@synopackageland/cli 0.6.1 → 0.7.1

package/templates/_executor/records.go

@@ -0,0 +1,242 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const maxJournalBytes int64 = 10 << 20
+const maxAuditBytes int64 = 50 << 20
+const maxMoveBytes int64 = 16 << 30
+const maxQueued = 16
+
+type directoryIdentity struct {
+	Device uint64 `json:"dev"`
+	Inode  uint64 `json:"ino"`
+}
+type Operation struct {
+	Version       int           `json:"v"`
+	Package       string        `json:"package"`
+	ID            string        `json:"delegation_id"`
+	Job           string        `json:"job_id"`
+	Subject       Subject       `json:"subject"`
+	Staging       string        `json:"staging"`
+	Name          string        `json:"name"`
+	Size          int64         `json:"size"`
+	State         string        `json:"state"`
+	Path          string        `json:"path,omitempty"`
+	Code          string        `json:"code,omitempty"`
+	Reason        string        `json:"reason,omitempty"`
+	Part          *partMetadata `json:"part,omitempty"`
+	PublishIntent bool          `json:"publish_intent,omitempty"`
+	// CancelRequested durably keeps an acknowledged cancel of a copy in flight.
+	CancelRequested string    `json:"cancel_requested,omitempty"`
+	Updated         time.Time `json:"updated_at"`
+}
+
+// canceledBeforeAdmission marks the tombstone of a cancel that found no
+// operation; admitted operations always carry their staging name.
+func (op Operation) canceledBeforeAdmission() bool {
+	return op.State == "canceled" && op.Staging == ""
+}
+
+type MoveReceipt struct {
+	Path           string `json:"path,omitempty"`
+	CleanupPending bool   `json:"cleanup_pending,omitempty"`
+}
+type AuditEvent struct {
+	At        time.Time `json:"at"`
+	Package   string    `json:"package"`
+	Username  string    `json:"username"`
+	UID       int       `json:"uid"`
+	Operation string    `json:"operation"`
+	Job       string    `json:"job_id,omitempty"`
+	Path      string    `json:"path,omitempty"`
+	Result    string    `json:"result"`
+}
+
+func recordKey(job string) string { h := sha256.Sum256([]byte(job)); return hex.EncodeToString(h[:]) }
+func (s *Store) atomic(name string, b []byte) error {
+	f, err := os.CreateTemp(s.Dir, ".record-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	defer f.Close()
+	if err = f.Chmod(0600); err != nil {
+		return err
+	}
+	if _, err = f.Write(b); err != nil {
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		return err
+	}
+	if err = f.Close(); err != nil {
+		return err
+	}
+	if err = os.Rename(f.Name(), filepath.Join(s.Dir, name)); err != nil {
+		return err
+	}
+	dir, err := os.Open(s.Dir)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	return dir.Sync()
+}
+func (s *Store) record(name string, v any) error {
+	info, err := os.Lstat(filepath.Join(s.Dir, name))
+	if err != nil {
+		return err
+	}
+	if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || info.Size() > maxRequest {
+		return errors.New("record mode")
+	}
+	b, err := os.ReadFile(filepath.Join(s.Dir, name))
+	if err != nil {
+		return err
+	}
+	return strictJSON(b, v)
+}
+func (s *Store) Disabled() (bool, error) {
+	var b struct {
+		Disabled bool `json:"disabled"`
+	}
+	err := s.record("disabled.record", &b)
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return b.Disabled, err
+}
+func (s *Store) SetDisabled(disabled bool) error {
+	b, _ := json.Marshal(map[string]bool{"disabled": disabled})
+	return s.atomic("disabled.record", b)
+}
+func (s *Store) PutOperation(op Operation) error {
+	if op.Version != 1 || !tokenRE.MatchString(op.Job) || !idRE.MatchString(op.ID) || !validState(op.State) {
+		return errors.New("operation")
+	}
+	b, err := json.Marshal(op)
+	if err != nil || len(b) > maxRequest {
+		return errors.New("operation size")
+	}
+	entries, err := os.ReadDir(s.Dir)
+	if err != nil {
+		return err
+	}
+	var total int64
+	name := "operation-" + recordKey(op.Job) + ".record"
+	for _, ent := range entries {
+		if strings.HasPrefix(ent.Name(), "operation-") && ent.Name() != name {
+			info, err := ent.Info()
+			if err != nil {
+				return err
+			}
+			total += info.Size()
+		}
+	}
+	if total+int64(len(b)) > maxJournalBytes {
+		return errors.New("journal full")
+	}
+	return s.atomic(name, b)
+}
+func validState(state string) bool {
+	return contains([]string{"queued", "copying", "committed", "canceled", "interrupted", "uncertain"}, state)
+}
+func (s *Store) GetOperation(job string) (Operation, error) {
+	var op Operation
+	if !tokenRE.MatchString(job) {
+		return op, errors.New("job")
+	}
+	err := s.record("operation-"+recordKey(job)+".record", &op)
+	if err != nil {
+		return op, err
+	}
+	if op.Version != 1 || op.Job != job || !idRE.MatchString(op.ID) || !validState(op.State) {
+		return op, errors.New("operation schema")
+	}
+	return op, nil
+}
+func (s *Store) Operations() ([]Operation, error) {
+	entries, err := os.ReadDir(s.Dir)
+	if err != nil {
+		return nil, err
+	}
+	out := []Operation{}
+	for _, ent := range entries {
+		if !strings.HasPrefix(ent.Name(), "operation-") || !strings.HasSuffix(ent.Name(), ".record") {
+			continue
+		}
+		var op Operation
+		if err = s.record(ent.Name(), &op); err != nil {
+			return nil, err
+		}
+		if ent.Name() != "operation-"+recordKey(op.Job)+".record" || op.Version != 1 || !validState(op.State) || !idRE.MatchString(op.ID) {
+			return nil, errors.New("operation schema")
+		}
+		out = append(out, op)
+	}
+	return out, nil
+}
+func (s *Store) Audit(event AuditEvent) error {
+	path := filepath.Join(s.Dir, "audit.jsonl")
+	b, err := json.Marshal(event)
+	if err != nil {
+		return err
+	}
+	b = append(b, '\n')
+	info, err := os.Lstat(path)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+	if err == nil {
+		if !info.Mode().IsRegular() || info.Mode().Perm() != 0600 {
+			return errors.New("audit mode")
+		}
+		if info.Size()+int64(len(b)) > maxAuditBytes/2 {
+			if err = os.Rename(path, filepath.Join(s.Dir, "audit.previous")); err != nil {
+				return err
+			}
+		}
+	}
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if _, err = f.Write(b); err != nil {
+		return err
+	}
+	if err = f.Sync(); err != nil {
+		return err
+	}
+	dir, err := os.Open(s.Dir)
+	if err != nil {
+		return err
+	}
+	defer dir.Close()
+	return dir.Sync()
+}
+func (e *Executor) auditLocked(s Subject, operation, job, path, result string) error {
+	return e.Store.Audit(AuditEvent{At: e.Now().UTC(), Package: e.Policy.Package, Username: s.Username, UID: s.UID, Operation: operation, Job: job, Path: path, Result: result})
+}
+
+type partMetadata struct {
+	Temporary   string            `json:"temporary"`
+	Directory   directoryIdentity `json:"directory"`
+	Part        directoryIdentity `json:"part"`
+	Destination string            `json:"destination"`
+}
+type partRecordKey struct{}
+type legacyPublishKey struct{}
+
+type publishRejectedError struct{ Code string }
+
+func (e publishRejectedError) Error() string { return e.Code }

package/templates/_executor/scope_cancel_contract_test.go

@@ -0,0 +1,91 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// killedChildWriter models the subprocess writer: its child dies with the
+// context and the copy ends with a transport error, before any publish guard.
+type killedChildWriter struct{ copying chan struct{} }
+
+func (w killedChildWriter) Write(context.Context, Subject, string, string, string, string) error {
+	return nil
+}
+func (w killedChildWriter) Move(ctx context.Context, _ Subject, _ Operation, _ Delegation, _ func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	close(w.copying)
+	<-ctx.Done()
+	return MoveReceipt{}, errors.New("child copy")
+}
+
+func TestStopDuringCopySettlesExecutorPausedNotWriteFailed(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := killedChildWriter{copying: make(chan struct{})}
+	e.Writer = w
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if r := offline(e, "files.moveFromStaging", moveParams(id, "job")); !r.OK {
+		t.Fatal(r)
+	}
+	<-w.copying
+	e.stopOperations()
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	// An executor stop is not an I/O failure of the destination.
+	wantOperation(t, offline(e, "files.operationStatus", map[string]any{"delegation_id": id, "job_id": "job"}), "interrupted", "EXECUTOR_PAUSED", "")
+}
+
+func TestScopeChangeCancelsCopyDurablyAcrossStop(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, d.ID, "job")
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	ref := map[string]any{"delegation_id": d.ID, "job_id": "job"}
+	wantOperation(t, offline(e, "files.operationStatus", ref), "copying", "CANCEL_REQUESTED", "scope-changed")
+	stopped := make(chan struct{})
+	go func() { e.stopOperations(); close(stopped) }()
+	w.let()
+	<-stopped
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "scope-changed")
+	select {
+	case <-w.published:
+		t.Fatal("published to a revoked destination")
+	default:
+	}
+}
+
+func TestScopeChangeCancelRecordedBeforeCrashSettlesCanceled(t *testing.T) {
+	e, _ := selectedExecutor(t)
+	if r := selectScope(e, "home", 0); !r.OK {
+		t.Fatal(r)
+	}
+	d := selectedGrant(t, e, "/home")
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, d.ID, "job")
+	if r := selectScope(e, "shared:reports", 0); !r.OK {
+		t.Fatal(r)
+	}
+	e.commitMu.Lock()
+	op, err := e.Store.GetOperation("job")
+	e.commitMu.Unlock()
+	if err != nil || op.CancelRequested != "scope-changed" {
+		t.Fatal("scope cancellation not durable before the writer stops", op, err)
+	}
+}

