@synopackageland/cli 0.6.0 → 0.7.0

package/dist/templates/native-go/backend/cmd/app/main.go

@@ -20,15 +20,22 @@ import (
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	delegateScope  = ""
-	executorDigest = ""
-	policyDigest   = ""
-	packageID      = "dev"
-	version        = "0.0.0"
+	delegateScope            = ""
+	delegateOperationsJSON   = ""
+	delegateDestinationsJSON = ""
+	delegateLifetime         = ""
+	executorDigest           = ""
+	policyDigest             = ""
+	packageID                = "dev"
+	version                  = "0.0.0"
 	// "session" when the project opted into the interactive File Station adapter.
 	fileStation = ""
 	// "standalone" enables the SDK identity adapter; the runtime owns authentication.
 	identity = ""
+	// dsm-package.yaml entry: "admin-only" or "app-privilege"; empty keeps the route policy alone.
+	entry = ""
+	// "on" when dsm-package.yaml declares portal: serves portal.status.
+	portal = ""
 )
 
 func main() {
@@ -39,15 +46,24 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		DelegateScope:  delegateScope,
-		ExecutorDigest: executorDigest, PolicyDigest: policyDigest,
+		DelegateScope:            delegateScope,
+		DelegateOperationsJSON:   delegateOperationsJSON,
+		DelegateDestinationsJSON: delegateDestinationsJSON,
+		DelegateLifetime:         delegateLifetime,
+		ExecutorDigest:           executorDigest, PolicyDigest: policyDigest,
 		PackageID: packageID,
 		Version:   version,
 		DataDir:   "/var/packages/" + packageID + "/var",
+		Portal:    portal == "on",
+	}
+	if _, err := app.ParseDelegateConfig(cfg); err != nil {
+		log.Fatal(err)
 	}
 	if app.SessionFilesEnabled(fileStation) {
 		cfg.SessionFiles = filestation.Local(cfg.DataDir)
 	}
+	// Kernels without memfd_create stage DSM's bridges in the package's own temp.
+	dsm.SetBridgeFallbackDir("/var/packages/" + packageID + "/tmp")
 	var auth api.Authenticator = dsm.NewAuthenticator()
 	var standalone *standaloneidentity.Service
 	if identity == "standalone" {
@@ -58,6 +74,10 @@ func main() {
 		}
 		auth = standalone
 	}
+	auth, err := dsm.NewEntryGate(auth, entry, packageID, cfg.DataDir)
+	if err != nil {
+		log.Fatal(err)
+	}
 	srv, err := api.NewServer(auth, app.Routes(cfg)...)
 	if err != nil {
 		log.Fatal(err)

package/dist/templates/native-go/backend/internal/api/entry_test.go

@@ -0,0 +1,47 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+)
+
+func TestEntryRefusalsReachTheBrowserAsStableCodes(t *testing.T) {
+	raw := []byte(`{"schema":1,"default":"administrators","methods":{"demo.user":"authenticated"}}`)
+	for _, tc := range []struct {
+		err  error
+		code string
+	}{
+		{ErrAdminRequired, "admin_required"},
+		{ErrAppPrivilegeDenied, "app_privilege_denied"},
+		{errors.New("bridge exited 2"), "auth_unavailable"},
+	} {
+		executed := 0
+		srv, err := NewServerWithPermissions(&fakeAuth{err: tc.err}, raw, Handle("demo.user", func(context.Context, Caller, json.RawMessage) (any, error) {
+			executed++
+			return nil, nil
+		}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, method := range []string{"demo.user", "future.unknown"} {
+			_, env := post(t, srv, `{"method":"`+method+`"}`)
+			if env.Error == nil || env.Error.Code != tc.code || executed != 0 {
+				t.Fatalf("%v %s: %+v executed=%d", tc.err, method, env.Error, executed)
+			}
+		}
+	}
+}
+
+func TestRequireAdminLetsHandlersReserveGlobalSettings(t *testing.T) {
+	if err := RequireAdmin(Caller{identity: Identity{User: "alice", Admin: true}, authenticated: true}); err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range []Caller{{identity: Identity{User: "bob"}, authenticated: true}, {identity: Identity{User: "alice", Admin: true}}, {}} {
+		var apiErr *Error
+		if err := RequireAdmin(c); !errors.As(err, &apiErr) || apiErr.Code != "admin_required" {
+			t.Fatalf("%+v: %v", c, err)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/api/permissions_test.go

@@ -9,7 +9,7 @@ import (
 
 func TestDefaultPermissionsRequireAdministratorGroup(t *testing.T) {
 	for _, makeRoute := range []func(string, Handler) Route{User, Public, Admin} {
-		for _, method := range []string{"future.read", "future.unknown"} {
+		for method, code := range map[string]string{"future.read": "admin_required", "future.unknown": "unknown_method"} {
 			executed := 0
 			auth := &fakeAuth{user: "admin"} // Name alone confers no group membership.
 			srv, err := NewServer(auth, makeRoute("future.read", func(context.Context, Caller, json.RawMessage) (any, error) {
@@ -20,7 +20,7 @@ func TestDefaultPermissionsRequireAdministratorGroup(t *testing.T) {
 				t.Fatal(err)
 			}
 			_, env := post(t, srv, `{"method":"`+method+`","params":{"admin":true,"groups":["administrators"]}}`)
-			if env.Error == nil || env.Error.Code != "admin_required" || executed != 0 || auth.calls != 1 {
+			if env.Error == nil || env.Error.Code != code || executed != 0 || auth.calls != 1 {
 				t.Fatalf("method=%s error=%+v executed=%d auth=%d", method, env.Error, executed, auth.calls)
 			}
 		}
@@ -39,7 +39,7 @@ func TestCentralPermissionsAreTheOnlyAccessDecision(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, tc := range []struct{ method, code string }{
-		{"demo.user", ""}, {"demo.ping", ""}, {"demo.private", "admin_required"}, {"future.unknown", "admin_required"},
+		{"demo.user", ""}, {"demo.ping", ""}, {"demo.private", "admin_required"}, {"future.unknown", "unknown_method"},
 	} {
 		_, env := post(t, srv, `{"method":"`+tc.method+`"}`)
 		if tc.code == "" {

package/dist/templates/native-go/backend/internal/api/registry.go

@@ -102,6 +102,17 @@ func (c Caller) Authenticated() bool { return c.authenticated }
 func (c Caller) User() string        { return c.identity.User }
 func (c Caller) Admin() bool         { return c.authenticated && c.identity.Admin }
 
+var adminRequired = &Error{"admin_required", "this action needs the DSM administrators group"}
+
+// RequireAdmin reserves part of a shared route, such as global settings, for
+// DSM administrators. Whole routes are reserved in permissions.json instead.
+func RequireAdmin(c Caller) error {
+	if !c.Admin() {
+		return adminRequired
+	}
+	return nil
+}
+
 var methodName = regexp.MustCompile(`^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$`)
 
 func buildRegistry(routes []Route) (map[string]Route, error) {

package/dist/templates/native-go/backend/internal/api/sdk-permissions.json

@@ -23,6 +23,9 @@
     "bg.jobs.purge": "administrators",
     "bg.schedules.enable": "administrators"
   },
+  "portal": {
+    "portal.status": "authenticated"
+  },
   "identity": {
     "identity.status": "public",
     "identity.login": "public",
@@ -35,12 +38,22 @@
     "root.run": "administrators"
   },
   "delegate": {
+    "delegate.destination": "authenticated",
     "delegate.status": "authenticated",
     "delegate.create": "authenticated",
     "delegate.list": "authenticated",
     "delegate.revoke": "authenticated",
     "delegate.jobs.submit": "authenticated",
     "delegate.jobs.list": "authenticated",
-    "delegate.jobs.cancel": "authenticated"
+    "delegate.jobs.cancel": "authenticated",
+    "delegate.select_destination": "authenticated",
+    "delegate.move_from_staging": "authenticated",
+    "delegate.operations.get": "authenticated",
+    "delegate.operations.list": "authenticated",
+    "delegate.operations.cancel": "authenticated",
+    "delegate.disable": "administrators",
+    "delegate.enable": "administrators",
+    "delegate.audit": "authenticated",
+    "delegate.example.export": "authenticated"
   }
 }

package/dist/templates/native-go/backend/internal/api/server.go

@@ -40,6 +40,13 @@ func WithRequestDeadline(next http.Handler) http.Handler {
 // ErrNoSession means the request carries no valid DSM session.
 var ErrNoSession = errors.New("no valid DSM session")
 
+// ErrAdminRequired is an entry refusal: the app admits only administrators.
+var ErrAdminRequired = errors.New("app entry requires an administrator")
+
+// ErrAppPrivilegeDenied is an entry refusal: DSM Application Privileges do not
+// allow this account to use the app from this address.
+var ErrAppPrivilegeDenied = errors.New("DSM Application Privileges deny this app")
+
 // Authenticator verifies the DSM session behind a request.
 type Authenticator interface {
 	Authenticate(r *http.Request) (Identity, error)
@@ -212,18 +219,24 @@ func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Erro
 	if errors.Is(err, ErrNoSession) {
 		return Caller{}, Route{}, &Error{"session_required", "sign in to DSM again"}
 	}
+	if errors.Is(err, ErrAdminRequired) {
+		return Caller{}, Route{}, adminRequired
+	}
+	if errors.Is(err, ErrAppPrivilegeDenied) {
+		return Caller{}, Route{}, &Error{"app_privilege_denied", "DSM Application Privileges do not allow this account to use this app"}
+	}
 	if err != nil {
 		log.Printf("authentication unavailable: %v", err)
 		return Caller{}, Route{}, &Error{"auth_unavailable", "DSM authentication is unavailable"}
 	}
-	// Unknown methods inherit the fixed administrators default before revealing
-	// whether a handler exists. Route constructors never grant permission.
-	if (!known || route.policy == policyAdmin) && !identity.Admin {
-		return Caller{}, Route{}, &Error{"admin_required", "this action needs the DSM administrators group"}
-	}
+	// Signed-in callers learn that a method is unregistered; method names
+	// already ship in the app's UI. Route constructors never grant permission.
 	if !known {
 		return Caller{}, Route{}, &Error{"unknown_method", "unknown method"}
 	}
+	if route.policy == policyAdmin && !identity.Admin {
+		return Caller{}, Route{}, adminRequired
+	}
 	caller := Caller{identity: identity, authenticated: true}
 	return caller, route, nil
 }

package/dist/templates/native-go/backend/internal/app/delegate_config.go

@@ -0,0 +1,57 @@
+package app
+
+import (
+	"encoding/json"
+	"errors"
+	"regexp"
+)
+
+type DelegateSettings struct {
+	Scope                    string
+	Operations, Destinations []string
+	Lifetime                 string
+}
+
+var destinationKey = regexp.MustCompile(`^[a-z][a-z0-9_-]{0,63}$`)
+
+// ParseDelegateConfig consumes only build/startup settings. Legacy declarations
+// retain their TTL/job branch; absent extension fields never imply permanence.
+func ParseDelegateConfig(cfg Config) (DelegateSettings, error) {
+	out := DelegateSettings{Scope: cfg.DelegateScope, Lifetime: cfg.DelegateLifetime}
+	invalid := errors.New("invalid delegate build configuration")
+	if cfg.DelegateOperationsJSON != "" && json.Unmarshal([]byte(cfg.DelegateOperationsJSON), &out.Operations) != nil {
+		return DelegateSettings{}, invalid
+	}
+	if cfg.DelegateDestinationsJSON != "" && json.Unmarshal([]byte(cfg.DelegateDestinationsJSON), &out.Destinations) != nil {
+		return DelegateSettings{}, invalid
+	}
+	if out.Lifetime == "" {
+		if len(out.Destinations) != 0 {
+			return DelegateSettings{}, invalid
+		}
+		seen := map[string]bool{}
+		for _, op := range out.Operations {
+			switch op {
+			case "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write":
+			default:
+				return DelegateSettings{}, invalid
+			}
+			if seen[op] {
+				return DelegateSettings{}, invalid
+			}
+			seen[op] = true
+		}
+		return out, nil
+	}
+	if out.Lifetime != "until-revoked" || out.Scope == "" || len(out.Operations) != 1 || out.Operations[0] != "files.moveFromStaging" || len(out.Destinations) == 0 || len(out.Destinations) > 64 {
+		return DelegateSettings{}, invalid
+	}
+	seen := map[string]bool{}
+	for _, key := range out.Destinations {
+		if !destinationKey.MatchString(key) || seen[key] {
+			return DelegateSettings{}, invalid
+		}
+		seen[key] = true
+	}
+	return out, nil
+}

