@wlfi-agent/cli 1.4.12 → 1.4.14

package/crates/vault-cli-daemon/src/main.rs

@@ -0,0 +1,644 @@
+use std::collections::BTreeSet;
+use std::io::Read;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use anyhow::{anyhow, bail, Context, Result};
+use clap::{Parser, ValueEnum};
+use vault_daemon::{DaemonConfig, InMemoryDaemon, PersistentStoreConfig};
+use vault_signer::{SecureEnclaveSignerBackend, SoftwareSignerBackend};
+use vault_transport_unix::UnixDaemonServer;
+use zeroize::Zeroize;
+
+mod relay_sync;
+
+const MAX_SECRET_STDIN_BYTES: u64 = 16 * 1024;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)]
+enum SignerBackendKind {
+    SecureEnclave,
+    Software,
+}
+
+#[derive(Debug, Parser)]
+#[command(name = "wlfi-agent-daemon")]
+#[command(about = "Long-running local daemon process for policy-gated signing")]
+struct Cli {
+    #[arg(
+        long,
+        default_value_t = false,
+        help = "Read vault password from stdin (trailing newlines are trimmed)"
+    )]
+    vault_password_stdin: bool,
+    #[arg(
+        long,
+        default_value_t = false,
+        help = "Do not prompt for password; require --vault-password-stdin"
+    )]
+    non_interactive: bool,
+    #[arg(
+        long,
+        env = "WLFI_STATE_FILE",
+        value_name = "PATH",
+        help = "Encrypted persistent daemon state file path (default: $WLFI_HOME/daemon-state.enc or ~/.wlfi_agent/daemon-state.enc)"
+    )]
+    state_file: Option<PathBuf>,
+    #[arg(
+        long,
+        env = "WLFI_DAEMON_SOCKET",
+        value_name = "PATH",
+        help = "Unix socket path for daemon RPC (default: $WLFI_HOME/daemon.sock or ~/.wlfi_agent/daemon.sock)"
+    )]
+    daemon_socket: Option<PathBuf>,
+    #[arg(
+        long,
+        env = "WLFI_SECURE_ENCLAVE_LABEL_PREFIX",
+        default_value = "com.wlfi.vault",
+        value_name = "PREFIX",
+        help = "Secure Enclave key label prefix"
+    )]
+    secure_enclave_label_prefix: String,
+    #[arg(
+        long,
+        env = "WLFI_SIGNER_BACKEND",
+        value_enum,
+        default_value_t = SignerBackendKind::SecureEnclave,
+        value_name = "secure-enclave|software",
+        help = "Signer backend for daemon key creation and signing"
+    )]
+    signer_backend: SignerBackendKind,
+    #[arg(
+        long = "allow-admin-euid",
+        env = "WLFI_ALLOW_ADMIN_EUID",
+        value_name = "UID[,UID...]",
+        value_delimiter = ',',
+        num_args = 1..,
+        help = "Additional non-root admin client euid(s) allowed to connect for privileged RPCs. Root (0) is always allowed."
+    )]
+    allow_admin_euid: Vec<u32>,
+    #[arg(
+        long = "allow-agent-euid",
+        env = "WLFI_ALLOW_AGENT_EUID",
+        value_name = "UID[,UID...]",
+        value_delimiter = ',',
+        num_args = 1..,
+        help = "Additional non-root agent client euid(s) allowed to connect for signing and nonce RPCs. Root (0) is always allowed."
+    )]
+    allow_agent_euid: Vec<u32>,
+    #[arg(
+        long = "allow-client-euid",
+        env = "WLFI_ALLOW_CLIENT_EUID",
+        value_name = "UID[,UID...]",
+        value_delimiter = ',',
+        num_args = 1..,
+        help = "Legacy compatibility alias that grants the same non-root client euid(s) both admin and agent access. Root (0) is always allowed."
+    )]
+    allow_client_euid: Vec<u32>,
+}
+
+#[derive(Debug, Clone)]
+struct AllowedPeerEuids {
+    admin: BTreeSet<u32>,
+    agent: BTreeSet<u32>,
+}
+
+struct StateFileLock {
+    #[cfg(unix)]
+    file: std::fs::File,
+}
+
+impl Drop for StateFileLock {
+    fn drop(&mut self) {
+        #[cfg(unix)]
+        {
+            use std::os::fd::AsRawFd;
+            // SAFETY: valid fd with best-effort unlock during drop.
+            unsafe {
+                let _ = libc::flock(self.file.as_raw_fd(), libc::LOCK_UN);
+            }
+        }
+    }
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let cli = Cli::parse();
+    validate_signer_backend_runtime(cli.signer_backend)?;
+    let mut vault_password = resolve_vault_password(cli.vault_password_stdin, cli.non_interactive)?;
+    let state_file = resolve_state_file_path(cli.state_file)?;
+    let daemon_socket = resolve_socket_path(cli.daemon_socket)?;
+    let _state_lock = acquire_state_file_lock(&state_file)?;
+
+    let allowed_peer_euids = resolve_allowed_peer_euids(
+        &cli.allow_admin_euid,
+        &cli.allow_agent_euid,
+        &cli.allow_client_euid,
+    )?;
+    if !cli.allow_client_euid.is_empty() {
+        eprintln!(
+            "==> warning: --allow-client-euid grants both admin and agent access; prefer --allow-admin-euid and --allow-agent-euid"
+        );
+    }
+    let server = UnixDaemonServer::bind_with_allowed_peer_euids(
+        daemon_socket.clone(),
+        allowed_peer_euids.admin.clone(),
+        allowed_peer_euids.agent.clone(),
+    )
+    .await
+    .with_context(|| {
+        format!(
+            "failed to bind daemon socket at {}",
+            daemon_socket.display()
+        )
+    })?;
+
+    eprintln!(
+        "==> daemon listening on {} (allowed admin euid(s): {}; allowed agent euid(s): {})",
+        daemon_socket.display(),
+        format_allowed_euids(&allowed_peer_euids.admin),
+        format_allowed_euids(&allowed_peer_euids.agent)
+    );
+    eprintln!("==> press Ctrl+C to stop");
+
+    match cli.signer_backend {
+        SignerBackendKind::SecureEnclave => {
+            let daemon = Arc::new(
+                InMemoryDaemon::new_with_persistent_store(
+                    &vault_password,
+                    SecureEnclaveSignerBackend::new(cli.secure_enclave_label_prefix),
+                    DaemonConfig::default(),
+                    PersistentStoreConfig::new(state_file),
+                )
+                .context("failed to initialize daemon")?,
+            );
+            let relay_task =
+                relay_sync::spawn_relay_sync_task(Arc::clone(&daemon), "secure-enclave");
+            vault_password.zeroize();
+            server
+                .run_until_shutdown(daemon, async {
+                    let _ = tokio::signal::ctrl_c().await;
+                    relay_task.abort();
+                })
+                .await
+                .context("daemon server loop failed")?;
+        }
+        SignerBackendKind::Software => {
+            let daemon = Arc::new(
+                InMemoryDaemon::new_with_persistent_store(
+                    &vault_password,
+                    SoftwareSignerBackend::default(),
+                    DaemonConfig::default(),
+                    PersistentStoreConfig::new(state_file),
+                )
+                .context("failed to initialize daemon")?,
+            );
+            let relay_task =
+                relay_sync::spawn_relay_sync_task(Arc::clone(&daemon), "secure-enclave");
+            vault_password.zeroize();
+            server
+                .run_until_shutdown(daemon, async {
+                    let _ = tokio::signal::ctrl_c().await;
+                    relay_task.abort();
+                })
+                .await
+                .context("daemon server loop failed")?;
+        }
+    }
+
+    Ok(())
+}
+
+fn validate_signer_backend_runtime(backend: SignerBackendKind) -> Result<()> {
+    #[cfg(not(target_os = "macos"))]
+    {
+        if matches!(backend, SignerBackendKind::SecureEnclave) {
+            bail!("Secure Enclave daemon mode is supported only on macOS");
+        }
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        let euid = nix::unistd::geteuid().as_raw();
+        if matches!(backend, SignerBackendKind::SecureEnclave) && euid != 0 {
+            bail!("secure enclave daemon mode requires root daemon context (current euid: {euid})");
+        }
+    }
+
+    Ok(())
+}
+
+fn resolve_vault_password(from_stdin: bool, non_interactive: bool) -> Result<String> {
+    if from_stdin {
+        return read_secret_from_reader(std::io::stdin(), "vault password");
+    }
+
+    if non_interactive {
+        bail!("vault password is required in non-interactive mode; use --vault-password-stdin");
+    }
+
+    let prompted =
+        rpassword::prompt_password("Vault password: ").context("failed to read password input")?;
+    validate_password(prompted, "prompt")
+}
+
+fn validate_password(mut password: String, source: &str) -> Result<String> {
+    if password.as_bytes().len() > MAX_SECRET_STDIN_BYTES as usize {
+        password.zeroize();
+        bail!("vault password from {source} must not exceed {MAX_SECRET_STDIN_BYTES} bytes");
+    }
+    if password.trim().is_empty() {
+        password.zeroize();
+        bail!("vault password from {source} must not be empty or whitespace");
+    }
+    Ok(password)
+}
+
+fn read_secret_from_reader(mut reader: impl std::io::Read, label: &str) -> Result<String> {
+    let mut raw = String::new();
+    reader
+        .by_ref()
+        .take(MAX_SECRET_STDIN_BYTES + 1)
+        .read_to_string(&mut raw)
+        .with_context(|| format!("failed to read {label} from stdin"))?;
+    if raw.as_bytes().len() > MAX_SECRET_STDIN_BYTES as usize {
+        raw.zeroize();
+        bail!("{label} must not exceed {MAX_SECRET_STDIN_BYTES} bytes");
+    }
+    let secret = raw.trim_end_matches(['\r', '\n']).to_string();
+    raw.zeroize();
+    validate_password(secret, "stdin")
+}
+
+fn resolve_allowed_peer_euids(
+    configured_admin: &[u32],
+    configured_agent: &[u32],
+    configured_legacy: &[u32],
+) -> Result<AllowedPeerEuids> {
+    resolve_allowed_peer_euids_with_sudo_uid(
+        configured_admin,
+        configured_agent,
+        configured_legacy,
+        None,
+    )
+}
+
+fn resolve_allowed_peer_euids_with_sudo_uid(
+    configured_admin: &[u32],
+    configured_agent: &[u32],
+    configured_legacy: &[u32],
+    _sudo_uid: Option<u32>,
+) -> Result<AllowedPeerEuids> {
+    let mut admin = BTreeSet::from([0]);
+    let mut agent = BTreeSet::from([0]);
+
+    admin.extend(configured_legacy.iter().copied());
+    admin.extend(configured_admin.iter().copied());
+    agent.extend(configured_legacy.iter().copied());
+    agent.extend(configured_agent.iter().copied());
+
+    Ok(AllowedPeerEuids { admin, agent })
+}
+
+fn format_allowed_euids(values: &BTreeSet<u32>) -> String {
+    values
+        .iter()
+        .map(ToString::to_string)
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+fn resolve_state_file_path(cli_value: Option<PathBuf>) -> Result<PathBuf> {
+    let path = match cli_value {
+        Some(path) => path,
+        None => default_state_file_path()?,
+    };
+    ensure_file_parent(&path, "state")?;
+    Ok(path)
+}
+
+fn resolve_socket_path(cli_value: Option<PathBuf>) -> Result<PathBuf> {
+    let path = match cli_value {
+        Some(path) => path,
+        None => default_socket_path()?,
+    };
+    ensure_file_parent(&path, "socket")?;
+    Ok(path)
+}
+
+fn acquire_state_file_lock(path: &Path) -> Result<StateFileLock> {
+    let lock_path = lock_path(path);
+    ensure_file_parent(&lock_path, "state lock")?;
+    let mut options = std::fs::OpenOptions::new();
+    options.read(true).write(true).create(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+        options.custom_flags(libc::O_NOFOLLOW);
+    }
+    let file = options
+        .open(&lock_path)
+        .with_context(|| format!("failed to open state lock file {}", lock_path.display()))?;
+    #[cfg(unix)]
+    {
+        use std::os::fd::AsRawFd;
+        // SAFETY: valid fd for advisory lock in-process lifetime.
+        unsafe {
+            if libc::flock(file.as_raw_fd(), libc::LOCK_EX) != 0 {
+                return Err(anyhow!(
+                    "failed to acquire state lock on {}",
+                    lock_path.display()
+                ));
+            }
+        }
+    }
+    Ok(StateFileLock {
+        #[cfg(unix)]
+        file,
+    })
+}
+
+fn default_state_file_path() -> Result<PathBuf> {
+    Ok(wlfi_home_dir()?.join("daemon-state.enc"))
+}
+
+fn default_socket_path() -> Result<PathBuf> {
+    Ok(wlfi_home_dir()?.join("daemon.sock"))
+}
+
+fn wlfi_home_dir() -> Result<PathBuf> {
+    if let Some(path) = std::env::var_os("WLFI_HOME") {
+        let candidate = PathBuf::from(path);
+        if candidate.as_os_str().is_empty() {
+            bail!("WLFI_HOME must not be empty");
+        }
+        return Ok(candidate);
+    }
+
+    let Some(home) = std::env::var_os("HOME") else {
+        bail!("HOME is not set; use WLFI_HOME to choose config directory");
+    };
+    let mut path = PathBuf::from(home);
+    path.push(".wlfi_agent");
+    Ok(path)
+}
+
+fn ensure_file_parent(path: &Path, label: &str) -> Result<()> {
+    if is_symlink(path)? {
+        bail!("{label} path '{}' must not be a symlink", path.display());
+    }
+    if let Some(parent) = path.parent() {
+        if !parent.as_os_str().is_empty() {
+            std::fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create directory {}", parent.display()))?;
+            if is_symlink(parent)? {
+                bail!(
+                    "{label} directory '{}' must not be a symlink",
+                    parent.display()
+                );
+            }
+            ensure_secure_directory_owner(parent, label)?;
+        }
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+fn assert_allowed_directory_owner(
+    path: &Path,
+    owner_uid: u32,
+    effective_uid: u32,
+    label: &str,
+) -> Result<()> {
+    if owner_uid == 0 {
+        return Ok(());
+    }
+
+    if effective_uid == 0 {
+        bail!(
+            "{label} directory '{}' must be owned by root; found uid {owner_uid}",
+            path.display()
+        );
+    }
+
+    if owner_uid != effective_uid {
+        bail!(
+            "{label} directory '{}' must be owned by current user or root; found uid {owner_uid}",
+            path.display()
+        );
+    }
+
+    Ok(())
+}
+
+#[cfg(unix)]
+fn ensure_secure_directory_owner(path: &Path, label: &str) -> Result<()> {
+    use std::os::unix::fs::MetadataExt;
+
+    const STICKY_BIT_MODE: u32 = 0o1000;
+
+    fn validate_directory(
+        path: &Path,
+        metadata: &std::fs::Metadata,
+        effective_uid: u32,
+        label: &str,
+        allow_sticky_group_other_write: bool,
+    ) -> Result<()> {
+        if !metadata.is_dir() {
+            bail!("{label} directory '{}' is not a directory", path.display());
+        }
+        assert_allowed_directory_owner(path, metadata.uid(), effective_uid, label)?;
+        let mode = metadata.mode() & 0o7777;
+        if mode & 0o022 != 0 && !(allow_sticky_group_other_write && mode & STICKY_BIT_MODE != 0) {
+            bail!(
+                "{label} directory '{}' must not be writable by group/other (current mode {:o})",
+                path.display(),
+                mode & 0o777
+            );
+        }
+        Ok(())
+    }
+
+    let effective_uid = nix::unistd::geteuid().as_raw();
+    let metadata = std::fs::metadata(path)
+        .with_context(|| format!("failed to inspect {label} directory {}", path.display()))?;
+    validate_directory(path, &metadata, effective_uid, label, false)?;
+
+    let canonical = std::fs::canonicalize(path).with_context(|| {
+        format!(
+            "failed to canonicalize {label} directory {}",
+            path.display()
+        )
+    })?;
+    for ancestor in canonical.ancestors().skip(1) {
+        let metadata = std::fs::metadata(ancestor).with_context(|| {
+            format!(
+                "failed to inspect ancestor {label} directory {}",
+                ancestor.display()
+            )
+        })?;
+        validate_directory(ancestor, &metadata, effective_uid, label, true)?;
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn ensure_secure_directory_owner(_path: &Path, _label: &str) -> Result<()> {
+    Ok(())
+}
+
+fn is_symlink(path: &Path) -> Result<bool> {
+    match std::fs::symlink_metadata(path) {
+        Ok(metadata) => Ok(metadata.file_type().is_symlink()),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(false),
+        Err(err) => {
+            Err(err).with_context(|| format!("failed to inspect metadata for {}", path.display()))
+        }
+    }
+}
+
+fn lock_path(path: &Path) -> PathBuf {
+    let mut lock = path.as_os_str().to_os_string();
+    lock.push(".lock");
+    PathBuf::from(lock)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        ensure_file_parent, resolve_allowed_peer_euids_with_sudo_uid, resolve_vault_password,
+        validate_password, Cli,
+    };
+    use clap::Parser;
+    use std::collections::BTreeSet;
+    use std::path::Path;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    #[test]
+    fn validate_password_rejects_oversized_non_stdin_secret() {
+        let err = validate_password("a".repeat((16 * 1024) + 1), "argument or environment")
+            .expect_err("must fail");
+        assert!(err.to_string().contains("must not exceed"));
+    }
+
+    #[test]
+    fn cli_rejects_inline_vault_password_argument() {
+        let err = Cli::try_parse_from([
+            "wlfi-agent-daemon",
+            "--vault-password",
+            "vault-secret",
+            "--non-interactive",
+        ])
+        .expect_err("must reject");
+        assert!(err.to_string().contains("--vault-password"));
+    }
+
+    #[test]
+    fn resolve_vault_password_requires_stdin_in_non_interactive_mode() {
+        let err = resolve_vault_password(false, true).expect_err("must fail");
+        assert!(err.to_string().contains("use --vault-password-stdin"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn ensure_file_parent_accepts_current_user_owned_directory() {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("time")
+            .as_nanos();
+        let parent = std::env::temp_dir().join(format!(
+            "wlfi-daemon-parent-{}-{}",
+            std::process::id(),
+            unique
+        ));
+        std::fs::create_dir_all(&parent).expect("create parent");
+        let path = parent.join("daemon-state.enc");
+        ensure_file_parent(&path, "state").expect("current-user-owned directory should pass");
+        std::fs::remove_dir_all(&parent).expect("cleanup");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn ensure_file_parent_rejects_group_writable_ancestor_directory() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("time")
+            .as_nanos();
+        let root = std::env::temp_dir().join(format!(
+            "wlfi-daemon-parent-ancestor-{}-{}",
+            std::process::id(),
+            unique
+        ));
+        let shared = root.join("shared");
+        let nested = shared.join("nested");
+        std::fs::create_dir_all(&nested).expect("create nested directory");
+        std::fs::set_permissions(&shared, std::fs::Permissions::from_mode(0o777))
+            .expect("set insecure ancestor permissions");
+        std::fs::set_permissions(&nested, std::fs::Permissions::from_mode(0o700))
+            .expect("set nested permissions");
+
+        let path = nested.join("daemon-state.enc");
+        let err = ensure_file_parent(&path, "state").expect_err("must reject");
+        assert!(err
+            .to_string()
+            .contains("must not be writable by group/other"));
+
+        std::fs::set_permissions(&shared, std::fs::Permissions::from_mode(0o700))
+            .expect("restore cleanup permissions");
+        std::fs::remove_dir_all(&root).expect("cleanup");
+    }
+
+    #[test]
+    fn resolve_allowed_peer_euids_keeps_root_only_when_allowlists_are_omitted() {
+        let resolved = resolve_allowed_peer_euids_with_sudo_uid(&[], &[], &[], Some(501))
+            .expect("allowed peer euids");
+
+        assert_eq!(resolved.admin, BTreeSet::from([0]));
+        assert_eq!(resolved.agent, BTreeSet::from([0]));
+    }
+
+    #[test]
+    fn resolve_allowed_peer_euids_supports_split_admin_and_agent_allowlists() {
+        let resolved = resolve_allowed_peer_euids_with_sudo_uid(&[11], &[22], &[33], Some(501))
+            .expect("allowed peer euids");
+
+        assert_eq!(resolved.admin, BTreeSet::from([0, 11, 33]));
+        assert_eq!(resolved.agent, BTreeSet::from([0, 22, 33]));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn assert_allowed_directory_owner_rejects_non_root_owner_for_root_runtime() {
+        let err = super::assert_allowed_directory_owner(Path::new("/tmp/wlfi"), 501, 0, "state")
+            .expect_err("root runtime must reject non-root owner");
+
+        assert!(err.to_string().contains("must be owned by root"));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn assert_allowed_directory_owner_allows_root_owner_for_root_runtime() {
+        super::assert_allowed_directory_owner(Path::new("/tmp/wlfi"), 0, 0, "state")
+            .expect("root runtime should allow root-owned directories");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn assert_allowed_directory_owner_allows_current_user_for_non_root_runtime() {
+        super::assert_allowed_directory_owner(Path::new("/tmp/wlfi"), 501, 501, "state")
+            .expect("non-root runtime should allow current-user-owned directories");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn assert_allowed_directory_owner_rejects_other_user_for_non_root_runtime() {
+        let err = super::assert_allowed_directory_owner(Path::new("/tmp/wlfi"), 502, 501, "state")
+            .expect_err("non-root runtime must reject another user's directory");
+
+        assert!(err
+            .to_string()
+            .contains("must be owned by current user or root"));
+    }
+}