package/templates/_executor/scope_client.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"net"
+	"path/filepath"
+	"time"
+)
+
+// This command runs from the protected, pinned binary via the DSM root task.
+// It asks the live executor to serialize selection with admission and publish;
+// a second process must never write the authority file around that fence.
+func rootSelectScope(pkg, scope, actor string, expectedGeneration uint64) error {
+	c, err := net.DialTimeout("unix", filepath.Join(socketBase, pkg, "executor.sock"), 5*time.Second)
+	if err != nil {
+		return errors.New("scope executor unavailable")
+	}
+	defer c.Close()
+	if err = c.SetDeadline(time.Now().Add(30 * time.Second)); err != nil {
+		return err
+	}
+	if err = json.NewEncoder(c).Encode(map[string]any{"v": 1, "op": "delegate.setScope", "auth": map[string]string{}, "params": map[string]any{"scope": scope, "actor": actor, "expected_generation": expectedGeneration}}); err != nil {
+		return err
+	}
+	scan := bufio.NewScanner(c)
+	scan.Buffer(make([]byte, 4096), maxRequest)
+	if !scan.Scan() {
+		return errors.New("scope response unavailable")
+	}
+	var out Response
+	if strictJSON(scan.Bytes(), &out) != nil || !out.OK {
+		return errors.New("scope selection refused")
+	}
+	return nil
+}

package/templates/_executor/scope_contract.go

@@ -0,0 +1,12 @@
+package main
+
+// The immutable policy opts into administrator-selected scope. Only the
+// password-confirmed root task may populate the protected runtime selection.
+const installSelectedScope = "install-selected"
+const maxScopeGeneration = uint64(1<<53 - 1)
+
+type SelectedScope struct {
+	Schema     int    `json:"schema"`
+	Scope      string `json:"scope"`
+	Generation uint64 `json:"generation"`
+}

