node-command 2.0.13 → 2.0.14

package/lib/setup.mjs

@@ -707,6 +707,13 @@ const INCOMPLETE_SYSTEM_HOST_ENV = '/opt/nc/config/nc-client.env';
 const INCOMPLETE_SYSTEM_UNIT = '/etc/systemd/system/nc-client.service';
 const INCOMPLETE_SYSTEM_UNIT_DROPIN = '/etc/systemd/system/nc-client.service.d';
 const INCOMPLETE_HELPER_APP = '/opt/nc/libexec/privileged-helper';
+const INCOMPLETE_HELPER_BOOTSTRAP = '/opt/nc/libexec/protected-helper-bootstrap';
+const INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES = new Map([
+  ['archive.tar.gz', 'file'],
+  ['install-request.json', 'file'],
+  ['modules', 'directory'],
+  ['release', 'directory']
+]);
 const INCOMPLETE_HELPER_DAEMON = INCOMPLETE_HELPER_APP + '/privileged-helper-linux-daemon.mjs';
 const INCOMPLETE_HELPER_PROFILE = INCOMPLETE_HELPER_APP + '/privileged-helper-profile.json';
 const INCOMPLETE_HELPER_UNIT = '/etc/systemd/system/nc-privileged-helper.service';
@@ -823,12 +830,37 @@ function systemValidateHelperArtifacts(io, runtime) {
   return { service: !!service, tmpfiles: !!tmpfiles };
 }
 
+/**
+ * `libexec` is removable only while empty or holding the exact staging tree a
+ * protected helper bootstrap writes before provisioning: root-owned regular
+ * files/directories, no symlinks, no group/other write bits, and no unknown
+ * entry. A provisioned helper, peercred shim or any other content fails closed.
+ */
+function systemValidateStagedHelperBootstrap(io, libexec) {
+  const entries = systemReaddir(io)(libexec);
+  if (entries.length === 0) return true;
+  if (entries.length !== 1 || entries[0] !== 'protected-helper-bootstrap') return false;
+  const stage = systemLstatOrNull(io, INCOMPLETE_HELPER_BOOTSTRAP);
+  if (!stage || stage.isSymbolicLink() || !stage.isDirectory() || stage.uid !== 0 || (stage.mode & 0o022)) return false;
+  const staged = systemReaddir(io)(INCOMPLETE_HELPER_BOOTSTRAP);
+  if (staged.length !== INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES.size) return false;
+  for (const [name, type] of INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES) {
+    if (!staged.includes(name)) return false;
+    const info = systemLstatOrNull(io, path.join(INCOMPLETE_HELPER_BOOTSTRAP, name));
+    if (!info || info.isSymbolicLink() || info.uid !== 0 || (info.mode & 0o022)) return false;
+    if (type === 'directory' ? !info.isDirectory() : (!info.isFile() || info.nlink !== 1)) return false;
+  }
+  return true;
+}
+
 /**
  * Recognize the two root-recoverable system-install leftovers this CLI may
  * remove without the packaged maintenance entry: a helper provisioned but
  * never bound (`pending`/`not_initialized`, no profile, no lifecycle custody)
  * and a failed install whose app payload never landed but whose stale unit
- * remains. Anything else returns null so callers keep failing closed.
+ * remains. A failed install may also leave the exact root-owned protected
+ * helper bootstrap staged but never provisioned. Anything else returns null so
+ * callers keep failing closed.
  * @param {string} root
  * @param {{ platform?: string, io?: typeof fs }} [options]
  * @returns {null | { kind: 'pending-helper'|'failed-install', runtime: string, payloadUid: number, helperArtifacts: { service: boolean, tmpfiles: boolean } }}
@@ -900,7 +932,7 @@ export function incompleteSystemInstallationShape(root, { platform = os.platform
     if (systemLstatOrNull(io, INCOMPLETE_SYSTEM_LIFECYCLE) || systemLstatOrNull(io, INCOMPLETE_SYSTEM_PAIRED_ROOT)) return null;
     const libexec = systemLstatOrNull(io, path.join(root, 'libexec'));
     if (libexec) {
-      if (libexec.isSymbolicLink() || !libexec.isDirectory() || systemReaddir(io)(path.join(root, 'libexec')).length !== 0) return null;
+      if (libexec.isSymbolicLink() || !libexec.isDirectory() || !systemValidateStagedHelperBootstrap(io, path.join(root, 'libexec'))) return null;
     }
     const launcher = systemLstatOrNull(io, INCOMPLETE_SYSTEM_LAUNCHER);
     if (launcher && (launcher.isSymbolicLink() || !launcher.isFile() || launcher.size !== 0 ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.13",
+  "version": "2.0.14",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {