@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/dsmprobe/collector_linux.go

@@ -1,335 +0,0 @@
-package dsmprobe
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"debug/elf"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"runtime"
-	"slices"
-	"strconv"
-	"strings"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// root is test-only filesystem injection. The executable exposes no path/root
-// option or environment override. It reads no shadow, native DB, or data file.
-type collector struct{ root string }
-
-func (c *collector) path(p string) string {
-	if c.root != "" {
-		return c.root + p
-	}
-	return p
-}
-func openObserved(path string, flags int) (*os.File, error) {
-	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
-		return nil, ErrInvalid
-	}
-	fd, e := unix.Open("/", unix.O_PATH|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if e != nil {
-		return nil, e
-	}
-	parts := strings.Split(path[1:], "/")
-	for i, p := range parts {
-		f := unix.O_PATH | unix.O_DIRECTORY
-		if i == len(parts)-1 {
-			f = flags
-		}
-		next, e := unix.Openat(fd, p, f|unix.O_NOFOLLOW|unix.O_CLOEXEC|unix.O_NONBLOCK, 0)
-		unix.Close(fd)
-		if e != nil {
-			return nil, e
-		}
-		fd = next
-	}
-	return os.NewFile(uintptr(fd), "observation"), nil
-}
-func (c *collector) read(ctx context.Context, path string, maximum int) ([]byte, error) {
-	if ctx.Err() != nil {
-		return nil, ctx.Err()
-	}
-	f, e := openObserved(c.path(path), unix.O_RDONLY)
-	if e != nil {
-		return nil, e
-	}
-	defer f.Close()
-	var st unix.Stat_t
-	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Size > int64(maximum) {
-		return nil, ErrInvalid
-	}
-	out, e := io.ReadAll(io.LimitReader(f, int64(maximum+1)))
-	if len(out) > maximum {
-		return nil, ErrInvalid
-	}
-	if ctx.Err() != nil {
-		return nil, ctx.Err()
-	}
-	return out, e
-}
-func hash(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
-func version(b []byte) string {
-	values := map[string]string{}
-	for _, line := range strings.Split(string(b), "\n") {
-		k, v, ok := strings.Cut(line, "=")
-		if !ok {
-			continue
-		}
-		if k != "productversion" && k != "buildnumber" {
-			continue
-		}
-		if _, ok := values[k]; ok {
-			return ""
-		}
-		values[k] = strings.Trim(v, "\"")
-	}
-	if values["productversion"] == "" || values["buildnumber"] == "" {
-		return ""
-	}
-	return values["productversion"] + "-" + values["buildnumber"]
-}
-func (c *collector) runtime(ctx context.Context) (Runtime, error) {
-	r := Runtime{Architecture: runtime.GOARCH, Libraries: []LibraryEvidence{}}
-	var u unix.Utsname
-	if unix.Uname(&u) != nil {
-		return r, ErrInvalid
-	}
-	r.Kernel = unix.ByteSliceToString(u.Release[:])
-	b, e := c.read(ctx, "/etc.defaults/VERSION", 4096)
-	if e == nil {
-		r.DSMBuild = version(b)
-		r.VersionDigest = hash(b)
-	}
-	boot, e := c.read(ctx, "/proc/sys/kernel/random/boot_id", 128)
-	if e == nil && len(strings.TrimSpace(string(boot))) == 36 {
-		r.BootRef = hash(bytes.TrimSpace(boot))
-	}
-	modules, _ := c.read(ctx, "/proc/modules", 1<<20)
-	for _, line := range strings.Split(string(modules), "\n") {
-		if strings.HasPrefix(line, "synoacl_vfs ") {
-			r.ACLModule = true
-		}
-	}
-	for _, name := range []string{"libsynoacl.so", "libsynosdk.so.7", "libsynolocalaccount.so.7"} {
-		b, e := c.read(ctx, "/usr/lib/"+name, 32<<20)
-		if e != nil {
-			continue
-		}
-		evidence := LibraryEvidence{Name: name, SHA256: hash(b), Exports: []string{}}
-		image, e := elf.NewFile(bytes.NewReader(b))
-		if e != nil {
-			r.Libraries = append(r.Libraries, evidence)
-			continue
-		}
-		symbols, _ := image.DynamicSymbols()
-		image.Close()
-		for _, s := range symbols {
-			switch s.Name {
-			case "SYNOACLPermCheck", "SYNOACLIsSupport", "SYNOUserGetLocal", "SYNOServiceUserHomeStatusGet", "SYNOShareGet", "SYNOShareUGPrivGetLocalInt":
-				if s.Section != elf.SHN_UNDEF {
-					evidence.Exports = append(evidence.Exports, s.Name)
-				}
-			}
-		}
-		slices.Sort(evidence.Exports)
-		r.Libraries = append(r.Libraries, evidence)
-	}
-	// Deterministic fingerprint binds actual bytes and kernel/build/architecture;
-	// it is an observation, NOT a source-to-build or native semantics certificate.
