@synopackageland/cli 0.8.0 → 0.9.0

package/templates/_executor/executor_test.go

@@ -1,314 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-type fakeDSM struct {
-	apiMu                    sync.Mutex
-	user                     Subject
-	accountErr, privilegeErr error
-	apiCalls                 int
-	root                     string
-}
-
-func (f *fakeDSM) Verify(context.Context, string, string) (string, error) {
-	return f.user.Username, nil
-}
-func (f *fakeDSM) Account(context.Context, string) (Subject, error)           { return f.user, f.accountErr }
-func (f *fakeDSM) Allow(context.Context, Subject, string, string) error       { return f.privilegeErr }
-func (f *fakeDSM) ScopeRoot(context.Context, Subject, string) (string, error) { return f.root, nil }
-func (f *fakeDSM) API(context.Context, string, string, map[string]any) (json.RawMessage, error) {
-	f.apiMu.Lock()
-	f.apiCalls++
-	f.apiMu.Unlock()
-	return json.RawMessage(`{"allowed":true}`), nil
-}
-
-type fakeWriter struct{ calls int }
-
-func (f *fakeWriter) Write(context.Context, Subject, string, string, string, string) error {
-	f.calls++
-	return nil
-}
-func setup(t *testing.T) (*Executor, *fakeDSM, *fakeWriter) {
-	t.Helper()
-	root, _ := filepath.EvalSymlinks(t.TempDir())
-	f := &fakeDSM{user: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}, Home: root, Expired: "normal"}, root: root}
-	w := &fakeWriter{}
-	e := &Executor{Policy: Policy{Version: 1, Package: "p2probe", App: "app", Scope: "home", Operations: allOps}, DSM: f, Writer: w, Store: &Store{Dir: t.TempDir()}, Now: func() time.Time { return time.Unix(1000, 0) }}
-	return e, f, w
-}
-func request(e *Executor, op string, params any) Response {
-	b, _ := json.Marshal(params)
-	return e.Handle(context.Background(), Request{Version: 1, Op: op, Auth: Auth{Cookie: "session", SynoToken: "token"}, Params: b})
-}
-func create(t *testing.T, e *Executor) string {
-	t.Helper()
-	r := request(e, "delegate.create", map[string]any{"job_id": "job1", "ops": []string{"files.write", "files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 60})
-	if !r.OK {
-		t.Fatalf("create: %+v", r)
-	}
-	b, _ := json.Marshal(r.Result)
-	var d Delegation
-	json.Unmarshal(b, &d)
-	return d.ID
-}
-func TestRejections(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		mutate func(*Executor, *fakeDSM, *fakeWriter, string)
-		params map[string]any
-		code   string
-	}{
-		{"missing account", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.accountErr = errors.New("missing") }, nil, "INELIGIBLE"},
-		{"disabled", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "now" }, nil, "INELIGIBLE"},
-		{"unknown disabled state", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.Expired = "" }, nil, "INELIGIBLE"},
-		{"system runner", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID = 1 }, nil, "INELIGIBLE"},
-		{"uid reuse", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.user.UID++ }, nil, "INELIGIBLE"},
-		{"app deny", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) { f.privilegeErr = errors.New("deny") }, nil, "APP_DENIED"},
-		{"expired", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {
-			e.Now = func() time.Time { return time.Unix(1060, 0) }
-		}, nil, "DELEGATION_DENIED"},
-		{"revoked", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {
-			d, _ := e.Store.Get(id)
-			d.Revoked = true
-			e.Store.Put(d)
-		}, nil, "DELEGATION_DENIED"},
-		{"job", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"job_id": "job2"}, "DELEGATION_DENIED"},
-		{"scope", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"dest_dir": "/etc"}, "SCOPE_DENIED"},
-		{"dotdot", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"dest_dir": "/home/../home"}, "INVALID_REQUEST"},
-		{"name", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"name": "../oops"}, "INVALID_REQUEST"},
-		{"outside staging", func(e *Executor, f *fakeDSM, w *fakeWriter, id string) {}, map[string]any{"staging": "../secret"}, "INVALID_REQUEST"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			e, f, w := setup(t)
-			id := create(t, e)
-			tc.mutate(e, f, w, id)
-			p := map[string]any{"delegation_id": id, "job_id": "job1", "staging": "a", "dest_dir": "/home", "name": "new"}
-			for k, v := range tc.params {
-				p[k] = v
-			}
-			r := request(e, "files.write", p)
-			if r.OK || r.Code != tc.code || w.calls != 0 {
-				t.Fatalf("%+v calls=%d", r, w.calls)
-			}
-		})
-	}
-}
-func TestUnknownAndPolicy(t *testing.T) {
-	e, _, _ := setup(t)
-	if r := request(e, "shell", nil); r.Code != "UNKNOWN_OP" {
-		t.Fatal(r)
-	}
-	e.Policy.Operations = []string{"status"}
-	if r := request(e, "delegate.create", nil); r.Code != "POLICY_DENIED" {
-		t.Fatal(r)
-	}
-}
-func TestSpoofedUsername(t *testing.T) {
-	e, _, _ := setup(t)
-	r := request(e, "delegate.create", map[string]any{"username": "bob", "job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10})
-	if r.OK || r.Code != "INVALID_REQUEST" {
-		t.Fatal(r)
-	}
-	id := create(t, e)
-	d, _ := e.Store.Get(id)
-	if d.Subject.Username != "alice" {
-		t.Fatal(d)
-	}
-}
-func TestScopeSymlink(t *testing.T) {
-	e, f, _ := setup(t)
-	id := create(t, e)
-	os.Symlink(t.TempDir(), filepath.Join(f.root, "escape"))
-	r := request(e, "files.list", map[string]any{"delegation_id": id, "job_id": "job1", "path": "/home/escape"})
-	if r.Code != "SCOPE_DENIED" || f.apiCalls != 1 {
-		t.Fatal(r, f.apiCalls)
-	}
-}
-func TestOperationDelegation(t *testing.T) {
-	e, _, _ := setup(t)
-	id := create(t, e)
-	r := request(e, "files.info", map[string]any{"delegation_id": id, "job_id": "job1", "path": "/home"})
-	if r.Code != "DELEGATION_DENIED" {
-		t.Fatal(r)
-	}
-}
-func TestListAndRevokeOwnership(t *testing.T) {
-	e, f, _ := setup(t)
-	id := create(t, e)
-	f.user.Username = "bob"
-	r := request(e, "delegate.list", map[string]any{})
-	b, _ := json.Marshal(r.Result)
-	if strings.Contains(string(b), id) {
-		t.Fatal(r)
-	}
-	r = request(e, "delegate.revoke", map[string]any{"delegation_id": id})
-	if r.Code != "DELEGATION_DENIED" {
-		t.Fatal(r)
-	}
-	r = e.Handle(context.Background(), Request{Version: 1, Op: "delegate.revoke", Params: json.RawMessage(`{"delegation_id":"` + id + `","job_id":"job1"}`)})
-	if !r.OK {
-		t.Fatal(r)
-	}
-}
-func TestProtocol(t *testing.T) {
-	for _, tc := range []struct{ name, raw, code string }{{"oversize", strings.Repeat("x", 65537) + "\n", "REQUEST_TOO_LARGE"}, {"unknown field", `{"v":1,"op":"status","username":"admin"}` + "\n", "INVALID_REQUEST"}, {"duplicate", `{"v":1,"v":1,"op":"status"}` + "\n", "INVALID_REQUEST"}, {"utf8", string([]byte{255}) + "\n", "INVALID_REQUEST"}, {"version", `{"v":2,"op":"status"}` + "\n", "INVALID_REQUEST"}} {
-		t.Run(tc.name, func(t *testing.T) {
-			e, _, _ := setup(t)
-			a, b := net.Pipe()
-			go func() {
-				defer a.Close()
-				e.Connection(context.Background(), a, 100, func(net.Conn) (int, error) { return 100, nil })
-			}()
-			defer b.Close()
-			go b.Write([]byte(tc.raw))
-			var r Response
-			if err := json.NewDecoder(b).Decode(&r); err != nil || r.Code != tc.code {
-				t.Fatalf("%+v %v", r, err)
-			}
-		})
-	}
-}
-func TestWrongPeer(t *testing.T) {
-	e, _, _ := setup(t)
-	a, b := net.Pipe()
-	go func() {
-		defer a.Close()
-		e.Connection(context.Background(), a, 100, func(net.Conn) (int, error) { return 101, nil })
-	}()
-	defer b.Close()
-	var r Response
-	if json.NewDecoder(b).Decode(&r) == nil {
-		t.Fatal("wrong uid got response")
-	}
-}
-func TestStorePersistence(t *testing.T) {
-	e, _, _ := setup(t)
-	id := create(t, e)
-	d, err := (&Store{Dir: e.Store.Dir}).Get(id)
-	if err != nil || d.Subject.UID != 1200 {
-		t.Fatal(d, err)
-	}
-	info, _ := os.Stat(filepath.Join(e.Store.Dir, id+".json"))