package/dist/templates/native-go/backend/internal/app/delegate_config_test.go

@@ -0,0 +1,28 @@
+package app
+
+import "testing"
+
+func TestDelegateBuildConfigStrictlySeparatesLegacyAndPermanent(t *testing.T) {
+	valid := Config{DelegateScope: "home", DelegateOperationsJSON: `["files.moveFromStaging"]`, DelegateDestinationsJSON: `["save"]`, DelegateLifetime: "until-revoked"}
+	settings, err := ParseDelegateConfig(valid)
+	if err != nil || settings.Lifetime != "until-revoked" || len(settings.Destinations) != 1 {
+		t.Fatal(settings, err)
+	}
+	for _, cfg := range []Config{{}, {DelegateScope: "home"}, {DelegateScope: "home", DelegateOperationsJSON: `["files.write"]`}} {
+		settings, err = ParseDelegateConfig(cfg)
+		if err != nil || settings.Lifetime != "" || len(settings.Destinations) != 0 {
+			t.Fatal("legacy changed", settings, err)
+		}
+	}
+	for _, mutate := range []func(*Config){
+		func(c *Config) { c.DelegateLifetime = "" }, func(c *Config) { c.DelegateScope = "" }, func(c *Config) { c.DelegateOperationsJSON = `["files.write"]` },
+		func(c *Config) { c.DelegateDestinationsJSON = `["save","save"]` }, func(c *Config) { c.DelegateDestinationsJSON = `["Save"]` }, func(c *Config) { c.DelegateDestinationsJSON = `[]` }, func(c *Config) { c.DelegateDestinationsJSON = `null` },
+		func(c *Config) { c.DelegateDestinationsJSON = `["save"] {}` },
+	} {
+		cfg := valid
+		mutate(&cfg)
+		if _, err = ParseDelegateConfig(cfg); err == nil {
+			t.Fatal("invalid trusted config accepted", cfg)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/app/portal.go

@@ -0,0 +1,30 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/portal"
+)
+
+// portalRoutes serves portal.status when dsm-package.yaml declares `portal`.
+// An administrator sets the alias with DSM's own AppPortal API from the UI;
+// the package only reads DSM's saved setting.
+func (cfg Config) portalRoutes() []api.Route {
+	if !cfg.Portal {
+		return nil
+	}
+	return []api.Route{api.Handle("portal.status", cfg.portalStatus)}
+}
+
+func (cfg Config) portalStatus(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	path := cfg.PortalConfig
+	if path == "" {
+		path = portal.ConfigPath(cfg.PackageID)
+	}
+	return portal.Read(path, "SYNO.SDS."+cfg.PackageID+".Instance"), nil
+}

package/dist/templates/native-go/backend/internal/app/portal_test.go

@@ -0,0 +1,55 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func portalConfig(t *testing.T, saved string) Config {
+	cfg := testConfig(t)
+	cfg.Portal = true
+	cfg.PortalConfig = filepath.Join(t.TempDir(), "AppPortal.json")
+	if saved != "" {
+		if err := os.WriteFile(cfg.PortalConfig, []byte(saved), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return cfg
+}
+
+func TestPortalStatusTellsEverySignedInUserTheAlias(t *testing.T) {
+	cfg := portalConfig(t, `{"alias":"hello-go","id":"SYNO.SDS.HelloGo.Instance","version":3}`)
+	code, out := call(t, cfg, bob, "portal.status", `{}`)
+	if code != "" {
+		t.Fatalf("%q %v", code, out)
+	}
+	data := out["data"].(map[string]any)
+	if data["state"] != "active" || data["alias"] != "hello-go" {
+		t.Fatalf("%v", data)
+	}
+	if code, _ := call(t, cfg, nobody, "portal.status", `{}`); code != "session_required" {
+		t.Fatalf("anonymous: %q", code)
+	}
+	if code, _ := call(t, cfg, bob, "portal.status", `{"alias":"x"}`); code != "bad_request" {
+		t.Fatalf("params: %q", code)
+	}
+}
+
+func TestPortalStatusFailsClosedOnAnotherAppsSetting(t *testing.T) {
+	cfg := portalConfig(t, `{"alias":"hello-go","id":"SYNO.SDS.Other.Instance"}`)
+	_, out := call(t, cfg, bob, "portal.status", `{}`)
+	if data := out["data"].(map[string]any); data["state"] != "unavailable" || data["alias"] != nil {
+		t.Fatalf("%v", data)
+	}
+	_, out = call(t, portalConfig(t, ""), bob, "portal.status", `{}`)
+	if data := out["data"].(map[string]any); data["state"] != "inactive" {
+		t.Fatalf("%v", data)
+	}
+}
+
+func TestPortalStatusExistsOnlyForAPortalBuild(t *testing.T) {
+	if code, _ := call(t, testConfig(t), alice, "portal.status", `{}`); code != "unknown_method" {
+		t.Fatalf("%q", code)
+	}
+}