package/templates/_executor/selected_scope.go

@@ -0,0 +1,146 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"strings"
+)
+
+func validSelectedScope(scope string) bool {
+	if scope == "home" {
+		return true
+	}
+	if !strings.HasPrefix(scope, "shared:") {
+		return false
+	}
+	name := strings.TrimPrefix(scope, "shared:")
+	return validName(name) && name != "." && strings.TrimSpace(name) == name && !strings.ContainsAny(name, "\\:%") && !strings.EqualFold(name, "home") && !strings.EqualFold(name, "homes")
+}
+func (s *Store) SelectedScope() (SelectedScope, error) {
+	var out SelectedScope
+	if err := s.record("selected-scope.record", &out); err != nil {
+		return out, err
+	}
+	if out.Schema != 1 || !validSelectedScope(out.Scope) || out.Generation == 0 || out.Generation > maxScopeGeneration {
+		return SelectedScope{}, errors.New("selected scope state")
+	}
+	return out, nil
+}
+
+// Caller holds commitMu; root selection and publish share the same fence.
+func (e *Executor) selectionLocked() (SelectedScope, string) {
+	if e.Policy.Scope != installSelectedScope {
+		return SelectedScope{Schema: 1, Scope: e.Policy.Scope}, ""
+	}
+	state, err := e.Store.SelectedScope()
+	if os.IsNotExist(err) {
+		return SelectedScope{}, "needs-scope-confirmation"
+	}
+	if err != nil {
+		return SelectedScope{}, "STORAGE_ERROR"
+	}
+	return state, ""
+}
+func (e *Executor) selection() (SelectedScope, string) {
+	e.commitMu.Lock()
+	defer e.commitMu.Unlock()
+	return e.selectionLocked()
+}
+func (e *Executor) scopeMatchesLocked(d Delegation) bool {
+	state, code := e.selectionLocked()
+	return code == "" && state.Scope == d.Scope && state.Generation == d.ScopeGeneration
+}
+func (e *Executor) scopeMatches(d Delegation) bool {
+	e.commitMu.Lock()
+	defer e.commitMu.Unlock()
+	return e.scopeMatchesLocked(d)
+}
+
+// Only a kernel-verified root peer can reach this operation. It is absent from
+// the public wire allowlist, even when a package supplies an administrator SID.
+func (e *Executor) handlePeer(ctx context.Context, r Request, peerUID, packageUID int) Response {
+	if peerUID == 0 && r.Op == "delegate.setScope" {
+		if r.Version != 1 || r.Auth.hasKeys || r.Auth.Cookie != "" || r.Auth.SynoToken != "" {
+			return deny("INVALID_REQUEST")
+		}
+		return e.setSelectedScope(ctx, r.Params)
+	}
+	if peerUID != packageUID {
+		return deny("PEER_DENIED")
+	}
+	return e.Handle(ctx, r)
+}
+func (e *Executor) setSelectedScope(ctx context.Context, raw json.RawMessage) Response {
+	if ctx.Err() != nil {
+		return deny("EXECUTOR_PAUSED")
+	}
+	if e.Policy.Scope != installSelectedScope || e.Policy.Lifetime != "until-revoked" {
+		return deny("POLICY_DENIED")
+	}
+	var in struct {
+		Scope              string  `json:"scope"`
+		Actor              string  `json:"actor"`
+		ExpectedGeneration *uint64 `json:"expected_generation"`
+	}
+	if strictJSON(raw, &in) != nil || !validSelectedScope(in.Scope) || in.Actor == "" || in.ExpectedGeneration == nil || *in.ExpectedGeneration > maxScopeGeneration {
+		return deny("INVALID_REQUEST")
+	}
+	actor, err := e.DSM.Account(ctx, in.Actor)
+	if err != nil || actor.Username != in.Actor || !actor.Admin || actor.Expired != "normal" || actor.UID < 1024 {
+		return deny("ADMIN_REQUIRED")
+	}
+	if e.DSM.Allow(ctx, actor, e.Policy.App, e.Policy.Entry) != nil {
+		return deny("APP_DENIED")
+	}
+	// Scope selection grants no data permission. Resolve existence only; each
+	// destination and subsequent write still checks its owner's current ACL/UID.
+	if in.Scope != "home" {
+		if _, err = e.DSM.ScopeRoot(ctx, actor, in.Scope); err != nil {
+			return deny("SCOPE_DENIED")
+		}
+	}
+	e.commitMu.Lock()
+	defer e.commitMu.Unlock()
+	old, err := e.Store.SelectedScope()
+	if err != nil && !os.IsNotExist(err) {
+		return deny("STORAGE_ERROR")
+	}
+	if old.Generation != *in.ExpectedGeneration {
+		return deny("SCOPE_APPROVAL_STALE")
+	}
+	if err == nil && old.Scope == in.Scope {
+		return success(old)
+	}
+	if old.Generation >= maxScopeGeneration {
+		return deny("STORAGE_ERROR")
+	}
+	next := SelectedScope{Schema: 1, Scope: in.Scope, Generation: old.Generation + 1}
+	if e.auditLocked(actor, "delegate.scope.confirm", "", scopeVirtual(in.Scope), "admitting") != nil {
+		return deny("STORAGE_ERROR")
+	}
+	b, _ := json.Marshal(next)
+	if e.Store.atomic("selected-scope.record", b) != nil {
+		return deny("STORAGE_ERROR")
+	}
+	// New generation is already authoritative if cleanup fails. Old grants fail
+	// admission/publish before acknowledgement, and switching back cannot revive them.
+	grants, err := e.Store.List()
+	if err != nil {
+		return deny("STORAGE_ERROR")
+	}
+	for _, d := range grants {
+		if d.Package == e.Policy.Package && !d.Revoked {
+			d.Revoked = true
+			if e.Store.Put(d) != nil {
+				return deny("STORAGE_ERROR")
+			}
+			e.cancelGrantLocked(d.ID, "scope-changed")
+		}
+	}
+	if e.auditLocked(actor, "delegate.scope.confirm", "", scopeVirtual(in.Scope), "confirmed") != nil {
+		return deny("STORAGE_ERROR")
+	}
+	return success(next)
+}