-	if info.Mode().Perm() != 0600 {
-		t.Fatal(info.Mode())
-	}
-	if _, err = e.Store.Get("../x"); err == nil {
-		t.Fatal("traversal")
-	}
-}
-
-func TestFileStationPrivilegeRequiredSeparately(t *testing.T) {
-	e, f, _ := setup(t)
-	e.DSM = &selectivePrivilege{fakeDSM: f}
-	if out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10}); out.Code != "APP_DENIED" {
-		t.Fatal(out)
-	}
-}
-
-type selectivePrivilege struct{ *fakeDSM }
-
-func (f *selectivePrivilege) Allow(_ context.Context, _ Subject, app, _ string) error {
-	if app == "SYNO.SDS.App.FileStation3.Instance" {
-		return errors.New("deny File Station")
-	}
-	return nil
-}
-func TestSharedScope(t *testing.T) {
-	e, _, _ := setup(t)
-	e.Policy.Scope = "shared:p2probe-share"
-	out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "shared:p2probe-share", "path": "/p2probe-share", "ttl_seconds": 10})
-	if !out.OK {
-		t.Fatal(out)
-	}
-}
-
-type entryRecorder struct {
-	*fakeDSM
-	entries map[string]string
-}
-
-func (f *entryRecorder) Allow(_ context.Context, _ Subject, app, entry string) error {
-	f.entries[app] = entry
-	return nil
-}
-func TestPackageEntryModeReachesAppPrivilegeOnly(t *testing.T) {
-	e, f, _ := setup(t)
-	e.Policy.Entry = "app-privilege"
-	r := &entryRecorder{fakeDSM: f, entries: map[string]string{}}
-	e.DSM = r
-	if out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": 10}); !out.OK {
-		t.Fatal(out)
-	}
-	// File Station is a DSM App without the package's entry mode.
-	if r.entries["app"] != "app-privilege" || r.entries["SYNO.SDS.App.FileStation3.Instance"] != "" {
-		t.Fatal(r.entries)
-	}
-}
-func TestPolicyValidation(t *testing.T) {
-	base := Policy{Version: 1, Package: "p2probe", App: "app", Scope: "home", Operations: allOps}
-	for _, entry := range []string{"", "admin-only", "app-privilege"} {
-		p := base
-		p.Entry = entry
-		if validatePolicy(p, "p2probe") != nil {
-			t.Fatal("valid policy", entry)
-		}
-	}
-	for _, mutate := range []func(*Policy){func(p *Policy) { p.Package = "another" }, func(p *Policy) { p.Version = 2 }, func(p *Policy) { p.Operations = []string{"shell"} }, func(p *Policy) { p.Operations = []string{"status", "status"} }, func(p *Policy) { p.Scope = "../../etc" }, func(p *Policy) { p.Root = map[string]string{"a": "bad"} }, func(p *Policy) { p.Entry = "everyone" }} {
-		p := base
-		mutate(&p)
-		if validatePolicy(p, "p2probe") == nil {
-			t.Fatal("invalid policy accepted")
-		}
-	}
-}
-func TestFilenameAndTTL(t *testing.T) {
-	for _, n := range []string{"", "..", "a..b", "a/b", "a\x00b", "a\tb", "a\nb"} {
-		if validName(n) {
-			t.Fatal(n)
-		}
-	}
-	e, _, _ := setup(t)
-	for _, ttl := range []int{0, -1, 2592001} {
-		out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home", "ttl_seconds": ttl})
-		if out.Code != "INVALID_REQUEST" {
-			t.Fatal(out)
-		}
-	}
-}
-func TestStoreRejectSymlinkAndMode(t *testing.T) {
-	e, _, _ := setup(t)
-	id := create(t, e)
-	p := filepath.Join(e.Store.Dir, id+".json")
-	os.Chmod(p, 0644)
-	if _, err := e.Store.Get(id); err == nil {
-		t.Fatal("mode")
-	}
-	os.Remove(p)
-	os.Symlink(filepath.Join(t.TempDir(), "secret"), p)
-	if _, err := e.Store.Get(id); err == nil {
-		t.Fatal("symlink")
-	}
-}
-
-func TestCallerRequiresBothSessionValuesWithoutCredentialLeak(t *testing.T) {
-	e, _, _ := setup(t)
-	for _, auth := range []Auth{{Cookie: "secret-cookie"}, {SynoToken: "secret-token"}, {Cookie: "secret-cookie", SynoToken: "secret\r\nInjected: value"}, {Cookie: "secret-cookie", SynoToken: strings.Repeat("x", 4097)}} {
-		out := e.Handle(context.Background(), Request{Version: 1, Op: "delegate.list", Auth: auth, Params: json.RawMessage(`{}`)})
-		b, _ := json.Marshal(out)
-		if out.Code != "AUTH_DENIED" || strings.Contains(string(b), "secret") {
-			t.Fatal("invalid credentials not safely refused")
-		}
-	}
-}

