@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/_executor/move_linux.go

@@ -0,0 +1,490 @@
+//go:build linux
+
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"syscall"
+	"time"
+)
+
+// publishReceiptTimeout bounds the only I/O done under the commit lock.
+var publishReceiptTimeout = 5 * time.Second
+
+// syncPublished makes the child's link durable; tests slow it down.
+var syncPublished = func(dir *os.File) error { return dir.Sync() }
+
+type moveSpec struct {
+	SourceUID   int               `json:"source_uid"`
+	Subject     Subject           `json:"subject"`
+	Destination string            `json:"destination"`
+	Directory   directoryIdentity `json:"directory"`
+	Name        string            `json:"name"`
+	Size        int64             `json:"size"`
+	Part        partMetadata      `json:"part"`
+	SourceName  string            `json:"source_name,omitempty"`
+}
+type childEvent struct {
+	Code    string            `json:"code,omitempty"`
+	Kind    string            `json:"kind"`
+	Part    directoryIdentity `json:"part,omitempty"`
+	Receipt MoveReceipt       `json:"receipt,omitempty"`
+}
+
+func fileIdentity(f *os.File) (directoryIdentity, error) {
+	info, err := f.Stat()
+	if err != nil {
+		return directoryIdentity{}, err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return directoryIdentity{}, errors.New("stat")
+	}
+	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
+}
+func openDirectory(path string) (*os.File, error) {
+	if !cleanPath(path) || path == "/" {
+		return nil, errors.New("directory path")
+	}
+	return openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
+}
+func checkDirectory(path string, pinned *os.File, expected directoryIdentity) (*os.File, error) {
+	dir, err := openDirectory(path)
+	if err != nil {
+		return nil, err
+	}
+	got, err := fileIdentity(dir)
+	pin, x := fileIdentity(pinned)
+	if err != nil || x != nil || got != expected || got != pin {
+		dir.Close()
+		return nil, errors.New("directory replaced")
+	}
+	return dir, nil
+}
+func (w subprocessWriter) openSource(relative string) (*os.File, string, error) {
+	parent, err := filepath.EvalSymlinks(filepath.Dir(w.Staging))
+	if err != nil {
+		return nil, "", err
+	}
+	root := filepath.Join(parent, filepath.Base(w.Staging))
+	f, err := openBeneath(root, relative, syscall.O_RDONLY, 0)
+	if err != nil {
+		return nil, "", err
+	}
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		f.Close()
+		return nil, "", errors.New("staging file")
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || int(st.Uid) != w.PackageUID || st.Nlink != 1 {
+		f.Close()
+		return nil, "", errors.New("staging owner or hardlink")
+	}
+	return f, root, nil
+}
+func (w subprocessWriter) Move(ctx context.Context, s Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	if !tokenRE.MatchString(op.Job) || !validName(op.Name) || op.Size < 0 || op.Size > maxMoveBytes {
+		return MoveReceipt{}, errors.New("request")
+	}
+	f, root, err := w.openSource(op.Staging)
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || info.Size() != op.Size {
+		return MoveReceipt{}, errors.New("size mismatch")
+	}
+	dir, err := openDirectory(d.Root)
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer dir.Close()
+	di, err := fileIdentity(dir)
+	if err != nil || di != d.Directory {
+		return MoveReceipt{}, errors.New("destination replaced")
+	}
+	random := make([]byte, 16)
+	if _, err = rand.Read(random); err != nil {
+		return MoveReceipt{}, err
+	}
+	spec := moveSpec{SourceUID: w.PackageUID, Subject: s, Destination: d.Root, Directory: d.Directory, Name: op.Name, Size: op.Size, Part: partMetadata{Temporary: ".synopkgland-" + op.Job + "-" + hex.EncodeToString(random) + ".part", Directory: d.Directory, Destination: d.Root}}
+	// Separate pipes allow a fixed child to copy first and wait for the parent's
+	// commit decision. There is no socket endpoint or arbitrary child payload.
+	input, inWrite, err := os.Pipe()
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer input.Close()
+	defer inWrite.Close()
+	output, outWrite, err := os.Pipe()
+	if err != nil {
+		return MoveReceipt{}, err
+	}
+	defer output.Close()
+	defer outWrite.Close()
+	cmd := command(ctx, w.Executable, []string{"move-child"})
+	cmd.Stdin = input
+	cmd.Stdout = outWrite
+	cmd.Stderr = io.Discard
+	cmd.ExtraFiles = []*os.File{f, dir}
+	if err = cmd.Start(); err != nil {
+		return MoveReceipt{}, err
+	}
+	input.Close()
+	outWrite.Close()
+	waited := false
+	defer func() {
+		if !waited {
+			cmd.Cancel()
+			cmd.Wait()
+		}
+	}()
+	defer func() {
+		if spec.Part.Part.Inode != 0 {
+			cleanup, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			w.cleanupPart(cleanup, spec, dir)
+		}
+	}()
+	if err = json.NewEncoder(inWrite).Encode(spec); err != nil {
+		return MoveReceipt{}, err
+	}
+	reader := bufio.NewReader(output)
+	event := func() (childEvent, error) {
+		var event childEvent
+		b, err := reader.ReadBytes('\n')
+		if err != nil || len(b) > maxRequest {
+			return event, errors.New("child receipt")
+		}
+		if strictJSON(b, &event) != nil {
+			return event, errors.New("child receipt")
+		}
+		return event, nil
+	}
+	ev, err := event()
+	if err != nil || ev.Kind != "part" || ev.Part.Inode == 0 {
+		return MoveReceipt{}, errors.New("child part")
+	}
+	spec.Part.Part = ev.Part
+	if record, ok := ctx.Value(partRecordKey{}).(func(partMetadata) error); ok {
+		if err = record(spec.Part); err != nil {
+			return MoveReceipt{}, err
+		}
+	}
+	if _, err = inWrite.Write([]byte("C\n")); err != nil {
+		return MoveReceipt{}, err
+	}
+	ev, err = event()
+	if err != nil || ev.Kind != "ready" {
+		return MoveReceipt{}, errors.New("child copy")
+	}
+	receipt, err := guard(func() (MoveReceipt, error) {
+		// This is the only bounded I/O under the commit lock. Lost ack is uncertain.
+		if x := output.SetReadDeadline(time.Now().Add(publishReceiptTimeout)); x != nil {
+			return MoveReceipt{}, x
+		}
+		if _, x := inWrite.Write([]byte("P\n")); x != nil {
+			cmd.Cancel()
+			cmd.Wait()
+			waited = true
+			return MoveReceipt{}, x
+		}
+		ev, x := event()
+		if x != nil || ev.Kind != "committed" {
+			// Drain before releasing the protected publish lock: a lost receipt must
+			// never leave a live child that could publish after revoke acknowledges.
+			cmd.Cancel()
+			cmd.Wait()
+			waited = true
+		}
+		if x == nil && ev.Kind == "refused" && contains([]string{"destination-exists", "PERMISSION_DENIED", "NO_SPACE"}, ev.Code) {
+			return MoveReceipt{}, publishRejectedError{ev.Code}
+		}
+		if x != nil || ev.Kind != "committed" {
+			// The child may have linked before its receipt was lost, e.g. while a
+			// large file's directory fsync outlived the bound. With the child gone
+			// the final name is settled: our exact part inode there is the commit.
+			if waited && publishedPart(dir, spec) && dir.Sync() == nil {
+				return MoveReceipt{}, nil
+			}
+			return MoveReceipt{}, errors.New("publish receipt")
+		}
+		return ev.Receipt, nil
+	})
+	if err != nil {
+		return receipt, err
+	}
+	if !waited && cmd.Wait() != nil {
+		receipt.CleanupPending = true
+	}
+	waited = true
+	// Committed is immutable even if part/source cleanup fails.
+	if err = w.cleanupPart(ctx, spec, dir); err != nil {
+		receipt.CleanupPending = true
+	} else {
+		spec.Part.Part = directoryIdentity{}
+	}
+	if err = w.cleanupSource(ctx, f, root, op.Staging); err != nil {
+		receipt.CleanupPending = true
+	}
+	return receipt, nil
+}
+
+// publishedPart reports whether the final name is the recorded part inode: a
+// regular file of the declared size owned by the subject.
+func publishedPart(dir *os.File, spec moveSpec) bool {
+	fd, err := syscall.Openat(int(dir.Fd()), spec.Name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK|syscall.O_CLOEXEC, 0)
+	if err != nil {
+		return false
+	}
+	f := os.NewFile(uintptr(fd), spec.Name)
+	defer f.Close()
+	got, err := fileIdentity(f)
+	info, x := f.Stat()
+	if err != nil || x != nil || !info.Mode().IsRegular() || info.Size() != spec.Size || spec.Part.Part.Inode == 0 || got != spec.Part.Part {
+		return false
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	return ok && int(st.Uid) == spec.Subject.UID
+}
+func (w subprocessWriter) cleanupPart(ctx context.Context, spec moveSpec, dir *os.File) error {
+	b, _ := json.Marshal(spec)
+	cmd := command(ctx, w.Executable, []string{"part-cleanup-child"})
+	cmd.ExtraFiles = []*os.File{dir}
+	cmd.Stdin = strings.NewReader(string(b))
+	cmd.Stdout = io.Discard
+	cmd.Stderr = io.Discard
+	return cmd.Run()
+}
+func (w subprocessWriter) cleanupSource(ctx context.Context, original *os.File, root, relative string) error {
+	parent := filepath.Dir(relative)
+	path := root
+	if parent != "." {
+		path = filepath.Join(root, parent)
+	}
+	dir, err := openDirectory(path)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	spec := moveSpec{Subject: Subject{UID: w.PackageUID, GID: w.PackageGID, Groups: []int{w.PackageGID}}, SourceName: filepath.Base(relative)}
+	b, _ := json.Marshal(spec)
+	cmd := command(ctx, w.Executable, []string{"source-cleanup-child"})
+	cmd.ExtraFiles = []*os.File{original, dir}
+	cmd.Stdin = strings.NewReader(string(b))
+	cmd.Stdout = io.Discard
+	cmd.Stderr = io.Discard
+	return cmd.Run()
+}
+func readMoveSpec(r io.Reader) (moveSpec, error) {
+	var s moveSpec
+	b, err := io.ReadAll(io.LimitReader(r, maxRequest+1))
+	if err != nil || len(b) > maxRequest || strictJSON(b, &s) != nil {
+		return s, errors.New("spec")
+	}
+	return s, nil
+}
+func runMoveChild() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if os.Geteuid() != 0 {
+		return errors.New("root child required")
+	}
+	input := bufio.NewReader(os.Stdin)
+	line, err := input.ReadBytes('\n')
+	if err != nil || len(line) > maxRequest {
+		return errors.New("spec")
+	}
+	var spec moveSpec
+	if strictJSON(line, &spec) != nil || !validName(spec.Name) || !validTemporary(spec.Part.Temporary) || spec.Size < 0 || spec.Size > maxMoveBytes {
+		return errors.New("spec")
+	}
+	if err = dropSealedIdentity(realIdentity{}, spec.Subject); err != nil {
+		return err
+	}
+	pinned := os.NewFile(4, "destination")
+	defer pinned.Close()
+	dir, err := checkDirectory(spec.Destination, pinned, spec.Directory)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	fd, err := syscall.Openat(int(dir.Fd()), spec.Part.Temporary, syscall.O_RDWR|syscall.O_CREAT|syscall.O_EXCL|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600)
+	if err != nil {
+		return err
+	}
+	part := os.NewFile(uintptr(fd), spec.Part.Temporary)
+	defer part.Close()
+	identity, err := fileIdentity(part)
+	if err != nil {
+		return err
+	}
+	defer unlinkExact(dir, spec.Part.Temporary, identity)
+	send := func(event childEvent) error { return json.NewEncoder(os.Stdout).Encode(event) }
+	if err = send(childEvent{Kind: "part", Part: identity}); err != nil {
+		return err
+	}
+	decision, err := input.ReadString('\n')
+	if err != nil || decision != "C\n" {
+		return errors.New("copy refused")
+	}
+	src := os.NewFile(3, "staging")
+	defer src.Close()
+	// The parent's death closes stdin; stop copying instead of orphaning.
+	control := awaitControl(input)
+	if err = copyUnlessParentGone(part, src, spec.Size, control); err != nil {
+		return err
+	}
+	info, err := src.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		return errors.New("staging changed")
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || int(st.Uid) != spec.SourceUID || st.Nlink != 1 || info.Size() != spec.Size {
+		return errors.New("staging changed")
+	}
+	if err = part.Sync(); err != nil {
+		return err
+	}
+	if err = send(childEvent{Kind: "ready"}); err != nil {
+		return err
+	}
+	if next := <-control; next.err != nil || next.line != "P\n" {
+		return errors.New("publish refused")
+	}
+	check, err := checkDirectory(spec.Destination, pinned, spec.Directory)
+	if err != nil {
+		return err
+	}
+	check.Close()
+	// Link the OPEN part inode, never a possibly swapped pathname. AT_SYMLINK_FOLLOW
+	// is needed only for this trusted proc FD; the destination name cannot replace.