package/dist/templates/native-go/backend/internal/app/routes.go

@@ -24,8 +24,9 @@ import (
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
-	DelegateScope                string
-	ExecutorDigest, PolicyDigest string
+	DelegateScope                                                      string
+	DelegateOperationsJSON, DelegateDestinationsJSON, DelegateLifetime string
+	ExecutorDigest, PolicyDigest                                       string
 
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
 	SessionFiles *filestation.Service
@@ -36,6 +37,10 @@ type Config struct {
 	DataDir string
 	// VolumeRoot is where /volumeN lives; empty means "/". Tests set it.
 	VolumeRoot string
+	// Portal serves portal.status; PortalConfig overrides DSM's saved
+	// AppPortal.json path in tests.
+	Portal       bool
+	PortalConfig string
 }
 
 func Routes(cfg Config) []api.Route {
@@ -47,6 +52,7 @@ func Routes(cfg Config) []api.Route {
 	}...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)
+	routes = append(routes, cfg.portalRoutes()...)
 	return append(routes, cfg.rootRoutes()...)
 }
 

package/dist/templates/native-go/backend/internal/background/runner.go

@@ -14,7 +14,7 @@ import (
 // Work is one fixed worker algorithm. It receives only the job's input bytes.
 type Work func(ctx context.Context, in io.Reader) (Result, error)
 
-// SHA256V1 is the only worker in this version: it hashes the imported copy.
+// SHA256V1 hashes the imported private copy; delegate assembly adds a separate fixed worker.
 func SHA256V1(ctx context.Context, in io.Reader) (Result, error) {
 	h := sha256.New()
 	buf := make([]byte, 32*1024)

package/dist/templates/native-go/backend/internal/background/store.go

@@ -61,18 +61,20 @@ const (
 func (s State) terminal() bool { return s != StateQueued && s != StateRunning }
 
 var (
-	ErrBusy           = errors.New("background journal is busy; retry later")
-	ErrOwnerQueueFull = errors.New("owner pending quota reached")
-	ErrOwnerQuota     = errors.New("owner storage quota reached")
-	ErrInvalid        = errors.New("invalid background request")
-	ErrTooLarge       = errors.New("input is larger than the per-file limit")
-	ErrQueueFull      = errors.New("background queue is full")
-	ErrQuota          = errors.New("background spool quota reached")
-	ErrKeyConflict    = errors.New("idempotency key already used for another input")
-	ErrNotFound       = errors.New("job not found")
-	ErrNotCancelable  = errors.New("job already finished")
-	ErrNotRunning     = errors.New("job is not running")
-	ErrUnsafeSpool    = errors.New("background spool is not private to the package account")
+	ErrBusy              = errors.New("background journal is busy; retry later")
+	ErrOwnerQueueFull    = errors.New("owner pending quota reached")
+	ErrOwnerQuota        = errors.New("owner storage quota reached")
+	ErrInvalid           = errors.New("invalid background request")
+	ErrTooLarge          = errors.New("input is larger than the per-file limit")
+	ErrQueueFull         = errors.New("background queue is full")
+	ErrQuota             = errors.New("background spool quota reached")
+	ErrKeyConflict       = errors.New("idempotency key already used for another input")
+	ErrNotFound          = errors.New("job not found")
+	ErrNotCancelable     = errors.New("job already finished")
+	ErrNotRunning        = errors.New("job is not running")
+	ErrUnsafeSpool       = errors.New("background spool is not private to the package account")
+	ErrJournalUnreadable = errors.New("background journal unreadable")
+	ErrJournalSchema     = errors.New("background journal has an unsupported schema")
 )
 