package/templates/_executor/go.mod

@@ -1,5 +0,0 @@
-module synopkgland/executor
-
-go 1.23
-
-toolchain go1.26.9

package/templates/_executor/identity.go

@@ -1,74 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"sort"
-)
-
-// Injectable syscall surface: tests verify the exact ordering and every error.
-type identitySwitch interface {
-	Setgroups([]int) error
-	Setresgid(int, int, int) error
-	Setresuid(int, int, int) error
-	IDs() (int, int, int, int)
-	Groups() ([]int, error)
-}
-
-func dropIdentity(x identitySwitch, s Subject) error {
-	if s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 {
-		return errors.New("subject")
-	}
-	for _, g := range s.Groups {
-		if g < 0 {
-			return errors.New("groups")
-		}
-	}
-	if err := x.Setgroups(s.Groups); err != nil {
-		return err
-	}
-	if err := x.Setresgid(s.GID, s.GID, s.GID); err != nil {
-		return err
-	}
-	if err := x.Setresuid(s.UID, s.UID, s.UID); err != nil {
-		return err
-	}
-	uid, euid, gid, egid := x.IDs()
-	gs, err := x.Groups()
-	if err != nil {
-		return err
-	}
-	want := append([]int(nil), s.Groups...)
-	sort.Ints(want)
-	sort.Ints(gs)
-	if uid != s.UID || euid != s.UID || gid != s.GID || egid != s.GID || fmt.Sprint(gs) != fmt.Sprint(want) {
-		return errors.New("identity mismatch")
-	}
-	return nil
-}
-
-func sameGroups(a, b []int) bool {
-	a = append([]int(nil), a...)
-	b = append([]int(nil), b...)
-	sort.Ints(a)
-	sort.Ints(b)
-	return fmt.Sprint(a) == fmt.Sprint(b)
-}
-
-// Keep the historical injectable identity interface for existing consumer
-// fixtures. Production fixed children require this stricter syscall surface.
-type sealedIdentitySwitch interface {
-	identitySwitch
-	Seal() error
-	VerifyPrivileges(Subject) error
-}
-
-func dropSealedIdentity(x sealedIdentitySwitch, s Subject) error {
-	if err := x.Seal(); err != nil {
-		return err
-	}
-	if err := dropIdentity(x, s); err != nil {
-		return err
-	}
-	return x.VerifyPrivileges(s)
-}

