@synopackageland/cli 0.6.1 → 0.7.1

package/templates/_executor/main.go

@@ -9,7 +9,6 @@ import (
 	"log"
 	"net"
 	"os"
-	"os/exec"
 	"os/signal"
 	"os/user"
 	"path/filepath"
@@ -26,20 +25,23 @@ const socketBase = "/run/synopkgland"
 func main() {
 	if err := run(os.Args[1:]); err != nil {
 		fmt.Fprintln(os.Stderr, "executor:", err)
-		os.Exit(1)
+		os.Exit(exitStatus(err))
 	}
 }
 func run(args []string) error {
 	if len(args) == 1 {
-		if args[0] == "write-child" {
-			return writeChild()
+		if args[0] == "move-child" {
+			return runMoveChild()
 		}
-		if args[0] == "cleanup-child" {
-			return runWriteChild(true)
+		if args[0] == "part-cleanup-child" {
+			return runPartCleanupChild()
+		}
+		if args[0] == "source-cleanup-child" {
+			return runSourceCleanupChild()
 		}
 	}
 	if len(args) < 1 {
-		return errors.New("usage: executor serve --package <pkg> | control start|stop|purge --package <pkg>")
+		return errors.New("usage: executor serve|supervise --package <pkg> | control start|stop|purge --package <pkg>")
 	}
 	mode := args[0]
 	args = args[1:]
@@ -53,14 +55,21 @@ func run(args []string) error {
 		if !contains([]string{"start", "stop", "purge"}, action) {
 			return errors.New("invalid control action")
 		}
-	} else if mode != "serve" {
+	} else if mode != "serve" && mode != "supervise" && mode != "select-scope" {
 		return errors.New("invalid command")
 	}
 	fs := flag.NewFlagSet("executor", flag.ContinueOnError)
 	pkg := fs.String("package", "", "package account")
+	scope := fs.String("scope", "", "administrator-confirmed scope")
+	actor := fs.String("actor", "", "password-confirmed administrator")
+	expectedGeneration := fs.Uint64("expected-generation", maxScopeGeneration+1, "protected generation observed before confirmation")
+	revived := fs.Bool("revived", false, "restarted by the root supervisor")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	if *revived && mode != "serve" {
+		return errors.New("unexpected revive")
+	}
 	if fs.NArg() != 0 || !tokenRE.MatchString(*pkg) {
 		return errors.New("invalid package")
 	}
@@ -82,6 +91,15 @@ func run(args []string) error {
 	if err != nil {
 		return err
 	}
+	if mode == "select-scope" {
+		if e.Policy.Scope != installSelectedScope || !validSelectedScope(*scope) || *actor == "" || *expectedGeneration > maxScopeGeneration {
+			return errors.New("scope selection")
+		}
+		return rootSelectScope(*pkg, *scope, *actor, *expectedGeneration)
+	}
+	if *scope != "" || *actor != "" || *expectedGeneration != maxScopeGeneration+1 {
+		return errors.New("unexpected selection arguments")
+	}
 	if mode == "control" {
 		// If the validated service already owns its pidfile, start is idempotent.
 		f, err := os.OpenFile(filepath.Join(e.Store.Dir, "executor.pid"), os.O_RDWR|os.O_CREATE, 0600)
@@ -104,9 +122,7 @@ func run(args []string) error {
 				return closeErr
 			}
 		}
-		cmd := exec.Command(exe, "serve", "--package", *pkg)
-		cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
-		cmd.Dir = "/"
+		cmd := supervisorCommand(exe, *pkg)
 		log, err := os.OpenFile(filepath.Join(e.Store.Dir, "executor.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 		if err != nil {
 			return err
@@ -114,13 +130,15 @@ func run(args []string) error {
 		defer log.Close()
 		cmd.Stdout = log
 		cmd.Stderr = log
-		cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 		if err = cmd.Start(); err != nil {
 			return err
 		}
 		return cmd.Process.Release()
 	}
-	return serve(e, uid, gid)
+	if mode == "supervise" {
+		return runSupervisor(exe, *pkg)
+	}
+	return serve(e, uid, gid, *revived)
 }
 
