@synopackageland/cli 0.8.0 → 0.9.0

package/templates/_executor/testdata/live_probe.py

@@ -1,98 +0,0 @@
-#!/usr/bin/env python3
-"""Root-only disposable vt-nas probe. Password JSON is read from stdin, never logged.
-Requires pre-created p2probe{1,2,adm,pkg}, protected runtime, home-scoped policy.
-No tasks, installed packages or global DSM settings are changed.
-"""
-import json, os, pathlib, pwd, socket, subprocess, sys, urllib.parse, urllib.request
-
-creds = json.load(sys.stdin)
-BASE = pathlib.Path('/usr/local/etc/synopkgland/p2probepkg')
-SOCK = '/run/synopkgland/p2probepkg/executor.sock'
-STAGE = pathlib.Path('/var/packages/p2probepkg/var/executor-staging')
-sessions = {}
-
-def api(params):
-    data = urllib.parse.urlencode(params).encode()
-    with urllib.request.urlopen('http://127.0.0.1:5000/webapi/entry.cgi', data, timeout=15) as r:
-        return json.load(r)
-
-def login(name):
-    r = api({'api':'SYNO.API.Auth','method':'login','version':'7','account':name,'passwd':creds[name],'format':'sid','enable_syno_token':'yes'})
-    assert r.get('success'), ('login failed', name, r.get('error'))
-    sessions[name] = r['data']
-    return sessions[name]['sid']
-
-def run_api(api_name, method, **params):
-    args = ['/usr/syno/bin/synowebapi','--exec','api='+api_name,'method='+method,'version=1']
-    args += [k+'='+json.dumps(v) for k,v in params.items()]
-    r = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)
-    return json.loads(r.stdout)
-
-def call(op, params=None, cookie=None, peer='p2probepkg'):
-    req = {'v':1,'op':op,'params':params or {}}
-    if cookie: req['auth'] = {'dsm_cookie':cookie,'dsm_synotoken':next((v['synotoken'] for v in sessions.values() if v['sid']==cookie),'')}
-    # Launch a disposable package-uid client, with no root client shortcut.
-    u = pwd.getpwnam(peer)
-    def identity():
-        os.setgroups(os.getgrouplist(peer,u.pw_gid));os.setgid(u.pw_gid);os.setuid(u.pw_uid)
-    script = 'import socket,sys;s=socket.socket(socket.AF_UNIX);s.settimeout(35);s.connect(sys.argv[1]);s.sendall(sys.stdin.buffer.read());print(s.recv(1048576).decode())'
-    r = subprocess.run(['/usr/bin/python3','-c',script,SOCK],input=(json.dumps(req)+'\n').encode(),stdout=subprocess.PIPE,stderr=subprocess.PIPE,preexec_fn=identity)
-    raw = r.stdout.decode().strip()
-    return json.loads(raw) if raw else {'closed':True}
-
-def check(label, response, code=None):
-    print(json.dumps({'scenario':label,'response':response}),flush=True)
-    assert response.get('ok') if code is None else response.get('code')==code, label
-
-def create(cookie, path='/home'):
-    r=call('delegate.create',{'job_id':'p2probejob','ops':['files.write','files.list','files.info','files.createFolder','files.checkPermission'],'scope':'home','path':path,'ttl_seconds':600},cookie)
-    check('delegate.create '+path,r)
-    return r['result']['delegation_id']
-
-try:
-    alice=login('p2probe1');bob=login('p2probe2');admin=login('p2probeadm')
-    check('status',call('status'))
-    denied=call('status',peer='p2probe2');print(json.dumps({'scenario':'wrong peer','response':denied}));assert denied.get('closed')
-    delegation=create(alice)
-    p={'delegation_id':delegation,'job_id':'p2probejob','staging':'p2probe-source','dest_dir':'/home','name':'p2probe-output'}
-    STAGE.joinpath('p2probe-source').write_text('P2 executor content\n')
