jochen
994cab533b
mesh/merge-gate pass: builds new: modules/mesh-reads, sent nowhere; no bus step; every machine composes with the change as it did without (4 of 4 compose)
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
mesh/delivery delivered
Reading a file, searching one, listing a directory, the owner and mode of each component of a path and looking up an account went through the login shell's execute as the operator's account, which sees the operator's keys and the agent's credentials. This module holds node-reads on every node and runs as mesh-reads (no login, no group beside its own). It refuses the node's secret places by name, judging the file actually opened rather than the name asked, so a flipped link reaches nothing refused; withholds any line shaped like a secret through mesh-sdk's outward rule and every line of a BEGIN/END block; and bounds every answer. Replaces mesh-catalog #244 (reviews 55), whose first commit carried a built binary.
205 lines
8.6 KiB
Go
205 lines
8.6 KiB
Go
// mesh-reads (novox/hq ADR 0310, to-be 41 WP8): the holder of node-reads. A node's files and accounts read
|
|
// through the mesh — the owner and mode of each component of a path, a link, a directory, a text file, a search
|
|
// by fixed string, an account or a group — so these reads never go through the login shell's execute.
|
|
//
|
|
// It runs as an account of its own, mesh-reads, served by the tool runner in a runtime of its own (ADR 0259
|
|
// §8): in no group that holds a secret, with no login shell and no home of the operator's, so the node's file
|
|
// modes bound what it sees. On top, it refuses by name the places a secret is kept (refuse.go) and withholds
|
|
// any piece of an answer shaped like a secret (mesh-sdk's outward). Read-only: nothing here writes a file.
|
|
//
|
|
// stdout is the MCP channel; what this module says, it says on stderr.
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
|
|
stdio "git.novox.be/novox/mesh-sdk/go"
|
|
)
|
|
|
|
// Seat is the role this module holds.
|
|
const Seat = "node-reads"
|
|
|
|
// PlacesWord is where the controller names this node's secret places (novox/hq ADR 0310 §5).
|
|
const PlacesWord = "MESH_SECRET_PLACES"
|
|
|
|
func main() {
|
|
places, err := placesFrom(os.Getenv(PlacesWord))
|
|
if err != nil {
|
|
fmt.Fprintf(os.Stderr, "[mesh-reads] %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
if err := stdio.Serve("", tools(newReader(places))); err != nil {
|
|
fmt.Fprintf(os.Stderr, "[mesh-reads] %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
// placesFrom reads the controller's list. Absent is refused: without it, a module's own-secret directory
|
|
// would be read wherever the account's modes allow, and a refusal the decision promises would be silent.
|
|
func placesFrom(raw string) ([]string, error) {
|
|
if strings.TrimSpace(raw) == "" {
|
|
return nil, fmt.Errorf("%s is not given, so this node's secret places are unknown and nothing would be "+
|
|
"refused by them (novox/hq ADR 0310 §5): a controller that knows node-reads composes it", PlacesWord)
|
|
}
|
|
var places []string
|
|
if err := json.Unmarshal([]byte(raw), &places); err != nil {
|
|
return nil, fmt.Errorf("%s is not a list of paths: %v", PlacesWord, err)
|
|
}
|
|
return places, nil
|
|
}
|
|
|
|
func str(description string) map[string]any {
|
|
return map[string]any{"type": "string", "description": description}
|
|
}
|
|
|
|
func arg(a map[string]any, k string) string {
|
|
switch v := a[k].(type) {
|
|
case string:
|
|
return strings.TrimSpace(v)
|
|
case float64:
|
|
return strconv.FormatFloat(v, 'f', -1, 64)
|
|
case bool:
|
|
return strconv.FormatBool(v)
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func number(a map[string]any, k string) (int, error) {
|
|
s := arg(a, k)
|
|
if s == "" {
|
|
return 0, nil
|
|
}
|
|
n, err := strconv.Atoi(s)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("%s is a whole number, and %q was given", k, s)
|
|
}
|
|
return n, nil
|
|
}
|
|
|
|
// pathsArg is the paths given, one per line — or, from a caller that sends a list, the list.
|
|
func pathsArg(a map[string]any) []string {
|
|
var raw []string
|
|
switch v := a["paths"].(type) {
|
|
case string:
|
|
raw = strings.Split(v, "\n")
|
|
case []any:
|
|
for _, p := range v {
|
|
if s, ok := p.(string); ok {
|
|
raw = append(raw, s)
|
|
}
|
|
}
|
|
}
|
|
var out []string
|
|
for _, p := range raw {
|
|
if p = strings.TrimSpace(p); p != "" {
|
|
out = append(out, p)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// bounded is the last bound (novox/hq ADR 0310): whatever a verb made, no answer is larger than MaxAnswer.
|
|
func bounded(answer any, err error) (any, error) {
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
body, err := json.Marshal(answer)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if len(body) > MaxAnswer {
|
|
return nil, fmt.Errorf("the answer is %d bytes, and an answer of node-reads is at most %d: ask for less", len(body), MaxAnswer)
|
|
}
|
|
return answer, nil
|
|
}
|
|
|
|
// verb is one of the seat's verbs: listed as `<seat>.<verb>`, so the runtime serves it on the seat's subject.
|
|
// The descriptions are the controller's (internal/catalogue/reads.go), said again here for a caller of the
|
|
// module's own address.
