@synopackageland/cli 0.6.0 → 0.7.0

package/dist/templates/_executor/executor_test.go

@@ -8,11 +8,13 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 )
 
 type fakeDSM struct {
+	apiMu                    sync.Mutex
 	user                     Subject
 	accountErr, privilegeErr error
 	apiCalls                 int
@@ -23,10 +25,12 @@ func (f *fakeDSM) Verify(context.Context, string, string) (string, error) {
 	return f.user.Username, nil
 }
 func (f *fakeDSM) Account(context.Context, string) (Subject, error)           { return f.user, f.accountErr }
-func (f *fakeDSM) Allow(context.Context, Subject, string) error               { return f.privilegeErr }
+func (f *fakeDSM) Allow(context.Context, Subject, string, string) error       { return f.privilegeErr }
 func (f *fakeDSM) ScopeRoot(context.Context, Subject, string) (string, error) { return f.root, nil }
 func (f *fakeDSM) API(context.Context, string, string, map[string]any) (json.RawMessage, error) {
+	f.apiMu.Lock()
 	f.apiCalls++
+	f.apiMu.Unlock()
 	return json.RawMessage(`{"allowed":true}`), nil
 }
 
@@ -69,7 +73,6 @@ func TestRejections(t *testing.T) {
 		{"missing account", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.accountErr = errors.New("missing") }, nil, "INELIGIBLE"},
 		{"disabled", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "now" }, nil, "INELIGIBLE"},
 		{"unknown disabled state", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "" }, nil, "INELIGIBLE"},
-		{"admin runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Admin = true }, nil, "INELIGIBLE"},
 		{"system runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID = 1 }, nil, "INELIGIBLE"},
 		{"uid reuse", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID++ }, nil, "INELIGIBLE"},
 		{"app deny", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.privilegeErr = errors.New("deny") }, nil, "APP_DENIED"},
@@ -216,7 +219,7 @@ func TestFileStationPrivilegeRequiredSeparately(t *testing.T) {
 
 type selectivePrivilege struct{ *fakeDSM }
 
-func (f *selectivePrivilege) Allow(_ context.Context, _ Subject, app string) error {
+func (f *selectivePrivilege) Allow(_ context.Context, _ Subject, app, _ string) error {
 	if app == "SYNO.SDS.App.FileStation3.Instance" {
 		return errors.New("deny File Station")
 	}
@@ -230,12 +233,39 @@ func TestSharedScope(t *testing.T) {
 		t.Fatal(out)
 	}
 }
+
+type entryRecorder struct {
+	*fakeDSM
+	entries map[string]string
+}
+
+func (f *entryRecorder) Allow(_ context.Context, _ Subject, app, entry string) error {
+	f.entries[app] = entry
+	return nil
+}
+func TestPackageEntryModeReachesAppPrivilegeOnly(t *testing.T) {
+	e, f, _ := setup(t)
+	e.Policy.Entry = "app-privilege"
+	r := &entryRecorder{fakeDSM: f, entries: map[string]string{}}
+	e.DSM = r
+	if out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10}); !out.OK {
+		t.Fatal(out)
+	}
+	// File Station is a DSM App without the package's entry mode.
+	if r.entries["app"] != "app-privilege" || r.entries["SYNO.SDS.App.FileStation3.Instance"] != "" {
+		t.Fatal(r.entries)
+	}
+}
 func TestPolicyValidation(t *testing.T) {
 	base := Policy{Version: 1, Package: "p2probe", App: "app", Scope: "home", Operations: allOps}
-	if validatePolicy(base, "p2probe") != nil {
-		t.Fatal("valid policy")
+	for _, entry := range []string{"", "admin-only", "app-privilege"} {
+		p := base
+		p.Entry = entry
+		if validatePolicy(p, "p2probe") != nil {
+			t.Fatal("valid policy", entry)
+		}
 	}
-	for _, mutate := range []func(*Policy){func(p *Policy) { p.Package = "another" }, func(p *Policy) { p.Version = 2 }, func(p *Policy) { p.Operations = []string{"shell"} }, func(p *Policy) { p.Operations = []string{"status", "status"} }, func(p *Policy) { p.Scope = "../../etc" }, func(p *Policy) { p.Root = map[string]string{"a": "bad"} }} {
+	for _, mutate := range []func(*Policy){func(p *Policy) { p.Package = "another" }, func(p *Policy) { p.Version = 2 }, func(p *Policy) { p.Operations = []string{"shell"} }, func(p *Policy) { p.Operations = []string{"status", "status"} }, func(p *Policy) { p.Scope = "../../etc" }, func(p *Policy) { p.Root = map[string]string{"a": "bad"} }, func(p *Policy) { p.Entry = "everyone" }} {
 		p := base
 		mutate(&p)
 		if validatePolicy(p, "p2probe") == nil {

