil {
-				p.relayErr = outcome.err
-			}
-			if p.readOnly {
-				p.mountSequence = outcome.mountSequence
-			}
-		default:
-			return false, nil
-		}
-	}
-	return true, p.relayErr
-}
-func (p *linuxOperation) chunk(n uint32) error {
-	idle, err := p.idle()
-	if err != nil {
-		return err
-	}
-	if !idle || p.closed || n == 0 || n > MaxChunkBytes || p.readOnly && (p.result == nil || !p.metadataReleased || p.result.Code != "" || uint64(n) > p.remaining) {
-		return errTrust
-	}
-	finish := p.readOnly && uint64(n) == p.remaining
-	if err := p.beginRelayFinish(n, finish); err != nil {
-		return err
-	}
-	if p.readOnly {
-		p.remaining -= uint64(n)
-		if finish {
-			p.finishSent = true
-		}
-	}
-	p.sequence++
-	return writeOperationPacket(p.control, operationLease{Token: p.token, Sequence: p.sequence, Bytes: n, ProofDeadline: p.proofDeadline.UnixNano(), SubjectRef: p.proofSubject, SessionRef: p.proofSession})
-}
-func (p *linuxOperation) stopRelay() {
-	if p.closed {
-		return
-	}
-	p.closed = true
-	if p.output != nil {
-		p.output.Close()
-	}
-	if p.control != nil {
-		p.control.Close()
-	}
-	if p.data != nil {
-		p.data.Close()
-	}
-}
-func (p *linuxOperation) relayStopped() bool {
-	idle, _ := p.idle()
-	return p.closed && idle && (p.output == nil || p.outputWatchDone)
-}
-func writeOperationPacket(conn *net.UnixConn, v any) error {
-	return writeOperationPacketBound(conn, v, MaxHealthBytes)
-}
-func writeOperationPacketBound(conn *net.UnixConn, v any, limit int) error {
-	if err := conn.SetWriteDeadline(time.Now().Add(300 * time.Millisecond)); err != nil {
-		return err
-	}
-	b, err := json.Marshal(v)
-	if err != nil || len(b) > limit {
-		return errTrust
-	}
-	n, err := conn.Write(b)
-	if err == nil && n != len(b) {
-		return io.ErrShortWrite
-	}
-	return err
-}
-func readOperationPacket(conn *net.UnixConn, v any) (*syscall.Ucred, error) {
-	return readOperationPacketBound(conn, v, MaxHealthBytes, 300*time.Millisecond)
-}
-func readOperationPacketBound(conn *net.UnixConn, v any, limit int, timeout time.Duration) (*syscall.Ucred, error) {
-	if err := conn.SetReadDeadline(time.Now().Add(timeout)); err != nil {
-		return nil, err
-	}
-	b := make([]byte, limit+1)
-	oob := make([]byte, syscall.CmsgSpace(syscall.SizeofUcred))
-	n, on, flags, _, err := conn.ReadMsgUnix(b, oob)
-	if err != nil || n > limit || flags&(syscall.MSG_TRUNC|syscall.MSG_CTRUNC) != 0 {
-		return nil, errTrust
-	}
-	decoder := json.NewDecoder(bytes.NewReader(b[:n]))
-	decoder.DisallowUnknownFields()
-	if decoder.Decode(v) != nil || decoder.Decode(new(any)) != io.EOF {
-		return nil, errTrust
-	}
-	messages, err := syscall.ParseSocketControlMessage(oob[:on])
-	if err != nil {
-		return nil, err
-	}
-	var cred *syscall.Ucred
-	for _, m := range messages {
-		if m.Header.Level == syscall.SOL_SOCKET && m.Header.Type == syscall.SCM_CREDENTIALS {
-			if cred != nil {
-				return nil, errTrust
-			}
-			cred, err = syscall.ParseUnixCredentials(&m)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-	return cred, nil
-}
-func operationSocket(f *os.File) (*net.UnixConn, error) {
-	c, err := net.FileConn(f)
-	if err != nil {
-		return nil, err
-	}
-	u, ok := c.(*net.UnixConn)
-	if !ok {
-		c.Close()
-		return nil, errTrust
-	}
-	return u, nil
-}
-func enableCredentials(c *net.UnixConn) error {
-	raw, err := c.SyscallConn()
-	if err != nil {
-		return err
-	}
-	var setErr error
-	if err := raw.Control(func(fd uintptr) { setErr = syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_PASSCRED, 1) }); err != nil {
-		return err
-	}
-	return setErr
-}
-
-// Caller is the locked supervisor OS thread. Its own approved root-only payload
-// execs BEFORE dropping credentials; no package executable or arbitrary args.
-// On any post-Start failure return the owned child too, so Q cannot be fabricated.
-func startLinuxOperation(c Client, binary string, a NativeActor, b operationBinding, out net.Conn) (operationProcess, error) {
-	return startLinuxOperationWork(c, binary, a, b, out, nil, nil, nil)
-}
-
-// Invoked only by S3's factory after WithGrantAdmission has reserved fixed work.
-// The reservation and grant checks are S3-owned; there is no second authority.
-func startLinuxReadOnlyOperation(c Client, binary string, a NativeActor, b operationBinding, pin *pinnedReadOnlyRoot, w readOnlyWork, out net.Conn) (operationProcess, error) {
-	if code := w.validate(); code != "" {
-		return nil, code
-	}
-	if pin == nil || pin.file == nil || pin.path != w.RootPath {
-		return nil, ErrSuspended
-	}
-	w.Segments = append([]string{}, w.Segments...)
-	return startLinuxOperationWork(c, binary, a, b, out, pin, &w, nil)
-}
-func (p *linuxOperation) readOnlyMetadata() (*readOnlyResult, bool, error) {
-	_, err := p.idle()
-	if err != nil {
-		return nil, false, err
-	}
-	return p.result, p.readOnly && p.result != nil, nil
-}
-func (p *linuxOperation) releaseReadOnlyMetadata() error {
-	if p.closed || !p.readOnly || p.result == nil {
-		return errTrust
-	}
-	p.metadataReleased = true
-	if p.remaining == 0 && !p.finishSent {
-		p.finishSent = true
-		return writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
-	}
-	return nil
-}
-func (p *linuxOperation) readOnlyLeaseReady(n uint32) Code {
-	_, err := p.idle()
-	if err != nil {
-		return ErrCleanupRequired
-	}
-	if p.closed {
-		return ErrCanceled
-	}
-	if !p.metadataReleased || p.result == nil {
-		return ErrBusy
-	}
-	if p.result.Code != "" || n == 0 || uint64(n) > p.remaining {
-		return ErrLimit
-	}
-	return ""
-}
-func startLinuxOperationWork(c Client, binary string, a NativeActor, b operationBinding, out net.Conn, pin *pinnedReadOnlyRoot, work *readOnlyWork, write *writeWork) (operationProcess, error) {
-	if binary != "/var/lib/synopkgland-"+c.Expected.Package+"/payload-"+c.Expected.PayloadDigest || !a.valid || a.UID() == 0 || a.GID() == 0 || a.account.Groups == nil || processLifetime == nil {
-		return nil, errTrust
-	}
-	actual, err := inspectSupervisor(os.Getpid(), c.Expected)
-	if err != nil || actual.Inventory != b.Inventory {
-		return nil, errTrust
-	}
-	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	parent := os.NewFile(uintptr(pair[0]), "operation-parent")
-	child := os.NewFile(uintptr(pair[1]), "operation-child")
-	defer parent.Close()
-	defer child.Close()
-	control, err := operationSocket(parent)
-	if err != nil {
-		return nil, err
-	}
-	if err := enableCredentials(control); err != nil {
-		control.Close()
-		return nil, err
-	}
-	r, w, err := os.Pipe()
-	if err != nil {
-		control.Close()
-		return nil, err
-	}
-	parentData, childData := r, w
-	if write != nil {
-		parentData, childData = w, r
-	}
-	defer childData.Close()
-	token := make([]byte, 32)
-	if _, err := rand.Read(token); err != nil {
-		control.Close()
-		parentData.Close()
-		return nil, err
-	}