-	seed, _ := json.Marshal(struct {
-		Architecture, DSMBuild, Kernel, VersionDigest string
-		Libraries                                     []LibraryEvidence
-		ACLModule                                     bool
-	}{r.Architecture, r.DSMBuild, r.Kernel, r.VersionDigest, r.Libraries, r.ACLModule})
-	r.Fingerprint = hash(seed)
-	if ctx.Err() != nil {
-		return r, ctx.Err()
-	}
-	return r, nil
-}
-func identity() Identity {
-	groups, _ := os.Getgroups()
-	g := make([]uint32, 0, len(groups))
-	for _, v := range groups {
-		g = append(g, uint32(v))
-	}
-	slices.Sort(g)
-	g = slices.Compact(g)
-	n, e := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
-	d, de := unix.PrctlRetInt(unix.PR_GET_DUMPABLE, 0, 0, 0, 0)
-	return Identity{UID: uint32(os.Geteuid()), GID: uint32(os.Getegid()), Groups: g, NoNewPrivs: e == nil && n == 1, NonDumpable: de == nil && d == 0}
-}
-func (c *collector) account(ctx context.Context, r Request) (Account, error) {
-	b, e := c.read(ctx, "/etc/passwd", 128<<10)
-	if e != nil {
-		return Account{}, e
-	}
-	var found *Account
-	for _, line := range strings.Split(string(b), "\n") {
-		fields := strings.Split(line, ":")
-		if len(fields) != 7 || fields[0] != r.Username {
-			continue
-		}
-		if found != nil {
-			return Account{}, ErrInvalid
-		}
-		uid, e := strconv.ParseUint(fields[2], 10, 32)
-		if e != nil {
-			return Account{}, ErrInvalid
-		}
-		gid, e := strconv.ParseUint(fields[3], 10, 32)
-		if e != nil {
-			return Account{}, ErrInvalid
-		}
-		found = &Account{Username: r.Username, UID: uint32(uid), GID: uint32(gid), Home: fields[5], Groups: []uint32{}}
-	}
-	if found == nil {
-		return Account{}, os.ErrNotExist
-	}
-	if found.UID != r.UID || found.GID != r.GID || found.Home != "/var/services/homes/"+r.Username {
-		return Account{}, ErrInvalid
-	}
-	// passwd is metadata only. Enabled/local/group/service/share native proofs
-	// remain false; no UID/name fingerprint is advertised as incarnation.
-	return *found, nil
-}
-func (c *collector) home(ctx context.Context, r Request) (Home, *os.File, error) {
-	var h Home
-	if ctx.Err() != nil {
-		return h, nil, ctx.Err()
-	}
-	link := c.path("/var/services/homes")
-	before, e := os.Lstat(link)
-	if e != nil || before.Mode()&os.ModeSymlink == 0 {
-		return h, nil, ErrInvalid
-	}
-	target, e := os.Readlink(link)
-	if e != nil || !filepath.IsAbs(target) || filepath.Clean(target) != target || !strings.HasPrefix(target, "/volume") || !strings.HasSuffix(target, "/homes") {
-		return h, nil, ErrInvalid
-	}
-	h.HomesPath = target
-	f, e := openObserved(c.path(target+"/"+r.Username), unix.O_PATH|unix.O_DIRECTORY)
-	if e != nil {
-		return h, nil, e
-	}
-	var st unix.Stat_t
-	if unix.Fstat(int(f.Fd()), &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFDIR {
-		f.Close()
-		return h, nil, ErrInvalid
-	}
-	after, e := os.Lstat(link)
-	again, re := os.Readlink(link)
-	if e != nil || re != nil || !os.SameFile(before, after) || target != again {
-		f.Close()
-		return h, nil, ErrInvalid
-	}
-	h.Existing = true
-	h.Device = uint64(st.Dev)
-	h.Inode = st.Ino
-	h.Owner = st.Uid
-	return h, f, nil
-}
-func sampleACL(ctx context.Context, r Request, out Response, fd int) ACLSample {
-	sample := ACLSample{Mask: 0x105, SupportErrno: []uint32{}}
-	// Exact source-reviewed candidate only, explicitly requested for evidence.
-	// Never feed this result into bridge certification or a production Allow.
-	if ctx.Err() != nil || runtime.GOARCH != "amd64" || out.Runtime.DSMBuild != "7.4-90069" || out.Runtime.Kernel != "4.4.302+" || !out.Runtime.ACLModule || len(out.Runtime.Libraries) != 3 || r.ExpectedRuntime != out.Runtime.Fingerprint || out.Identity.UID != r.UID || out.Identity.GID != r.GID || !slices.Equal(out.Identity.Groups, r.Groups) || !out.Identity.NoNewPrivs || !out.Identity.NonDumpable || out.Home.Owner != r.UID {
-		return sample
-	}
-	ru, eu, su := unix.Getresuid()
-	rg, eg, sg := unix.Getresgid()
-	if ru != int(r.UID) || eu != ru || su != ru || rg != int(r.GID) || eg != rg || sg != rg {
-		return sample
-	}
-	var caps [2]unix.CapUserData
-	head := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
-	if unix.Capget(&head, &caps[0]) != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
-		return sample
-	}
-	var before unix.Stat_t
-	if unix.Fstat(fd, &before) != nil {
-		return sample
-	}
-	alias, e := unix.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", fd))
-	if e != nil {
-		return sample
-	}
-	defer runtime.KeepAlive(alias)
-	sample.Attempted = true
-	for _, tag := range []uintptr{1, 2} {
-		result, _, errno := unix.Syscall(813, uintptr(unsafe.Pointer(alias)), uintptr(fd), tag)
-		sample.SupportErrno = append(sample.SupportErrno, uint32(errno))
-		if tag == 1 {
-			sample.FilesystemSupport = int64(result)
-		} else {
-			sample.ObjectSupport = int64(result)
-		}
-		if errno != 0 || result != 1 {
-			return sample
-		}
-		if ctx.Err() != nil {
-			return sample
-		}
-	}
-	result, _, errno := unix.Syscall(812, uintptr(unsafe.Pointer(alias)), uintptr(sample.Mask), 0)
-	sample.CheckResult = int64(result)
-	sample.CheckErrno = uint32(errno)
-	runtime.KeepAlive(alias)
-	var after unix.Stat_t
-	if unix.Fstat(fd, &after) != nil || before.Dev != after.Dev || before.Ino != after.Ino || before.Uid != after.Uid || before.Mode != after.Mode {
-		sample.CheckErrno = uint32(unix.ESTALE)
-	}
-	return sample
-}
-func (c *collector) collect(ctx context.Context, r Request) (Response, error) {
-	out := Response{Version: Protocol, Nonce: r.Nonce, Status: "unsupported", Identity: identity(), Account: Account{Groups: []uint32{}}, ACL: ACLSample{SupportErrno: []uint32{}}}
-	if r.Validate() != nil {
-		return out, ErrInvalid
-	}
-	rt, e := c.runtime(ctx)
-	out.Runtime = rt
-	if e != nil {
-		return out, e
-	}
-	if rt.DSMBuild != "" && rt.BootRef != "" {
-		out.Status = "ok"
-	}
-	if r.Kind == "runtime" {
-		return out, nil
-	}
-	a, e := c.account(ctx, r)
-	out.Account = a
-	if e != nil {
-		return out, e
-	}
-	h, f, e := c.home(ctx, r)
-	out.Home = h
-	out.Share = Share{Name: "homes", Path: h.HomesPath}
-	if e != nil {
-		return out, e
-	}
-	defer f.Close()
-	if r.Kind == "acl" {
-		out.ACL = sampleACL(ctx, r, out, int(f.Fd()))
-	}
-	if ctx.Err() != nil {
-		return out, ctx.Err()
-	}
-	return out, nil
-}
-func Collect(ctx context.Context, r Request) (Response, error) {
-	out, e := (&collector{}).collect(ctx, r)
-	if e != nil && !errors.Is(e, context.Canceled) && !errors.Is(e, context.DeadlineExceeded) {
-		out.Status = "unsupported"
-	}
-	return out, e
-}

package/dist/templates/native-go/backend/internal/dsmprobe/collector_linux_test.go

@@ -1,41 +0,0 @@
-package dsmprobe
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestCollectorMetadataNeverCertifiesNativePolicyOrCreatesHome(t *testing.T) {
-	root := t.TempDir()
-	for _, p := range []string{"etc.defaults", "etc", "proc/sys/kernel/random", "volume1/homes", "var/services"} {
-		if e := os.MkdirAll(filepath.Join(root, p), 0755); e != nil {
-			t.Fatal(e)
-		}
-	}
-	os.WriteFile(root+"/etc/passwd", []byte("normal3:x:1217:100::/var/services/homes/normal3:/sbin/nologin\n"), 0644)
-	os.WriteFile(root+"/etc.defaults/VERSION", []byte("productversion=\"7.4\"\nbuildnumber=\"90069\"\n"), 0644)