package/dist/templates/_executor/identity.go

@@ -16,7 +16,7 @@ type identitySwitch interface {
 }
 
 func dropIdentity(x identitySwitch, s Subject) error {
-	if s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || s.Admin {
+	if s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 {
 		return errors.New("subject")
 	}
 	for _, g := range s.Groups {
@@ -46,3 +46,29 @@ func dropIdentity(x identitySwitch, s Subject) error {
 	}
 	return nil
 }
+
+func sameGroups(a, b []int) bool {
+	a = append([]int(nil), a...)
+	b = append([]int(nil), b...)
+	sort.Ints(a)
+	sort.Ints(b)
+	return fmt.Sprint(a) == fmt.Sprint(b)
+}
+
+// Keep the historical injectable identity interface for existing consumer
+// fixtures. Production fixed children require this stricter syscall surface.
+type sealedIdentitySwitch interface {
+	identitySwitch
+	Seal() error
+	VerifyPrivileges(Subject) error
+}
+
+func dropSealedIdentity(x sealedIdentitySwitch, s Subject) error {
+	if err := x.Seal(); err != nil {
+		return err
+	}
+	if err := dropIdentity(x, s); err != nil {
+		return err
+	}
+	return x.VerifyPrivileges(s)
+}

package/dist/templates/_executor/identity_kernel_linux_test.go

@@ -0,0 +1,60 @@
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"syscall"
+	"testing"
+)
+
+func TestSealedIdentityRealKernel(t *testing.T) {
+	if mode := os.Getenv("T0188_IDENTITY_CHILD"); mode != "" {
+		runtime.LockOSThread()
+		subject := Subject{UID: 1200, GID: 100, Groups: []int{100}}
+		var err error
+		if mode == "unsealed" {
+			// Clear capabilities and IDs without setting no_new_privs.
+			// VerifyPrivileges must still refuse this otherwise sealed child.
+			for cap := uintptr(0); cap < 64; cap++ {
+				_, _, errno := syscall.Syscall6(syscall.SYS_PRCTL, 24, cap, 0, 0, 0, 0)
+				if errno != 0 && errno != syscall.EINVAL {
+					fmt.Fprintln(os.Stderr, errno)
+					os.Exit(1)
+				}
+			}
+			err = dropIdentity(realIdentity{}, subject)
+			if err == nil {
+				err = realIdentity{}.VerifyPrivileges(subject)
+			}
+			if err == nil || err.Error() != "no_new_privs missing" {
+				fmt.Fprintln(os.Stderr, "expected no_new_privs refusal, got", err)
+				os.Exit(1)
+			}
+			os.Exit(0)
+		}
+		err = dropSealedIdentity(realIdentity{}, subject)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		os.Exit(0)
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("root Linux fixture required")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, mode := range []string{"sealed", "unsealed"} {
+		cmd := exec.Command(exe, "-test.run=^TestSealedIdentityRealKernel$")
+		cmd.Env = append(os.Environ(), "T0188_IDENTITY_CHILD="+mode)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("%s subject kernel verification: %s: %v", mode, out, err)
+		}
+	}
+}

