@synopackageland/cli 0.6.1 → 0.7.0

package/templates/native-go/backend/internal/app/portal.go

@@ -0,0 +1,30 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/portal"
+)
+
+// portalRoutes serves portal.status when dsm-package.yaml declares `portal`.
+// An administrator sets the alias with DSM's own AppPortal API from the UI;
+// the package only reads DSM's saved setting.
+func (cfg Config) portalRoutes() []api.Route {
+	if !cfg.Portal {
+		return nil
+	}
+	return []api.Route{api.Handle("portal.status", cfg.portalStatus)}
+}
+
+func (cfg Config) portalStatus(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	path := cfg.PortalConfig
+	if path == "" {
+		path = portal.ConfigPath(cfg.PackageID)
+	}
+	return portal.Read(path, "SYNO.SDS."+cfg.PackageID+".Instance"), nil
+}

package/templates/native-go/backend/internal/app/portal_test.go

@@ -0,0 +1,55 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func portalConfig(t *testing.T, saved string) Config {
+	cfg := testConfig(t)
+	cfg.Portal = true
+	cfg.PortalConfig = filepath.Join(t.TempDir(), "AppPortal.json")
+	if saved != "" {
+		if err := os.WriteFile(cfg.PortalConfig, []byte(saved), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return cfg
+}
+
+func TestPortalStatusTellsEverySignedInUserTheAlias(t *testing.T) {
+	cfg := portalConfig(t, `{"alias":"hello-go","id":"SYNO.SDS.HelloGo.Instance","version":3}`)
+	code, out := call(t, cfg, bob, "portal.status", `{}`)
+	if code != "" {
+		t.Fatalf("%q %v", code, out)
+	}
+	data := out["data"].(map[string]any)
+	if data["state"] != "active" || data["alias"] != "hello-go" {
+		t.Fatalf("%v", data)
+	}
+	if code, _ := call(t, cfg, nobody, "portal.status", `{}`); code != "session_required" {
+		t.Fatalf("anonymous: %q", code)
+	}
+	if code, _ := call(t, cfg, bob, "portal.status", `{"alias":"x"}`); code != "bad_request" {
+		t.Fatalf("params: %q", code)
+	}
+}
+
+func TestPortalStatusFailsClosedOnAnotherAppsSetting(t *testing.T) {
+	cfg := portalConfig(t, `{"alias":"hello-go","id":"SYNO.SDS.Other.Instance"}`)
+	_, out := call(t, cfg, bob, "portal.status", `{}`)
+	if data := out["data"].(map[string]any); data["state"] != "unavailable" || data["alias"] != nil {
+		t.Fatalf("%v", data)
+	}
+	_, out = call(t, portalConfig(t, ""), bob, "portal.status", `{}`)
+	if data := out["data"].(map[string]any); data["state"] != "inactive" {
+		t.Fatalf("%v", data)
+	}
+}
+
+func TestPortalStatusExistsOnlyForAPortalBuild(t *testing.T) {
+	if code, _ := call(t, testConfig(t), alice, "portal.status", `{}`); code != "unknown_method" {
+		t.Fatalf("%q", code)
+	}
+}

package/templates/native-go/backend/internal/app/routes.go

@@ -24,8 +24,9 @@ import (
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
-	DelegateScope                string
-	ExecutorDigest, PolicyDigest string
+	DelegateScope                                                      string
+	DelegateOperationsJSON, DelegateDestinationsJSON, DelegateLifetime string
+	ExecutorDigest, PolicyDigest                                       string
 
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
 	SessionFiles *filestation.Service
@@ -36,6 +37,10 @@ type Config struct {
 	DataDir string
 	// VolumeRoot is where /volumeN lives; empty means "/". Tests set it.
 	VolumeRoot string
+	// Portal serves portal.status; PortalConfig overrides DSM's saved
+	// AppPortal.json path in tests.
+	Portal       bool
+	PortalConfig string
 }
 
 func Routes(cfg Config) []api.Route {
@@ -47,6 +52,7 @@ func Routes(cfg Config) []api.Route {
 	}...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)
+	routes = append(routes, cfg.portalRoutes()...)
 	return append(routes, cfg.rootRoutes()...)
 }
 

package/templates/native-go/backend/internal/background/runner.go

@@ -14,7 +14,7 @@ import (
 // Work is one fixed worker algorithm. It receives only the job's input bytes.
 type Work func(ctx context.Context, in io.Reader) (Result, error)
 
