@synopackageland/cli 0.5.3 → 0.6.1

package/templates/_executor/cmd/lifecycle/main.go

@@ -0,0 +1,42 @@
+// This helper runs as the package account, separately from the root executor.
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"synopkgland/executor/internal/lifecycle"
+)
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "executor lifecycle:", err)
+		os.Exit(1)
+	}
+}
+func run(args []string) error {
+	if len(args) == 0 {
+		return errors.New("start, stop or purge required")
+	}
+	action := args[0]
+	fs := flag.NewFlagSet("lifecycle", flag.ContinueOnError)
+	pkg := fs.String("package", "", "package account")
+	if err := fs.Parse(args[1:]); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 {
+		return errors.New("unexpected arguments")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Second)
+	defer cancel()
+	data := os.Getenv("SYNOPKG_PKGVAR")
+	if data == "" {
+		data = filepath.Join("/var/packages", *pkg, "var")
+	}
+	return lifecycle.Run(ctx, lifecycle.Config{Package: *pkg, Data: data, Socket: filepath.Join("/run/synopkgland", *pkg, "executor.sock"), Log: func(s string) { fmt.Fprintln(os.Stderr, s) }}, action)
+}

package/templates/_executor/cookie_review_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"context"
+	"testing"
+)
+
+func TestReviewCookieControlRejectedBeforeDSM(t *testing.T) {
+	for _, cookie := range []string{"sess\tion", "sess\x7fion", "sess\x01ion"} {
+		e, _, _ := setup(t)
+		if _, code := e.verified(context.Background(), Auth{Cookie: cookie, SynoToken: "token"}); code == "" {
+			t.Errorf("cookie control character accepted: %q", cookie)
+		}
+	}
+}
+
+func TestExecutorCookieRejectsEveryASCIIControl(t *testing.T) {
+	for c := 0; c <= 127; c++ {
+		if c >= 32 && c != 127 {
+			continue
+		}
+		e, _, _ := setup(t)
+		if _, code := e.verified(context.Background(), Auth{Cookie: "sess" + string(rune(c)) + "ion", SynoToken: "token"}); code != "AUTH_DENIED" {
+			t.Errorf("accepted control %d", c)
+		}
+	}
+}

package/templates/_executor/digest_review_test.go

@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
+	dir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	exe := filepath.Join(dir, "executor")
+	f, err := os.Create(exe)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = f.Truncate(1 << 40); err != nil {
+		f.Close()
+		t.Skip(err)
+	}
+	f.Close()
+	os.WriteFile(filepath.Join(dir, "policy.json"), []byte("policy"), 0600)
+	ctx, cancel := context.WithCancel(context.Background())
+	entered := make(chan struct{})
+	done := make(chan error, 1)
+	go func() {
+		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
+			close(entered)
+			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
+		}, func() error { return nil }, func(string) {})
+	}()
+	<-entered
+	time.Sleep(20 * time.Millisecond)
+	cancel()
+	blocked := false
+	select {
+	case <-done:
+	case <-time.After(50 * time.Millisecond):
+		blocked = true
+	}
+	os.Truncate(exe, 0)
+	if blocked {
+		<-done
+		t.Fatal("canceled monitor remains blocked hashing package-controlled file")
+	}
+}
+
+func TestDigestBoundsAndCancellation(t *testing.T) {
+	dir := realTestPath(t, t.TempDir())
+	for _, tc := range []struct {
+		name  string
+		limit int64
+	}{{"executor", maxExecutorBytes}, {"policy.json", maxPolicyBytes}} {
+		path := filepath.Join(dir, tc.name)
+		f, err := os.Create(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err = f.Truncate(tc.limit + 1); err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+		if _, err = digestFile(context.Background(), path, tc.limit); err == nil {
+			t.Fatal("oversize file accepted")
+		}
+		os.WriteFile(path, []byte("valid"), 0600)
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		if _, err = digestFile(ctx, path, tc.limit); err != context.Canceled {
+			t.Fatal("ignored cancellation", err)
+		}
+	}
+	if _, err := digestFile(context.Background(), dir, maxExecutorBytes); err == nil {
+		t.Fatal("directory accepted")
+	}
+	os.Symlink(filepath.Join(dir, "executor"), filepath.Join(dir, "link"))
+	if _, err := digestFile(context.Background(), filepath.Join(dir, "link"), maxExecutorBytes); err == nil {
+		t.Fatal("symlink accepted")
+	}
+}
+
+func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
+	for _, action := range []string{"stop", "purge", "shutdown"} {
+		t.Run(action, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			entered, canceled := make(chan struct{}), make(chan struct{})
+			actions := make(chan string)
+			done := make(chan error, 1)
+			go func() {
+				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil }, func(string) {})
+			}()
+			<-entered
+			if action == "shutdown" {
+				cancel()
+			} else {
+				actions <- action
+			}
+			select {
+			case <-canceled:
+			case <-time.After(time.Second):
+				t.Fatal("pin check not canceled")
+			}
+			cancel()
+			select {
+			case err := <-done:
+				if err != nil {
+					t.Fatal(err)
+				}
+			case <-time.After(time.Second):
+				t.Fatal("monitor stuck")
+			}
+		})
+	}
+}