package/dist/templates/_executor/identity_linux.go

@@ -0,0 +1,82 @@
+//go:build linux
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+func (realIdentity) Seal() error {
+	// These are per-thread Linux settings. Every fresh child locks its OS thread
+	// until exit; it never execs untrusted code after dropping the identity.
+	prctl := func(op, a uintptr) error {
+		_, _, err := syscall.Syscall6(syscall.SYS_PRCTL, op, a, 0, 0, 0, 0)
+		if err != 0 {
+			return err
+		}
+		return nil
+	}
+	if err := prctl(38, 1); err != nil {
+		return err
+	} // PR_SET_NO_NEW_PRIVS
+	if err := prctl(8, 0); err != nil {
+		return err
+	} // PR_SET_KEEPCAPS off
+	for cap := uintptr(0); cap < 64; cap++ {
+		if err := prctl(24, cap); err != nil && err != syscall.EINVAL {
+			return err
+		}
+	} // PR_CAPBSET_DROP
+	return nil
+}
+func (realIdentity) VerifyPrivileges(s Subject) error {
+	b, err := os.ReadFile(fmt.Sprintf("/proc/self/task/%d/status", syscall.Gettid()))
+	if err != nil {
+		return err
+	}
+	fields := map[string][]string{}
+	for _, line := range strings.Split(string(b), "\n") {
+		parts := strings.Fields(line)
+		if len(parts) > 1 {
+			fields[strings.TrimSuffix(parts[0], ":")] = parts[1:]
+		}
+	}
+	for key, want := range map[string]int{"Uid": s.UID, "Gid": s.GID} {
+		got := fields[key]
+		if len(got) != 4 {
+			return errors.New("saved IDs missing")
+		}
+		for _, v := range got {
+			n, err := strconv.Atoi(v)
+			if err != nil || n != want {
+				return errors.New("saved IDs mismatch")
+			}
+		}
+	}
+	for _, key := range []string{"CapInh", "CapPrm", "CapEff", "CapBnd", "CapAmb"} {
+		v := fields[key]
+		if len(v) != 1 {
+			return errors.New("capability missing")
+		}
+		n, err := strconv.ParseUint(v[0], 16, 64)
+		if err != nil || n != 0 {
+			return errors.New("capability retained")
+		}
+	}
+	// Linux 4.4 supports no_new_privs but does not expose NoNewPrivs in
+	// proc status. Query the locked writer thread directly; missing/failed
+	// kernel support still refuses the write, without relaxing the seal.
+	nnp, _, errno := syscall.Syscall6(syscall.SYS_PRCTL, 39, 0, 0, 0, 0, 0) // PR_GET_NO_NEW_PRIVS
+	if errno != 0 {
+		return errno
+	}
+	if nnp != 1 {
+		return errors.New("no_new_privs missing")
+	}
+	return nil
+}

package/dist/templates/_executor/identity_security_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"errors"
+	"testing"
+)
+
+type secureSwitch struct {
+	sealed, verified bool
+	bad              bool
+	subject          Subject
+}
+
+func (s *secureSwitch) Seal() error { s.sealed = true; return nil }
+func (s *secureSwitch) VerifyPrivileges(Subject) error {
+	s.verified = true
+	if s.bad {
+		return errors.New("saved root or capability")
+	}
+	return nil
+}
+func (s *secureSwitch) Setgroups([]int) error {
+	if !s.sealed {
+		return errors.New("not sealed")
+	}
+	return nil
+}
+func (s *secureSwitch) Setresgid(int, int, int) error { return nil }
+func (s *secureSwitch) Setresuid(int, int, int) error { return nil }
+func (s *secureSwitch) IDs() (int, int, int, int) {
+	return s.subject.UID, s.subject.UID, s.subject.GID, s.subject.GID
+}
+func (s *secureSwitch) Groups() ([]int, error) { return s.subject.Groups, nil }
+func TestDropAdminSealsAndChecksSavedIDsCapabilities(t *testing.T) {
+	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 101}, Admin: true}
+	for _, bad := range []bool{false, true} {
+		s := &secureSwitch{bad: bad, subject: subject}
+		err := dropSealedIdentity(s, subject)
+		if (err != nil) != bad || !s.verified {
+			t.Fatal("unverified privilege drop", err)
+		}
+	}
+}

package/dist/templates/_executor/internal/lifecycle/lifecycle.go

@@ -69,6 +69,11 @@ func Run(ctx context.Context, cfg Config, action string) error {
 	defer ticker.Stop()
 	for {
 		gone, err := absent(cfg.Socket)
+		if err == nil && gone && action == "purge" {
+			// A paused executor has no socket but still polls the mailbox. Only
+			// its purge removes the socket directory, after root cleanup.
+			gone, err = absent(filepath.Dir(cfg.Socket))
+		}
 		if err != nil {
 			if cfg.Log != nil {
 				cfg.Log("executor socket status unavailable: request retained; lifecycle continues")

package/dist/templates/_executor/internal/lifecycle/lifecycle_test.go

@@ -13,7 +13,8 @@ func TestRequestPersistsOfflineWithoutScheduler(t *testing.T) {
 	for _, action := range []string{"stop", "purge"} {
 		t.Run(action, func(t *testing.T) {
 			root := t.TempDir()
-			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "executor.sock")}
+			// No executor ever ran: its socket directory does not exist.
+			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "run", "executor.sock")}
 			if err := Run(context.Background(), cfg, action); err != nil {
 				t.Fatal(err)
 			}
@@ -34,7 +35,8 @@ func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
 		for _, timeout := range []bool{false, true} {
 			t.Run(action+"-"+map[bool]string{false: "confirmed", true: "timeout"}[timeout], func(t *testing.T) {
 				root := t.TempDir()
-				socket := filepath.Join(root, "executor.sock")
+				os.Mkdir(filepath.Join(root, "run"), 0750)
+				socket := filepath.Join(root, "run", "executor.sock")
 				os.WriteFile(socket, []byte{}, 0600)
 				warnings := []string{}
 				cfg := Config{Package: "TestApp", Data: root, Socket: socket, Log: func(s string) { warnings = append(warnings, s) }}
@@ -50,7 +52,12 @@ func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
 						defer close(done)
 						for {
 							if _, err := os.Stat(filepath.Join(root, "executor", "control")); err == nil {
-								os.Remove(socket)
+								// Pause closes the socket; purge ends with its directory.
+								if action == "purge" {
+									os.RemoveAll(filepath.Dir(socket))
+								} else {
+									os.Remove(socket)
+								}
 								return
 							}
 							select {
@@ -80,6 +87,57 @@ func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
 		}
 	}
 }
+
+// A stopped package already paused the executor and removed its socket, so
+// preuninst's purge must wait for the root purge itself: the executor removes
+// its socket directory only after consuming purge. Returning earlier lets DSM
+// delete the mailbox before the paused monitor polls it.
+func TestPurgeOfPausedExecutorWaitsForSocketDirectoryRemoval(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "run")
+	os.Mkdir(dir, 0750)
+	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock")}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	consumed := make(chan time.Time, 1)
+	go func() {
+		for ctx.Err() == nil {
+			if b, _ := os.ReadFile(filepath.Join(root, "executor", "control")); string(b) == "purge\n" {
+				time.Sleep(300 * time.Millisecond)
+				consumed <- time.Now()
+				os.RemoveAll(dir)
+				return
+			}
+			time.Sleep(time.Millisecond)
+		}
+	}()
+	if err := Run(ctx, cfg, "purge"); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-consumed:
+	default:
+		t.Fatal("purge returned before the executor removed its socket directory")
+	}
+	if ctx.Err() != nil {
+		t.Fatal("purge confirmation timed out")
+	}
+}
+
+func TestStopOfPausedExecutorDoesNotWaitForSocketDirectory(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "run")
+	os.Mkdir(dir, 0750)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := Run(ctx, Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock")}, "stop"); err != nil {
+		t.Fatal(err)
+	}
+	if ctx.Err() != nil {
+		t.Fatal("stop waited for the socket directory")
+	}
+}
+
 func TestRequestRejectsInvalidActionAndSymlink(t *testing.T) {
 	root := t.TempDir()
 	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "socket")}

package/dist/templates/_executor/internal/taskscript/boot.sh

@@ -8,24 +8,24 @@ q=/var/packages/$p
 s=$q/target/executor
 r=/usr/local/etc/synopkgland/$p
 d=$r/runtime
-v(){ echo "@EXECUTOR_DIGEST@  $1executor
-@POLICY_DIGEST@  $1policy.json"|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
+o="--package $p"
+v(){ echo "$2@POLICY_DIGEST@  ${1}policy.json"|sha256sum -c - >/dev/null||{ logger digest;exit 1;};}
 a=purge
 if [ -d $q ];then
 a=stop
-[ "$(cat "$q/var/executor/control" 2>/dev/null)" != purge ] || { a=purge;[ -e $d ] || [ -L $d ] || { logger purged;exit 0;};}
+[ "$(cat $q/var/executor/control)" != purge ] || { a=purge;[ -e $d ] || [ -L $d ] || { logger purged;exit 0;};}
 else [ -d $r ] || exit 0;fi
-[ $a = stop ] || s=$d
-v $s/
 mkdir -p -m 700 $d
 [ "$(find $d -maxdepth 0 -uid 0 -type d -perm 700)" = $d ]
 cd $d
+[ $a = stop ] || { v ./ "";exec ./executor control purge $o;}
+e=$(sed -n 's/^synopkgland_executor_sha256="\([0-9a-f]*\)"$/\1/p' $q/INFO)
+[ ${#e} = 64 ]
 cp $s/executor .executor
 cp $s/policy.json .policy.json
-v .
+v . "$e  .executor
+"
 chmod 700 .executor
-./.executor control $a --package $p
-[ $a = stop ] || exit 0
 for f in executor policy.json;do mv .$f $f;done
 [ -e $s/../root ] && cp -R $s/../root .
-./executor control start --package $p
+./executor control start $o

package/dist/templates/_executor/internal/taskscript/cmd/main.go

@@ -8,10 +8,10 @@ import (
 )
 
 func main() {
-	if len(os.Args) != 4 {
+	if len(os.Args) != 3 {
 		os.Exit(2)
 	}
-	tasks, err := taskscript.Generate(os.Args[1], os.Args[2], os.Args[3])
+	tasks, err := taskscript.Generate(os.Args[1], os.Args[2])
 	if err != nil {
 		os.Exit(1)
 	}