-// SHA256V1 is the only worker in this version: it hashes the imported copy.
+// SHA256V1 hashes the imported private copy; delegate assembly adds a separate fixed worker.
 func SHA256V1(ctx context.Context, in io.Reader) (Result, error) {
 	h := sha256.New()
 	buf := make([]byte, 32*1024)

package/templates/native-go/backend/internal/background/store.go

@@ -61,18 +61,20 @@ const (
 func (s State) terminal() bool { return s != StateQueued && s != StateRunning }
 
 var (
-	ErrBusy           = errors.New("background journal is busy; retry later")
-	ErrOwnerQueueFull = errors.New("owner pending quota reached")
-	ErrOwnerQuota     = errors.New("owner storage quota reached")
-	ErrInvalid        = errors.New("invalid background request")
-	ErrTooLarge       = errors.New("input is larger than the per-file limit")
-	ErrQueueFull      = errors.New("background queue is full")
-	ErrQuota          = errors.New("background spool quota reached")
-	ErrKeyConflict    = errors.New("idempotency key already used for another input")
-	ErrNotFound       = errors.New("job not found")
-	ErrNotCancelable  = errors.New("job already finished")
-	ErrNotRunning     = errors.New("job is not running")
-	ErrUnsafeSpool    = errors.New("background spool is not private to the package account")
+	ErrBusy              = errors.New("background journal is busy; retry later")
+	ErrOwnerQueueFull    = errors.New("owner pending quota reached")
+	ErrOwnerQuota        = errors.New("owner storage quota reached")
+	ErrInvalid           = errors.New("invalid background request")
+	ErrTooLarge          = errors.New("input is larger than the per-file limit")
+	ErrQueueFull         = errors.New("background queue is full")
+	ErrQuota             = errors.New("background spool quota reached")
+	ErrKeyConflict       = errors.New("idempotency key already used for another input")
+	ErrNotFound          = errors.New("job not found")
+	ErrNotCancelable     = errors.New("job already finished")
+	ErrNotRunning        = errors.New("job is not running")
+	ErrUnsafeSpool       = errors.New("background spool is not private to the package account")
+	ErrJournalUnreadable = errors.New("background journal unreadable")
+	ErrJournalSchema     = errors.New("background journal has an unsupported schema")
 )
 
 // Submitter binds visibility to a fresh DSM username and UID. It never grants
@@ -336,10 +338,10 @@ func (s *Store) readJournal(root *os.Root) (journal, error) {
 	}
 	b, err := io.ReadAll(io.LimitReader(f, maxJournal+1))
 	if err != nil || len(b) > maxJournal {
-		return j, errors.New("background journal unreadable")
+		return j, ErrJournalUnreadable
 	}
 	if err := json.Unmarshal(b, &j); err != nil || j.Schema != schemaVersion {
-		return journal{}, errors.New("background journal has an unsupported schema")
+		return journal{}, ErrJournalSchema
 	}
 	return j, nil
 }

package/templates/native-go/backend/internal/dsm/admin.go

@@ -56,8 +56,14 @@ func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
 }
 
 func parseNativeRole(out []byte, err error) (bool, error) {
+	return parseNativeBit(out, err, errNativeRole)
+}
+
+// parseNativeBit accepts only a bridge's exact "1\n" or "0\n"; anything else,
+// including a failed run, is the caller's unavailable error.
+func parseNativeBit(out []byte, err, unavailable error) (bool, error) {
 	if err != nil {
-		return false, errNativeRole
+		return false, unavailable
 	}
 	switch string(out) {
 	case "1\n":
@@ -65,6 +71,6 @@ func parseNativeRole(out []byte, err error) (bool, error) {
 	case "0\n":
 		return false, nil
 	default:
-		return false, errNativeRole
+		return false, unavailable
 	}
 }

package/templates/native-go/backend/internal/dsm/admin_linux.go

@@ -23,31 +23,61 @@ var adminAMD64 []byte
 //go:embed native/admin-aarch64.elf
 var adminARM64 []byte
 
+//go:embed native/apppriv-x86_64.elf
+var appPrivAMD64 []byte
+
+//go:embed native/apppriv-aarch64.elf
+var appPrivARM64 []byte
+
+//go:embed native/admin-armv7.elf
+var adminARMv7 []byte
+
+//go:embed native/apppriv-armv7.elf
+var appPrivARMv7 []byte
+
+// Bridges per runtime.GOARCH; an architecture without one is refused.
+var (
+	adminBridges   = map[string][]byte{"amd64": adminAMD64, "arm64": adminARM64, "arm": adminARMv7}
+	appPrivBridges = map[string][]byte{"amd64": appPrivAMD64, "arm64": appPrivARM64, "arm": appPrivARMv7}
+)
+
 func nativeAdministrator(ctx context.Context, principal string) (bool, error) {
-	var payload []byte
-	switch runtime.GOARCH {
-	case "amd64":
-		payload = adminAMD64
-	case "arm64":
-		payload = adminARM64
-	default:
-		return false, errNativeRole
+	out, err := runBridge(ctx, adminBridges, principal)
+	return parseNativeRole(out, err)
+}
+
+func nativeAppPrivilege(ctx context.Context, principal, app, addr string) (bool, error) {
+	out, err := runBridge(ctx, appPrivBridges, principal, app, addr)
+	return parseNativeBit(out, err, errNativeAppPriv)
+}
+
+// runBridge executes the sealed bridge for this architecture with fixed
+// arguments and a minimal environment, returning at most 16 bytes of output.
+func runBridge(ctx context.Context, bridges map[string][]byte, args ...string) ([]byte, error) {
+	payload, ok := bridges[runtime.GOARCH]
+	if !ok {
+		return nil, errors.New("unsupported architecture")
 	}
 	file, err := sealedBridge(payload)
 	if err != nil {
-		return false, errNativeRole
+		return nil, err
 	}
 	defer file.Close()
-	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", principal)
+	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", args...)
 	cmd.ExtraFiles = []*os.File{file}
 	// In particular, never inherit LD_PRELOAD/LD_LIBRARY_PATH or credentials.
 	cmd.Env = []string{"LANG=C", "LC_ALL=C"}
-	out, err := commandOutput(cmd, 16)
-	return parseNativeRole(out, err)
+	return commandOutput(cmd, 16)
 }
 
+// memfdCreate is the sealing primitive; tests replace it to model old kernels.
+var memfdCreate = unix.MemfdCreate
+
 func sealedBridge(payload []byte) (*os.File, error) {
-	fd, err := unix.MemfdCreate("synopkgland-admin", unix.MFD_CLOEXEC|unix.MFD_ALLOW_SEALING)
+	fd, err := memfdCreate("synopkgland-admin", unix.MFD_CLOEXEC|unix.MFD_ALLOW_SEALING)
+	if errors.Is(err, unix.ENOSYS) {
+		return unlinkedBridge(bridgeFallbackDir, payload)
+	}
 	if err != nil {
 		return nil, err
 	}

package/templates/native-go/backend/internal/dsm/admin_linux_test.go

@@ -3,14 +3,23 @@
 package dsm
 
 import (
+	"bytes"
 	"context"
+	"debug/elf"
+	"errors"
 	"golang.org/x/sys/unix"
+	"io"
 	"os"
 	"strings"
 	"testing"
 )
 
 func TestNativeBridgeIsSealedBeforeExecution(t *testing.T) {
+	if fd, err := unix.MemfdCreate("probe", unix.MFD_CLOEXEC); errors.Is(err, unix.ENOSYS) {
+		t.Skip("kernel has no memfd_create; covered by the fallback tests")
+	} else if err == nil {
+		unix.Close(fd)
+	}
 	file, err := sealedBridge([]byte("immutable"))
 	if err != nil {
 		t.Fatal(err)
@@ -28,6 +37,53 @@ func TestNativeBridgeIsSealedBeforeExecution(t *testing.T) {
 	}
 }
 
+func TestEveryShippedArchHasBothBridges(t *testing.T) {
+	for arch, machine := range map[string]elf.Machine{"amd64": elf.EM_X86_64, "arm64": elf.EM_AARCH64, "arm": elf.EM_ARM} {
+		for name, bridges := range map[string]map[string][]byte{"admin": adminBridges, "apppriv": appPrivBridges} {
+			file, err := elf.NewFile(bytes.NewReader(bridges[arch]))
+			if err != nil || file.Machine != machine {
+				t.Fatalf("%s bridge for %s: %v %v", name, arch, file, err)
+			}
+		}
+	}
+}
+
+func withMemfd(t *testing.T, create func(string, int) (int, error), fallback string) {
+	t.Helper()
+	saved, savedDir := memfdCreate, bridgeFallbackDir
+	t.Cleanup(func() { memfdCreate, bridgeFallbackDir = saved, savedDir })
+	memfdCreate = create
+	SetBridgeFallbackDir(fallback)
+}
+
+func TestBridgeFallsBackToPackageTempOnlyWithoutMemfd(t *testing.T) {
+	dir := t.TempDir()
+	withMemfd(t, func(string, int) (int, error) { return -1, unix.ENOSYS }, dir)
+	file, err := sealedBridge([]byte("bridge"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	got, err := io.ReadAll(file)
+	if err != nil || string(got) != "bridge" {
+		t.Fatalf("payload %q %v", got, err)
+	}
+	if entries, _ := os.ReadDir(dir); len(entries) != 0 {
+		t.Fatalf("fallback left %v", entries)
+	}
+}
+
+func TestBridgeRefusesOtherMemfdFailuresAndUnsetFallback(t *testing.T) {
+	withMemfd(t, func(string, int) (int, error) { return -1, unix.EPERM }, t.TempDir())
+	if _, err := sealedBridge([]byte("bridge")); !errors.Is(err, unix.EPERM) {
+		t.Fatalf("EPERM must not fall back: %v", err)
+	}
+	withMemfd(t, func(string, int) (int, error) { return -1, unix.ENOSYS }, "")
+	if _, err := sealedBridge([]byte("bridge")); err == nil {
+		t.Fatal("ENOSYS without a package temp directory must refuse")
+	}
+}
+
 // Read-only device fixture. The runner provides existing principals and executes
 // this test binary from a memfd. No files, users, groups or NAS settings change.
 func TestNativeAdministratorDeviceFixture(t *testing.T) {

package/templates/native-go/backend/internal/dsm/admin_other.go

@@ -9,4 +9,7 @@ import (
 
 // Host tests inject a role provider; DSM native roles require Linux.
 func nativeAdministrator(context.Context, string) (bool, error) { return false, errNativeRole }
-func configureCommand(*exec.Cmd)                                {}
+func nativeAppPrivilege(context.Context, string, string, string) (bool, error) {
+	return false, errNativeAppPriv
+}
+func configureCommand(*exec.Cmd) {}

package/templates/native-go/backend/internal/dsm/apppriv.go

@@ -0,0 +1,30 @@
+package dsm
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"regexp"
+	"time"
+)
+
+var errNativeAppPriv = errors.New("DSM Application Privileges verification unavailable")
+
+// appID is a DSM application ID such as SYNO.SDS.<package>.Instance.
+var appID = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*){1,7}$`)
+
+// AppPrivilege asks DSM's native SDK whether principal may use app from addr.
+// DSM applies its own user, group and everyone rules, deny precedence and IP
+// ranges, and always allows administrators. Unknown results refuse.
+func AppPrivilege(ctx context.Context, principal, app, addr string) (bool, error) {
+	if !validPrincipal(principal) || len(app) > 128 || !appID.MatchString(app) {
+		return false, errNativeAppPriv
+	}
+	ip, err := netip.ParseAddr(addr)
+	if err != nil || ip.Zone() != "" || ip.String() != addr {
+		return false, errNativeAppPriv
+	}
+	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	return nativeAppPrivilege(ctx, principal, app, addr)
+}

