@synopackageland/cli 0.6.1 → 0.7.0

package/dist/templates/_executor/executor.go

@@ -22,17 +22,21 @@ import (
 const version = "1"
 const maxRequest = 64 << 10
 
-var allOps = []string{"status", "delegate.create", "delegate.list", "delegate.revoke", "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "root.run"}
+var allOps = []string{"status", "delegate.create", "delegate.list", "delegate.revoke", "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.moveFromStaging", "files.operationStatus", "files.cancelOperation", "delegate.disable", "delegate.enable", "delegate.audit", "root.run"}
 var tokenRE = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
+var destinationRE = regexp.MustCompile(`^[a-z][a-z0-9_-]{0,63}$`)
 var idRE = regexp.MustCompile(`^[a-f0-9]{64}$`)
 
 type Policy struct {
-	Version    int               `json:"v"`
-	Package    string            `json:"package"`
-	App        string            `json:"app"`
-	Scope      string            `json:"scope,omitempty"`
-	Operations []string          `json:"operations"`
-	Root       map[string]string `json:"root,omitempty"`
+	Version      int               `json:"v"`
+	Package      string            `json:"package"`
+	App          string            `json:"app"`
+	Entry        string            `json:"entry,omitempty"`
+	Scope        string            `json:"scope,omitempty"`
+	Operations   []string          `json:"operations"`
+	Destinations []string          `json:"destinations,omitempty"`
+	Lifetime     string            `json:"lifetime,omitempty"`
+	Root         map[string]string `json:"root,omitempty"`
 }
 type Subject struct {
 	Username string `json:"username"`
@@ -44,16 +48,20 @@ type Subject struct {
 	Admin    bool   `json:"admin"`
 }
 type Delegation struct {
-	ID      string    `json:"delegation_id"`
-	Package string    `json:"package"`
-	Subject Subject   `json:"subject"`
-	Job     string    `json:"job_id"`
-	Ops     []string  `json:"ops"`
-	Scope   string    `json:"scope"`
-	Path    string    `json:"path"`
-	Root    string    `json:"root"`
-	Expires time.Time `json:"expires_at"`
-	Revoked bool      `json:"revoked"`
+	ScopeGeneration uint64            `json:"scope_generation,omitempty"`
+	Lifetime        string            `json:"lifetime,omitempty"`
+	DestinationKey  string            `json:"destination,omitempty"`
+	Directory       directoryIdentity `json:"directory,omitempty"`
+	ID              string            `json:"delegation_id"`
+	Package         string            `json:"package"`
+	Subject         Subject           `json:"subject"`
+	Job             string            `json:"job_id"`
+	Ops             []string          `json:"ops"`
+	Scope           string            `json:"scope"`
+	Path            string            `json:"path"`
+	Root            string            `json:"root"`
+	Expires         time.Time         `json:"expires_at"`
+	Revoked         bool              `json:"revoked"`
 }
 type Auth struct {
 	Cookie    string `json:"dsm_cookie,omitempty"`
@@ -95,20 +103,23 @@ type Response struct {
 	Message string `json:"message,omitempty"`
 }
 type Params struct {
-	Job     string   `json:"job_id,omitempty"`
-	Ops     []string `json:"ops,omitempty"`
-	Scope   string   `json:"scope,omitempty"`
-	Path    string   `json:"path,omitempty"`
-	TTL     int64    `json:"ttl_seconds,omitempty"`
-	ID      string   `json:"delegation_id,omitempty"`
-	Staging string   `json:"staging,omitempty"`
-	Dest    string   `json:"dest_dir,omitempty"`
-	Name    string   `json:"name,omitempty"`
+	Lifetime       string   `json:"lifetime,omitempty"`
+	DestinationKey string   `json:"destination,omitempty"`
+	Size           int64    `json:"size,omitempty"`
+	Job            string   `json:"job_id,omitempty"`
+	Ops            []string `json:"ops,omitempty"`
+	Scope          string   `json:"scope,omitempty"`
+	Path           string   `json:"path,omitempty"`
+	TTL            int64    `json:"ttl_seconds,omitempty"`
+	ID             string   `json:"delegation_id,omitempty"`
+	Staging        string   `json:"staging,omitempty"`
+	Dest           string   `json:"dest_dir,omitempty"`
+	Name           string   `json:"name,omitempty"`
 }
 type DSM interface {
 	Verify(context.Context, string, string) (string, error)
 	Account(context.Context, string) (Subject, error)
-	Allow(context.Context, Subject, string) error
+	Allow(context.Context, Subject, string, string) error
 	ScopeRoot(context.Context, Subject, string) (string, error)
 	API(context.Context, string, string, map[string]any) (json.RawMessage, error)
 }
@@ -128,7 +139,10 @@ type Executor struct {
 	Store                        *Store
 	Now                          func() time.Time
 	ExecutorDigest, PolicyDigest string
-	mu                           sync.Mutex // Serializes execution with revoke, including already accepted requests.
+	legacyCalls                  map[string][]chan struct{}
+	copySlot                     chan struct{}
+	commitMu                     sync.Mutex // Durable admission/revoke/disable and bounded publish only.
+	async                        *operationRuntime
 }
 
 func deny(code string) Response {
@@ -231,7 +245,7 @@ func uniqueValue(d *json.Decoder, canonical bool) error {
 }
 func (e *Executor) Connection(parent context.Context, c net.Conn, uid int, peer func(net.Conn) (int, error)) {
 	got, err := peer(c)
-	if err != nil || got != uid {
+	if err != nil || (got != uid && got != 0) {
 		return
 	}
 	c.SetDeadline(time.Now().Add(15 * time.Second))
@@ -249,22 +263,36 @@ func (e *Executor) Connection(parent context.Context, c net.Conn, uid int, peer
 		} else {
 			ctx, cancel := context.WithTimeout(parent, 30*time.Second)
 			defer cancel()
-			out = e.Handle(ctx, req)
+			out = e.handlePeer(ctx, req, got, uid)
 		}
 	}
 	c.SetWriteDeadline(time.Now().Add(5 * time.Second))
 	json.NewEncoder(c).Encode(out)
 }
 func (e *Executor) eligible(ctx context.Context, name string, uid int, files bool) (Subject, string) {
+	moveValidationStage(ctx, "account")
 	s, err := e.DSM.Account(ctx, name)
-	if err != nil || s.Username != name || s.Expired != "normal" || s.Admin || s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || (uid >= 0 && s.UID != uid) {
+	if moveValidationDeadline(ctx, err) {
+		return s, "EXECUTOR_PAUSED"
+	}
+	if err != nil || s.Username != name || s.Expired != "normal" || s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || (uid >= 0 && s.UID != uid) {
 		return Subject{}, "INELIGIBLE"
 	}
-	if e.DSM.Allow(ctx, s, e.Policy.App) != nil {
+	moveValidationStage(ctx, "app-privilege")
+	if err := e.DSM.Allow(ctx, s, e.Policy.App, e.Policy.Entry); err != nil {
+		if moveValidationDeadline(ctx, err) {
+			return s, "EXECUTOR_PAUSED"
+		}
 		return Subject{}, "APP_DENIED"
 	}
-	if files && e.DSM.Allow(ctx, s, "SYNO.SDS.App.FileStation3.Instance") != nil {
-		return Subject{}, "APP_DENIED"
+	moveValidationStage(ctx, "file-station-privilege")
+	if files {
+		if err := e.DSM.Allow(ctx, s, "SYNO.SDS.App.FileStation3.Instance", ""); err != nil {
+			if moveValidationDeadline(ctx, err) {
+				return s, "EXECUTOR_PAUSED"
+			}
+			return Subject{}, "APP_DENIED"
+		}
 	}
 	return s, ""
 }
@@ -283,8 +311,9 @@ func (e *Executor) verified(ctx context.Context, auth Auth) (Subject, string) {
 	return s, ""
 }
 func (e *Executor) Handle(ctx context.Context, r Request) Response {
-	e.mu.Lock()
-	defer e.mu.Unlock()
+	if isExtension(r.Op) {
+		return e.handleExtension(ctx, r)
+	}
 	if ctx.Err() != nil {
 		return deny("EXECUTOR_PAUSED")
 	}
@@ -309,17 +338,55 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 	if json.Unmarshal(r.Params, &keys) != nil {
 		return deny("INVALID_REQUEST")
 	}
-	allowed := map[string]string{"status": "", "delegate.create": "job_id ops scope path ttl_seconds", "delegate.list": "", "delegate.revoke": "delegation_id job_id", "files.list": "delegation_id job_id path", "files.info": "delegation_id job_id path", "files.createFolder": "delegation_id job_id path name", "files.checkPermission": "delegation_id job_id path", "files.write": "delegation_id job_id staging dest_dir name", "root.run": "name"}
+	allowed := map[string]string{"status": "", "delegate.create": "job_id ops scope path ttl_seconds destination lifetime", "delegate.list": "", "delegate.revoke": "delegation_id job_id", "files.list": "delegation_id job_id path", "files.info": "delegation_id job_id path", "files.createFolder": "delegation_id job_id path name", "files.checkPermission": "delegation_id job_id path", "files.write": "delegation_id job_id staging dest_dir name", "root.run": "name"}
 	for k := range keys {
 		if !contains(strings.Fields(allowed[r.Op]), k) {
 			return deny("INVALID_REQUEST")
 		}
 	}
+	if r.Op == "delegate.create" || strings.HasPrefix(r.Op, "files.") {
+		e.commitMu.Lock()
+		disabled, err := e.Store.Disabled()
+		e.commitMu.Unlock()
+		if err != nil {
+			return deny("STORAGE_ERROR")
+		}
+		if disabled {
+			return deny("disabled")
+		}
+	}
 	switch r.Op {
 	case "status":
-		return success(map[string]any{"executor_digest": e.ExecutorDigest, "policy_digest": e.PolicyDigest, "version": version, "ready": true})
+		e.commitMu.Lock()
+		defer e.commitMu.Unlock()
+		disabled, err := e.Store.Disabled()
+		out := map[string]any{"executor_digest": e.ExecutorDigest, "policy_digest": e.PolicyDigest, "version": version, "ready": err == nil, "disabled": disabled}
+		if e.Policy.Scope == installSelectedScope {
+			state, code := e.selectionLocked()
+			out["scope_state"] = code
+			out["selection"] = nil
+			if code == "" {
+				out["selection"] = map[string]any{"scope": state.Scope, "root": scopeVirtual(state.Scope), "generation": state.Generation}
+			}
+			if code == "STORAGE_ERROR" {
+				out["ready"] = false
+			}
+		}
+		return success(out)
 	case "delegate.create":
-		if !tokenRE.MatchString(p.Job) || p.TTL <= 0 || p.TTL > 86400*30 || len(p.Ops) == 0 || p.Scope != e.Policy.Scope || !cleanPath(p.Path) {
+		long := p.Lifetime == "until-revoked"
+		if long {
+			if _, ok := keys["job_id"]; ok {
+				return deny("INVALID_REQUEST")
+			}
+			if _, ok := keys["ttl_seconds"]; ok {
+				return deny("INVALID_REQUEST")
+			}
+			if !contains(e.Policy.Destinations, p.DestinationKey) {
+				return deny("invalid-destination")
+			}
+		}
+		if (long && (e.Policy.Lifetime != p.Lifetime || !contains(e.Policy.Destinations, p.DestinationKey) || p.Job != "" || p.TTL != 0 || len(p.Ops) != 1 || p.Ops[0] != "files.moveFromStaging")) || (!long && (p.Lifetime != "" || p.DestinationKey != "" || !tokenRE.MatchString(p.Job) || p.TTL <= 0 || p.TTL > 86400*30 || contains(p.Ops, "files.moveFromStaging"))) || len(p.Ops) == 0 || p.Scope != e.Policy.Scope || !cleanPath(p.Path) {
 			return deny("INVALID_REQUEST")
 		}
 		for _, op := range p.Ops {
@@ -335,17 +402,35 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		if code != "" {
 			return deny(code)
 		}
-		root, err := e.DSM.ScopeRoot(ctx, s, p.Scope)
+		selection, selectionCode := e.selection()
+		if selectionCode != "" {
+			return deny(selectionCode)
+		}
+		root, err := e.DSM.ScopeRoot(ctx, s, selection.Scope)
 		if err != nil {
 			return deny("SCOPE_DENIED")
 		}
-		d := Delegation{Package: e.Policy.Package, Subject: s, Job: p.Job, Ops: p.Ops, Scope: p.Scope, Path: scopeVirtual(p.Scope), Root: root, Expires: e.Now().UTC().Add(time.Duration(p.TTL) * time.Second)}
-		real, err := scopedPath(d, p.Path)
+		d := Delegation{Package: e.Policy.Package, Subject: s, Job: p.Job, Ops: p.Ops, Scope: selection.Scope, ScopeGeneration: selection.Generation, Path: scopeVirtual(selection.Scope), Root: root, Expires: e.Now().UTC().Add(time.Duration(p.TTL) * time.Second)}
+		var real string
+		if long {
+			real, err = mappedDirectory(d, p.Path)
+		} else {
+			real, err = scopedPath(d, p.Path)
+		}
 		if err != nil {
 			return deny("SCOPE_DENIED")
 		}
 		d.Root = real
 		d.Path = p.Path
+		if long {
+			d.Lifetime = p.Lifetime
+			d.DestinationKey = p.DestinationKey
+			d.Expires = time.Time{}
+			d.Directory, err = bindDirectory(real)
+			if err != nil {
+				return deny("SCOPE_DENIED")
+			}
+		}
 		// Permission creation is checked as the subject, never SYSTEM_ADMIN.
 		if _, err = e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Path}); err != nil {
 			return deny("PERMISSION_DENIED")
@@ -355,9 +440,49 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 			return deny("INTERNAL")
 		}
 		d.ID = hex.EncodeToString(id)
-		if e.Store.Put(d) != nil {
+		e.commitMu.Lock()
+		disabled, disableErr := e.Store.Disabled()
+		if !e.scopeMatchesLocked(d) {
+			e.commitMu.Unlock()
+			return deny("SCOPE_DENIED")
+		}
+		if disableErr != nil || disabled {
+			e.commitMu.Unlock()
+			return deny("disabled")
+		}
+		putErr := e.auditLocked(s, "delegate.create", "", d.Path, "admitting")
+		// A destination key denotes one current choice for this person. Changing
+		// it cancels its previous grant under the same publish fence.
+		if putErr == nil && long {
+			var previous []Delegation
+			previous, putErr = e.Store.List()
+			for _, prior := range previous {
+				if putErr != nil {
+					break
+				}
+				if prior.Package != d.Package || prior.Subject.UID != s.UID || prior.Subject.Username != s.Username || prior.Lifetime != "until-revoked" || prior.DestinationKey != d.DestinationKey || prior.Revoked {
+					continue
+				}
+				putErr = e.auditLocked(s, "delegate.revoke", prior.ID, prior.Path, "destination-replaced")
+				if putErr == nil {
+					prior.Revoked = true
+					putErr = e.Store.Put(prior)
+				}
+				if putErr == nil {
+					e.cancelGrantLocked(prior.ID, "destination-replaced")
+				}
+			}
+		}
+		if putErr == nil {
+			putErr = e.Store.Put(d)
+		}
+		e.commitMu.Unlock()
+		if putErr != nil {
 			return deny("STORAGE_ERROR")
 		}
+		if long {
+			return success(publicDelegation(d))
+		}
 		return success(map[string]any{"delegation_id": d.ID, "subject": publicSubject(s), "expires_at": d.Expires})
 	case "delegate.list":
 		s, code := e.verified(ctx, r.Auth)
@@ -371,6 +496,9 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		out := []any{}
 		for _, d := range ds {
 			if d.Package == e.Policy.Package && d.Subject.UID == s.UID && d.Subject.Username == s.Username {
+				if !e.scopeMatches(d) {
+					d.Revoked = true
+				}
 				out = append(out, publicDelegation(d))
 			}
 		}
@@ -385,16 +513,37 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 			if code != "" {
 				return deny(code)
 			}
-			if !s.Admin && (s.UID != d.Subject.UID || s.Username != d.Subject.Username) {
+			if (d.Lifetime != "" || !s.Admin) && (s.UID != d.Subject.UID || s.Username != d.Subject.Username) {
 				return deny("DELEGATION_DENIED")
 			}
-		} else if p.Job == "" || p.Job != d.Job {
+		} else if d.Lifetime != "" || p.Job == "" || p.Job != d.Job {
 			return deny("DELEGATION_DENIED")
 		}
+		e.commitMu.Lock()
+		locked := true
+		defer func() {
+			if locked {
+				e.commitMu.Unlock()
+			}
+		}()
+		d, err = e.Store.Get(p.ID)
+		if err != nil {
+			return deny("STORAGE_ERROR")
+		}
 		d.Revoked = true
 		if e.Store.Put(d) != nil {
 			return deny("STORAGE_ERROR")
 		}
+		e.cancelGrantLocked(d.ID, "grant-revoked")
+		if e.auditLocked(d.Subject, "delegate.revoke", "", d.Path, "revoked") != nil {
+			return deny("STORAGE_ERROR")
+		}
+		pending := e.legacyPendingLocked(d.ID)
+		e.commitMu.Unlock()
+		locked = false
+		if waitLegacy(ctx, pending) != nil {
+			return deny("EXECUTOR_PAUSED")
+		}
 		return success(map[string]any{"revoked": true})
 	case "root.run":
 		if !tokenRE.MatchString(p.Name) {
@@ -411,7 +560,7 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		if !s.Admin {
 			return deny("ADMIN_REQUIRED")
 		}
-		if e.DSM.Allow(ctx, s, e.Policy.App) != nil {
+		if e.DSM.Allow(ctx, s, e.Policy.App, e.Policy.Entry) != nil {
 			return deny("APP_DENIED")
 		}
 		if e.Runner == nil {
@@ -424,7 +573,7 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		return success(map[string]any{"output": out})
 	}
 	d, err := e.Store.Get(p.ID)
-	if err != nil || d.Package != e.Policy.Package || d.Revoked || !e.Now().Before(d.Expires) || d.Job != p.Job || !contains(d.Ops, r.Op) || d.Scope != e.Policy.Scope {
+	if err != nil || d.Package != e.Policy.Package || d.Revoked || (d.Lifetime != "" || !e.Now().Before(d.Expires)) || d.Job != p.Job || !contains(d.Ops, r.Op) || !e.scopeMatches(d) {
 		return deny("DELEGATION_DENIED")
 	}
 	s, code := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
@@ -461,7 +610,43 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		if !validName(p.Name) || !validRelative(p.Staging) {
 			return deny("INVALID_REQUEST")
 		}
-		if err = e.Writer.Write(context.WithValue(ctx, writeJobKey{}, p.Job), s, p.Staging, real, p.Name, d.Root); err != nil {
+		release, err := e.acquireCopy(ctx)
+		if err != nil {
+			return deny("EXECUTOR_PAUSED")
+		}
+		defer release()
+		e.commitMu.Lock()
+		disabled, x := e.Store.Disabled()
+		fresh, x2 := e.Store.Get(d.ID)
+		e.commitMu.Unlock()
+		if x != nil || x2 != nil {
+			return deny("STORAGE_ERROR")
+		}
+		if disabled {
+			return deny("disabled")
+		}
+		if fresh.Revoked || ctx.Err() != nil {
+			return deny("DELEGATION_DENIED")
+		}
+		writerCtx := context.WithValue(ctx, writeJobKey{}, p.Job)
+		writerCtx = context.WithValue(writerCtx, legacyPublishKey{}, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
+			current, c := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
+			if c != "" || !sameIdentity(s, current) {
+				return MoveReceipt{}, errors.New("identity changed")
+			}
+			if _, x := e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Dest}); x != nil {
+				return MoveReceipt{}, x
+			}
+			e.commitMu.Lock()
+			defer e.commitMu.Unlock()
+			disabled, x := e.Store.Disabled()
+			fresh, x2 := e.Store.Get(d.ID)
+			if x != nil || x2 != nil || disabled || fresh.Revoked || !e.Now().Before(fresh.Expires) || ctx.Err() != nil {
+				return MoveReceipt{}, errors.New("write fenced")
+			}
+			return publish()
+		})
+		if err = e.Writer.Write(writerCtx, s, p.Staging, real, p.Name, d.Root); err != nil {
 			return deny("WRITE_FAILED")
 		}
 		return success(map[string]any{"path": strings.TrimSuffix(p.Dest, "/") + "/" + p.Name})
@@ -473,6 +658,11 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 		}
 		args["name"] = p.Name
 	}
+	done, code := e.beginLegacy(d)
+	if code != "" {
+		return deny(code)
+	}
+	defer done()
 	out, err := e.DSM.API(ctx, s.Username, r.Op, args)
 	if err != nil {
 		return deny("DSM_FAILED")
@@ -481,7 +671,11 @@ func (e *Executor) Handle(ctx context.Context, r Request) Response {
 }
 func publicSubject(s Subject) any { return map[string]any{"username": s.Username, "uid": s.UID} }
 func publicDelegation(d Delegation) any {
-	return map[string]any{"delegation_id": d.ID, "subject": publicSubject(d.Subject), "job_id": d.Job, "ops": d.Ops, "scope": d.Scope, "path": d.Path, "expires_at": d.Expires, "revoked": d.Revoked}
+	out := map[string]any{"delegation_id": d.ID, "subject": publicSubject(d.Subject), "job_id": d.Job, "ops": d.Ops, "scope": d.Scope, "path": d.Path, "expires_at": d.Expires, "revoked": d.Revoked, "destination": d.DestinationKey, "lifetime": d.Lifetime}
+	if d.ScopeGeneration != 0 {
+		out["scope_generation"] = d.ScopeGeneration
+	}
+	return out
 }
 func scopeVirtual(scope string) string {
 	if scope == "home" {
@@ -522,3 +716,20 @@ func validRelative(p string) bool {
 	}
 	return true
 }
+
+// Permanent destinations reject every symlink component; legacy File Station
+// lookup retains its historical canonical-path semantics.
+func mappedDirectory(d Delegation, p string) (string, error) {
+	base := d.Path
+	if base == "" {
+		base = scopeVirtual(d.Scope)
+	}
+	if base == "" || !cleanPath(d.Root) || !cleanPath(p) || !within(base, p) {
+		return "", errors.New("scope")
+	}
+	real := filepath.Join(d.Root, strings.TrimPrefix(strings.TrimPrefix(p, base), "/"))
+	if _, err := bindDirectory(real); err != nil {
+		return "", err
+	}
+	return real, nil
+}

package/dist/templates/_executor/executor_test.go

@@ -8,11 +8,13 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 )
 
 type fakeDSM struct {
+	apiMu                    sync.Mutex
 	user                     Subject
 	accountErr, privilegeErr error
 	apiCalls                 int
@@ -23,10 +25,12 @@ func (f *fakeDSM) Verify(context.Context, string, string) (string, error) {
 	return f.user.Username, nil
 }
 func (f *fakeDSM) Account(context.Context, string) (Subject, error)           { return f.user, f.accountErr }
-func (f *fakeDSM) Allow(context.Context, Subject, string) error               { return f.privilegeErr }
+func (f *fakeDSM) Allow(context.Context, Subject, string, string) error       { return f.privilegeErr }
 func (f *fakeDSM) ScopeRoot(context.Context, Subject, string) (string, error) { return f.root, nil }
 func (f *fakeDSM) API(context.Context, string, string, map[string]any) (json.RawMessage, error) {
+	f.apiMu.Lock()
 	f.apiCalls++
+	f.apiMu.Unlock()
 	return json.RawMessage(`{"allowed":true}`), nil
 }
 
@@ -69,7 +73,6 @@ func TestRejections(t *testing.T) {
 		{"missing account", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.accountErr = errors.New("missing") }, nil, "INELIGIBLE"},
 		{"disabled", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "now" }, nil, "INELIGIBLE"},
 		{"unknown disabled state", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "" }, nil, "INELIGIBLE"},
-		{"admin runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Admin = true }, nil, "INELIGIBLE"},
 		{"system runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID = 1 }, nil, "INELIGIBLE"},
 		{"uid reuse", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID++ }, nil, "INELIGIBLE"},
 		{"app deny", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.privilegeErr = errors.New("deny") }, nil, "APP_DENIED"},
@@ -216,7 +219,7 @@ func TestFileStationPrivilegeRequiredSeparately(t *testing.T) {
 
 type selectivePrivilege struct{ *fakeDSM }
 
-func (f *selectivePrivilege) Allow(_ context.Context, _ Subject, app string) error {
+func (f *selectivePrivilege) Allow(_ context.Context, _ Subject, app, _ string) error {
 	if app == "SYNO.SDS.App.FileStation3.Instance" {
 		return errors.New("deny File Station")
 	}
@@ -230,12 +233,39 @@ func TestSharedScope(t *testing.T) {
 		t.Fatal(out)
 	}
 }
+
+type entryRecorder struct {
+	*fakeDSM
+	entries map[string]string
+}
+
+func (f *entryRecorder) Allow(_ context.Context, _ Subject, app, entry string) error {
+	f.entries[app] = entry
+	return nil
+}
+func TestPackageEntryModeReachesAppPrivilegeOnly(t *testing.T) {
+	e, f, _ := setup(t)
+	e.Policy.Entry = "app-privilege"
+	r := &entryRecorder{fakeDSM: f, entries: map[string]string{}}
+	e.DSM = r
+	if out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10}); !out.OK {
+		t.Fatal(out)
+	}
+	// File Station is a DSM App without the package's entry mode.
+	if r.entries["app"] != "app-privilege" || r.entries["SYNO.SDS.App.FileStation3.Instance"] != "" {
+		t.Fatal(r.entries)
+	}
+}
 func TestPolicyValidation(t *testing.T) {
 	base := Policy{Version: 1, Package: "p2probe", App: "app", Scope: "home", Operations: allOps}
-	if validatePolicy(base, "p2probe") != nil {
-		t.Fatal("valid policy")
+	for _, entry := range []string{"", "admin-only", "app-privilege"} {
+		p := base
+		p.Entry = entry
+		if validatePolicy(p, "p2probe") != nil {
+			t.Fatal("valid policy", entry)
+		}
 	}
-	for _, mutate := range []func(*Policy){func(p *Policy) { p.Package = "another" }, func(p *Policy) { p.Version = 2 }, func(p *Policy) { p.Operations = []string{"shell"} }, func(p *Policy) { p.Operations = []string{"status", "status"} }, func(p *Policy) { p.Scope = "../../etc" }, func(p *Policy) { p.Root = map[string]string{"a": "bad"} }} {
+	for _, mutate := range []func(*Policy){func(p *Policy) { p.Package = "another" }, func(p *Policy) { p.Version = 2 }, func(p *Policy) { p.Operations = []string{"shell"} }, func(p *Policy) { p.Operations = []string{"status", "status"} }, func(p *Policy) { p.Scope = "../../etc" }, func(p *Policy) { p.Root = map[string]string{"a": "bad"} }, func(p *Policy) { p.Entry = "everyone" }} {
 		p := base
 		mutate(&p)
 		if validatePolicy(p, "p2probe") == nil {

package/dist/templates/_executor/identity.go

@@ -16,7 +16,7 @@ type identitySwitch interface {
 }
 
 func dropIdentity(x identitySwitch, s Subject) error {
-	if s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || s.Admin {
+	if s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 {
 		return errors.New("subject")
 	}
 	for _, g := range s.Groups {
@@ -46,3 +46,29 @@ func dropIdentity(x identitySwitch, s Subject) error {
 	}
 	return nil
 }
+
+func sameGroups(a, b []int) bool {
+	a = append([]int(nil), a...)
+	b = append([]int(nil), b...)
+	sort.Ints(a)
+	sort.Ints(b)
+	return fmt.Sprint(a) == fmt.Sprint(b)
+}
+
+// Keep the historical injectable identity interface for existing consumer
+// fixtures. Production fixed children require this stricter syscall surface.
+type sealedIdentitySwitch interface {
+	identitySwitch
+	Seal() error
+	VerifyPrivileges(Subject) error
+}
+
+func dropSealedIdentity(x sealedIdentitySwitch, s Subject) error {
+	if err := x.Seal(); err != nil {
+		return err
+	}
+	if err := dropIdentity(x, s); err != nil {
+		return err
+	}
+	return x.VerifyPrivileges(s)
+}

package/dist/templates/_executor/identity_kernel_linux_test.go

@@ -0,0 +1,60 @@
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"syscall"
+	"testing"
+)
+
+func TestSealedIdentityRealKernel(t *testing.T) {
+	if mode := os.Getenv("T0188_IDENTITY_CHILD"); mode != "" {
+		runtime.LockOSThread()
+		subject := Subject{UID: 1200, GID: 100, Groups: []int{100}}
+		var err error
+		if mode == "unsealed" {
+			// Clear capabilities and IDs without setting no_new_privs.
+			// VerifyPrivileges must still refuse this otherwise sealed child.
+			for cap := uintptr(0); cap < 64; cap++ {
+				_, _, errno := syscall.Syscall6(syscall.SYS_PRCTL, 24, cap, 0, 0, 0, 0)
+				if errno != 0 && errno != syscall.EINVAL {
+					fmt.Fprintln(os.Stderr, errno)
+					os.Exit(1)
+				}
+			}
+			err = dropIdentity(realIdentity{}, subject)
+			if err == nil {
+				err = realIdentity{}.VerifyPrivileges(subject)
+			}
+			if err == nil || err.Error() != "no_new_privs missing" {
+				fmt.Fprintln(os.Stderr, "expected no_new_privs refusal, got", err)
+				os.Exit(1)
+			}
+			os.Exit(0)
+		}
+		err = dropSealedIdentity(realIdentity{}, subject)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		os.Exit(0)
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("root Linux fixture required")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, mode := range []string{"sealed", "unsealed"} {
+		cmd := exec.Command(exe, "-test.run=^TestSealedIdentityRealKernel$")
+		cmd.Env = append(os.Environ(), "T0188_IDENTITY_CHILD="+mode)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("%s subject kernel verification: %s: %v", mode, out, err)
+		}
+	}
+}