node-command 2.0.13 → 2.0.15

package/lib/setup.mjs

@@ -707,6 +707,16 @@ const INCOMPLETE_SYSTEM_HOST_ENV = '/opt/nc/config/nc-client.env';
 const INCOMPLETE_SYSTEM_UNIT = '/etc/systemd/system/nc-client.service';
 const INCOMPLETE_SYSTEM_UNIT_DROPIN = '/etc/systemd/system/nc-client.service.d';
 const INCOMPLETE_HELPER_APP = '/opt/nc/libexec/privileged-helper';
+const INCOMPLETE_HELPER_BOOTSTRAP = '/opt/nc/libexec/protected-helper-bootstrap';
+const INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES = new Map([
+  ['archive.tar.gz', 'file'],
+  ['install-request.json', 'file'],
+  // Written by the provisioner from the signed archive before the helper tree
+  // is published; installations that failed earlier may not have it yet.
+  ['control-plane-public-key.pem', 'optional-file'],
+  ['modules', 'directory'],
+  ['release', 'directory']
+]);
 const INCOMPLETE_HELPER_DAEMON = INCOMPLETE_HELPER_APP + '/privileged-helper-linux-daemon.mjs';
 const INCOMPLETE_HELPER_PROFILE = INCOMPLETE_HELPER_APP + '/privileged-helper-profile.json';
 const INCOMPLETE_HELPER_UNIT = '/etc/systemd/system/nc-privileged-helper.service';
@@ -823,12 +833,48 @@ function systemValidateHelperArtifacts(io, runtime) {
   return { service: !!service, tmpfiles: !!tmpfiles };
 }
 
+/**
+ * The exact staging tree a protected helper bootstrap writes before
+ * provisioning: root-owned regular files/directories, no symlinks, no
+ * group/other write bits, and no unknown entry. An absent stage is not a
+ * failure by itself; callers that require it check separately.
+ */
+function systemValidateStagedHelperBootstrapTree(io) {
+  const stage = systemLstatOrNull(io, INCOMPLETE_HELPER_BOOTSTRAP);
+  if (!stage) return true;
+  if (stage.isSymbolicLink() || !stage.isDirectory() || stage.uid !== 0 || (stage.mode & 0o022)) return false;
+  const required = [...INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES].filter(([, type]) => type !== 'optional-file');
+  const staged = systemReaddir(io)(INCOMPLETE_HELPER_BOOTSTRAP);
+  if (staged.some((name) => !INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES.has(name)) ||
+      required.some(([name]) => !staged.includes(name))) return false;
+  for (const [name, type] of INCOMPLETE_HELPER_BOOTSTRAP_ENTRIES) {
+    if (!staged.includes(name)) continue;
+    const info = systemLstatOrNull(io, path.join(INCOMPLETE_HELPER_BOOTSTRAP, name));
+    if (!info || info.isSymbolicLink() || info.uid !== 0 || (info.mode & 0o022)) return false;
+    if (type === 'directory' ? !info.isDirectory() : (!info.isFile() || info.nlink !== 1)) return false;
+  }
+  return true;
+}
+
+/**
+ * `libexec` is removable only while empty or holding that exact staging tree.
+ * A provisioned helper, peercred shim or any other content fails closed.
+ */
+function systemValidateStagedHelperBootstrap(io, libexec) {
+  const entries = systemReaddir(io)(libexec);
+  if (entries.length === 0) return true;
+  if (entries.length !== 1 || entries[0] !== 'protected-helper-bootstrap') return false;
+  return systemValidateStagedHelperBootstrapTree(io);
+}
+
 /**
  * Recognize the two root-recoverable system-install leftovers this CLI may
  * remove without the packaged maintenance entry: a helper provisioned but
  * never bound (`pending`/`not_initialized`, no profile, no lifecycle custody)
  * and a failed install whose app payload never landed but whose stale unit
- * remains. Anything else returns null so callers keep failing closed.
+ * remains. A failed install may also leave the exact root-owned protected
+ * helper bootstrap staged but never provisioned. Anything else returns null so
+ * callers keep failing closed.