+	if err = linkOpenPart(part, dir, spec.Name); err != nil {
+		code := ""
+		switch err {
+		case syscall.EEXIST:
+			code = "destination-exists"
+		case syscall.EACCES, syscall.EPERM:
+			code = "PERMISSION_DENIED"
+		case syscall.ENOSPC:
+			code = "NO_SPACE"
+		}
+		if code != "" {
+			return send(childEvent{Kind: "refused", Code: code})
+		}
+		return err
+	}
+	// A failure to sync after link is a lost durable result, not a retryable error.
+	if err = syncPublished(dir); err != nil {
+		return err
+	}
+	cleanupPending := unlinkExact(dir, spec.Part.Temporary, identity) != nil
+	if !cleanupPending {
+		cleanupPending = dir.Sync() != nil
+	}
+	return send(childEvent{Kind: "committed", Receipt: MoveReceipt{CleanupPending: cleanupPending}})
+}
+func unlinkExact(dir *os.File, name string, expected directoryIdentity) error {
+	fd, err := syscall.Openat(int(dir.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK|syscall.O_CLOEXEC, 0)
+	if err == syscall.ENOENT {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	got, err := fileIdentity(f)
+	info, x := f.Stat()
+	f.Close()
+	if err != nil || x != nil || !info.Mode().IsRegular() || got != expected {
+		return errors.New("cleanup replaced")
+	}
+	return syscall.Unlinkat(int(dir.Fd()), name)
+}
+func runPartCleanupChild() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if os.Geteuid() != 0 {
+		return errors.New("root child required")
+	}
+	spec, err := readMoveSpec(os.Stdin)
+	if err != nil || !validTemporary(spec.Part.Temporary) || spec.Part.Part.Inode == 0 {
+		return errors.New("spec")
+	}
+	if err = dropSealedIdentity(realIdentity{}, spec.Subject); err != nil {
+		return err
+	}
+	dir := os.NewFile(3, "directory")
+	defer dir.Close()
+	got, err := fileIdentity(dir)
+	if err != nil || got != spec.Directory {
+		return errors.New("directory")
+	}
+	if err = unlinkExact(dir, spec.Part.Temporary, spec.Part.Part); err != nil {
+		return err
+	}
+	return dir.Sync()
+}
+func runSourceCleanupChild() error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if os.Geteuid() != 0 {
+		return errors.New("root child required")
+	}
+	spec, err := readMoveSpec(os.Stdin)
+	if err != nil || !validName(spec.SourceName) {
+		return errors.New("spec")
+	}
+	if err = dropSealedIdentity(realIdentity{}, spec.Subject); err != nil {
+		return err
+	}
+	src := os.NewFile(3, "source")
+	defer src.Close()
+	dir := os.NewFile(4, "directory")
+	defer dir.Close()
+	identity, err := fileIdentity(src)
+	if err != nil {
+		return err
+	}
+	if err = unlinkExact(dir, spec.SourceName, identity); err != nil {
+		return err
+	}
+	return dir.Sync()
+}
+
+func (w subprocessWriter) PublishedPart(_ context.Context, op Operation) bool {
+	if op.Part == nil || !validName(op.Name) {
+		return false
+	}
+	dir, err := openDirectory(op.Part.Destination)
+	if err != nil {
+		return false
+	}
+	defer dir.Close()
+	got, err := fileIdentity(dir)
+	return err == nil && got == op.Part.Directory && publishedPart(dir, moveSpec{Subject: op.Subject, Name: op.Name, Size: op.Size, Part: *op.Part}) && dir.Sync() == nil
+}
+func (w subprocessWriter) CleanupRecorded(ctx context.Context, s Subject, part partMetadata) error {
+	dir, err := openDirectory(part.Destination)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	got, err := fileIdentity(dir)
+	if err != nil || got != part.Directory {
+		return errors.New("cleanup directory changed")
+	}
+	return w.cleanupPart(ctx, moveSpec{Subject: s, Directory: part.Directory, Part: part}, dir)
+}