 // Never chmod or chown an existing untrusted directory into trust. Check all
@@ -215,23 +233,42 @@ func load(pkg, exe string) (*Executor, int, int, error) {
 	if err != nil {
 		return nil, 0, 0, err
 	}
-	return &Executor{Policy: p, DSM: newDSM(), Writer: subprocessWriter{Staging: filepath.Join("/var/packages", pkg, "var/executor-staging"), Executable: exe, PackageUID: uid}, Runner: scriptRunner{Dir: dir}, Store: &Store{Dir: state}, Now: time.Now, ExecutorDigest: ed, PolicyDigest: pd}, uid, gid, nil
+	return &Executor{Policy: p, DSM: newDSM(), Writer: subprocessWriter{Staging: filepath.Join("/var/packages", pkg, "var/executor-staging"), Executable: exe, PackageUID: uid, PackageGID: gid}, Runner: scriptRunner{Dir: dir}, Store: &Store{Dir: state}, Now: time.Now, ExecutorDigest: ed, PolicyDigest: pd}, uid, gid, nil
 }
 func validatePolicy(p Policy, pkg string) error {
 	if p.Version != 1 || p.Package != pkg || !tokenRE.MatchString(p.App) || len(p.Operations) == 0 {
 		return errors.New("policy")
 	}
+	if !contains([]string{"", "admin-only", "app-privilege"}, p.Entry) {
+		return errors.New("policy entry")
+	}
+	if p.Lifetime != "" && p.Lifetime != "until-revoked" {
+		return errors.New("policy lifetime")
+	}
+	if (len(p.Destinations) > 0) != (p.Lifetime == "until-revoked") {
+		return errors.New("policy destinations")
+	}
+	keys := map[string]bool{}
+	for _, key := range p.Destinations {
+		if !destinationRE.MatchString(key) || keys[key] {
+			return errors.New("policy destination")
+		}
+		keys[key] = true
+	}
+	if p.Lifetime != "" && !contains(p.Operations, "files.moveFromStaging") {
+		return errors.New("policy move")
+	}
 	seen := map[string]bool{}
 	for _, op := range p.Operations {
 		if !contains(allOps, op) || seen[op] {
 			return errors.New("policy operation")
 		}
 		seen[op] = true
-		if strings.HasPrefix(op, "files.") && scopeVirtual(p.Scope) == "" {
+		if strings.HasPrefix(op, "files.") && scopeVirtual(p.Scope) == "" && !(p.Scope == installSelectedScope && p.Lifetime == "until-revoked") {
 			return errors.New("policy scope")
 		}
 	}
-	if seen["delegate.create"] && scopeVirtual(p.Scope) == "" {
+	if seen["delegate.create"] && scopeVirtual(p.Scope) == "" && !(p.Scope == installSelectedScope && p.Lifetime == "until-revoked") {
 		return errors.New("policy scope")
 	}
 	for n, d := range p.Root {
@@ -241,14 +278,18 @@ func validatePolicy(p Policy, pkg string) error {
 	}
 	return nil
 }
-func serve(e *Executor, uid, gid int) error {
+func serve(e *Executor, uid, gid int, revived bool) error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 	actions := make(chan string, 1)
 	stopControls := rootControlSignals(ctx, actions)
 	defer stopControls()
 	pkgDir := filepath.Join("/var/packages", e.Policy.Package)
-	monitor := newLifecycleMonitor(e.Policy.Package, pkgDir, filepath.Join(pkgDir, "var/executor/control"), func(s string) { log.Print(s) })
+	newMonitor := newLifecycleMonitor
+	if revived {
+		newMonitor = newRevivedLifecycleMonitor
+	}
+	monitor := newMonitor(e.Policy.Package, pkgDir, filepath.Join(pkgDir, "var/executor/control"), func(s string) { log.Print(s) })
 	pidpath := filepath.Join(e.Store.Dir, "executor.pid")
 	pid, err := os.OpenFile(pidpath, os.O_RDWR|os.O_CREATE, 0600)
 	if err != nil {
@@ -256,7 +297,7 @@ func serve(e *Executor, uid, gid int) error {
 	}
 	defer pid.Close()
 	if err = lockFile(pid); err != nil {
-		return errors.New("already running")
+		return errAlreadyRunning
 	}
 	if err = pid.Truncate(0); err != nil {
 		return err
@@ -309,13 +350,17 @@ func serve(e *Executor, uid, gid int) error {
 		}
 	}()
 	open := func() (func(), error) { return openService(ctx, e, uid, gid, sock) }
+	target, packageInfo := filepath.Join(pkgDir, "target/executor"), filepath.Join(pkgDir, "INFO")
 	samePins := func(ctx context.Context) bool {
-		return samePackagePins(ctx, filepath.Join(pkgDir, "target/executor"), e.ExecutorDigest, e.PolicyDigest)
+		state := packagePins(ctx, target, packageInfo, rootOwnedReadOnly, e.ExecutorDigest, e.PolicyDigest)
+		install := func() error { return installAnchored(ctx, target, packageInfo, rootOwnedReadOnly, runtime) }
+		start := func() error { return startInstalled(runtime, e.Policy.Package) }
+		return approvedPins(state, install, start, func(s string) { log.Print(s) })
 	}
 	purge := func() error {
 		return purgeProtected(ctx, d, e.Policy.Package, filepath.Join(stateBase, e.Policy.Package), runtime, sockDir)
 	}
-	return manageService(ctx, actions, open, samePins, purge, func(s string) { log.Print(s) })
+	return manageService(ctx, actions, open, samePins, purge)
 }
 