  * @param {string} root
  * @param {{ platform?: string, io?: typeof fs }} [options]
  * @returns {null | { kind: 'pending-helper'|'failed-install', runtime: string, payloadUid: number, helperArtifacts: { service: boolean, tmpfiles: boolean } }}
@@ -861,6 +907,11 @@ export function incompleteSystemInstallationShape(root, { platform = os.platform
       // ordinary root all require their own trusted maintenance.
       if (systemLstatOrNull(io, INCOMPLETE_HELPER_PROFILE) || systemLstatOrNull(io, INCOMPLETE_SYSTEM_LIFECYCLE) ||
           systemLstatOrNull(io, INCOMPLETE_SYSTEM_PAIRED_ROOT)) return null;
+      // libexec may hold only the helper tree, its peercred shim and the exact
+      // pre-provision protected bootstrap stage. Any other entry fails closed.
+      const libexecEntries = systemReaddir(io)(path.join(root, 'libexec'));
+      if (!libexecEntries.every((name) => ['nc-linux-peercred', 'privileged-helper', 'protected-helper-bootstrap'].includes(name)) ||
+          !systemValidateStagedHelperBootstrapTree(io)) return null;
       const bootstrap = JSON.parse(readSystemFile(io, INCOMPLETE_HELPER_APP + '/helper-bootstrap.json', { mode: 0o600 }));
       const controlPlaneId = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256 &&
         value.trim() === value && !/[\x00-\x1f\x7f]/.test(value);
@@ -875,20 +926,37 @@ export function incompleteSystemInstallationShape(root, { platform = os.platform
           bootstrap.ordinary_service_scope !== 'system' ||
           bootstrap.ack_private_key_file !== INCOMPLETE_HELPER_APP + '/privileged-helper-ack-key.pem' ||
           !systemCanonical(bootstrap.node_bin)) return null;
-      readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper.json', { mode: 0o600 });
-      readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-ack-key.pem', { mode: 0o600 });
-      readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-public.pem', { mode: 0o644 });
-      const peercred = systemLstatOrNull(io, '/opt/nc/libexec/nc-linux-peercred');
-      if (!peercred || peercred.isSymbolicLink() || !peercred.isFile() || peercred.uid !== 0 || peercred.nlink !== 1) return null;
-      const daemon = systemLstatOrNull(io, INCOMPLETE_HELPER_DAEMON);
-      if (!daemon || daemon.isSymbolicLink() || !daemon.isFile() || daemon.uid !== 0 || !(daemon.mode & 0o111)) return null;
+      // The helper tree is either fully prepared but unbound, or only a
+      // bootstrap record whose provisioning never completed. The latter is
+      // removable only while the exact protected staging tree still exists.
+      const helperEntries = systemReaddir(io)(INCOMPLETE_HELPER_APP);
+      const bootstrapOnly = helperEntries.length === 1 && helperEntries[0] === 'helper-bootstrap.json';
+      let helperArtifacts;
+      if (bootstrapOnly) {
+        if (!systemLstatOrNull(io, INCOMPLETE_HELPER_BOOTSTRAP) ||
+            systemLstatOrNull(io, '/opt/nc/libexec/nc-linux-peercred') ||
+            systemLstatOrNull(io, INCOMPLETE_HELPER_UNIT) || systemLstatOrNull(io, INCOMPLETE_HELPER_SOCKET) ||
+            systemLstatOrNull(io, INCOMPLETE_HELPER_TMPFILES) || systemLstatOrNull(io, INCOMPLETE_HELPER_UNIT_DROPIN) ||
+            systemLstatOrNull(io, INCOMPLETE_HELPER_SOCKET_DROPIN)) return null;
+        helperArtifacts = Object.freeze({ service: false, tmpfiles: false });
+      } else {
+        readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper.json', { mode: 0o600 });
+        readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-ack-key.pem', { mode: 0o600 });
+        readSystemFile(io, INCOMPLETE_HELPER_APP + '/privileged-helper-public.pem', { mode: 0o644 });
+        const peercred = systemLstatOrNull(io, '/opt/nc/libexec/nc-linux-peercred');
+        if (!peercred || peercred.isSymbolicLink() || !peercred.isFile() || peercred.uid !== 0 || peercred.nlink !== 1) return null;
+        // Node executes the .mjs daemon regardless of its executable bit; the
+        // released module is 0644. Require the protected root-owned metadata.