package/templates/_executor/directories.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"syscall"
+)
+
+func directoryMatches(info os.FileInfo, mode os.FileMode, uid, gid int) bool {
+	st, ok := info.Sys().(*syscall.Stat_t)
+	return ok && info.IsDir() && info.Mode().Perm() == mode && int(st.Uid) == uid && int(st.Gid) == gid
+}
+
+// Only repair permissions on a directory this invocation created. mkdir's
+// requested mode is reduced by the inherited boot-task umask (normally 0077).
+func createDirectory(path string, mode os.FileMode, uid, gid int) (os.FileInfo, error) {
+	if err := os.Mkdir(path, mode); err != nil {
+		return nil, err
+	}
+	fd, err := syscall.Open(path, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	f := os.NewFile(uintptr(fd), path)
+	defer f.Close()
+	if err = f.Chown(uid, gid); err != nil {
+		return nil, err
+	}
+	if err = f.Chmod(mode); err != nil {
+		return nil, err
+	}
+	info, err := f.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !directoryMatches(info, mode, uid, gid) {
+		return nil, errors.New("created directory permissions")
+	}
+	return info, nil
+}

package/templates/_executor/dsm.go

@@ -0,0 +1,319 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"os/user"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Command interface {
+	Exec(context.Context, string, []string) ([]byte, error)
+}
+type Accounts interface{ Lookup(string) (Subject, error) }
+type localAccounts struct{}
+
+func (localAccounts) Lookup(name string) (Subject, error) {
+	var s Subject
+	u, err := user.Lookup(name)
+	if err != nil || u.Username != name {
+		return s, errors.New("account")
+	}
+	uid, err := strconv.Atoi(u.Uid)
+	if err != nil {
+		return s, err
+	}
+	gid, err := strconv.Atoi(u.Gid)
+	if err != nil {
+		return s, err
+	}
+	gs, err := u.GroupIds()
+	if err != nil {
+		return s, err
+	}
+	admin, err := user.LookupGroup("administrators")
+	if err != nil {
+		return s, err
+	}
+	s = Subject{Username: name, UID: uid, GID: gid, Home: u.HomeDir}
+	for _, v := range gs {
+		g, err := strconv.Atoi(v)
+		if err != nil {
+			return Subject{}, err
+		}
+		s.Groups = append(s.Groups, g)
+		if v == admin.Gid {
+			s.Admin = true
+		}
+	}
+	sort.Ints(s.Groups)
+	return s, nil
+}
+
+type HTTPDoer interface {
+	Do(*http.Request) (*http.Response, error)
+}
+type liveDSM struct {
+	Command  Command
+	Accounts Accounts
+	HTTP     HTTPDoer
+	Endpoint string
+}
+
+func newDSM() *liveDSM {
+	return &liveDSM{Command: processCommand{}, Accounts: localAccounts{}, HTTP: &http.Client{Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, Endpoint: "http://127.0.0.1:5000/webapi/entry.cgi"}
+}
+
+type envelope struct {
+	Success bool            `json:"success"`
+	Data    json.RawMessage `json:"data"`
+}
+
+func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	var r envelope
+	d := json.NewDecoder(bytes.NewReader(b))
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
+		return nil, errors.New("DSM refused")
+	}
+	return r.Data, nil
+}
+func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, error) {
+	form := url.Values{"api": {"SYNO.Core.NormalUser"}, "version": {"1"}, "method": {"get"}}
