@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/_executor/path_test.go

@@ -15,3 +15,21 @@ func realTestPath(t *testing.T, p string) string {
 	return p
 }
 func makeTestDir(p string) error { return os.Mkdir(p, 0700) }
+
+// DSM links /var/packages/<pkg>/target to the volume. Every platform must
+// refuse a symlinked ancestor so tests catch callers that skip EvalSymlinks.
+func TestOpenRegularRefusesASymlinkedAncestor(t *testing.T) {
+	dir := realTestPath(t, t.TempDir())
+	os.MkdirAll(filepath.Join(dir, "appstore"), 0755)
+	os.WriteFile(filepath.Join(dir, "appstore", "executor"), []byte("x"), 0755)
+	os.Symlink(filepath.Join(dir, "appstore"), filepath.Join(dir, "target"))
+	if f, err := openRegular(filepath.Join(dir, "target", "executor")); err == nil {
+		f.Close()
+		t.Fatal("symlinked ancestor accepted")
+	}
+	f, err := openRegular(filepath.Join(dir, "appstore", "executor"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+}

package/dist/templates/_executor/pid.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+// approvedExecutable reports whether a /proc/<pid>/exe link and the inode it
+// runs (stat of that link) belong to an executor root installed in runtime.
+// The inode decides, not the name: kernel 3.10 (DSM 7.1) names a
+// rename-replaced inode after the rename source, so a monitor whose executor
+// was replaced reads as .executor (control.sh) or .executor-* (installAnchored)
+// "(deleted)". Only root writes runtime (root:root 0700), and a replaced inode
+// must be unlinked on the runtime's device.
+func approvedExecutable(link string, running os.FileInfo, runtime string, trusted func(os.FileInfo) bool) bool {
+	name, deleted := strings.CutSuffix(link, " (deleted)")
+	base := filepath.Base(name)
+	if filepath.Dir(name) != runtime || (base != "executor" && !strings.HasPrefix(base, ".executor")) {
+		return false
+	}
+	if !running.Mode().IsRegular() || !trusted(running) {
+		return false
+	}
+	if !deleted {
+		current, err := os.Lstat(filepath.Join(runtime, "executor"))
+		return err == nil && os.SameFile(running, current)
+	}
+	dir, err := os.Stat(runtime)
+	if err != nil {
+		return false
+	}
+	st, ok := running.Sys().(*syscall.Stat_t)
+	dt, dirOK := dir.Sys().(*syscall.Stat_t)
+	return ok && dirOK && st.Nlink == 0 && st.Dev == dt.Dev
+}