package/templates/native-go/backend/internal/dsm/bridge_file.go

@@ -0,0 +1,75 @@
+package dsm
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// bridgeFallbackDir is where a kernel without memfd_create (DSM 7 platforms on
+// Linux 3.10) stages the bridge. Empty refuses, as before the fallback existed.
+var bridgeFallbackDir string
+
+// SetBridgeFallbackDir names the package's own temp directory,
+// /var/packages/<package>/tmp. main calls it once, before serving.
+func SetBridgeFallbackDir(dir string) { bridgeFallbackDir = dir }
+
+var errBridgeDir = errors.New("bridge fallback directory must be a private absolute directory")
+
+// unlinkedBridge stages payload in a fresh 0700 directory under dir and returns
+// a read-only descriptor whose name is already gone. /tmp is noexec on DSM, so
+// dir is the package's own exec-capable temp. Unlike a sealed memfd, a process
+// running as the same package account could rewrite the file before it is
+// unlinked; that account already controls the CGI, so the trust is unchanged.
+func unlinkedBridge(dir string, payload []byte) (*os.File, error) {
+	if err := privateDir(dir); err != nil {
+		return nil, err
+	}
+	stage, err := os.MkdirTemp(dir, "bridge-")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(stage)
+	path := filepath.Join(stage, "bridge")
+	writer, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	_, err = writer.Write(payload)
+	if closeErr := writer.Close(); err == nil {
+		err = closeErr
+	}
+	if err == nil {
+		err = os.Chmod(path, 0o500)
+	}
+	if err != nil {
+		return nil, err
+	}
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	if err = os.Remove(path); err != nil {
+		file.Close()
+		return nil, err
+	}
+	return file, nil
+}
+
+// privateDir accepts an absolute directory owned by this account and writable
+// by no one else. It follows links: DSM's /var/packages/<pkg>/tmp is one.
+func privateDir(dir string) error {
+	if !filepath.IsAbs(dir) {
+		return errBridgeDir
+	}
+	info, err := os.Stat(dir)
+	if err != nil {
+		return err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !info.IsDir() || info.Mode().Perm()&0o022 != 0 || !ok || int(st.Uid) != os.Geteuid() {
+		return errBridgeDir
+	}
+	return nil
+}

package/templates/native-go/backend/internal/dsm/bridge_file_test.go

@@ -0,0 +1,57 @@
+package dsm
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestUnlinkedBridgeLeavesOnlyAReadOnlyDescriptor(t *testing.T) {
+	dir := t.TempDir()
+	file, err := unlinkedBridge(dir, []byte("bridge"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	got, err := io.ReadAll(file)
+	if err != nil || string(got) != "bridge" {
+		t.Fatalf("payload %q %v", got, err)
+	}
+	if _, err = file.Seek(0, io.SeekStart); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = file.Write([]byte("attack")); err == nil {
+		t.Fatal("bridge descriptor is writable")
+	}
+	info, err := file.Stat()
+	if err != nil || info.Mode().Perm() != 0o500 {
+		t.Fatalf("mode %v %v", info.Mode(), err)
+	}
+	if entries, err := os.ReadDir(dir); err != nil || len(entries) != 0 {
+		t.Fatalf("bridge left a name behind: %v %v", entries, err)
+	}
+}
+
+func TestUnlinkedBridgeRefusesWithoutAPrivateDirectory(t *testing.T) {
+	shared := t.TempDir()
+	if err := os.Chmod(shared, 0o777); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(t.TempDir(), "link")
+	if err := os.Symlink(t.TempDir(), link); err != nil {
+		t.Fatal(err)
+	}
+	for name, dir := range map[string]string{"unset": "", "relative": "tmp", "missing": filepath.Join(shared, "none"), "shared": shared} {
+		if file, err := unlinkedBridge(dir, []byte("bridge")); err == nil {
+			file.Close()
+			t.Fatalf("%s directory accepted", name)
+		}
+	}
+	// DSM's /var/packages/<pkg>/tmp is a root-owned link to @apptemp/<pkg>.
+	file, err := unlinkedBridge(link, []byte("bridge"))
+	if err != nil {
+		t.Fatalf("linked private directory refused: %v", err)
+	}
+	file.Close()
+}