@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/_executor/identity_linux.go

@@ -0,0 +1,82 @@
+//go:build linux
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+func (realIdentity) Seal() error {
+	// These are per-thread Linux settings. Every fresh child locks its OS thread
+	// until exit; it never execs untrusted code after dropping the identity.
+	prctl := func(op, a uintptr) error {
+		_, _, err := syscall.Syscall6(syscall.SYS_PRCTL, op, a, 0, 0, 0, 0)
+		if err != 0 {
+			return err
+		}
+		return nil
+	}
+	if err := prctl(38, 1); err != nil {
+		return err
+	} // PR_SET_NO_NEW_PRIVS
+	if err := prctl(8, 0); err != nil {
+		return err
+	} // PR_SET_KEEPCAPS off
+	for cap := uintptr(0); cap < 64; cap++ {
+		if err := prctl(24, cap); err != nil && err != syscall.EINVAL {
+			return err
+		}
+	} // PR_CAPBSET_DROP
+	return nil
+}
+func (realIdentity) VerifyPrivileges(s Subject) error {
+	b, err := os.ReadFile(fmt.Sprintf("/proc/self/task/%d/status", syscall.Gettid()))
+	if err != nil {
+		return err
+	}
+	fields := map[string][]string{}
+	for _, line := range strings.Split(string(b), "\n") {
+		parts := strings.Fields(line)
+		if len(parts) > 1 {
+			fields[strings.TrimSuffix(parts[0], ":")] = parts[1:]
+		}
+	}
+	for key, want := range map[string]int{"Uid": s.UID, "Gid": s.GID} {
+		got := fields[key]
+		if len(got) != 4 {
+			return errors.New("saved IDs missing")
+		}
+		for _, v := range got {
+			n, err := strconv.Atoi(v)
+			if err != nil || n != want {
+				return errors.New("saved IDs mismatch")
+			}
+		}
+	}
+	for _, key := range []string{"CapInh", "CapPrm", "CapEff", "CapBnd", "CapAmb"} {
+		v := fields[key]
+		if len(v) != 1 {
+			return errors.New("capability missing")
+		}
+		n, err := strconv.ParseUint(v[0], 16, 64)
+		if err != nil || n != 0 {
+			return errors.New("capability retained")
+		}
+	}
+	// Linux 4.4 supports no_new_privs but does not expose NoNewPrivs in
+	// proc status. Query the locked writer thread directly; missing/failed
+	// kernel support still refuses the write, without relaxing the seal.
+	nnp, _, errno := syscall.Syscall6(syscall.SYS_PRCTL, 39, 0, 0, 0, 0, 0) // PR_GET_NO_NEW_PRIVS
+	if errno != 0 {
+		return errno
+	}
+	if nnp != 1 {
+		return errors.New("no_new_privs missing")
+	}
+	return nil
+}

package/dist/templates/_executor/identity_security_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"errors"
+	"testing"
+)
+
+type secureSwitch struct {
+	sealed, verified bool
+	bad              bool
+	subject          Subject
+}
+
+func (s *secureSwitch) Seal() error { s.sealed = true; return nil }
+func (s *secureSwitch) VerifyPrivileges(Subject) error {
+	s.verified = true
+	if s.bad {
+		return errors.New("saved root or capability")
+	}
+	return nil
+}
+func (s *secureSwitch) Setgroups([]int) error {
+	if !s.sealed {
+		return errors.New("not sealed")
+	}
+	return nil
+}
+func (s *secureSwitch) Setresgid(int, int, int) error { return nil }
+func (s *secureSwitch) Setresuid(int, int, int) error { return nil }
+func (s *secureSwitch) IDs() (int, int, int, int) {
+	return s.subject.UID, s.subject.UID, s.subject.GID, s.subject.GID
+}
+func (s *secureSwitch) Groups() ([]int, error) { return s.subject.Groups, nil }
+func TestDropAdminSealsAndChecksSavedIDsCapabilities(t *testing.T) {
+	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 101}, Admin: true}
+	for _, bad := range []bool{false, true} {
+		s := &secureSwitch{bad: bad, subject: subject}
+		err := dropSealedIdentity(s, subject)
+		if (err != nil) != bad || !s.verified {
+			t.Fatal("unverified privilege drop", err)
+		}
+	}
+}

package/dist/templates/_executor/internal/lifecycle/lifecycle.go

@@ -69,6 +69,11 @@ func Run(ctx context.Context, cfg Config, action string) error {
 	defer ticker.Stop()
 	for {
 		gone, err := absent(cfg.Socket)
+		if err == nil && gone && action == "purge" {
+			// A paused executor has no socket but still polls the mailbox. Only
+			// its purge removes the socket directory, after root cleanup.
+			gone, err = absent(filepath.Dir(cfg.Socket))
+		}
 		if err != nil {
 			if cfg.Log != nil {
 				cfg.Log("executor socket status unavailable: request retained; lifecycle continues")

package/dist/templates/_executor/internal/lifecycle/lifecycle_test.go

@@ -13,7 +13,8 @@ func TestRequestPersistsOfflineWithoutScheduler(t *testing.T) {
 	for _, action := range []string{"stop", "purge"} {
 		t.Run(action, func(t *testing.T) {
 			root := t.TempDir()
-			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "executor.sock")}
+			// No executor ever ran: its socket directory does not exist.
+			cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "run", "executor.sock")}
 			if err := Run(context.Background(), cfg, action); err != nil {
 				t.Fatal(err)
 			}
@@ -34,7 +35,8 @@ func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
 		for _, timeout := range []bool{false, true} {
 			t.Run(action+"-"+map[bool]string{false: "confirmed", true: "timeout"}[timeout], func(t *testing.T) {
 				root := t.TempDir()
-				socket := filepath.Join(root, "executor.sock")
+				os.Mkdir(filepath.Join(root, "run"), 0750)
+				socket := filepath.Join(root, "run", "executor.sock")
 				os.WriteFile(socket, []byte{}, 0600)
 				warnings := []string{}
 				cfg := Config{Package: "TestApp", Data: root, Socket: socket, Log: func(s string) { warnings = append(warnings, s) }}
@@ -50,7 +52,12 @@ func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
 						defer close(done)
 						for {
 							if _, err := os.Stat(filepath.Join(root, "executor", "control")); err == nil {
-								os.Remove(socket)
+								// Pause closes the socket; purge ends with its directory.
+								if action == "purge" {
+									os.RemoveAll(filepath.Dir(socket))
+								} else {
+									os.Remove(socket)
+								}
 								return
 							}
 							select {
@@ -80,6 +87,57 @@ func TestRequestWaitsForSocketAndTimeoutDoesNotBlockUninstall(t *testing.T) {
 		}
 	}
 }
+
+// A stopped package already paused the executor and removed its socket, so
+// preuninst's purge must wait for the root purge itself: the executor removes
+// its socket directory only after consuming purge. Returning earlier lets DSM
+// delete the mailbox before the paused monitor polls it.
+func TestPurgeOfPausedExecutorWaitsForSocketDirectoryRemoval(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "run")
+	os.Mkdir(dir, 0750)
+	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock")}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	consumed := make(chan time.Time, 1)
+	go func() {
+		for ctx.Err() == nil {
+			if b, _ := os.ReadFile(filepath.Join(root, "executor", "control")); string(b) == "purge\n" {
+				time.Sleep(300 * time.Millisecond)
+				consumed <- time.Now()
+				os.RemoveAll(dir)
+				return
+			}
+			time.Sleep(time.Millisecond)
+		}
+	}()
+	if err := Run(ctx, cfg, "purge"); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-consumed:
+	default:
+		t.Fatal("purge returned before the executor removed its socket directory")
+	}
+	if ctx.Err() != nil {
+		t.Fatal("purge confirmation timed out")
+	}
+}
+
+func TestStopOfPausedExecutorDoesNotWaitForSocketDirectory(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "run")
+	os.Mkdir(dir, 0750)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := Run(ctx, Config{Package: "TestApp", Data: root, Socket: filepath.Join(dir, "executor.sock")}, "stop"); err != nil {
+		t.Fatal(err)
+	}
+	if ctx.Err() != nil {
+		t.Fatal("stop waited for the socket directory")
+	}
+}
+
 func TestRequestRejectsInvalidActionAndSymlink(t *testing.T) {
 	root := t.TempDir()
 	cfg := Config{Package: "TestApp", Data: root, Socket: filepath.Join(root, "socket")}