-	os.WriteFile(root+"/proc/sys/kernel/random/boot_id", []byte("11111111-2222-3333-4444-555555555555\n"), 0644)
-	os.Symlink("/volume1/homes", root+"/var/services/homes")
-	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "metadata"}
-	c := collector{root: root}
-	out, e := c.collect(context.Background(), r)
-	if !os.IsNotExist(e) || out.Account.UID != 1217 || out.Account.Home != "/var/services/homes/normal3" {
-		t.Fatal(e, out)
-	}
-	if out.Account.NativeKnown || out.Account.GroupsKnown || out.Home.StatusKnown || out.Share.NativeKnown || out.Share.PermissionKnown || out.ACL.Certified || out.ACL.Attempted {
-		t.Fatal("metadata became authority")
-	}
-	if _, e := os.Stat(root + "/volume1/homes/normal3"); !os.IsNotExist(e) {
-		t.Fatal("missing home created")
-	}
-}
-func TestCollectorACLRefusesDifferentActorAndFingerprint(t *testing.T) {
-	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}, Kind: "acl", ExpectedRuntime: strings.Repeat("b", 64)}
-	out, _ := (&collector{}).collect(context.Background(), r)
-	if out.ACL.Attempted || out.ACL.Certified {
-		t.Fatal("unproven ABI or actor reached raw syscall")
-	}
-}

package/dist/templates/native-go/backend/internal/dsmprobe/protocol.go

@@ -1,179 +0,0 @@
-// Package dsmprobe defines a bounded, non-secret observation protocol. It is
-// private to the helper/probe; neither browser nor package RPC exposes it.
-package dsmprobe
-
-import (
-	"bytes"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-)
-
-const MaxRequestBytes = 4096
-const MaxResponseBytes = 32768
-const Protocol = 1
-
-var ErrInvalid = errors.New("invalid probe request")
-
-type Request struct {
-	Version         int      `json:"version"`
-	Nonce           string   `json:"nonce"`
-	Kind            string   `json:"kind"`
-	Username        string   `json:"username"`
-	UID             uint32   `json:"uid"`
-	GID             uint32   `json:"gid"`
-	Groups          []uint32 `json:"groups"`
-	ExpectedRuntime string   `json:"expectedRuntime"`
-}
-type LibraryEvidence struct {
-	Name    string   `json:"name"`
-	SHA256  string   `json:"sha256"`
-	Exports []string `json:"exports"`
-}
-type Runtime struct {
-	VersionDigest string            `json:"versionDigest"`
-	Architecture  string            `json:"architecture"`
-	DSMBuild      string            `json:"dsmBuild"`
-	Kernel        string            `json:"kernel"`
-	BootRef       string            `json:"bootRef"`
-	Fingerprint   string            `json:"fingerprint"`
-	Libraries     []LibraryEvidence `json:"libraries"`
-	ACLModule     bool              `json:"aclModule"`
-}
-type Identity struct {
-	UID         uint32   `json:"uid"`
-	GID         uint32   `json:"gid"`
-	Groups      []uint32 `json:"groups"`
-	NoNewPrivs  bool     `json:"noNewPrivs"`
-	NonDumpable bool     `json:"nonDumpable"`
-}
-type Account struct {
-	Username    string   `json:"username"`
-	UID         uint32   `json:"uid"`
-	GID         uint32   `json:"gid"`
-	Groups      []uint32 `json:"groups"`
-	Home        string   `json:"home"`
-	NativeKnown bool     `json:"nativeKnown"`
-	Local       bool     `json:"local"`
-	Enabled     bool     `json:"enabled"`
-	GroupsKnown bool     `json:"groupsKnown"`
-}
-type Home struct {
-	HomesPath   string `json:"homesPath"`
-	StatusKnown bool   `json:"statusKnown"`
-	Enabled     bool   `json:"enabled"`
-	Existing    bool   `json:"existing"`
-	Device      uint64 `json:"device"`
-	Inode       uint64 `json:"inode"`
-	Owner       uint32 `json:"owner"`
-}
-type Share struct {
-	Name            string `json:"name"`
-	Path            string `json:"path"`
-	NativeKnown     bool   `json:"nativeKnown"`
-	Available       bool   `json:"available"`
-	VolumeKnown     bool   `json:"volumeKnown"`
-	PermissionKnown bool   `json:"permissionKnown"`