package/dist/templates/_executor/pid_test.go

@@ -0,0 +1,113 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// runningExecutor installs runtime/executor and keeps it open, as a live monitor.
+func runningExecutor(t *testing.T) (string, *os.File) {
+	t.Helper()
+	runtime := t.TempDir()
+	path := filepath.Join(runtime, "executor")
+	if err := os.WriteFile(path, []byte("old"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { f.Close() })
+	return runtime, f
+}
+
+// replaceExecutor renames a new copy over runtime/executor, as control.sh and
+// installAnchored do; the running inode is unlinked.
+func replaceExecutor(t *testing.T, runtime, staged string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(runtime, staged), []byte("new"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(filepath.Join(runtime, staged), filepath.Join(runtime, "executor")); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func stat(t *testing.T, f *os.File) os.FileInfo {
+	t.Helper()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return info
+}
+
+func TestApprovedExecutableAcceptsTheLiveRuntimeExecutor(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	if !approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, trustAll) {
+		t.Fatal("live runtime executor refused")
+	}
+}
+
+// Kernel 3.10 (DSM 7.1 armv7) names a rename-replaced inode after the rename
+// source: control.sh stages .executor, installAnchored stages .executor-*.
+func TestApprovedExecutableAcceptsAReplacedExecutorUnderItsSwappedName(t *testing.T) {
+	for _, staged := range []string{".executor", ".executor-123456"} {
+		runtime, f := runningExecutor(t)
+		replaceExecutor(t, runtime, staged)
+		for _, name := range []string{staged, "executor"} {
+			link := filepath.Join(runtime, name) + " (deleted)"
+			if !approvedExecutable(link, stat(t, f), runtime, trustAll) {
+				t.Fatalf("replaced executor refused: %s", link)
+			}
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnotherInode(t *testing.T) {
+	runtime, _ := runningExecutor(t)
+	other := filepath.Join(runtime, ".executor")
+	if err := os.WriteFile(other, []byte("other"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(other)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	running := stat(t, f)
+	// Still linked: not the installed executor, whatever the link claims.
+	for _, link := range []string{other, other + " (deleted)", filepath.Join(runtime, "executor"), filepath.Join(runtime, "executor") + " (deleted)"} {
+		if approvedExecutable(link, running, runtime, trustAll) {
+			t.Fatalf("linked non-executor accepted as %s", link)
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnUnlinkedInodeOutsideTheRuntime(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	replaceExecutor(t, runtime, ".executor")
+	running := stat(t, f)
+	for _, link := range []string{
+		filepath.Join(t.TempDir(), "executor") + " (deleted)",
+		filepath.Join(runtime, "sh") + " (deleted)",
+		filepath.Join(runtime, ".executor"), // unlinked yet not reported deleted
+	} {
+		if approvedExecutable(link, running, runtime, trustAll) {
+			t.Fatalf("unlinked inode accepted as %s", link)
+		}
+	}
+}
+
+func TestApprovedExecutableRefusesAnUntrustedInode(t *testing.T) {
+	runtime, f := runningExecutor(t)
+	refuse := func(os.FileInfo) bool { return false }
+	if approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, refuse) {
+		t.Fatal("untrusted live executor accepted")
+	}
+	replaceExecutor(t, runtime, ".executor")
+	if approvedExecutable(filepath.Join(runtime, ".executor")+" (deleted)", stat(t, f), runtime, refuse) {
+		t.Fatal("untrusted replaced executor accepted")
+	}
+}

package/dist/templates/_executor/platform_linux.go

@@ -4,19 +4,12 @@ package main
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
 	"errors"
-	"io"
 	"net"
 	"os"
 	"os/exec"
-	"path/filepath"
-	"strconv"
 	"strings"
 	"syscall"
-	"time"
 )
 
 func ownedByRoot(info os.FileInfo) bool {
@@ -103,7 +96,7 @@ func openBeneath(root, relative string, flags int, mode uint32) (*os.File, error
 	for i, part := range parts {
 		f := flags
 		if i < len(parts)-1 {
-			f = syscall.O_RDONLY | syscall.O_DIRECTORY
+			f = 0x200000 | syscall.O_DIRECTORY // O_PATH: ancestor requires search, not listing rights
 		}
 		fd, err := syscall.Openat(int(dir.Fd()), part, f|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, mode)
 		if err != nil {
@@ -135,104 +128,31 @@ func openRegular(path string) (*os.File, error) {
 }
 
 type subprocessWriter struct {
-	Staging, Executable string
-	PackageUID          int
-}
-type childSpec struct {
-	Subject   Subject `json:"subject"`
-	Dest      string  `json:"dest_dir"`
-	Name      string  `json:"name"`
-	Root      string  `json:"root"`
-	Temporary string  `json:"temporary"`
+	Staging, Executable    string
+	PackageUID, PackageGID int
 }
 