+	req, err := http.NewRequestWithContext(ctx, "POST", d.Endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
+	req.Header.Set("X-SYNO-TOKEN", token)
+	res, err := d.HTTP.Do(req)
+	if err != nil {
+		return "", errors.New("session")
+	}
+	defer res.Body.Close()
+	b, err := io.ReadAll(io.LimitReader(res.Body, maxRequest+1))
+	if err != nil || len(b) > maxRequest || res.StatusCode != 200 {
+		return "", errors.New("session")
+	}
+	data, err := decodeEnvelope(b)
+	if err != nil {
+		return "", err
+	}
+	var out struct {
+		Username string `json:"username"`
+	}
+	if json.Unmarshal(data, &out) != nil || out.Username == "" || strings.ContainsFunc(out.Username, func(r rune) bool { return r < 32 }) {
+		return "", errors.New("session")
+	}
+	return out.Username, nil
+}
+func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
+	if runner != "" {
+		args = append(args, "runner="+runner)
+	}
+	keys := make([]string, 0, len(params))
+	for k := range params {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		b, err := json.Marshal(params[k])
+		if err != nil {
+			return nil, err
+		}
+		args = append(args, k+"="+string(b))
+	}
+	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
+	if err != nil {
+		return nil, errors.New("DSM command")
+	}
+	return decodeEnvelope(b)
+}
+func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
+	s, err := d.Accounts.Lookup(name)
+	if err != nil {
+		return s, err
+	}
+	data, err := d.call(ctx, "SYNO.Core.User", "get", "1", "", map[string]any{"name": name, "additional": []string{"expired"}})
+	if err != nil {
+		return Subject{}, err
+	}
+	var out struct {
+		Users []struct {
+			Name    string `json:"name"`
+			UID     *int   `json:"uid"`
+			Expired string `json:"expired"`
+		} `json:"users"`
+	}
+	if json.Unmarshal(data, &out) != nil || len(out.Users) != 1 || out.Users[0].Name != name || out.Users[0].UID == nil || *out.Users[0].UID != s.UID || out.Users[0].Expired != "normal" {
+		return Subject{}, errors.New("account ineligible")
+	}
+	s.Expired = out.Users[0].Expired
+	return s, nil
+}
+func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
+	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
+	if err != nil {
+		return err
+	}
+	// DSM 7.x omits default-allowed Apps from preview (measured on vt-nas).
+	// An explicit deny/custom entry or malformed/ambiguous response still refuses.
+	var out struct {
+		Apps *[]json.RawMessage `json:"applications"`
+	}
+	if json.Unmarshal(data, &out) != nil || out.Apps == nil || app == "" {
+		return errors.New("app privilege")
+	}
+	count := 0
+	for _, raw := range *out.Apps {
+		var a struct {
+			ID        string `json:"app_id"`
+			Privilege string `json:"privilelge"`
+		}
+		if json.Unmarshal(raw, &a) != nil || a.ID == "" || !contains([]string{"allow", "deny", "custom"}, a.Privilege) {
+			return errors.New("app privilege entry")
+		}
+		if a.ID == app {
+			count++
+			if a.Privilege != "allow" {
+				return errors.New("app denied")
+			}
+		}
+	}
+	if count > 1 {
+		return errors.New("app ambiguous")
+	}
+	return nil
+}
+func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