-    os.chown(str(STAGE/'p2probe-source'),pwd.getpwnam('p2probepkg').pw_uid,pwd.getpwnam('p2probepkg').pw_gid)
-    check('files.write own home',call('files.write',p))
-    out=pathlib.Path('/var/services/homes/p2probe1/p2probe-output');st=out.stat();assert st.st_uid==pwd.getpwnam('p2probe1').pw_uid
-    print(json.dumps({'scenario':'owner','uid':st.st_uid,'gid':st.st_gid,'mode':oct(st.st_mode&0o777),'content':out.read_text()}))
-    acl=subprocess.run(['/usr/syno/bin/synoacltool','-get',str(out)],stdout=subprocess.PIPE,stderr=subprocess.STDOUT).stdout.decode()
-    print(json.dumps({'scenario':'ACL readback','acl':acl}))
-    assert 'inherited' in acl.lower() or 'level:1' in acl.lower() or 'level: 1' in acl.lower(), 'ACL did not inherit'
-    STAGE.joinpath('p2probe-source').write_text('must not overwrite')
-    os.chown(str(STAGE/'p2probe-source'),pwd.getpwnam('p2probepkg').pw_uid,pwd.getpwnam('p2probepkg').pw_gid)
-    check('no overwrite',call('files.write',p),'WRITE_FAILED');assert out.read_text()=='P2 executor content\n'
-    check('other home',call('files.write',dict(p,dest_dir='/homes/p2probe2')),'SCOPE_DENIED')
-    home=pathlib.Path('/var/services/homes/p2probe1');(home/'p2probe-escape').symlink_to('/var/services/homes/p2probe2',target_is_directory=True)
-    check('symlink escape',call('files.write',dict(p,dest_dir='/home/p2probe-escape')),'SCOPE_DENIED')
-    check('cross job',call('files.write',dict(p,job_id='other')),'DELEGATION_DENIED')
-    check('admin runner',call('delegate.create',{'job_id':'j','ops':['files.list'],'scope':'home','path':'/home','ttl_seconds':30},admin),'INELIGIBLE')
-    check('root.run admin',call('root.run',{'name':'whoami'},admin))
-    check('root.run regular',call('root.run',{'name':'whoami'},alice),'ADMIN_REQUIRED')
-    check('files.list',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}))
-    check('files.info',call('files.info',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home/p2probe-output'}))
-    check('files.createFolder',call('files.createFolder',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home','name':'p2probe-folder'}))
-    check('files.checkPermission',call('files.checkPermission',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}))
-    # Mutate only disposable identities/privileges, then restore and read back.
-    r=run_api('SYNO.Core.User','set',name='p2probe1',expired='now');assert r.get('success')
-    check('disabled runner',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}),'INELIGIBLE')
-    assert run_api('SYNO.Core.User','set',name='p2probe1',expired='normal').get('success')
-    rules=[{'entity_type':'user','entity_name':'p2probe1','app_id':'SYNO.SDS.App.FileStation3.Instance','deny_ip':['0.0.0.0']}]
-    assert run_api('SYNO.Core.AppPriv.Rule','set',rules=rules).get('success')
-    check('AppPriv deny',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}),'APP_DENIED')
-    assert run_api('SYNO.Core.AppPriv.Rule','delete',rules=[{'entity_type':'user','entity_name':'p2probe1','app_id':'SYNO.SDS.App.FileStation3.Instance'}]).get('success')
-    check('revoke',call('delegate.revoke',{'delegation_id':delegation,'job_id':'p2probejob'}))
-    check('revoked',call('files.list',{'delegation_id':delegation,'job_id':'p2probejob','path':'/home'}),'DELEGATION_DENIED')
-    # Deleted account with a root-only delegation: success-empty DSM data is insufficient.