 func (w subprocessWriter) Write(ctx context.Context, s Subject, staging, dest, name, root string) error {
-	parent, err := filepath.EvalSymlinks(filepath.Dir(w.Staging))
-	if err != nil {
-		return err
-	}
-	stagingRoot := filepath.Join(parent, filepath.Base(w.Staging))
-	f, err := openBeneath(stagingRoot, staging, syscall.O_RDONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	info, err := f.Stat()
-	if err != nil || !info.Mode().IsRegular() {
-		return errors.New("staging file")
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || int(st.Uid) != w.PackageUID || st.Nlink != 1 {
-		return errors.New("staging owner or hardlink")
-	}
 	job, _ := ctx.Value(writeJobKey{}).(string)
-	if !tokenRE.MatchString(job) {
-		return errors.New("write job")
-	}
-	random := make([]byte, 16)
-	if _, err = rand.Read(random); err != nil {
-		return err
-	}
-	temporary := ".synopkgland-" + job + "-" + hex.EncodeToString(random) + ".part"
-	// Retain this directory solely for cleanup. The writer opens it again after
-	// dropping identity and verifies the inode before creating any file.
-	dir, err := os.Open(dest)
+	f, _, err := w.openSource(staging)
 	if err != nil {
 		return err
 	}
-	defer dir.Close()
-	spec, err := json.Marshal(childSpec{Subject: s, Dest: dest, Name: name, Root: root, Temporary: temporary})
-	if err != nil {
-		return err
-	}
-	runChild := func(childCtx context.Context, mode string) error {
-		cmd := command(childCtx, w.Executable, []string{mode})
-		cmd.ExtraFiles = []*os.File{f, dir}
-		cmd.Stdin = strings.NewReader(string(spec))
-		cmd.Stdout = io.Discard
-		cmd.Stderr = io.Discard
-		return cmd.Run()
-	}
-	writeErr := runChild(ctx, "write-child")
-	// SIGKILL cannot execute a child defer. Cleanup uses the subject's identity
-	// and the retained directory, even if the subject has renamed that directory.
-	cleanup, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	cleanupErr := runChild(cleanup, "cleanup-child")
-	cancel()
-	if writeErr != nil || cleanupErr != nil {
-		return errors.New("write child refused")
-	}
-
-	// Unlink via the pinned staging parent; swapping staging never removes an
-	// unrelated object outside staging. A replacement is deliberately not deleted.
-	return removeStaging(stagingRoot, staging, info)
-}
-func removeStaging(root, relative string, original os.FileInfo) error {
-	parent := filepath.Dir(relative)
-	dir, err := os.Open(root)
+	info, err := f.Stat()
+	f.Close()
 	if err != nil {
 		return err
 	}
-	if parent != "." {
-		dir.Close()
-		dir, err = openBeneath(root, parent, syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
-		if err != nil {
-			return err
-		}
-	}
-	defer dir.Close()
-	name := filepath.Base(relative)
-	fd, err := syscall.Openat(int(dir.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, 0)
+	di, err := bindDirectory(dest)
 	if err != nil {
 		return err
 	}
-	f := os.NewFile(uintptr(fd), name)
-	now, err := f.Stat()
-	f.Close()
-	if err != nil || !os.SameFile(original, now) {
-		return errors.New("staging replaced")
+	guard, _ := ctx.Value(legacyPublishKey{}).(func(func() (MoveReceipt, error)) (MoveReceipt, error))
+	if guard == nil {
+		guard = func(publish func() (MoveReceipt, error)) (MoveReceipt, error) { return publish() }
 	}
-	return syscall.Unlinkat(int(dir.Fd()), name)
+	_, err = w.Move(ctx, s, Operation{Job: job, Name: name, Staging: staging, Size: info.Size()}, Delegation{Root: dest, Directory: di}, guard)
+	return err
 }
 
 type realIdentity struct{}
@@ -244,93 +164,24 @@ func (realIdentity) IDs() (int, int, int, int) {
 	return os.Getuid(), os.Geteuid(), os.Getgid(), os.Getegid()
 }
 func (realIdentity) Groups() ([]int, error) { return os.Getgroups() }
-func writeChild() error                     { return runWriteChild(false) }
-func runWriteChild(cleanup bool) error {
-	if os.Geteuid() != 0 {
-		return errors.New("root required")
-	}
-	b, err := io.ReadAll(io.LimitReader(os.Stdin, maxRequest+1))
-	if err != nil || len(b) > maxRequest {
-		return errors.New("child spec")
-	}
-	var s childSpec
-	if strictJSON(b, &s) != nil {
-		return errors.New("child spec")
-	}
-	if !validTemporary(s.Temporary) || !validName(s.Name) || !cleanPath(s.Dest) || !cleanPath(s.Root) || !within(s.Root, s.Dest) {
-		return errors.New("scope")
-	}
-	if err = dropIdentity(realIdentity{}, s.Subject); err != nil {
-		return err
-	}
-	dir := os.NewFile(4, "destination")
-	defer dir.Close()
-	if cleanup {
-		info, err := dir.Stat()
-		if err != nil || !info.IsDir() {
-			return errors.New("cleanup directory")
-		}
-		err = syscall.Unlinkat(int(dir.Fd()), s.Temporary)
-		if err != nil && err != syscall.ENOENT {
-			return err
-		}
-		return dir.Sync()
-	}
-	return copyDestination(os.NewFile(3, "staging"), s.Dest, s.Name, s.Root, s.Temporary, dir)
-}
 func validTemporary(name string) bool {
 	return validName(name) && strings.HasPrefix(name, ".synopkgland-") && strings.HasSuffix(name, ".part")
 }
-func copyDestination(src *os.File, dest, name, root, temporary string, pinned *os.File) error {
-	if !validTemporary(temporary) || !validName(name) || !cleanPath(dest) || !cleanPath(root) {
-		return errors.New("path")
-	}
-	dir, err := os.Open(dest)
+func lockFile(f *os.File) error { return syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) }
+
+func bindDirectory(path string) (directoryIdentity, error) {
+	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
 	if err != nil {
-		return err
-	}
-	defer dir.Close()
-	info, err := dir.Stat()
-	if err != nil || !info.IsDir() {
-		return errors.New("directory")
-	}
-	expected, err := pinned.Stat()
-	if err != nil || !os.SameFile(info, expected) {
-		return errors.New("directory replaced")
-	}
-	actual, err := os.Readlink("/proc/self/fd/" + strconv.Itoa(int(dir.Fd())))
-	if err != nil || !within(root, actual) || strings.HasSuffix(actual, " (deleted)") {
-		return errors.New("scope")
+		return directoryIdentity{}, err
 	}
-	fd, err := syscall.Openat(int(dir.Fd()), temporary, syscall.O_WRONLY|syscall.O_CREAT|syscall.O_EXCL|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600)
+	defer f.Close()
+	info, err := f.Stat()
 	if err != nil {
-		return err
-	}
-	out := os.NewFile(uintptr(fd), temporary)
-	defer func() { out.Close(); syscall.Unlinkat(int(dir.Fd()), temporary) }()
-	// Recheck the pinned directory after creation, before copying any bytes.
-	actual, err = os.Readlink("/proc/self/fd/" + strconv.Itoa(int(dir.Fd())))
-	if err != nil || !within(root, actual) || strings.HasSuffix(actual, " (deleted)") {
-		return errors.New("scope")
-	}
-	if _, err = io.Copy(out, src); err != nil {
-		return err
-	}
-	if err = out.Sync(); err != nil {
-		return err
+		return directoryIdentity{}, err
 	}
-	if err = out.Close(); err != nil {
-		return err
-	}
-	// link publishes complete fsynced bytes and atomically refuses any existing
-	// final file or symlink. Both paths resolve through the pinned directory.
-	procDir := "/proc/self/fd/" + strconv.Itoa(int(dir.Fd()))
-	if err = os.Link(procDir+"/"+temporary, procDir+"/"+name); err != nil {
-		return err
-	}
-	if err = syscall.Unlinkat(int(dir.Fd()), temporary); err != nil {
-		return err
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || !info.IsDir() {
+		return directoryIdentity{}, errors.New("directory")
 	}
-	return dir.Sync()
+	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
 }
-func lockFile(f *os.File) error { return syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) }

package/dist/templates/_executor/platform_linux_test.go

@@ -29,9 +29,11 @@ func (s *switchStub) step(name string) error {
 	}
 	return nil
 }
-func (s *switchStub) Setgroups([]int) error         { return s.step("groups") }
-func (s *switchStub) Setresgid(int, int, int) error { return s.step("gid") }
-func (s *switchStub) Setresuid(int, int, int) error { return s.step("uid") }
+func (s *switchStub) Seal() error                    { return s.step("seal") }
+func (s *switchStub) VerifyPrivileges(Subject) error { return s.step("verify") }
+func (s *switchStub) Setgroups([]int) error          { return s.step("groups") }
+func (s *switchStub) Setresgid(int, int, int) error  { return s.step("gid") }
+func (s *switchStub) Setresuid(int, int, int) error  { return s.step("uid") }
 func (s *switchStub) IDs() (int, int, int, int) {
 	if s.wrong {
 		return 0, 0, 0, 0
@@ -41,13 +43,13 @@ func (s *switchStub) IDs() (int, int, int, int) {
 func (s *switchStub) Groups() ([]int, error) { return s.s.Groups, nil }
 func TestDropOrderAndFailures(t *testing.T) {
 	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 123}}
-	for _, fail := range []string{"", "groups", "gid", "uid"} {
+	for _, fail := range []string{"", "seal", "groups", "gid", "uid", "verify"} {
 		s := &switchStub{fail: fail, s: subject}
-		err := dropIdentity(s, subject)
+		err := dropSealedIdentity(s, subject)
 		if (err == nil) != (fail == "") {
 			t.Fatal(err)
 		}
-		expected := []string{"groups", "gid", "uid"}
+		expected := []string{"seal", "groups", "gid", "uid", "verify"}
 		if fail != "" {
 			for i, n := range expected {
 				if n == fail {
@@ -61,7 +63,7 @@ func TestDropOrderAndFailures(t *testing.T) {
 		}
 	}
 	s := &switchStub{s: subject, wrong: true}
-	if dropIdentity(s, subject) == nil {
+	if dropSealedIdentity(s, subject) == nil {
 		t.Fatal("identity not verified")
 	}
 }
@@ -78,43 +80,6 @@ func TestLinuxStagingSymlinks(t *testing.T) {
 		}
 	}
 }
-func TestLinuxCopyScopeAndNoOverwrite(t *testing.T) {
-	root := t.TempDir()
-	out := t.TempDir()
-	src, err := os.CreateTemp(t.TempDir(), "source")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer src.Close()
-	src.WriteString("content")
-	src.Seek(0, 0)
-	pinned, _ := os.Open(root)
-	defer pinned.Close()
-	if err = copyDestination(src, root, "new", root, ".synopkgland-job1-test.part", pinned); err != nil {
-		t.Fatal(err)
-	}
-	src.Seek(0, 0)
-	if err = copyDestination(src, root, "new", root, ".synopkgland-job1-test.part", pinned); err == nil {
-		t.Fatal("overwrite")
-	}
-	b, _ := os.ReadFile(filepath.Join(root, "new"))
-	if string(b) != "content" {
-		t.Fatal(string(b))
-	}
-	os.Symlink(out, filepath.Join(root, "escape"))
-	src.Seek(0, 0)
-	if err = copyDestination(src, filepath.Join(root, "escape"), "new", root, ".synopkgland-job1-test.part", pinned); err == nil {
-		t.Fatal("escape")
-	}
-	if _, err = os.Stat(filepath.Join(out, "new")); !os.IsNotExist(err) {
-		t.Fatal(err)
-	}
-	for _, name := range []string{"..", "../a", "a/b", "a\x00b", "a\nb"} {
-		if copyDestination(src, root, name, root, ".synopkgland-job1-test.part", pinned) == nil {
-			t.Fatal(name)
-		}
-	}
-}
 func TestLinuxPeerCredential(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "sock")
 	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"})
@@ -224,24 +189,3 @@ func TestScriptTimeoutAndOutputLimit(t *testing.T) {
 		t.Fatal("excessive output accepted")
 	}
 }
-
-func TestLinuxCopyFailureNeverPublishesPartialDestination(t *testing.T) {
-	root := t.TempDir()
-	pinned, err := os.Open(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer pinned.Close()
-	src, err := os.CreateTemp(t.TempDir(), "source")
-	if err != nil {
-		t.Fatal(err)
-	}
-	src.Close()
-	if err = copyDestination(src, root, "final", root, ".synopkgland-job1-failed.part", pinned); err == nil {
-		t.Fatal("closed source succeeded")
-	}
-	entries, err := os.ReadDir(root)
-	if err != nil || len(entries) != 0 {
-		t.Fatal("failure published or leaked bytes", entries, err)
-	}
-}