-	boot := operationBootstrap{Binding: b, Token: hex.EncodeToString(token), UID: a.UID(), GID: a.GID(), Groups: a.Groups(), ReadOnly: work, Write: write, SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef()}
-	cmd := exec.Command(binary, "operation-child")
-	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
-	cmd.ExtraFiles = []*os.File{processLifetime, child, childData}
-	if work != nil || write != nil {
-		cmd.ExtraFiles = append(cmd.ExtraFiles, pin.file)
-	}
-	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
-	if err := cmd.Start(); err != nil {
-		control.Close()
-		parentData.Close()
-		return nil, err
-	}
-	relayOutput := out
-	if write != nil {
-		relayOutput = nil
-	}
-	p := newLinuxOperationRelay(&ownedLinuxChild{process: cmd.Process}, control, parentData, relayOutput)
-	if write != nil {
-		p.output = out
-	}
-	p.token = boot.Token
-	p.bootstrap = boot
-	if work != nil {
-		p.work = *work
-	}
-	packetLimit := MaxHealthBytes
-	if work != nil || write != nil {
-		packetLimit = MaxControlBytes
-	}
-	if err := writeOperationPacketBound(control, boot, packetLimit); err != nil {
-		return p, err
-	}
-	var ready operationBootstrap
-	cred, err := readOperationPacketBound(control, &ready, packetLimit, 300*time.Millisecond)
-	if err != nil || cred == nil || int(cred.Pid) != cmd.Process.Pid || cred.Uid != boot.UID || cred.Gid != boot.GID || ready.Binding != b || ready.Token != boot.Token || ready.SubjectRef != boot.SubjectRef || ready.SessionRef != boot.SessionRef || ready.UID != boot.UID || ready.GID != boot.GID || !slices.Equal(ready.Groups, boot.Groups) || !reflect.DeepEqual(ready.ReadOnly, work) || !reflect.DeepEqual(ready.Write, write) {
-		return p, errTrust
-	}
-	if write != nil {
-		info, e := openOperationFDInfo(cmd.Process.Pid)
-		if e != nil {
-			return p, e
-		}
-		p.resultPending = make(chan readOnlyPacketOutcome, 1)
-		done := p.resultPending
-		go runReadOnlyResultReceiver(done, func() readOnlyPacketOutcome {
-			outcome := receiveWriteProof(control, info, boot, *write, cmd.Process.Pid, 0, 0, BoundedTimeout)
-			if outcome.err == nil && (outcome.result.Mutation.BytesWritten != 0 || outcome.result.Mutation.Published || outcome.result.Mutation.Committed) {
-				outcome.err = errTrust
-			}
-			return outcome
-		}, info.Close)
-		return &linuxWriteOperation{linuxOperation: p, writeWork: *write}, nil
-	}
-	if work != nil {
-		fdinfo, err := openOperationFDInfo(cmd.Process.Pid)
-		if err != nil {
-			return p, err
-		}
-		p.readOnly = true
-		p.resultPending = make(chan readOnlyPacketOutcome, 1)
-		done := p.resultPending
-		go runReadOnlyResultReceiver(done, func() readOnlyPacketOutcome {
-			return receiveReadOnlyResult(control, fdinfo, boot, *work, cmd.Process.Pid)
-		}, fdinfo.Close)
-	}
-	return p, nil
-}
-
-// Bound each child ACL/read and relay to the freshly admitted subject proof.
-// Only the sole supervisor owner calls this after S3 chunk reservation.
-func (p *linuxOperation) chunkWithActor(n uint32, a NativeActor) error {
-	if !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) {
-		return ErrStale
-	}
-	p.proofDeadline = a.account.CheckedAt.Add(NativeProofFreshness)
-	p.proofSubject = a.Principal().SubjectRef
-	p.proofSession = a.SessionRef()
-	return p.chunk(n)
-}