package/dist/templates/_executor/internal/taskscript/boot.sh

@@ -8,24 +8,24 @@ q=/var/packages/$p
 s=$q/target/executor
 r=/usr/local/etc/synopkgland/$p
 d=$r/runtime
-v(){ echo "@EXECUTOR_DIGEST@  $1executor
-@POLICY_DIGEST@  $1policy.json"|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
+o="--package $p"
+v(){ echo "$2@POLICY_DIGEST@  ${1}policy.json"|sha256sum -c - >/dev/null||{ logger digest;exit 1;};}
 a=purge
 if [ -d $q ];then
 a=stop
-[ "$(cat "$q/var/executor/control" 2>/dev/null)" != purge ] || { a=purge;[ -e $d ] || [ -L $d ] || { logger purged;exit 0;};}
+[ "$(cat $q/var/executor/control)" != purge ] || { a=purge;[ -e $d ] || [ -L $d ] || { logger purged;exit 0;};}
 else [ -d $r ] || exit 0;fi
-[ $a = stop ] || s=$d
-v $s/
 mkdir -p -m 700 $d
 [ "$(find $d -maxdepth 0 -uid 0 -type d -perm 700)" = $d ]
 cd $d
+[ $a = stop ] || { v ./ "";exec ./executor control purge $o;}
+e=$(sed -n 's/^synopkgland_executor_sha256="\([0-9a-f]*\)"$/\1/p' $q/INFO)
+[ ${#e} = 64 ]
 cp $s/executor .executor
 cp $s/policy.json .policy.json
-v .
+v . "$e  .executor
+"
 chmod 700 .executor
-./.executor control $a --package $p
-[ $a = stop ] || exit 0
 for f in executor policy.json;do mv .$f $f;done
 [ -e $s/../root ] && cp -R $s/../root .
-./executor control start --package $p
+./executor control start $o

package/dist/templates/_executor/internal/taskscript/cmd/main.go

@@ -8,10 +8,10 @@ import (
 )
 
 func main() {
-	if len(os.Args) != 4 {
+	if len(os.Args) != 3 {
 		os.Exit(2)
 	}
-	tasks, err := taskscript.Generate(os.Args[1], os.Args[2], os.Args[3])
+	tasks, err := taskscript.Generate(os.Args[1], os.Args[2])
 	if err != nil {
 		os.Exit(1)
 	}