-    d=create(bob)
-    subprocess.run(['/usr/syno/sbin/synouser','--del','p2probe2'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
-    check('deleted runner',call('files.list',{'delegation_id':d,'job_id':'p2probejob','path':'/home'}),'INELIGIBLE')
-finally:
-    for session in sessions.values():
-        sid=session['sid']
-        try:api({'api':'SYNO.API.Auth','version':'7','method':'logout','_sid':sid})
-        except Exception:pass

package/templates/_executor/upgrade_watch_test.go

@@ -1,244 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"synopkgland/executor/internal/lifecycle"
-)
-
-func TestUpgradeGapPreservesRuntimeAndResumesOnlyApprovedPins(t *testing.T) {
-	for _, gap := range []string{"directory", "INFO"} {
-		for _, mode := range []string{"same pins", "new policy", "upgrade stop"} {
-			t.Run(gap+"/"+mode, func(t *testing.T) {
-				root := realTestPath(t, t.TempDir())
-				pkg := filepath.Join(root, "package")
-				target := filepath.Join(pkg, "target", "executor")
-				data := filepath.Join(root, "data")
-				state := filepath.Join(root, "protected")
-				sockDir := filepath.Join(root, "socket")
-				socket := filepath.Join(sockDir, "s")
-				for _, dir := range []string{target, filepath.Join(data, "executor"), filepath.Join(state, "runtime"), filepath.Join(state, "delegations"), sockDir} {
-					if err := os.MkdirAll(dir, 0700); err != nil {
-						t.Fatal(err)
-					}
-				}
-				write := func(path, text string) {
-					t.Helper()
-					if err := os.WriteFile(path, []byte(text), 0600); err != nil {
-						t.Fatal(err)
-					}
-				}
-				info := filepath.Join(pkg, "INFO")
-				write(info, "package=\"TestApp\"\n")
-				write(filepath.Join(target, "executor"), "approved executable")
-				write(filepath.Join(target, "policy.json"), "approved policy")
-				markers := []string{filepath.Join(state, "runtime", "tasks.json"), filepath.Join(state, "delegations", "grant")}
-				for _, marker := range markers {
-					write(marker, "retained")
-				}
-				ed, err := digestFile(context.Background(), filepath.Join(target, "executor"), maxExecutorBytes)
-				if err != nil {
-					t.Fatal(err)
-				}
-				pd, err := digestFile(context.Background(), filepath.Join(target, "policy.json"), maxPolicyBytes)
-				if err != nil {
-					t.Fatal(err)
-				}
-				control := filepath.Join(data, "executor", "control")
-				write(control, "start\n")
-				m := newLifecycleMonitor("TestApp", pkg, control, func(string) {})
-				ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-				defer cancel()
-				actions := make(chan string)
-				var opened, closed, purged atomic.Int32
-				approval := make(chan struct{}, 1)
-				done := make(chan error, 1)
-				finished := make(chan struct{})
-				go func() {
-					defer close(finished)
-					done <- manageService(ctx, actions, func() (func(), error) {
-						listener, err := net.Listen("unix", socket)
-						if err != nil {
-							return nil, err
-						}
-						opened.Add(1)
-						return func() { listener.Close(); closed.Add(1) }, nil
-					}, func(ctx context.Context) bool {
-						// The production decision: only differing pins ask for approval.
-						pins := packagePins(ctx, target, info, func(os.FileInfo) bool { return true }, ed, pd)
-						return approvedPins(pins, func() error { return errors.New("no anchored upgrade here") }, func() error { return nil }, func(message string) {
-							if strings.Contains(message, "administrator approval") {
-								select {
-								case approval <- struct{}{}:
-								default:
-								}
-							}
-						})
-					}, func() error {
-						purged.Add(1)
-						return finishControl(state, filepath.Join(state, "runtime"), sockDir, true)
-					})
-				}()
-				t.Cleanup(func() {
-					cancel()
-					select {
-					case <-finished:
-					case <-time.After(time.Second):
-						t.Error("service did not exit")
-					}
-				})
-				await := func(value *atomic.Int32, want int32) {
-					t.Helper()
-					for value.Load() != want {
-						select {
-						case <-ctx.Done():
-							t.Fatal("service timeout")
-						case <-time.After(time.Millisecond):
-						}
-					}
-				}
-				send := func(action string) {
-					t.Helper()
-					select {
-					case actions <- action:
-					case <-ctx.Done():
-						t.Fatal("action timeout")
-					}
-				}
-				start := time.Unix(1000, 0)
-				if action := observeLifecycle(t, m, start); action != "start" {
-					t.Fatal(action)
-				} else {
-					send(action)
-				}
-				await(&opened, 1)
-				if mode == "upgrade stop" {
-					write(control, "stop\n")
-					if action := observeLifecycle(t, m, start); action != "stop" {
-						t.Fatal(action)
-					} else {
-						send(action)
-					}
-					await(&closed, 1)
-				}
-				if gap == "directory" {
-					if err := os.Rename(pkg, pkg+".upgrade"); err != nil {
-						t.Fatal(err)
-					}
-				} else if err := os.Remove(info); err != nil {
-					t.Fatal(err)
-				}
-				if action := observeLifecycle(t, m, start); action != "stop" {
-					t.Fatal("gap did not pause", action)
-				} else {
-					send(action)
-				}
-				await(&closed, 1)
-				if conn, err := net.Dial("unix", socket); err == nil {
-					conn.Close()
-					t.Fatal("gap accepted a connection")
-				}
-				if action := observeLifecycle(t, m, start.Add(9*time.Minute)); action != "stop" {
-					t.Fatal("gap resumed or purged", action)
-				}
-				if gap == "directory" {
-					if err := os.Rename(pkg+".upgrade", pkg); err != nil {
-						t.Fatal(err)
-					}
-				} else {
-					write(info, "package=\"TestApp\"\n")
-				}
-				if mode != "same pins" {
-					write(filepath.Join(target, "policy.json"), "new unapproved policy")
-				}
-				want := "start"
-				if mode == "upgrade stop" {
-					want = "stop"
-				}
-				if action := observeLifecycle(t, m, start.Add(9*time.Minute)); action != want {
-					t.Fatalf("reappeared: got %q, want %q", action, want)
-				} else {
-					send(action)
-				}
-				if mode == "same pins" {
-					await(&opened, 2)
-					conn, err := net.Dial("unix", socket)
-					if err != nil {
-						t.Fatal("approved socket did not recover", err)
-					}
-					conn.Close()
-				} else {
-					if mode == "new policy" {
-						select {
-						case <-approval:
-						case <-ctx.Done():
-							t.Fatal("no approval-required result")
-						}
-					}
-					if _, err := os.Stat(socket); !os.IsNotExist(err) {
-						t.Fatal("unapproved socket exposed", err)
-					}
-				}
-				if purged.Load() != 0 {
-					t.Fatal("upgrade purged state")
-				}
-				for _, marker := range markers {
-					if _, err := os.Stat(marker); err != nil {
-						t.Fatal("upgrade lost retained state", err)
-					}
-				}
-				// The real package-account helper writes the preuninst purge mailbox.
-				hookDone := make(chan error, 1)
-				go func() {
-					hookDone <- lifecycle.Run(ctx, lifecycle.Config{Package: "TestApp", Data: data, Socket: socket}, "purge")
-				}()
-				for {
-					b, err := os.ReadFile(control)
-					if err == nil && string(b) == "purge\n" {
-						break
-					}
-					select {
-					case <-ctx.Done():
-						t.Fatal("preuninst mailbox timeout")
-					case <-time.After(time.Millisecond):
-					}
-				}
-				if action := observeLifecycle(t, m, start.Add(9*time.Minute)); action != "purge" {
-					t.Fatal("preuninst purge delayed", action)
-				} else {
-					send(action)
-				}
-				select {
-				case err := <-hookDone:
-					if err != nil {
-						t.Fatal(err)
-					}
-				case <-ctx.Done():
-					t.Fatal("preuninst timeout")
-				}
-				await(&purged, 1)
-				select {
-				case err := <-done:
-					if err != nil {
-						t.Fatal(err)
-					}
-				case <-ctx.Done():
-					t.Fatal("purge timeout")
-				}
-				for _, path := range []string{state, sockDir} {
-					if _, err := os.Stat(path); !os.IsNotExist(err) {
-						t.Fatal("purge remnant", path, err)
-					}
-				}
-			})
-		}
-	}
-}

package/templates/_executor/watch.go

@@ -1,164 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-type lifecycleMonitor struct {
-	pkg, packageDir, control string
-	initialStop              os.FileInfo
-	lastControl              os.FileInfo
-	lastValue                string
-	log                      func(string)
-	now                      func() time.Time
-	missingSince             time.Time
-	unavailable              bool
-}
-
-const missingPackageGrace = 10 * time.Minute
-
-func newLifecycleMonitor(pkg, packageDir, control string, log func(string)) *lifecycleMonitor {
-	m := &lifecycleMonitor{pkg: pkg, packageDir: packageDir, control: control, log: log, now: time.Now}
-	// An approved boot/admin start resumes a previous stop. Capture before the
-	// socket is exposed; every subsequent atomic request has a different inode.
-	if b, info, err := readLifecycleFile(control, 64); err == nil && (string(b) == "stop\n" || string(b) == "stop") {
-		m.initialStop = info
-	}
-	return m
-}
-
-// A supervisor restart carries no new approval, so a stop already in the
-// mailbox stays in force.