+        const daemon = systemLstatOrNull(io, INCOMPLETE_HELPER_DAEMON);
+        if (!daemon || daemon.isSymbolicLink() || !daemon.isFile() || daemon.uid !== 0 || (daemon.mode & 0o022)) return null;
+        helperArtifacts = systemValidateHelperArtifacts(io, bootstrap.node_bin);
+      }
       readSystemFile(io, INCOMPLETE_SYSTEM_LAUNCHER, { uids: new Set([0, payloadUid]) });
       const hostEnv = readSystemFile(io, INCOMPLETE_SYSTEM_HOST_ENV, { uids: new Set([0, payloadUid]) });
       const ids = hostEnv.split(/\r?\n/).filter((line) => /^\s*NC_CLIENT_ID\s*=/.test(line));
       const clientId = ids[0]?.match(/^\s*NC_CLIENT_ID\s*=\s*(?:"(nc_[0-9a-f]{64})"|'(nc_[0-9a-f]{64})'|(nc_[0-9a-f]{64}))\s*$/);
       if (ids.length !== 1 || !clientId || (clientId[1] || clientId[2] || clientId[3]) !== bootstrap.client_id) return null;
       systemValidateClientUnit(io, bootstrap.node_bin);
-      const helperArtifacts = systemValidateHelperArtifacts(io, bootstrap.node_bin);
       return Object.freeze({ kind: 'pending-helper', runtime: bootstrap.node_bin, payloadUid, helperArtifacts });
     }
     // Failed-install shape: no helper payload, no packaged uninstaller, and an
@@ -900,7 +968,7 @@ export function incompleteSystemInstallationShape(root, { platform = os.platform
     if (systemLstatOrNull(io, INCOMPLETE_SYSTEM_LIFECYCLE) || systemLstatOrNull(io, INCOMPLETE_SYSTEM_PAIRED_ROOT)) return null;
     const libexec = systemLstatOrNull(io, path.join(root, 'libexec'));
     if (libexec) {
-      if (libexec.isSymbolicLink() || !libexec.isDirectory() || systemReaddir(io)(path.join(root, 'libexec')).length !== 0) return null;
+      if (libexec.isSymbolicLink() || !libexec.isDirectory() || !systemValidateStagedHelperBootstrap(io, path.join(root, 'libexec'))) return null;
     }
     const launcher = systemLstatOrNull(io, INCOMPLETE_SYSTEM_LAUNCHER);
     if (launcher && (launcher.isSymbolicLink() || !launcher.isFile() || launcher.size !== 0 ||
@@ -1066,19 +1134,24 @@ export function findRemovalTargets({ io = {}, ...rest } = {}) {
   let pair = null;
   let incompleteRoot = null;
   if ((rest.platform || os.platform()) === 'linux') {
-    let pairedError = null;
-    try {
-      pair = linuxPairedInstallation(io);
-    } catch (err) {
-      // Protected metadata this account cannot stat or read is not a local
-      // removal target. Any other validation failure remains a hard stop
-      // unless the tree is the exact recoverable pending/failed shape.
-      if (err?.code !== 'TRUSTED_ROOT_MAINTENANCE_REQUIRED') throw err;
-      pairedError = err;
-    }
-    if (!pair) {
-      if (incompleteSystemInstallationShape(PARTIAL_SYSTEM_ROOT, { platform: 'linux', io })) incompleteRoot = PARTIAL_SYSTEM_ROOT;
-      if (pairedError && !incompleteRoot && !pairedMetadataUnreadable(io)) throw pairedError;
+    // A validated recoverable pending/failed shape takes precedence over the
+    // paired classification: the unprovisioned staging tree makes the paired
+    // metadata unverifiable, but the tree is not a paired installation. A
+    // genuinely prepared or bound pair never matches this shape (it requires
+    // lifecycle custody and a profile), so it keeps using the packaged path.
+    if (incompleteSystemInstallationShape(PARTIAL_SYSTEM_ROOT, { platform: 'linux', io })) {
+      incompleteRoot = PARTIAL_SYSTEM_ROOT;
+    } else {
+      let pairedError = null;
+      try {
+        pair = linuxPairedInstallation(io);
+      } catch (err) {
+        // Protected metadata this account cannot stat or read is not a local
+        // removal target. Any other validation failure remains a hard stop.
+        if (err?.code !== 'TRUSTED_ROOT_MAINTENANCE_REQUIRED') throw err;
+        pairedError = err;
+      }
+      if (!pair && pairedError && !pairedMetadataUnreadable(io)) throw pairedError;
     }
   }
   const env = rest.env || process.env;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-command",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {