@synopackageland/cli 0.8.0 → 0.9.1

package/dist/templates/_executor/path_test.go

@@ -1,35 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func realTestPath(t *testing.T, p string) string {
-	t.Helper()
-	p, err := filepath.EvalSymlinks(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return p
-}
-func makeTestDir(p string) error { return os.Mkdir(p, 0700) }
-
-// DSM links /var/packages/<pkg>/target to the volume. Every platform must
-// refuse a symlinked ancestor so tests catch callers that skip EvalSymlinks.
-func TestOpenRegularRefusesASymlinkedAncestor(t *testing.T) {
-	dir := realTestPath(t, t.TempDir())
-	os.MkdirAll(filepath.Join(dir, "appstore"), 0755)
-	os.WriteFile(filepath.Join(dir, "appstore", "executor"), []byte("x"), 0755)
-	os.Symlink(filepath.Join(dir, "appstore"), filepath.Join(dir, "target"))
-	if f, err := openRegular(filepath.Join(dir, "target", "executor")); err == nil {
-		f.Close()
-		t.Fatal("symlinked ancestor accepted")
-	}
-	f, err := openRegular(filepath.Join(dir, "appstore", "executor"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	f.Close()
-}

package/dist/templates/_executor/pid.go

@@ -1,37 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-)
-
-// approvedExecutable reports whether a /proc/<pid>/exe link and the inode it
-// runs (stat of that link) belong to an executor root installed in runtime.
-// The inode decides, not the name: kernel 3.10 (DSM 7.1) names a
-// rename-replaced inode after the rename source, so a monitor whose executor
-// was replaced reads as .executor (control.sh) or .executor-* (installAnchored)
-// "(deleted)". Only root writes runtime (root:root 0700), and a replaced inode
-// must be unlinked on the runtime's device.
-func approvedExecutable(link string, running os.FileInfo, runtime string, trusted func(os.FileInfo) bool) bool {
-	name, deleted := strings.CutSuffix(link, " (deleted)")
-	base := filepath.Base(name)
-	if filepath.Dir(name) != runtime || (base != "executor" && !strings.HasPrefix(base, ".executor")) {
-		return false
-	}
-	if !running.Mode().IsRegular() || !trusted(running) {
-		return false
-	}
-	if !deleted {
-		current, err := os.Lstat(filepath.Join(runtime, "executor"))
-		return err == nil && os.SameFile(running, current)
-	}
-	dir, err := os.Stat(runtime)
-	if err != nil {
-		return false
-	}
-	st, ok := running.Sys().(*syscall.Stat_t)
-	dt, dirOK := dir.Sys().(*syscall.Stat_t)
-	return ok && dirOK && st.Nlink == 0 && st.Dev == dt.Dev
-}

package/dist/templates/_executor/pid_test.go

@@ -1,113 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// runningExecutor installs runtime/executor and keeps it open, as a live monitor.
-func runningExecutor(t *testing.T) (string, *os.File) {
-	t.Helper()
-	runtime := t.TempDir()
-	path := filepath.Join(runtime, "executor")
-	if err := os.WriteFile(path, []byte("old"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	f, err := os.Open(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { f.Close() })
-	return runtime, f
-}
-
-// replaceExecutor renames a new copy over runtime/executor, as control.sh and
-// installAnchored do; the running inode is unlinked.
-func replaceExecutor(t *testing.T, runtime, staged string) {
-	t.Helper()
-	if err := os.WriteFile(filepath.Join(runtime, staged), []byte("new"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Rename(filepath.Join(runtime, staged), filepath.Join(runtime, "executor")); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func stat(t *testing.T, f *os.File) os.FileInfo {
-	t.Helper()
-	info, err := f.Stat()
-	if err != nil {
-		t.Fatal(err)
-	}
-	return info
-}
-
-func TestApprovedExecutableAcceptsTheLiveRuntimeExecutor(t *testing.T) {
-	runtime, f := runningExecutor(t)
-	if !approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, trustAll) {
-		t.Fatal("live runtime executor refused")
-	}
-}
-
-// Kernel 3.10 (DSM 7.1 armv7) names a rename-replaced inode after the rename
-// source: control.sh stages .executor, installAnchored stages .executor-*.
-func TestApprovedExecutableAcceptsAReplacedExecutorUnderItsSwappedName(t *testing.T) {
-	for _, staged := range []string{".executor", ".executor-123456"} {
-		runtime, f := runningExecutor(t)
-		replaceExecutor(t, runtime, staged)
-		for _, name := range []string{staged, "executor"} {
-			link := filepath.Join(runtime, name) + " (deleted)"
-			if !approvedExecutable(link, stat(t, f), runtime, trustAll) {
-				t.Fatalf("replaced executor refused: %s", link)
-			}
-		}
-	}
-}
-
-func TestApprovedExecutableRefusesAnotherInode(t *testing.T) {
-	runtime, _ := runningExecutor(t)
-	other := filepath.Join(runtime, ".executor")
-	if err := os.WriteFile(other, []byte("other"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	f, err := os.Open(other)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	running := stat(t, f)
-	// Still linked: not the installed executor, whatever the link claims.
-	for _, link := range []string{other, other + " (deleted)", filepath.Join(runtime, "executor"), filepath.Join(runtime, "executor") + " (deleted)"} {
-		if approvedExecutable(link, running, runtime, trustAll) {
-			t.Fatalf("linked non-executor accepted as %s", link)
-		}
-	}
-}
-
-func TestApprovedExecutableRefusesAnUnlinkedInodeOutsideTheRuntime(t *testing.T) {
-	runtime, f := runningExecutor(t)
-	replaceExecutor(t, runtime, ".executor")
-	running := stat(t, f)
-	for _, link := range []string{
-		filepath.Join(t.TempDir(), "executor") + " (deleted)",
-		filepath.Join(runtime, "sh") + " (deleted)",
-		filepath.Join(runtime, ".executor"), // unlinked yet not reported deleted
-	} {
-		if approvedExecutable(link, running, runtime, trustAll) {
-			t.Fatalf("unlinked inode accepted as %s", link)
-		}
-	}
-}
-
-func TestApprovedExecutableRefusesAnUntrustedInode(t *testing.T) {
-	runtime, f := runningExecutor(t)
-	refuse := func(os.FileInfo) bool { return false }
-	if approvedExecutable(filepath.Join(runtime, "executor"), stat(t, f), runtime, refuse) {
-		t.Fatal("untrusted live executor accepted")
-	}
-	replaceExecutor(t, runtime, ".executor")
-	if approvedExecutable(filepath.Join(runtime, ".executor")+" (deleted)", stat(t, f), runtime, refuse) {
-		t.Fatal("untrusted replaced executor accepted")
-	}
-}

package/dist/templates/_executor/platform_linux.go

@@ -1,187 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"os/exec"
-	"strings"
-	"syscall"
-)
-
-func ownedByRoot(info os.FileInfo) bool {
-	st, ok := info.Sys().(*syscall.Stat_t)
-	return ok && st.Uid == 0
-}
-
-// O_PATH allows fstat on the bound filesystem socket inode, rather than the
-// anonymous socket descriptor (which has different metadata).
-func verifySocket(path string, uid, gid int, mode os.FileMode) error {
-	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), 0x200000, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	info, err := f.Stat()
-	if err != nil {
-		return err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || info.Mode()&os.ModeSocket == 0 || info.Mode().Perm() != mode || int(st.Uid) != uid || int(st.Gid) != gid {
-		return errors.New("socket permissions")
-	}
-	return nil
-}
-
-func configureProcess(cmd *exec.Cmd) {
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	cmd.Cancel = func() error {
-		if cmd.Process == nil {
-			return os.ErrProcessDone
-		}
-		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
-		if err == syscall.ESRCH {
-			return os.ErrProcessDone
-		}
-		return err
-	}
-}
-func peerUID(c net.Conn) (int, error) {
-	u, ok := c.(*net.UnixConn)
-	if !ok {
-		return -1, errors.New("unix peer")
-	}
-	raw, err := u.SyscallConn()
-	if err != nil {
-		return -1, err
-	}
-	uid := -1
-	var sockErr error
-	err = raw.Control(func(fd uintptr) {
-		cred, e := syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
-		sockErr = e
-		if e == nil {
-			uid = int(cred.Uid)
-		}
-	})
-	if err != nil {
-		return -1, err
-	}
-	return uid, sockErr
-}
-
-// openBeneath rejects symlinks in every untrusted component, including parent
-// directories. Directory descriptors pin the lookup despite concurrent renames.
-func openBeneath(root, relative string, flags int, mode uint32) (*os.File, error) {
-	if !validRelative(relative) {
-		return nil, errors.New("relative path")
-	}
-	var dir *os.File
-	var err error
-	if root == "/" {
-		dir, err = os.Open(root)
-	} else if cleanPath(root) {
-		dir, err = openBeneath("/", strings.TrimPrefix(root, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
-	} else {
-		return nil, errors.New("root path")
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer func() { dir.Close() }()
-	parts := strings.Split(relative, "/")
-	for i, part := range parts {
-		f := flags
-		if i < len(parts)-1 {
-			f = 0x200000 | syscall.O_DIRECTORY // O_PATH: ancestor requires search, not listing rights
-		}
-		fd, err := syscall.Openat(int(dir.Fd()), part, f|syscall.O_NOFOLLOW|syscall.O_CLOEXEC|syscall.O_NONBLOCK, mode)
-		if err != nil {
-			return nil, err
-		}
-		next := os.NewFile(uintptr(fd), part)
-		if i == len(parts)-1 {
-			return next, nil
-		}
-		dir.Close()
-		dir = next
-	}
-	return nil, errors.New("path")
-}
-func openRegular(path string) (*os.File, error) {
-	if !cleanPath(path) {
-		return nil, errors.New("path")
-	}
-	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY, 0)
-	if err != nil {
-		return nil, err
-	}
-	info, err := f.Stat()
-	if err != nil || !info.Mode().IsRegular() {
-		f.Close()
-		return nil, errors.New("regular file required")
-	}
-	return f, nil
-}
-
-type subprocessWriter struct {
-	Staging, Executable    string
-	PackageUID, PackageGID int
-}
-
-func (w subprocessWriter) Write(ctx context.Context, s Subject, staging, dest, name, root string) error {
-	job, _ := ctx.Value(writeJobKey{}).(string)
-	f, _, err := w.openSource(staging)
-	if err != nil {
-		return err
-	}
-	info, err := f.Stat()
-	f.Close()
-	if err != nil {
-		return err
-	}
-	di, err := bindDirectory(dest)
-	if err != nil {
-		return err
-	}
-	guard, _ := ctx.Value(legacyPublishKey{}).(func(func() (MoveReceipt, error)) (MoveReceipt, error))
-	if guard == nil {
-		guard = func(publish func() (MoveReceipt, error)) (MoveReceipt, error) { return publish() }
-	}
-	_, err = w.Move(ctx, s, Operation{Job: job, Name: name, Staging: staging, Size: info.Size()}, Delegation{Root: dest, Directory: di}, guard)
-	return err
-}
-
-type realIdentity struct{}
-
-func (realIdentity) Setgroups(gs []int) error    { return syscall.Setgroups(gs) }
-func (realIdentity) Setresgid(a, b, c int) error { return syscall.Setresgid(a, b, c) }
-func (realIdentity) Setresuid(a, b, c int) error { return syscall.Setresuid(a, b, c) }
-func (realIdentity) IDs() (int, int, int, int) {
-	return os.Getuid(), os.Geteuid(), os.Getgid(), os.Getegid()
-}
-func (realIdentity) Groups() ([]int, error) { return os.Getgroups() }
-func validTemporary(name string) bool {
-	return validName(name) && strings.HasPrefix(name, ".synopkgland-") && strings.HasSuffix(name, ".part")
-}
-func lockFile(f *os.File) error { return syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) }
-
-func bindDirectory(path string) (directoryIdentity, error) {
-	f, err := openBeneath("/", strings.TrimPrefix(path, "/"), syscall.O_RDONLY|syscall.O_DIRECTORY, 0)
-	if err != nil {
-		return directoryIdentity{}, err
-	}
-	defer f.Close()
-	info, err := f.Stat()
-	if err != nil {
-		return directoryIdentity{}, err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || !info.IsDir() {
-		return directoryIdentity{}, errors.New("directory")
-	}
-	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
-}

package/dist/templates/_executor/platform_linux_test.go

@@ -1,191 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-type switchStub struct {
-	calls []string
-	fail  string
-	s     Subject
-	wrong bool
-}
-
-func (s *switchStub) step(name string) error {
-	s.calls = append(s.calls, name)
-	if s.fail == name {
-		return errors.New("fail")
-	}
-	return nil
-}
-func (s *switchStub) Seal() error                    { return s.step("seal") }
-func (s *switchStub) VerifyPrivileges(Subject) error { return s.step("verify") }
-func (s *switchStub) Setgroups([]int) error          { return s.step("groups") }
-func (s *switchStub) Setresgid(int, int, int) error  { return s.step("gid") }
-func (s *switchStub) Setresuid(int, int, int) error  { return s.step("uid") }
-func (s *switchStub) IDs() (int, int, int, int) {
-	if s.wrong {
-		return 0, 0, 0, 0
-	}
-	return s.s.UID, s.s.UID, s.s.GID, s.s.GID
-}
-func (s *switchStub) Groups() ([]int, error) { return s.s.Groups, nil }
-func TestDropOrderAndFailures(t *testing.T) {
-	subject := Subject{UID: 1200, GID: 100, Groups: []int{100, 123}}
-	for _, fail := range []string{"", "seal", "groups", "gid", "uid", "verify"} {
-		s := &switchStub{fail: fail, s: subject}
-		err := dropSealedIdentity(s, subject)
-		if (err == nil) != (fail == "") {
-			t.Fatal(err)
-		}
-		expected := []string{"seal", "groups", "gid", "uid", "verify"}
-		if fail != "" {
-			for i, n := range expected {
-				if n == fail {
-					expected = expected[:i+1]
-					break
-				}
-			}
-		}
-		if !reflect.DeepEqual(s.calls, expected) {
-			t.Fatal(s.calls)
-		}
-	}
-	s := &switchStub{s: subject, wrong: true}
-	if dropSealedIdentity(s, subject) == nil {
-		t.Fatal("identity not verified")
-	}
-}
-func TestLinuxStagingSymlinks(t *testing.T) {
-	root := t.TempDir()
-	outside := t.TempDir()
-	os.WriteFile(filepath.Join(outside, "source"), []byte("secret"), 0600)
-	os.Symlink(outside, filepath.Join(root, "escape"))
-	os.Symlink(filepath.Join(outside, "source"), filepath.Join(root, "file"))
-	for _, p := range []string{"escape/source", "file", "../source"} {
-		if f, err := openBeneath(root, p, syscall.O_RDONLY, 0); err == nil {
-			f.Close()
-			t.Fatal("symlink", p)
-		}
-	}
-}
-func TestLinuxPeerCredential(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "sock")
-	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer ln.Close()
-	done := make(chan error, 1)
-	go func() {
-		c, err := ln.AcceptUnix()
-		if err != nil {
-			done <- err
-			return
-		}
-		defer c.Close()
-		uid, err := peerUID(c)
-		if err == nil && uid != os.Getuid() {
-			err = errors.New("uid mismatch")
-		}
-		done <- err
-	}()
-	c, err := net.Dial("unix", path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	c.Close()
-	if err = <-done; err != nil {
-		t.Fatal(err)
-	}
-}
-func TestLinuxPIDLock(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "pid")
-	a, _ := os.Create(path)
-	defer a.Close()
-	b, _ := os.OpenFile(path, os.O_RDWR, 0600)
-	defer b.Close()
-	if lockFile(a) != nil || lockFile(b) == nil {
-		t.Fatal("duplicate lock")
-	}
-}
-func TestScriptDigest(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root-owned script test")
-	}
-	root := t.TempDir()
-	os.Mkdir(filepath.Join(root, "root"), 0700)
-	p := filepath.Join(root, "root/whoami.sh")
-	os.WriteFile(p, []byte("echo p2probe\n"), 0600)
-	digest, err := digestFile(context.Background(), p, maxExecutorBytes)
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := scriptRunner{Dir: root}
-	out, err := r.Run(context.Background(), "whoami", digest)
-	if err != nil || strings.TrimSpace(out) != "p2probe" {
-		t.Fatal(out, err)
-	}
-	os.WriteFile(p, []byte("echo changed\n"), 0600)
-	if _, err = r.Run(context.Background(), "whoami", digest); err == nil {
-		t.Fatal("digest")
-	}
-}
-
-func TestLinuxStagingRootSymlink(t *testing.T) {
-	root, outside := t.TempDir(), t.TempDir()
-	os.WriteFile(filepath.Join(outside, "source"), []byte("secret"), 0600)
-	os.Symlink(outside, filepath.Join(root, "stage"))
-	if f, err := openBeneath(filepath.Join(root, "stage"), "source", syscall.O_RDONLY, 0); err == nil {
-		f.Close()
-		t.Fatal("staging root symlink accepted")
-	}
-}
-func TestLinuxStagingHardlinkAndOwner(t *testing.T) {
-	root := t.TempDir()
-	p := filepath.Join(root, "source")
-	os.WriteFile(p, []byte("secret"), 0600)
-	subject := Subject{UID: 1200, GID: 100, Groups: []int{100}}
-	w := subprocessWriter{Staging: root, Executable: "/must-not-execute", PackageUID: os.Getuid() + 1}
-	if err := w.Write(context.WithValue(context.Background(), writeJobKey{}, "job1"), subject, "source", root, "new", root); err == nil || !strings.Contains(err.Error(), "owner or hardlink") {
-		t.Fatal(err)
-	}
-	w.PackageUID = os.Getuid()
-	os.Link(p, filepath.Join(root, "linked"))
-	if err := w.Write(context.WithValue(context.Background(), writeJobKey{}, "job1"), subject, "source", root, "new", root); err == nil || !strings.Contains(err.Error(), "owner or hardlink") {
-		t.Fatal(err)
-	}
-}
-
-func TestScriptTimeoutAndOutputLimit(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root-owned script test")
-	}
-	dir := t.TempDir()
-	os.Mkdir(filepath.Join(dir, "root"), 0700)
-	p := filepath.Join(dir, "root/probe.sh")
-	r := scriptRunner{Dir: dir}
-	os.WriteFile(p, []byte("sleep 10\n"), 0600)
-	digest, _ := digestFile(context.Background(), p, maxExecutorBytes)
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
-	defer cancel()
-	if _, err := r.Run(ctx, "probe", digest); err == nil {
-		t.Fatal("timeout accepted")
-	}
-	os.WriteFile(p, []byte("head -c 1048577 /dev/zero\n"), 0600)
-	digest, _ = digestFile(context.Background(), p, maxExecutorBytes)
-	if _, err := r.Run(context.Background(), "probe", digest); err == nil {
-		t.Fatal("excessive output accepted")
-	}
-}

package/dist/templates/_executor/platform_other.go

@@ -1,76 +0,0 @@
-//go:build !linux
-
-package main
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"syscall"
-)
-
-func verifySocket(string, int, int, os.FileMode) error { return errLinux }
-
-var errLinux = errors.New("executor requires Linux")
-
-func ownedByRoot(os.FileInfo) bool  { return false }
-func configureProcess(*exec.Cmd)    {}
-func peerUID(net.Conn) (int, error) { return -1, errLinux }
-
-// Like Linux openBeneath, refuse a symlink in any component, not only the last.
-func openRegular(path string) (*os.File, error) {
-	for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
-		if info, err := os.Lstat(dir); err != nil || info.Mode()&os.ModeSymlink != 0 {
-			return nil, errors.New("path")
-		}
-	}
-	info, err := os.Lstat(path)
-	if err != nil {
-		return nil, err
-	}
-	if !info.Mode().IsRegular() {
-		return nil, errLinux
-	}
-	return os.Open(path)
-}
-
-type subprocessWriter struct {
-	Staging, Executable    string
-	PackageUID, PackageGID int
-}
-
-func (subprocessWriter) Write(context.Context, Subject, string, string, string, string) error {
-	return errLinux
-}
-func lockFile(*os.File) error { return errLinux }
-
-func bindDirectory(path string) (directoryIdentity, error) {
-	current := ""
-	for _, part := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
-		current += "/" + part
-		info, err := os.Lstat(current)
-		if err != nil {
-			return directoryIdentity{}, err
-		}
-		if !info.IsDir() {
-			return directoryIdentity{}, errLinux
-		}
-	}
-	info, err := os.Stat(path)
-	if err != nil {
-		return directoryIdentity{}, err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || !info.IsDir() {
-		return directoryIdentity{}, errLinux
-	}
-	return directoryIdentity{uint64(st.Dev), st.Ino}, nil
-}
-
-func runMoveChild() error          { return errLinux }
-func runPartCleanupChild() error   { return errLinux }
-func runSourceCleanupChild() error { return errLinux }