@synopackageland/cli 0.6.1 → 0.7.0

package/dist/templates/_executor/main.go

@@ -9,7 +9,6 @@ import (
 	"log"
 	"net"
 	"os"
-	"os/exec"
 	"os/signal"
 	"os/user"
 	"path/filepath"
@@ -26,20 +25,23 @@ const socketBase = "/run/synopkgland"
 func main() {
 	if err := run(os.Args[1:]); err != nil {
 		fmt.Fprintln(os.Stderr, "executor:", err)
-		os.Exit(1)
+		os.Exit(exitStatus(err))
 	}
 }
 func run(args []string) error {
 	if len(args) == 1 {
-		if args[0] == "write-child" {
-			return writeChild()
+		if args[0] == "move-child" {
+			return runMoveChild()
 		}
-		if args[0] == "cleanup-child" {
-			return runWriteChild(true)
+		if args[0] == "part-cleanup-child" {
+			return runPartCleanupChild()
+		}
+		if args[0] == "source-cleanup-child" {
+			return runSourceCleanupChild()
 		}
 	}
 	if len(args) < 1 {
-		return errors.New("usage: executor serve --package <pkg> | control start|stop|purge --package <pkg>")
+		return errors.New("usage: executor serve|supervise --package <pkg> | control start|stop|purge --package <pkg>")
 	}
 	mode := args[0]
 	args = args[1:]
@@ -53,14 +55,21 @@ func run(args []string) error {
 		if !contains([]string{"start", "stop", "purge"}, action) {
 			return errors.New("invalid control action")
 		}
-	} else if mode != "serve" {
+	} else if mode != "serve" && mode != "supervise" && mode != "select-scope" {
 		return errors.New("invalid command")
 	}
 	fs := flag.NewFlagSet("executor", flag.ContinueOnError)
 	pkg := fs.String("package", "", "package account")
+	scope := fs.String("scope", "", "administrator-confirmed scope")
+	actor := fs.String("actor", "", "password-confirmed administrator")
+	expectedGeneration := fs.Uint64("expected-generation", maxScopeGeneration+1, "protected generation observed before confirmation")
+	revived := fs.Bool("revived", false, "restarted by the root supervisor")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	if *revived && mode != "serve" {
+		return errors.New("unexpected revive")
+	}
 	if fs.NArg() != 0 || !tokenRE.MatchString(*pkg) {
 		return errors.New("invalid package")
 	}
@@ -82,6 +91,15 @@ func run(args []string) error {
 	if err != nil {
 		return err
 	}
+	if mode == "select-scope" {
+		if e.Policy.Scope != installSelectedScope || !validSelectedScope(*scope) || *actor == "" || *expectedGeneration > maxScopeGeneration {
+			return errors.New("scope selection")
+		}
+		return rootSelectScope(*pkg, *scope, *actor, *expectedGeneration)
+	}
+	if *scope != "" || *actor != "" || *expectedGeneration != maxScopeGeneration+1 {
+		return errors.New("unexpected selection arguments")
+	}
 	if mode == "control" {
 		// If the validated service already owns its pidfile, start is idempotent.
 		f, err := os.OpenFile(filepath.Join(e.Store.Dir, "executor.pid"), os.O_RDWR|os.O_CREATE, 0600)
@@ -104,9 +122,7 @@ func run(args []string) error {
 				return closeErr
 			}
 		}
-		cmd := exec.Command(exe, "serve", "--package", *pkg)
-		cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
-		cmd.Dir = "/"
+		cmd := supervisorCommand(exe, *pkg)
 		log, err := os.OpenFile(filepath.Join(e.Store.Dir, "executor.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 		if err != nil {
 			return err
@@ -114,13 +130,15 @@ func run(args []string) error {
 		defer log.Close()
 		cmd.Stdout = log
 		cmd.Stderr = log
-		cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 		if err = cmd.Start(); err != nil {
 			return err
 		}
 		return cmd.Process.Release()
 	}
-	return serve(e, uid, gid)
+	if mode == "supervise" {
+		return runSupervisor(exe, *pkg)
+	}
+	return serve(e, uid, gid, *revived)
 }
 
 // Never chmod or chown an existing untrusted directory into trust. Check all
@@ -215,23 +233,42 @@ func load(pkg, exe string) (*Executor, int, int, error) {
 	if err != nil {
 		return nil, 0, 0, err
 	}
-	return &Executor{Policy: p, DSM: newDSM(), Writer: subprocessWriter{Staging: filepath.Join("/var/packages", pkg, "var/executor-staging"), Executable: exe, PackageUID: uid}, Runner: scriptRunner{Dir: dir}, Store: &Store{Dir: state}, Now: time.Now, ExecutorDigest: ed, PolicyDigest: pd}, uid, gid, nil
+	return &Executor{Policy: p, DSM: newDSM(), Writer: subprocessWriter{Staging: filepath.Join("/var/packages", pkg, "var/executor-staging"), Executable: exe, PackageUID: uid, PackageGID: gid}, Runner: scriptRunner{Dir: dir}, Store: &Store{Dir: state}, Now: time.Now, ExecutorDigest: ed, PolicyDigest: pd}, uid, gid, nil
 }
 func validatePolicy(p Policy, pkg string) error {
 	if p.Version != 1 || p.Package != pkg || !tokenRE.MatchString(p.App) || len(p.Operations) == 0 {
 		return errors.New("policy")
 	}
+	if !contains([]string{"", "admin-only", "app-privilege"}, p.Entry) {
+		return errors.New("policy entry")
+	}
+	if p.Lifetime != "" && p.Lifetime != "until-revoked" {
+		return errors.New("policy lifetime")
+	}
+	if (len(p.Destinations) > 0) != (p.Lifetime == "until-revoked") {
+		return errors.New("policy destinations")
+	}
+	keys := map[string]bool{}
+	for _, key := range p.Destinations {
+		if !destinationRE.MatchString(key) || keys[key] {
+			return errors.New("policy destination")
+		}
+		keys[key] = true
+	}
+	if p.Lifetime != "" && !contains(p.Operations, "files.moveFromStaging") {
+		return errors.New("policy move")
+	}
 	seen := map[string]bool{}
 	for _, op := range p.Operations {
 		if !contains(allOps, op) || seen[op] {
 			return errors.New("policy operation")
 		}
 		seen[op] = true
-		if strings.HasPrefix(op, "files.") && scopeVirtual(p.Scope) == "" {
+		if strings.HasPrefix(op, "files.") && scopeVirtual(p.Scope) == "" && !(p.Scope == installSelectedScope && p.Lifetime == "until-revoked") {
 			return errors.New("policy scope")
 		}
 	}
-	if seen["delegate.create"] && scopeVirtual(p.Scope) == "" {
+	if seen["delegate.create"] && scopeVirtual(p.Scope) == "" && !(p.Scope == installSelectedScope && p.Lifetime == "until-revoked") {
 		return errors.New("policy scope")
 	}
 	for n, d := range p.Root {
@@ -241,14 +278,18 @@ func validatePolicy(p Policy, pkg string) error {
 	}
 	return nil
 }
-func serve(e *Executor, uid, gid int) error {
+func serve(e *Executor, uid, gid int, revived bool) error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 	actions := make(chan string, 1)
 	stopControls := rootControlSignals(ctx, actions)
 	defer stopControls()
 	pkgDir := filepath.Join("/var/packages", e.Policy.Package)
-	monitor := newLifecycleMonitor(e.Policy.Package, pkgDir, filepath.Join(pkgDir, "var/executor/control"), func(s string) { log.Print(s) })
+	newMonitor := newLifecycleMonitor
+	if revived {
+		newMonitor = newRevivedLifecycleMonitor