 // Submitter binds visibility to a fresh DSM username and UID. It never grants
@@ -336,10 +338,10 @@ func (s *Store) readJournal(root *os.Root) (journal, error) {
 	}
 	b, err := io.ReadAll(io.LimitReader(f, maxJournal+1))
 	if err != nil || len(b) > maxJournal {
-		return j, errors.New("background journal unreadable")
+		return j, ErrJournalUnreadable
 	}
 	if err := json.Unmarshal(b, &j); err != nil || j.Schema != schemaVersion {
-		return journal{}, errors.New("background journal has an unsupported schema")
+		return journal{}, ErrJournalSchema
 	}
 	return j, nil
 }

package/dist/templates/native-go/backend/internal/dsm/admin.go

@@ -56,8 +56,14 @@ func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
 }
 
 func parseNativeRole(out []byte, err error) (bool, error) {
+	return parseNativeBit(out, err, errNativeRole)
+}
+
+// parseNativeBit accepts only a bridge's exact "1\n" or "0\n"; anything else,
+// including a failed run, is the caller's unavailable error.
+func parseNativeBit(out []byte, err, unavailable error) (bool, error) {
 	if err != nil {
-		return false, errNativeRole
+		return false, unavailable
 	}
 	switch string(out) {
 	case "1\n":
@@ -65,6 +71,6 @@ func parseNativeRole(out []byte, err error) (bool, error) {
 	case "0\n":
 		return false, nil
 	default:
-		return false, errNativeRole
+		return false, unavailable
 	}
 }

package/dist/templates/native-go/backend/internal/dsm/admin_linux.go

@@ -23,31 +23,61 @@ var adminAMD64 []byte
 //go:embed native/admin-aarch64.elf
 var adminARM64 []byte
 
+//go:embed native/apppriv-x86_64.elf
+var appPrivAMD64 []byte
+
+//go:embed native/apppriv-aarch64.elf
+var appPrivARM64 []byte
+
+//go:embed native/admin-armv7.elf
+var adminARMv7 []byte
+
+//go:embed native/apppriv-armv7.elf
+var appPrivARMv7 []byte
+
+// Bridges per runtime.GOARCH; an architecture without one is refused.
+var (
+	adminBridges   = map[string][]byte{"amd64": adminAMD64, "arm64": adminARM64, "arm": adminARMv7}
+	appPrivBridges = map[string][]byte{"amd64": appPrivAMD64, "arm64": appPrivARM64, "arm": appPrivARMv7}
+)
+
 func nativeAdministrator(ctx context.Context, principal string) (bool, error) {
-	var payload []byte
-	switch runtime.GOARCH {
-	case "amd64":
-		payload = adminAMD64
-	case "arm64":
-		payload = adminARM64
-	default:
-		return false, errNativeRole
+	out, err := runBridge(ctx, adminBridges, principal)
+	return parseNativeRole(out, err)
+}
+
+func nativeAppPrivilege(ctx context.Context, principal, app, addr string) (bool, error) {
+	out, err := runBridge(ctx, appPrivBridges, principal, app, addr)
+	return parseNativeBit(out, err, errNativeAppPriv)
+}
+
+// runBridge executes the sealed bridge for this architecture with fixed
+// arguments and a minimal environment, returning at most 16 bytes of output.
+func runBridge(ctx context.Context, bridges map[string][]byte, args ...string) ([]byte, error) {
+	payload, ok := bridges[runtime.GOARCH]
+	if !ok {
+		return nil, errors.New("unsupported architecture")
 	}
 	file, err := sealedBridge(payload)
 	if err != nil {
-		return false, errNativeRole
+		return nil, err
 	}
 	defer file.Close()
-	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", principal)
+	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", args...)
 	cmd.ExtraFiles = []*os.File{file}
 	// In particular, never inherit LD_PRELOAD/LD_LIBRARY_PATH or credentials.
 	cmd.Env = []string{"LANG=C", "LC_ALL=C"}
-	out, err := commandOutput(cmd, 16)
-	return parseNativeRole(out, err)
+	return commandOutput(cmd, 16)
 }
 
+// memfdCreate is the sealing primitive; tests replace it to model old kernels.
+var memfdCreate = unix.MemfdCreate
+
 func sealedBridge(payload []byte) (*os.File, error) {
-	fd, err := unix.MemfdCreate("synopkgland-admin", unix.MFD_CLOEXEC|unix.MFD_ALLOW_SEALING)
+	fd, err := memfdCreate("synopkgland-admin", unix.MFD_CLOEXEC|unix.MFD_ALLOW_SEALING)
+	if errors.Is(err, unix.ENOSYS) {
+		return unlinkedBridge(bridgeFallbackDir, payload)
+	}
 	if err != nil {
 		return nil, err
 	}