-func newRevivedLifecycleMonitor(pkg, packageDir, control string, log func(string)) *lifecycleMonitor {
-	m := newLifecycleMonitor(pkg, packageDir, control, log)
-	m.initialStop = nil
-	return m
-}
-
-// DSM's var link is expected. Resolve its parent, then reject final symlinks,
-// FIFOs and oversized input. Linux openRegular pins all resolved components.
-func readLifecycleFile(path string, limit int) ([]byte, os.FileInfo, error) {
-	parent, err := filepath.EvalSymlinks(filepath.Dir(path))
-	if err != nil {
-		return nil, nil, err
-	}
-	f, err := openRegular(filepath.Join(parent, filepath.Base(path)))
-	if err != nil {
-		return nil, nil, err
-	}
-	defer f.Close()
-	info, err := f.Stat()
-	if err != nil {
-		return nil, nil, err
-	}
-	b, err := readLimited(f, limit)
-	return b, info, err
-}
-func (m *lifecycleMonitor) watch(ctx context.Context, interval time.Duration) string {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	lastIssue := ""
-	lastInvalid := ""
-	report := func(issue string) {
-		if issue != lastIssue {
-			m.log(issue)
-		}
-		lastIssue = issue
-	}
-	for {
-		now := m.now()
-		available, missing := false, false
-		info, err := os.Stat(m.packageDir)
-		if os.IsNotExist(err) || err == nil && !info.IsDir() {
-			missing = true
-		} else if err != nil {
-			report("cannot inspect package directory")
-		} else {
-			b, _, err := readLifecycleFile(filepath.Join(m.packageDir, "INFO"), 65536)
-			if os.IsNotExist(err) {
-				missing = true
-			} else if err != nil {
-				report("cannot read package INFO")
-			} else {
-				matches, mismatch := 0, false
-				for _, line := range strings.Split(string(b), "\n") {
-					if strings.HasPrefix(line, "package=") {
-						if line != "package=\""+m.pkg+"\"" {
-							mismatch = true
-						}
-						matches++
-					}
-				}
-				available = matches == 1 && !mismatch
-				missing = !available
-			}
-		}
-		// Keep this timestamp on the monitor: watch returns for actions while
-		// the root process continues polling, including when already paused.
-		if missing {
-			if m.missingSince.IsZero() {
-				m.missingSince = now
-			}
-		} else {
-			// An unreadable path cannot confirm continuous absence either.
-			m.missingSince = time.Time{}
-		}
-		if available && m.unavailable {
-			m.unavailable = false
-			// The listener was paused independently of the mailbox. Re-read
-			// even an unchanged start, and honor a stop captured before boot.
-			m.lastControl = nil
-			m.lastValue = ""
-			m.initialStop = nil
-		}
-		b, controlInfo, controlErr := readLifecycleFile(m.control, 64)
-		if controlErr == nil {
-			action := strings.TrimSuffix(string(b), "\n")
-			switch action {
-			case "purge":
-				m.log("lifecycle control: purge")
-				return "purge"
-			case "stop", "start":
-				if !available {
-					break
-				}
-				if m.lastControl != nil && os.SameFile(m.lastControl, controlInfo) && m.lastControl.ModTime().Equal(controlInfo.ModTime()) && m.lastValue == action {
-					break
-				}
-				old := m.initialStop
-				if action == "start" || old == nil || !os.SameFile(old, controlInfo) || !old.ModTime().Equal(controlInfo.ModTime()) || old.Size() != controlInfo.Size() {
-					m.lastControl = controlInfo
-					m.lastValue = action
-					m.log("lifecycle control: " + action)
-					return action
-				}
-			default:
-				if string(b) != lastInvalid || lastInvalid == "" {
-					m.log(fmt.Sprintf("ignored invalid lifecycle control (%d bytes)", len(b)))
-				}
-				lastInvalid = string(b)
-			}
-		} else if !os.IsNotExist(controlErr) {
-			report("ignored unreadable lifecycle control")
-		}
-		if missing && now.Sub(m.missingSince) >= missingPackageGrace {
-			m.log("package identity absent for 10 minutes: purge")
-			return "purge"
-		}
-		if !available && !m.unavailable {
-			m.unavailable = true
-			m.log("package identity unavailable: paused")
-			return "stop"
-		}
-		select {
-		case <-ctx.Done():
-			return "stop"
-		case <-ticker.C:
-		}
-	}
-}