+	}
+	monitor := newMonitor(e.Policy.Package, pkgDir, filepath.Join(pkgDir, "var/executor/control"), func(s string) { log.Print(s) })
 	pidpath := filepath.Join(e.Store.Dir, "executor.pid")
 	pid, err := os.OpenFile(pidpath, os.O_RDWR|os.O_CREATE, 0600)
 	if err != nil {
@@ -256,7 +297,7 @@ func serve(e *Executor, uid, gid int) error {
 	}
 	defer pid.Close()
 	if err = lockFile(pid); err != nil {
-		return errors.New("already running")
+		return errAlreadyRunning
 	}
 	if err = pid.Truncate(0); err != nil {
 		return err
@@ -309,8 +350,12 @@ func serve(e *Executor, uid, gid int) error {
 		}
 	}()
 	open := func() (func(), error) { return openService(ctx, e, uid, gid, sock) }
+	target, packageInfo := filepath.Join(pkgDir, "target/executor"), filepath.Join(pkgDir, "INFO")
 	samePins := func(ctx context.Context) bool {
-		return samePackagePins(ctx, filepath.Join(pkgDir, "target/executor"), e.ExecutorDigest, e.PolicyDigest)
+		state := packagePins(ctx, target, packageInfo, rootOwnedReadOnly, e.ExecutorDigest, e.PolicyDigest)
+		install := func() error { return installAnchored(ctx, target, packageInfo, rootOwnedReadOnly, runtime) }
+		start := func() error { return startInstalled(runtime, e.Policy.Package) }
+		return approvedPins(state, install, start, func(s string) { log.Print(s) })
 	}
 	purge := func() error {
 		return purgeProtected(ctx, d, e.Policy.Package, filepath.Join(stateBase, e.Policy.Package), runtime, sockDir)
@@ -338,6 +383,12 @@ func openService(parent context.Context, e *Executor, uid, gid int, sock string)
 		return nil, err
 	}
 	ctx, cancel := context.WithCancel(parent)
+	if err = e.startOperations(ctx); err != nil {
+		cancel()
+		ln.Close()
+		os.Remove(sock)
+		return nil, err
+	}
 	var active sync.WaitGroup
 	var mu sync.Mutex
 	connections := map[*net.UnixConn]bool{}
@@ -382,6 +433,7 @@ func openService(parent context.Context, e *Executor, uid, gid int, sock string)
 		}
 		mu.Unlock()
 		active.Wait()
+		e.stopOperations()
 		os.Remove(sock)
 	}, nil
 }

package/dist/templates/_executor/move_linux.go

@@ -0,0 +1,490 @@
+//go:build linux
+
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// publishReceiptTimeout bounds the only I/O done under the commit lock.
+var publishReceiptTimeout = 5 * time.Second
+
+// syncPublished makes the child's link durable; tests slow it down.
+var syncPublished = func(dir *os.File) error { return dir.Sync() }
+
+type moveSpec struct {
+	SourceUID   int               `json:"source_uid"`
+	Subject     Subject           `json:"subject"`
+	Destination string            `json:"destination"`
+	Directory   directoryIdentity `json:"directory"`
+	Name        string            `json:"name"`
+	Size        int64             `json:"size"`
+	Part        partMetadata      `json:"part"`
+	SourceName  string            `json:"source_name,omitempty"`
+}
+type childEvent struct {
+	Code    string            `json:"code,omitempty"`
+	Kind    string            `json:"kind"`
+	Part    directoryIdentity `json:"part,omitempty"`
+	Receipt MoveReceipt       `json:"receipt,omitempty"`
+}
+
+func fileIdentity(f *os.File) (directoryIdentity, error) {
+	info, err := f.Stat()
+	if err != nil {
+		return directoryIdentity{}, err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return directoryIdentity{}, errors.New("stat")
+	}
+	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
+}
+func openDirectory(path string) (*os.File, error) {
+	if !cleanPath(path) || path == "/" {
+		return nil, errors.New("directory path")
+	}
+	return openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+}
+func checkDirectory(path string, pinned *os.File, expected directoryIdentity) (*os.File, error) {
+	dir, err := openDirectory(path)
+	if err != nil {
+		return nil, err
+	}
+	got, err := fileIdentity(dir)
+	pin, x := fileIdentity(pinned)
+	if err != nil || x != nil || got != expected || got != pin {
+		dir.Close()
+		return nil, errors.New("directory replaced")
+	}
+	return dir, nil
+}
+func (w subprocessWriter) openSource(relative string) (*os.File, string, error) {
+	parent, err := filepath.EvalSymlinks(filepath.Dir(w.Staging))
+	if err != nil {
+		return nil, "", err
+	}
+	root := filepath.Join(parent, filepath.Base(w.Staging))
+	f, err := openBeneath(root, relative, syscall.O_RDONLY, 0)
+	if err != nil {
+		return nil, "", err
+	}
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		f.Close()
+		return nil, "", errors.New("staging file")
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || int(st.Uid) != w.PackageUID || st.Nlink != 1 {
+		f.Close()
+		return nil, "", errors.New("staging owner or hardlink")
+	}
+	return f, root, nil
+}
+func (w subprocessWriter) Move(ctx context.Context, s Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	if !tokenRE.MatchString(op.Job) || !validName(op.Name) || op.Size < 0 || op.Size > maxMoveBytes {
+		return MoveReceipt{}, errors.New("request")
+	}
+	f, root, err := w.openSource(op.Staging)
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || info.Size() != op.Size {
+		return MoveReceipt{}, errors.New("size mismatch")
+	}
+	dir, err := openDirectory(d.Root)
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer dir.Close()
+	di, err := fileIdentity(dir)
+	if err != nil || di != d.Directory {
+		return MoveReceipt{}, errors.New("destination replaced")
+	}
+	random := make([]byte, 16)
+	if _, err = rand.Read(random); err != nil {
+		return MoveReceipt{}, err
+	}
+	spec := moveSpec{SourceUID: w.PackageUID, Subject: s, Destination: d.Root, Directory: d.Directory, Name: op.Name, Size: op.Size, Part: partMetadata{Temporary: ".synopkgland-" + op.Job + "-" + hex.EncodeToString(random) + ".part", Directory: d.Directory, Destination: d.Root}}
+	// Separate pipes allow a fixed child to copy first and wait for the parent's
+	// commit decision. There is no socket endpoint or arbitrary child payload.
+	input, inWrite, err := os.Pipe()
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer input.Close()
+	defer inWrite.Close()
+	output, outWrite, err := os.Pipe()
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer output.Close()
+	defer outWrite.Close()
+	cmd := command(ctx, w.Executable, []string{"move-child"})
+	cmd.Stdin = input
+	cmd.Stdout = outWrite
+	cmd.Stderr = io.Discard
+	cmd.ExtraFiles = []*os.File{f, dir}
+	if err = cmd.Start(); err != nil {
+		return MoveReceipt{}, err
+	}
+	input.Close()
+	outWrite.Close()
+	waited := false
+	defer func() {
+		if !waited {
+			cmd.Cancel()
+			cmd.Wait()
+		}
+	}()
+	defer func() {
+		if spec.Part.Part.Inode != 0 {
+			cleanup, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			w.cleanupPart(cleanup, spec, dir)
+		}
+	}()
+	if err = json.NewEncoder(inWrite).Encode(spec); err != nil {
+		return MoveReceipt{}, err
+	}
+	reader := bufio.NewReader(output)
+	event := func() (childEvent, error) {
+		var event childEvent
+		b, err := reader.ReadBytes('\n')
+		if err != nil || len(b) > maxRequest {
+			return event, errors.New("child receipt")
+		}
+		if strictJSON(b, &event) != nil {
+			return event, errors.New("child receipt")
+		}
+		return event, nil
+	}
+	ev, err := event()
+	if err != nil || ev.Kind != "part" || ev.Part.Inode == 0 {
+		return MoveReceipt{}, errors.New("child part")
+	}
+	spec.Part.Part = ev.Part
+	if record, ok := ctx.Value(partRecordKey{}).(func(partMetadata) error); ok {
+		if err = record(spec.Part); err != nil {
+			return MoveReceipt{}, err
+		}
+	}
+	if _, err = inWrite.Write([]byte("C\n")); err != nil {
+		return MoveReceipt{}, err
+	}
+	ev, err = event()
+	if err != nil || ev.Kind != "ready" {
+		return MoveReceipt{}, errors.New("child copy")
+	}
+	receipt, err := guard(func() (MoveReceipt, error) {
+		// This is the only bounded I/O under the commit lock. Lost ack is uncertain.
+		if x := output.SetReadDeadline(time.Now().Add(publishReceiptTimeout)); x != nil {
+			return MoveReceipt{}, x
+		}
+		if _, x := inWrite.Write([]byte("P\n")); x != nil {
+			cmd.Cancel()
+			cmd.Wait()
+			waited = true
+			return MoveReceipt{}, x
+		}
+		ev, x := event()
+		if x != nil || ev.Kind != "committed" {
+			// Drain before releasing the protected publish lock: a lost receipt must
+			// never leave a live child that could publish after revoke acknowledges.
+			cmd.Cancel()
+			cmd.Wait()
+			waited = true
+		}
+		if x == nil && ev.Kind == "refused" && contains([]string{"destination-exists", "PERMISSION_DENIED", "NO_SPACE"}, ev.Code) {
+			return MoveReceipt{}, publishRejectedError{ev.Code}
+		}
+		if x != nil || ev.Kind != "committed" {
+			// The child may have linked before its receipt was lost, e.g. while a
+			// large file's directory fsync outlived the bound. With the child gone
+			// the final name is settled: our exact part inode there is the commit.
+			if waited && publishedPart(dir, spec) && dir.Sync() == nil {
+				return MoveReceipt{}, nil
+			}
+			return MoveReceipt{}, errors.New("publish receipt")
+		}
+		return ev.Receipt, nil
+	})
+	if err != nil {
+		return receipt, err
+	}
+	if !waited && cmd.Wait() != nil {
+		receipt.CleanupPending = true
+	}
+	waited = true
+	// Committed is immutable even if part/source cleanup fails.
+	if err = w.cleanupPart(ctx, spec, dir); err != nil {
+		receipt.CleanupPending = true
+	} else {
+		spec.Part.Part = directoryIdentity{}
+	}
+	if err = w.cleanupSource(ctx, f, root, op.Staging); err != nil {
+		receipt.CleanupPending = true
+	}
+	return receipt, nil
+}
+
+// publishedPart reports whether the final name is the recorded part inode: a
+// regular file of the declared size owned by the subject.
+func publishedPart(dir *os.File, spec moveSpec) bool {
+	fd, err := syscall.Openat(int(dir.Fd()), spec.Name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return false
+	}
+	f := os.NewFile(uintptr(fd), spec.Name)
+	defer f.Close()
+	got, err := fileIdentity(f)
+	info, x := f.Stat()
+	if err != nil || x != nil || !info.Mode().IsRegular() || info.Size() != spec.Size || spec.Part.Part.Inode == 0 || got != spec.Part.Part {
+		return false
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	return ok && int(st.Uid) == spec.Subject.UID
+}
+func (w subprocessWriter) cleanupPart(ctx context.Context, spec moveSpec, dir *os.File) error {
+	b, _ := json.Marshal(spec)
+	cmd := command(ctx, w.Executable, []string{"part-cleanup-child"})
+	cmd.ExtraFiles = []*os.File{dir}
+	cmd.Stdin = strings.NewReader(string(b))
+	cmd.Stdout = io.Discard
+	cmd.Stderr = io.Discard
+	return cmd.Run()
+}
+func (w subprocessWriter) cleanupSource(ctx context.Context, original *os.File, root, relative string) error {
+	parent := filepath.Dir(relative)
+	path := root
+	if parent != "." {
+		path = filepath.Join(root, parent)
+	}
+	dir, err := openDirectory(path)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	spec := moveSpec{Subject: Subject{UID: w.PackageUID, GID: w.PackageGID, Groups: []int{w.PackageGID}}, SourceName: filepath.Base(relative)}
+	b, _ := json.Marshal(spec)
+	cmd := command(ctx, w.Executable, []string{"source-cleanup-child"})
+	cmd.ExtraFiles = []*os.File{original, dir}
+	cmd.Stdin = strings.NewReader(string(b))
+	cmd.Stdout = io.Discard
+	cmd.Stderr = io.Discard
+	return cmd.Run()
+}
+func readMoveSpec(r io.Reader) (moveSpec, error) {
+	var s moveSpec
+	b, err := io.ReadAll(io.LimitReader(r, maxRequest+1))
+	if err != nil || len(b) > maxRequest || strictJSON(b, &s) != nil {
+		return s, errors.New("spec")
+	}
+	return s, nil
+}
+func runMoveChild() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if os.Geteuid() != 0 {
+		return errors.New("root child required")
+	}
+	input := bufio.NewReader(os.Stdin)
+	line, err := input.ReadBytes('\n')
+	if err != nil || len(line) > maxRequest {
+		return errors.New("spec")
+	}
+	var spec moveSpec
+	if strictJSON(line, &spec) != nil || !validName(spec.Name) || !validTemporary(spec.Part.Temporary) || spec.Size < 0 || spec.Size > maxMoveBytes {
+		return errors.New("spec")
+	}
+	if err = dropSealedIdentity(realIdentity{}, spec.Subject); err != nil {
+		return err
+	}
+	pinned := os.NewFile(4, "destination")
+	defer pinned.Close()
+	dir, err := checkDirectory(spec.Destination, pinned, spec.Directory)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	fd, err := syscall.Openat(int(dir.Fd()), spec.Part.Temporary, syscall.O_RDWR|syscall.O_CREAT|syscall.O_EXCL|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600)
+	if err != nil {
+		return err
+	}
+	part := os.NewFile(uintptr(fd), spec.Part.Temporary)
+	defer part.Close()
+	identity, err := fileIdentity(part)
+	if err != nil {
+		return err
+	}
+	defer unlinkExact(dir, spec.Part.Temporary, identity)
+	send := func(event childEvent) error { return json.NewEncoder(os.Stdout).Encode(event) }
+	if err = send(childEvent{Kind: "part", Part: identity}); err != nil {
+		return err
+	}
+	decision, err := input.ReadString('\n')
+	if err != nil || decision != "C\n" {
+		return errors.New("copy refused")
+	}
+	src := os.NewFile(3, "staging")
+	defer src.Close()
+	// The parent's death closes stdin; stop copying instead of orphaning.
+	control := awaitControl(input)
+	if err = copyUnlessParentGone(part, src, spec.Size, control); err != nil {
+		return err
+	}
+	info, err := src.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		return errors.New("staging changed")
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || int(st.Uid) != spec.SourceUID || st.Nlink != 1 || info.Size() != spec.Size {
+		return errors.New("staging changed")
+	}
+	if err = part.Sync(); err != nil {
+		return err
+	}
+	if err = send(childEvent{Kind: "ready"}); err != nil {
+		return err
+	}
+	if next := <-control; next.err != nil || next.line != "P\n" {
+		return errors.New("publish refused")
+	}
+	check, err := checkDirectory(spec.Destination, pinned, spec.Directory)
+	if err != nil {
+		return err
+	}
+	check.Close()
+	// Link the OPEN part inode, never a possibly swapped pathname. AT_SYMLINK_FOLLOW
+	// is needed only for this trusted proc FD; the destination name cannot replace.
+	if err = linkOpenPart(part, dir, spec.Name); err != nil {
+		code := ""
+		switch err {
+		case syscall.EEXIST:
+			code = "destination-exists"
+		case syscall.EACCES, syscall.EPERM:
+			code = "PERMISSION_DENIED"
+		case syscall.ENOSPC:
+			code = "NO_SPACE"
+		}
+		if code != "" {
+			return send(childEvent{Kind: "refused", Code: code})
+		}
+		return err
+	}
+	// A failure to sync after link is a lost durable result, not a retryable error.
+	if err = syncPublished(dir); err != nil {
+		return err
+	}
+	cleanupPending := unlinkExact(dir, spec.Part.Temporary, identity) != nil
+	if !cleanupPending {
+		cleanupPending = dir.Sync() != nil
+	}
+	return send(childEvent{Kind: "committed", Receipt: MoveReceipt{CleanupPending: cleanupPending}})
+}
+func unlinkExact(dir *os.File, name string, expected directoryIdentity) error {
+	fd, err := syscall.Openat(int(dir.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK|syscall.O_CLOEXEC, 0)
+	if err == syscall.ENOENT {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	got, err := fileIdentity(f)
+	info, x := f.Stat()
+	f.Close()
+	if err != nil || x != nil || !info.Mode().IsRegular() || got != expected {
+		return errors.New("cleanup replaced")
+	}
+	return syscall.Unlinkat(int(dir.Fd()), name)
+}
+func runPartCleanupChild() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if os.Geteuid() != 0 {
+		return errors.New("root child required")
+	}
+	spec, err := readMoveSpec(os.Stdin)
+	if err != nil || !validTemporary(spec.Part.Temporary) || spec.Part.Part.Inode == 0 {
+		return errors.New("spec")
+	}
+	if err = dropSealedIdentity(realIdentity{}, spec.Subject); err != nil {
+		return err
+	}
+	dir := os.NewFile(3, "directory")
+	defer dir.Close()
+	got, err := fileIdentity(dir)
+	if err != nil || got != spec.Directory {
+		return errors.New("directory")
+	}
+	if err = unlinkExact(dir, spec.Part.Temporary, spec.Part.Part); err != nil {
+		return err
+	}
+	return dir.Sync()
+}
+func runSourceCleanupChild() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if os.Geteuid() != 0 {
+		return errors.New("root child required")
+	}
+	spec, err := readMoveSpec(os.Stdin)
+	if err != nil || !validName(spec.SourceName) {
+		return errors.New("spec")
+	}
+	if err = dropSealedIdentity(realIdentity{}, spec.Subject); err != nil {
+		return err
+	}
+	src := os.NewFile(3, "source")
+	defer src.Close()
+	dir := os.NewFile(4, "directory")
+	defer dir.Close()
+	identity, err := fileIdentity(src)
+	if err != nil {
+		return err
+	}
+	if err = unlinkExact(dir, spec.SourceName, identity); err != nil {
+		return err
+	}
+	return dir.Sync()
+}
+
+func (w subprocessWriter) PublishedPart(_ context.Context, op Operation) bool {
+	if op.Part == nil || !validName(op.Name) {
+		return false
+	}
+	dir, err := openDirectory(op.Part.Destination)
+	if err != nil {
+		return false
+	}
+	defer dir.Close()
+	got, err := fileIdentity(dir)
+	return err == nil && got == op.Part.Directory && publishedPart(dir, moveSpec{Subject: op.Subject, Name: op.Name, Size: op.Size, Part: *op.Part}) && dir.Sync() == nil
+}
+func (w subprocessWriter) CleanupRecorded(ctx context.Context, s Subject, part partMetadata) error {
+	dir, err := openDirectory(part.Destination)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	got, err := fileIdentity(dir)
+	if err != nil || got != part.Directory {
+		return errors.New("cleanup directory changed")
+	}
+	return w.cleanupPart(ctx, moveSpec{Subject: s, Directory: part.Directory, Part: part}, dir)
+}