+	if scope == "home" {
+		if !cleanPath(s.Home) || s.Home == "/" {
+			return "", errors.New("home")
+		}
+		return filepath.EvalSymlinks(s.Home)
+	}
+	if scopeVirtual(scope) == "" {
+		return "", errors.New("scope")
+	}
+	name := strings.TrimPrefix(scope, "shared:")
+	data, err := d.call(ctx, "SYNO.Core.Share", "get", "1", "", map[string]any{"name": name})
+	if err != nil {
+		return "", err
+	}
+	var out struct {
+		Shares []struct {
+			Name string `json:"name"`
+			Path string `json:"path"`
+		} `json:"shares"`
+	}
+	if json.Unmarshal(data, &out) != nil || len(out.Shares) != 1 || out.Shares[0].Name != name || !cleanPath(out.Shares[0].Path) {
+		return "", errors.New("share")
+	}
+	return filepath.EvalSymlinks(out.Shares[0].Path)
+}
+func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
+	if runner == "" {
+		return nil, errors.New("runner")
+	}
+	api, method := "", ""
+	version := "2"
+	params := map[string]any{}
+	switch op {
+	case "files.list":
+		api = "SYNO.FileStation.List"
+		method = "list"
+		params["folder_path"] = p["path"]
+	case "files.info":
+		api = "SYNO.FileStation.List"
+		method = "getinfo"
+		params["path"] = []any{p["path"]}
+	case "files.createFolder":
+		api = "SYNO.FileStation.CreateFolder"
+		method = "create"
+		params["folder_path"] = p["path"]
+		params["name"] = p["name"]
+		params["force_parent"] = false
+	case "files.checkPermission":
+		api = "SYNO.FileStation.CheckPermission"
+		method = "write"
+		version = "3"
+		params["path"] = p["path"]
+		params["filename"] = ".synopkgland-permission-probe"
+		params["overwrite"] = false
+		params["size"] = 0
+	default:
+		return nil, errors.New("operation")
+	}
+	data, err := d.call(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	// Some File Station methods report per-file errors inside success:true.
+	if hasDSMError(data) {
+		return nil, errors.New("DSM file error")
+	}
+	var shape map[string]json.RawMessage
+	if json.Unmarshal(data, &shape) != nil {
+		return nil, errors.New("DSM data")
+	}
+	if op == "files.checkPermission" {
+		var skip *bool
+		if json.Unmarshal(shape["blSkip"], &skip) != nil || skip == nil || *skip {
+			return nil, errors.New("permission not confirmed")
+		}
+	} else {
+		key := "files"
+		if op == "files.createFolder" {
+			key = "folders"
+		}
+		var entries []json.RawMessage
+		if json.Unmarshal(shape[key], &entries) != nil || entries == nil {
+			return nil, errors.New("missing files")
+		}
+		if (op == "files.info" || op == "files.createFolder") && len(entries) != 1 {
+			return nil, errors.New("missing target")
+		}
+	}
+	return data, nil
+}
+func hasDSMError(data json.RawMessage) bool {
+	var v any
+	if json.Unmarshal(data, &v) != nil {
+		return true
+	}
+	var walk func(any) bool
+	walk = func(v any) bool {
+		switch x := v.(type) {
+		case map[string]any:
+			for k, v := range x {
+				if k == "error" {
+					return true
+				}
+				if k == "success" && v == false {
+					return true
+				}
+				if walk(v) {
+					return true
+				}
+			}
+		case []any:
+			for _, v := range x {
+				if walk(v) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	return walk(v)
+}