|
|
func verb(name, description string, input map[string]any, run func(a map[string]any) (any, error)) stdio.Tool {
|
|
return stdio.Tool{Name: Seat + "." + name, Description: description, Input: input,
|
|
Run: func(a map[string]any) (any, error) { return bounded(run(a)) }}
|
|
}
|
|
|
|
func object(props map[string]any, required ...string) map[string]any {
|
|
if required == nil {
|
|
required = []string{}
|
|
}
|
|
return map[string]any{"type": "object", "properties": props, "required": required}
|
|
}
|
|
|
|
func tools(r Reader) []stdio.Tool {
|
|
return []stdio.Tool{
|
|
verb("stat", "Each component of one path or several, from / down: its type, owner and group (name and "+
|
|
"number), mode, whether it is a link and to what, and whether it is a mount point and of which file "+
|
|
"system. A link is not followed unless follow is \"true\". Read as the account mesh-reads, which holds no "+
|
|
"secret: a component it may not reach says so. At most 200 paths in one call.",
|
|
object(map[string]any{"paths": str("one absolute path, or several separated by line breaks"),
|
|
"follow": str("\"true\": also say where the path leads once every link is followed")}, "paths"),
|
|
func(a map[string]any) (any, error) { return r.Stat(pathsArg(a), arg(a, "follow") == "true") }),
|
|
verb("readlink", "What one link points to, as written, and where the path leads once every link is "+
|
|
"followed, and whether that exists.",
|
|
object(map[string]any{"path": str("an absolute path")}, "path"),
|
|
func(a map[string]any) (any, error) { return r.Readlink(arg(a, "path")) }),
|
|
verb("list", "Every entry of one directory with its type, owner, group, mode, size and, for a link, its "+
|
|
"target. At most 2000 entries; a longer directory is cut and says so. A place a secret is kept is "+
|
|
"refused by name.",
|
|
object(map[string]any{"path": str("an absolute path to a directory")}, "path"),
|
|
func(a map[string]any) (any, error) { return r.List(arg(a, "path")) }),
|
|
verb("read", "One text file, or a part of it by line: at most 256 KiB in one answer (64 KiB unless more "+
|
|
"is asked), cut at a line and said so. A negative from counts from the end, as tail does. A binary file "+
|
|
"is refused; a place a secret is kept, or a known credential file, is refused by name; a line shaped "+
|
|
"like a secret is withheld and its number said. /proc and /sys are read as far as mesh-reads may.",
|
|
object(map[string]any{"path": str("an absolute path to a file"),
|
|
"from": str("the first line to answer, counted from 1; negative: that many lines from the end (optional)"),
|
|
"lines": str("how many lines to answer (optional)"),
|
|
"bytes": str("the most bytes to answer, up to 262144 (optional, 65536 unless given)")}, "path"),
|
|
func(a map[string]any) (any, error) {
|
|
var ask ReadAsk
|
|
var err error
|
|
if ask.From, err = number(a, "from"); err != nil {
|
|
return nil, err
|
|
}
|
|
if ask.Lines, err = number(a, "lines"); err != nil {
|
|
return nil, err
|
|
}
|
|
if ask.Bytes, err = number(a, "bytes"); err != nil {
|
|
return nil, err
|
|
}
|
|
return r.Read(arg(a, "path"), ask)
|
|
}),
|
|
verb("search", "Find a fixed string (never a pattern) in one file or under one directory: every matching "+
|
|
"line with its file and number. Bounded: at most 500 matches (100 unless more is asked), 8 directories "+
|
|
"deep (4 unless more is asked), 5000 files, 4 MiB per file and 20 seconds, on the file system of the path "+
|
|
"named; links are not followed and binary files are skipped. A place a secret is kept is skipped and named; a matching line shaped like "+
|
|
"a secret is withheld. The answer says which bound it met.",
|
|
object(map[string]any{"text": str("the fixed string to find"),
|
|
"path": str("an absolute path to a file or a directory"),
|
|
"depth": str("how many directories deep, up to 8 (optional)"),
|
|
"matches": str("the most matches to answer, up to 500 (optional)"),
|
|
"case": str("\"false\": match whatever the case (optional)")}, "text", "path"),
|
|
func(a map[string]any) (any, error) {
|
|
text, _ := a["text"].(string) // as given: a space at either end is part of what is found
|
|
ask := SearchAsk{Text: text, Path: arg(a, "path"), CaseInsensitive: arg(a, "case") == "false"}
|
|
var err error
|
|
if ask.Depth, err = number(a, "depth"); err != nil {
|
|
return nil, err
|
|
}
|
|
if ask.Matches, err = number(a, "matches"); err != nil {
|
|
return nil, err
|
|
}
|
|
return r.Search(ask)
|
|
}),
|
|
verb("account", "One account or group by name or number, as this node's account files say: an account's "+
|
|
"number, group, home, shell and every group it is in; a group's number and members. With neither, every "+
|
|
"account and group. Never a password field.",
|
|
object(map[string]any{"name": str("an account's name or number (optional)"),
|
|
"group": str("a group's name or number (optional)")}),
|
|
func(a map[string]any) (any, error) { return r.Account(arg(a, "name"), arg(a, "group")) }),
|
|
}
|
|
}
|