package/dist/templates/_executor/platform_other.go

@@ -8,6 +8,9 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
 )
 
 func verifySocket(string, int, int, os.FileMode) error { return errLinux }
@@ -17,7 +20,14 @@ var errLinux = errors.New("executor requires Linux")
 func ownedByRoot(os.FileInfo) bool  { return false }
 func configureProcess(*exec.Cmd)    {}
 func peerUID(net.Conn) (int, error) { return -1, errLinux }
+
+// Like Linux openBeneath, refuse a symlink in any component, not only the last.
 func openRegular(path string) (*os.File, error) {
+	for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
+		if info, err := os.Lstat(dir); err != nil || info.Mode()&os.ModeSymlink != 0 {
+			return nil, errors.New("path")
+		}
+	}
 	info, err := os.Lstat(path)
 	if err != nil {
 		return nil, err
@@ -29,14 +39,38 @@ func openRegular(path string) (*os.File, error) {
 }
 
 type subprocessWriter struct {
-	Staging, Executable string
-	PackageUID          int
+	Staging, Executable    string
+	PackageUID, PackageGID int
 }
 
 func (subprocessWriter) Write(context.Context, Subject, string, string, string, string) error {
 	return errLinux
 }
-func writeChild() error       { return errLinux }
 func lockFile(*os.File) error { return errLinux }
 
-func runWriteChild(bool) error { return errLinux }
+func bindDirectory(path string) (directoryIdentity, error) {
+	current := ""
+	for _, part := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
+		current += "/" + part
+		info, err := os.Lstat(current)
+		if err != nil {
+			return directoryIdentity{}, err
+		}
+		if !info.IsDir() {
+			return directoryIdentity{}, errLinux
+		}
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return directoryIdentity{}, err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || !info.IsDir() {
+		return directoryIdentity{}, errLinux
+	}
+	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
+}
+
+func runMoveChild() error          { return errLinux }
+func runPartCleanupChild() error   { return errLinux }
+func runSourceCleanupChild() error { return errLinux }

package/dist/templates/_executor/process.go

@@ -47,6 +47,9 @@ func (processCommand) Exec(ctx context.Context, path string, args []string) ([]b
 	cmd.Stdout = &out
 	cmd.Stderr = io.Discard
 	if err := cmd.Run(); err != nil {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
 		return nil, err
 	}
 	return out.buf.Bytes(), nil

package/dist/templates/_executor/purge_log.go

@@ -0,0 +1,18 @@
+package main
+
+import (
+	"log"
+	"log/syslog"
+)
+
+// Purge removes executor.log with the protected state, so its diagnostics
+// also go to the system log, where they survive the uninstall.
+func purgeLogger() func(string) {
+	system, err := syslog.New(syslog.LOG_NOTICE|syslog.LOG_DAEMON, "synopkgland-executor")
+	return func(s string) {
+		log.Print(s)
+		if err == nil {
+			_ = system.Notice(s)
+		}
+	}
+}