 func openService(parent context.Context, e *Executor, uid, gid int, sock string) (func(), error) {
@@ -338,6 +383,12 @@ func openService(parent context.Context, e *Executor, uid, gid int, sock string)
 		return nil, err
 	}
 	ctx, cancel := context.WithCancel(parent)
+	if err = e.startOperations(ctx); err != nil {
+		cancel()
+		ln.Close()
+		os.Remove(sock)
+		return nil, err
+	}
 	var active sync.WaitGroup
 	var mu sync.Mutex
 	connections := map[*net.UnixConn]bool{}
@@ -382,15 +433,17 @@ func openService(parent context.Context, e *Executor, uid, gid int, sock string)
 		}
 		mu.Unlock()
 		active.Wait()
+		e.stopOperations()
 		os.Remove(sock)
 	}, nil
 }
 func purgeProtected(ctx context.Context, d *liveDSM, pkg, state, runtime, socket string) error {
+	logf := purgeLogger()
 	inv, err := readTaskInventory(runtime)
 	if err != nil {
-		log.Print("task cleanup skipped: protected inventory unavailable")
+		logf("task cleanup skipped: protected inventory unavailable: package=" + pkg)
 	} else {
-		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, func(s string) { log.Print(s) })
+		return purgeWithInventory(ctx, d, pkg, inv, state, runtime, socket, logf)
 	}
 	return finishControl(state, runtime, socket, true)
 }
@@ -463,8 +516,13 @@ func verifiedPID(f *os.File, runtime string) (int, error) {
 	if err != nil || pid <= 1 {
 		return 0, errors.New("pid")
 	}
-	actual, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", pid))
-	if err != nil || strings.TrimSuffix(actual, " (deleted)") != filepath.Join(runtime, "executor") {
+	exe := fmt.Sprintf("/proc/%d/exe", pid)
+	link, err := os.Readlink(exe)
+	if err != nil {
+		return 0, errors.New("pid executable mismatch")
+	}
+	running, err := os.Stat(exe)
+	if err != nil || !approvedExecutable(link, running, runtime, rootOwnedReadOnly) {
 		return 0, errors.New("pid executable mismatch")
 	}
 	return pid, nil

package/templates/_executor/managed.go

@@ -22,8 +22,9 @@ func samePackagePins(ctx context.Context, dir, executorDigest, policyDigest stri
 }
 
 // The process and monitor outlive its listener. A package start can only expose
-// the already-approved runtime when the shipped bytes still match both pins.
-func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error, log func(string)) error {
+// the already-approved runtime when the shipped bytes still match both pins;
+// samePins reports why it refused.
+func manageService(ctx context.Context, actions <-chan string, open func() (func(), error), samePins func(context.Context) bool, purge func() error) error {
 	var closeService func()
 	var checking <-chan bool
 	var cancelCheck context.CancelFunc
@@ -62,7 +63,6 @@ func manageService(ctx context.Context, actions <-chan string, open func() (func
 				return nil
 			}
 			if !matches {
-				log("executor paused: package pins require administrator approval")
 				continue
 			}
 			var err error

package/templates/_executor/managed_test.go

@@ -15,7 +15,7 @@ import (
 func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
 	for _, changed := range []bool{false, true} {
 		t.Run(map[bool]string{false: "same pins", true: "different policy"}[changed], func(t *testing.T) {
-			dir := t.TempDir()
+			dir := realTestPath(t, t.TempDir())
 			os.WriteFile(filepath.Join(dir, "executor"), []byte("approved executable"), 0600)
 			os.WriteFile(filepath.Join(dir, "policy.json"), []byte("approved policy"), 0600)
 			ed, _ := digestFile(context.Background(), filepath.Join(dir, "executor"), maxExecutorBytes)
@@ -34,7 +34,7 @@ func TestPauseResumeOnlyApprovedPinsAndPurgeWhilePaused(t *testing.T) {
 					}
 					opened.Add(1)
 					return func() { listener.Close(); closed.Add(1) }, nil
-				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil }, func(string) {})
+				}, func(ctx context.Context) bool { return samePackagePins(ctx, dir, ed, pd) }, func() error { purged.Add(1); return nil })
 			}()
 			await := func(v *atomic.Int32, want int32) {
 				t.Helper()
@@ -105,7 +105,7 @@ func TestRootControlSignalsPauseThenPurgeWithoutMailbox(t *testing.T) {
 	var opened, closed, purged atomic.Int32
 	done := make(chan error, 1)
 	go func() {
-		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil }, func(string) {})
+		done <- manageService(ctx, actions, func() (func(), error) { opened.Add(1); return func() { closed.Add(1) }, nil }, func(context.Context) bool { return true }, func() error { purged.Add(1); return nil })
 	}()
 	wait := func(value *atomic.Int32) {
 		t.Helper()