package/dist/templates/_executor/internal/taskscript/control.sh

@@ -8,19 +8,24 @@ q=/var/packages/$p
 s=$q/target/executor
 r=/usr/local/etc/synopkgland/$p
 d=$r/runtime
-v(){ { echo @EXECUTOR_DIGEST@"  $1/$2executor"; echo @POLICY_DIGEST@"  $1/$2policy.json"; }|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
-v "$s" ''
+v(){ echo "$3@POLICY_DIGEST@  $1/$2policy.json"|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
 mkdir -p -m 700 "$d"
 [ "$(find "$d" -maxdepth 0 -uid 0 -type d -perm 700)" = "$d" ]
-a=$(cat /var/packages/$p/var/executor/control)
+a=$(cat "$q/var/executor/control")
 case "$a" in start|stop|purge) ;; *) exit 1;; esac
-if [ "$a" = purge ]; then
+if [ "$a" = stop ]; then
+v "$d" '' ''
+exec "$d/executor" control stop --package "$p"
+fi
+# Root runs only executor bytes anchored in the root-owned INFO, under the approved policy.
+e=$(sed -n 's/^synopkgland_executor_sha256="\([0-9a-f]*\)"$/\1/p' "$q/INFO")
+[ ${#e} = 64 ] || { logger anchor;exit 1;}
 cp "$s/executor" "$d/.executor"
 cp "$s/policy.json" "$d/.policy.json"
-v "$d" .
+v "$d" . "$e  $d/.executor
+"
 chmod 700 "$d/.executor"
-"$d/.executor" control purge --package "$p"
-else
-v "$d" ''
-"$d/executor" control $a --package $p
-fi
+[ "$a" = start ] || exec "$d/.executor" control purge --package "$p"
+for f in executor policy.json; do mv "$d/.$f" "$d/$f"; done
+[ -e "$s/../root" ] && cp -R "$s/../root" "$d"
+"$d/executor" control start --package "$p"

package/dist/templates/_executor/internal/taskscript/tasks.go

@@ -21,11 +21,13 @@ type Task struct {
 	Script string `json:"script"`
 }
 
-func Generate(pkg, ed, pd string) ([]Task, error) {
-	if !regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`).MatchString(pkg) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(ed) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(pd) {
+// Tasks pin only the approved policy. Executor bytes are anchored per SPK in the
+// root-owned package INFO, so an executor-only upgrade keeps both definitions.
+func Generate(pkg, pd string) ([]Task, error) {
+	if !regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`).MatchString(pkg) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(pd) {
 		return nil, errors.New("task pins")
 	}
-	replace := strings.NewReplacer("@PACKAGE@", pkg, "@EXECUTOR_DIGEST@", ed, "@POLICY_DIGEST@", pd)
+	replace := strings.NewReplacer("@PACKAGE@", pkg, "@POLICY_DIGEST@", pd)
 	tasks := []Task{}
 	for i, source := range []string{boot, control} {
 		kind, limit := "boot", 1024

package/dist/templates/_executor/lifecycle_test.go

@@ -84,3 +84,14 @@ func TestDirectoryValidationRejectsExistingWrongModeOwnerAndSymlink(t *testing.T
 		t.Fatal("symlink accepted")
 	}
 }
+
+// The legacy write child linked its own copy without waiting for serve, so an
+// orphan could still publish. Nothing spawns it since files.write moved to the
+// move child; neither it nor its cleanup child may run at all.
+func TestLegacyWriteChildrenAreNotCommands(t *testing.T) {
+	for _, child := range []string{"write-child", "cleanup-child"} {
+		if err := run([]string{child}); err == nil || err.Error() != "invalid command" {
+			t.Fatalf("%s: %v", child, err)
+		}
+	}
+}

package/dist/templates/_executor/link_linux.go

@@ -0,0 +1,28 @@
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+func linkOpenPart(part, dir *os.File, name string) error {
+	// /proc/self/fd/<fd> refers to the still-open inode. Following that one trusted
+	// proc link prevents a subject from swapping a guessed temporary pathname.
+	old, err := syscall.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", part.Fd()))
+	if err != nil {
+		return err
+	}
+	new, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return err
+	}
+	_, _, errno := syscall.Syscall6(syscall.SYS_LINKAT, ^uintptr(99), uintptr(unsafe.Pointer(old)), dir.Fd(), uintptr(unsafe.Pointer(new)), 0x400, 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}