-	ReadAllowed     bool   `json:"readAllowed"`
-}
-type ACLSample struct {
-	Attempted         bool     `json:"attempted"`
-	FilesystemSupport int64    `json:"filesystemSupport"`
-	ObjectSupport     int64    `json:"objectSupport"`
-	SupportErrno      []uint32 `json:"supportErrno"`
-	CheckResult       int64    `json:"checkResult"`
-	CheckErrno        uint32   `json:"checkErrno"`
-	Mask              uint32   `json:"mask"`
-	Certified         bool     `json:"certified"`
-}
-type Response struct {
-	Version  int       `json:"version"`
-	Nonce    string    `json:"nonce"`
-	Status   string    `json:"status"`
-	Runtime  Runtime   `json:"runtime"`
-	Identity Identity  `json:"identity"`
-	Account  Account   `json:"account"`
-	Home     Home      `json:"home"`
-	Share    Share     `json:"share"`
-	ACL      ACLSample `json:"acl"`
-}
-
-func DigestValid(s string) bool {
-	b, e := hex.DecodeString(s)
-	return e == nil && len(b) == 32 && len(s) == 64
-}
-func (r Request) Validate() error {
-	if r.Version != Protocol || !DigestValid(r.Nonce) || r.Groups == nil || len(r.Groups) > 512 {
-		return ErrInvalid
-	}
-	for i, g := range r.Groups {
-		if i > 0 && r.Groups[i-1] >= g {
-			return ErrInvalid
-		}
-	}
-	if r.Kind == "runtime" {
-		if r.Username != "" || r.ExpectedRuntime != "" {
-			return ErrInvalid
-		}
-		return nil
-	}
-	if (r.Username != "normal3" && r.Username != "admin") || r.UID == 0 {
-		return ErrInvalid
-	}
-	switch r.Kind {
-	case "metadata":
-		if r.ExpectedRuntime != "" {
-			return ErrInvalid
-		}
-	case "acl":
-		if !DigestValid(r.ExpectedRuntime) {
-			return ErrInvalid
-		}
-	default:
-		return ErrInvalid
-	}
-	return nil
-}
-func DecodeRequest(b []byte) (Request, error) {
-	var out Request
-	if len(b) > MaxRequestBytes {
-		return out, ErrInvalid
-	}
-	d := json.NewDecoder(bytes.NewReader(b))
-	token, e := d.Token()
-	if e != nil || token != json.Delim('{') {
-		return out, ErrInvalid
-	}
-	allowed := map[string]bool{"version": true, "nonce": true, "kind": true, "username": true, "uid": true, "gid": true, "groups": true, "expectedRuntime": true}
-	raw := map[string]json.RawMessage{}
-	for d.More() {
-		t, e := d.Token()
-		if e != nil {
-			return out, ErrInvalid
-		}
-		k, ok := t.(string)
-		if !ok || !allowed[k] {
-			return out, ErrInvalid
-		}
-		if _, ok := raw[k]; ok {
-			return out, ErrInvalid
-		}
-		var v json.RawMessage
-		if d.Decode(&v) != nil {
-			return out, ErrInvalid
-		}
-		raw[k] = v
-	}
-	if t, e := d.Token(); e != nil || t != json.Delim('}') {
-		return out, ErrInvalid
-	}
-	if _, e = d.Token(); e != io.EOF {
-		return out, ErrInvalid
-	}
-	data, _ := json.Marshal(raw)
-	if json.Unmarshal(data, &out) != nil {
-		return Request{}, ErrInvalid
-	}
-	return out, out.Validate()
-}

package/dist/templates/native-go/backend/internal/dsmprobe/protocol_test.go

@@ -1,29 +0,0 @@
-package dsmprobe
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestRequestRejectsUnknownDuplicateAndOversized(t *testing.T) {
-	for _, s := range []string{`{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","kind":"acl"}`, `{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","allow":true}`, strings.Repeat(" ", MaxRequestBytes+1)} {
-		if _, e := DecodeRequest([]byte(s)); e == nil {
-			t.Fatal("invalid request accepted")
-		}
-	}
-}
-func TestRequestRestrictsFixtureAndNeverCarriesSession(t *testing.T) {
-	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Kind: "metadata", Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}}
-	if r.Validate() != nil {
-		t.Fatal("valid fixture refused")
-	}
-	r.Username = "normal1"
-	if r.Validate() == nil {
-		t.Fatal("reserved account accepted")
-	}
-	r.Username = "normal3"
-	r.Kind = "acl"
-	if r.Validate() == nil {
-		t.Fatal("ACL without runtime fingerprint accepted")
-	}
-}