package/dist/templates/_executor/internal/taskscript/control.sh

@@ -8,19 +8,24 @@ q=/var/packages/$p
 s=$q/target/executor
 r=/usr/local/etc/synopkgland/$p
 d=$r/runtime
-v(){ { echo @EXECUTOR_DIGEST@"  $1/$2executor"; echo @POLICY_DIGEST@"  $1/$2policy.json"; }|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
-v "$s" ''
+v(){ echo "$3@POLICY_DIGEST@  $1/$2policy.json"|sha256sum -c - >/dev/null || { logger digest;exit 1;};}
 mkdir -p -m 700 "$d"
 [ "$(find "$d" -maxdepth 0 -uid 0 -type d -perm 700)" = "$d" ]
-a=$(cat /var/packages/$p/var/executor/control)
+a=$(cat "$q/var/executor/control")
 case "$a" in start|stop|purge) ;; *) exit 1;; esac
-if [ "$a" = purge ]; then
+if [ "$a" = stop ]; then
+v "$d" '' ''
+exec "$d/executor" control stop --package "$p"
+fi
+# Root runs only executor bytes anchored in the root-owned INFO, under the approved policy.
+e=$(sed -n 's/^synopkgland_executor_sha256="\([0-9a-f]*\)"$/\1/p' "$q/INFO")
+[ ${#e} = 64 ] || { logger anchor;exit 1;}
 cp "$s/executor" "$d/.executor"
 cp "$s/policy.json" "$d/.policy.json"
-v "$d" .
+v "$d" . "$e  $d/.executor
+"
 chmod 700 "$d/.executor"
-"$d/.executor" control purge --package "$p"
-else
-v "$d" ''
-"$d/executor" control $a --package $p
-fi
+[ "$a" = start ] || exec "$d/.executor" control purge --package "$p"
+for f in executor policy.json; do mv "$d/.$f" "$d/$f"; done
+[ -e "$s/../root" ] && cp -R "$s/../root" "$d"
+"$d/executor" control start --package "$p"

package/dist/templates/_executor/internal/taskscript/tasks.go

@@ -21,11 +21,13 @@ type Task struct {
 	Script string `json:"script"`
 }
 
-func Generate(pkg, ed, pd string) ([]Task, error) {
-	if !regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`).MatchString(pkg) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(ed) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(pd) {
+// Tasks pin only the approved policy. Executor bytes are anchored per SPK in the
+// root-owned package INFO, so an executor-only upgrade keeps both definitions.
+func Generate(pkg, pd string) ([]Task, error) {
+	if !regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`).MatchString(pkg) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(pd) {
 		return nil, errors.New("task pins")
 	}
-	replace := strings.NewReplacer("@PACKAGE@", pkg, "@EXECUTOR_DIGEST@", ed, "@POLICY_DIGEST@", pd)
+	replace := strings.NewReplacer("@PACKAGE@", pkg, "@POLICY_DIGEST@", pd)
 	tasks := []Task{}
 	for i, source := range []string{boot, control} {
 		kind, limit := "boot", 1024

package/dist/templates/_executor/lifecycle_test.go

@@ -84,3 +84,14 @@ func TestDirectoryValidationRejectsExistingWrongModeOwnerAndSymlink(t *testing.T
 		t.Fatal("symlink accepted")
 	}
 }
+
+// The legacy write child linked its own copy without waiting for serve, so an
+// orphan could still publish. Nothing spawns it since files.write moved to the
+// move child; neither it nor its cleanup child may run at all.
+func TestLegacyWriteChildrenAreNotCommands(t *testing.T) {
+	for _, child := range []string{"write-child", "cleanup-child"} {
+		if err := run([]string{child}); err == nil || err.Error() != "invalid command" {
+			t.Fatalf("%s: %v", child, err)
+		}
+	}
+}

package/dist/templates/_executor/link_linux.go

@@ -0,0 +1,28 @@
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+	"unsafe"
+)
+
+func linkOpenPart(part, dir *os.File, name string) error {
+	// /proc/self/fd/<fd> refers to the still-open inode. Following that one trusted
+	// proc link prevents a subject from swapping a guessed temporary pathname.
+	old, err := syscall.BytePtrFromString(fmt.Sprintf("/proc/self/fd/%d", part.Fd()))
+	if err != nil {
+		return err
+	}
+	new, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return err
+	}
+	_, _, errno := syscall.Syscall6(syscall.SYS_LINKAT, ^uintptr(99), uintptr(unsafe.Pointer(old)), dir.Fd(), uintptr(unsafe.Pointer(new)), 0x400, 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}