package/templates/_executor/identity_kernel_linux_test.go

@@ -1,60 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"runtime"
-	"syscall"
-	"testing"
-)
-
-func TestSealedIdentityRealKernel(t *testing.T) {
-	if mode := os.Getenv("T0188_IDENTITY_CHILD"); mode != "" {
-		runtime.LockOSThread()
-		subject := Subject{UID: 1200, GID: 100, Groups: []int{100}}
-		var err error
-		if mode == "unsealed" {
-			// Clear capabilities and IDs without setting no_new_privs.
-			// VerifyPrivileges must still refuse this otherwise sealed child.
-			for cap := uintptr(0); cap < 64; cap++ {
-				_, _, errno := syscall.Syscall6(syscall.SYS_PRCTL, 24, cap, 0, 0, 0, 0)
-				if errno != 0 && errno != syscall.EINVAL {
-					fmt.Fprintln(os.Stderr, errno)
-					os.Exit(1)
-				}
-			}
-			err = dropIdentity(realIdentity{}, subject)
-			if err == nil {
-				err = realIdentity{}.VerifyPrivileges(subject)
-			}
-			if err == nil || err.Error() != "no_new_privs missing" {
-				fmt.Fprintln(os.Stderr, "expected no_new_privs refusal, got", err)
-				os.Exit(1)
-			}
-			os.Exit(0)
-		}
-		err = dropSealedIdentity(realIdentity{}, subject)
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		os.Exit(0)
-	}
-	if os.Geteuid() != 0 {
-		t.Skip("root Linux fixture required")
-	}
-	exe, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, mode := range []string{"sealed", "unsealed"} {
-		cmd := exec.Command(exe, "-test.run=^TestSealedIdentityRealKernel$")
-		cmd.Env = append(os.Environ(), "T0188_IDENTITY_CHILD="+mode)
-		if out, err := cmd.CombinedOutput(); err != nil {
-			t.Fatalf("%s subject kernel verification: %s: %v", mode, out, err)
-		}
-	}
-}

package/templates/_executor/identity_linux.go

@@ -1,82 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"syscall"
-)
-
-func (realIdentity) Seal() error {
-	// These are per-thread Linux settings. Every fresh child locks its OS thread
-	// until exit; it never execs untrusted code after dropping the identity.
-	prctl := func(op, a uintptr) error {
-		_, _, err := syscall.Syscall6(syscall.SYS_PRCTL, op, a, 0, 0, 0, 0)
-		if err != 0 {
-			return err
-		}
-		return nil
-	}
-	if err := prctl(38, 1); err != nil {
-		return err
-	} // PR_SET_NO_NEW_PRIVS
-	if err := prctl(8, 0); err != nil {
-		return err
-	} // PR_SET_KEEPCAPS off
-	for cap := uintptr(0); cap < 64; cap++ {
-		if err := prctl(24, cap); err != nil && err != syscall.EINVAL {
-			return err
-		}
-	} // PR_CAPBSET_DROP
-	return nil
-}
-func (realIdentity) VerifyPrivileges(s Subject) error {
-	b, err := os.ReadFile(fmt.Sprintf("/proc/self/task/%d/status", syscall.Gettid()))
-	if err != nil {
-		return err
-	}
-	fields := map[string][]string{}
-	for _, line := range strings.Split(string(b), "\n") {
-		parts := strings.Fields(line)
-		if len(parts) > 1 {
-			fields[strings.TrimSuffix(parts[0], ":")] = parts[1:]
-		}
-	}
-	for key, want := range map[string]int{"Uid": s.UID, "Gid": s.GID} {
-		got := fields[key]
-		if len(got) != 4 {
-			return errors.New("saved IDs missing")
-		}
-		for _, v := range got {
-			n, err := strconv.Atoi(v)
-			if err != nil || n != want {
-				return errors.New("saved IDs mismatch")
-			}
-		}
-	}
-	for _, key := range []string{"CapInh", "CapPrm", "CapEff", "CapBnd", "CapAmb"} {
-		v := fields[key]
-		if len(v) != 1 {
-			return errors.New("capability missing")
-		}
-		n, err := strconv.ParseUint(v[0], 16, 64)
-		if err != nil || n != 0 {
-			return errors.New("capability retained")
-		}
-	}
-	// Linux 4.4 supports no_new_privs but does not expose NoNewPrivs in
-	// proc status. Query the locked writer thread directly; missing/failed
-	// kernel support still refuses the write, without relaxing the seal.
-	nnp, _, errno := syscall.Syscall6(syscall.SYS_PRCTL, 39, 0, 0, 0, 0, 0) // PR_GET_NO_NEW_PRIVS
-	if errno != 0 {
-		return errno
-	}
-	if nnp != 1 {
-		return errors.New("no_new_privs missing")
-	}
-	return nil
-}

package/templates/_executor/identity_security_test.go

@@ -1,43 +0,0 @@
-package main
-
-import (
-	"errors"
-	"testing"
-)
-
-type secureSwitch struct {
-	sealed, verified bool
-	bad              bool
-	subject          Subject
-}
-
-func (s *secureSwitch) Seal() error { s.sealed = true; return nil }
-func (s *secureSwitch) VerifyPrivileges(Subject) error {
-	s.verified = true
-	if s.bad {
-		return errors.New("saved root or capability")
-	}
-	return nil
-}
-func (s *secureSwitch) Setgroups([]int) error {
-	if !s.sealed {
-		return errors.New("not sealed")
-	}
-	return nil
-}
-func (s *secureSwitch) Setresgid(int, int, int) error { return nil }
-func (s *secureSwitch) Setresuid(int, int, int) error { return nil }
-func (s *secureSwitch) IDs() (int, int, int, int) {
-	return s.subject.UID, s.subject.UID, s.subject.GID, s.subject.GID
-}
-func (s *secureSwitch) Groups() ([]int, error) { return s.subject.Groups, nil }
-func TestDropAdminSealsAndChecksSavedIDsCapabilities(t *testing.T) {
-	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 101}, Admin: true}
-	for _, bad := range []bool{false, true} {
-		s := &secureSwitch{bad: bad, subject: subject}
-		err := dropSealedIdentity(s, subject)
-		if (err != nil) != bad || !s.verified {
-			t.Fatal("unverified privilege drop", err)
-		}
-	}
-}

package/templates/_executor/internal/lifecycle/lifecycle.go

@@ -1,95 +0,0 @@
-// Package-account lifecycle only writes a bounded control request and waits.
-package lifecycle
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"regexp"
-	"time"
-)
-
-type Config struct {
-	Package, Data, Socket string
-	Log                   func(string)
-}
-
-var packageName = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
-
-func absent(path string) (bool, error) {
-	_, err := os.Lstat(path)
-	if os.IsNotExist(err) {
-		return true, nil
-	}
-	return false, err
-}
-func Run(ctx context.Context, cfg Config, action string) error {
-	if !packageName.MatchString(cfg.Package) || (action != "start" && action != "stop" && action != "purge") {
-		return errors.New("invalid lifecycle request")
-	}
-	mailbox := filepath.Join(cfg.Data, "executor")
-	if err := os.MkdirAll(mailbox, 0700); err != nil {
-		return err
-	}
-	info, err := os.Lstat(mailbox)
-	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
-		return errors.New("unsafe control directory")
-	}
-	path := filepath.Join(mailbox, "control")
-	if info, err := os.Lstat(path); err == nil && !info.Mode().IsRegular() {
-		return errors.New("unsafe control file")
-	} else if err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	f, err := os.CreateTemp(mailbox, ".control-")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(f.Name())
-	if _, err = f.WriteString(action + "\n"); err != nil {
-		f.Close()
-		return err
-	}
-	if err = f.Sync(); err != nil {
-		f.Close()
-		return err
-	}
-	if err = f.Close(); err != nil {
-		return err
-	}
-	if err = os.Rename(f.Name(), path); err != nil {
-		return err
-	}
-	if action == "start" {
-		return nil
-	}
-	// Offline requests still persist: the pinned boot task consumes pending purge.
-	ticker := time.NewTicker(100 * time.Millisecond)
-	defer ticker.Stop()
-	for {
-		gone, err := absent(cfg.Socket)
-		if err == nil && gone && action == "purge" {
-			// A paused executor has no socket but still polls the mailbox. Only
-			// its purge removes the socket directory, after root cleanup.
-			gone, err = absent(filepath.Dir(cfg.Socket))
-		}
-		if err != nil {
-			if cfg.Log != nil {
-				cfg.Log("executor socket status unavailable: request retained; lifecycle continues")
-			}
-			return nil
-		}
-		if gone {
-			return nil
-		}
-		select {
-		case <-ctx.Done():
-			if cfg.Log != nil {
-				cfg.Log("executor " + action + " timeout: request retained; uninstall may continue; purge mailbox is handled immediately, missing-package fallback requires 10 continuous minutes")
-			}
-			return nil
-		case <-ticker.C:
-		}
-	}
-}