novox/mesh-host
7
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Merge pull request 'Keep libraries under a group of their own, and give each joining module a user in it (hq ADR 0328, issue 567)' (#95) from feat/328-libraries-and-module-users into main

Browse Source
This commit was merged in pull request #95.
This commit is contained in:
mesh-admin
2026-10-12 20:28:16 +00:00
parent 303d4037e8 281837847e
commit d8e785bb4b
36 changed files with 3133 additions and 5007 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/mesh-host/kept.go
-439
View File
@@ -1,439 +0,0 @@
package main
import (
"context"
"errors"
"fmt"
"os"
"path/filepath"
"sort"
"strings"
"sync"
"sync/atomic"
"time"
"github.com/novox/mesh-host/internal/apply"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/link"
"github.com/novox/mesh-host/internal/store"
)
// An access is judged by what each of its users may do (novox/hq ADR 0325 §7, §10, §12).
//
// On every look the engine judges each module's access as its module's resource of kind `access`: waiting, with a
// wait of kind access, while the mesh may not keep its folder yet or its disk is not there; unhealthy for root's
// data on its placed filesystem, and for a kept folder that gives a user less than its right — read by entry and
// mask together, on the folder and the sweep's sample under it, which the sweep puts back where it can; healthy
// otherwise. The folder is the target, never in a reason nor in a wait's words: the controller says them on the
// operator's channel, which withholds a path (ADR 0234 §6).
// judgedAccess is one access as the judge reads it.
type judgedAccess struct {
module, id, name, path string
taken bool
users []store.KeptUser
// leftover is the mesh's entries nobody wants, not an access (link.KindKeptEntries).
leftover bool
}
// accessJudge reads every access on every look. Safe for the apply and the looking loop at once.
type accessJudge struct {
mu sync.Mutex
accesses []judgedAccess
// was is each access's last verdict, with since when and how many looks in a row found it unhealthy.
was map[string]link.ResourceHealth
// reading guards inFlight: every folder whose look has not returned yet.
reading sync.Mutex
inFlight map[string]bool
}
// accesses is the one access judge on this machine.
var accesses = newAccessJudge()
func newAccessJudge() *accessJudge {
return &accessJudge{was: map[string]link.ResourceHealth{}, inFlight: map[string]bool{}}
}
// set is what the declaration just applied asks: every access of a module, not held as found, with the users of
// its folder as every access of that folder gives them. An access no longer declared is forgotten.
func (j *accessJudge) set(d *declaration.Declaration, held map[string]bool) {
var as []judgedAccess
if d != nil {
// A tool runner's account that came with no number is read by name, as the apply read it (ADR 0325 §4).
ctx, cancel := context.WithTimeout(context.Background(), lookBound)
apply.ResolveRunners(ctx, d)
cancel()
users := map[string]map[uint32]store.KeptUser{}
taken := map[string]bool{}
for _, r := range d.Resources {
if a, ok := r.(*declaration.Access); ok {
path := filepath.Clean(a.Path)
if users[path] == nil {
users[path] = map[uint32]store.KeptUser{}
}
taken[path] = taken[path] || a.Taken
for _, u := range a.Users {
had, seen := users[path][uint32(u.UID)]
if !seen || (u.Use == declaration.AccessReadWrite && had.Use != declaration.AccessReadWrite) {
users[path][uint32(u.UID)] = store.KeptUser{Identity: u.Identity, UID: uint32(u.UID),
Use: u.Use, From: u.From}
}
}
}
}
for _, r := range d.Resources {
a, ok := r.(*declaration.Access)
if !ok || held[a.ID] || strings.HasPrefix(a.ID, declaration.AdoptionPrefix) {
continue
}
// An older controller's access is judged by nothing, as before ADR 0325: no state is said of it.
if !apply.Keeps(d, a.Path) {
continue
}
at := strings.LastIndex(a.ID, ".")
if at <= 0 {
continue
}
path := filepath.Clean(a.Path)
ja := judgedAccess{module: a.ID[:at], id: a.ID, name: a.ID[at+1:], path: path, taken: taken[path]}
for _, u := range users[path] {
ja.users = append(ja.users, u)
}
sort.Slice(ja.users, func(x, y int) bool { return ja.users[x].UID < ja.users[y].UID })
as = append(as, ja)
}
}
sort.Slice(as, func(a, b int) bool { return as[a].id < as[b].id })
j.mu.Lock()
defer j.mu.Unlock()
j.accesses = as
declared := map[string]bool{}
for _, a := range as {
declared[a.id] = true
}
for id := range j.was {
if !declared[id] {
delete(j.was, id)
}
}
}
// lookBound is how long a look waits for one accessed folder to answer. A hard network mount whose server is down
// blocks a stat for ever, and one access must never stop every health statement this machine makes.
var lookBound = 5 * time.Second
// verdict is one access's judgement in a look.
type verdict struct {
state, reason string
waits []link.AccessWait
act *link.AccessActRecord
entries []link.KeptEntry
}
// judgeBounded judges one access within lookBound, outside any lock. A look that has not answered is said so;
// while it still hangs, later looks start no other on the same folder, so a dead mount costs one blocked read.
func (j *accessJudge) judgeBounded(a judgedAccess) (verdict, bool) {
j.reading.Lock()
if j.inFlight[a.path] {
j.reading.Unlock()
return verdict{}, false
}
j.inFlight[a.path] = true
j.reading.Unlock()
done := make(chan verdict, 1)
go func() {
v := judgeAccess(a)
j.reading.Lock()
delete(j.inFlight, a.path)
j.reading.Unlock()
done <- v
}()
select {
case v := <-done:
return v, true
case <-time.After(lookBound):
return verdict{}, false
}
}
// judgeAccess is one access's judgement now (ADR 0325 §7, §10, §12), the sweep of its kept folder included.
func judgeAccess(a judgedAccess) verdict {
v := apply.AccessVerdict(context.Background(), a.path, a.taken, len(a.users) > 0)
switch v.Kind {
case apply.VerdictWaitKeep:
return verdict{state: link.StateWaiting, reason: "it holds data the mesh has not taken on the filesystem " +
"it is on now, and waits for the operator's word (novox/hq ADR 0325 §7, §8)",
waits: []link.AccessWait{{Kind: link.WaitKindAccess, Access: a.name, Part: a.module,
What: apply.KeepWords(a.name), Placed: v.Placed, Reason: link.WaitKeep, ACL: v.ACL}}}
case apply.VerdictWaitDisk:
return verdict{state: link.StateWaiting, reason: "the disk that holds it is not there (novox/hq ADR 0325 §9)",
waits: []link.AccessWait{{Kind: link.WaitKindAccess, Access: a.name, Part: a.module,
What: apply.DiskWords(a.name), Reason: link.WaitDisk}}}
case apply.VerdictRoot:
return verdict{state: link.StateUnhealthy, reason: apply.RootWords(v.Why)}
case apply.VerdictUnknown:
// Not a fault and not the operator's: said as not known, and judged again on the next look.
return verdict{state: link.StateUnknown, reason: v.Why + "; judged again on the next look"}
case apply.VerdictBroken:
// Its words carry no path (AccessVerdict says them so): the reason reaches the operator's channel.
return verdict{state: link.StateUnhealthy, reason: v.Why}
case apply.VerdictMake:
return verdict{state: link.StateUnhealthy, reason: "it is not there yet; the next apply makes it where " +
"its data lives (novox/hq ADR 0325 §9)"}
case apply.VerdictNobody:
return verdict{state: link.StateHealthy}
}
out := verdict{state: link.StateHealthy, entries: entriesOf(a.users)}
rec, _ := keptNow(a.path)
if act := rec.Act; act != nil {
out.act = &link.AccessActRecord{Act: act.Act, Access: a.id, Warrant: act.Warrant, By: act.By, State: act.State,
Started: act.Started, Ended: act.Ended, Folders: act.Folders, Files: act.Files, Kept: act.Kept,
Links: act.Links, Other: act.Other, Mounts: act.Mounts, Why: act.Why}
}
if !rec.Kept {
out.state, out.reason = link.StateStarting, "the controller says it was taken; the next apply keeps it"
return out
}
look := apply.LookKept(a.path, a.users, apply.SweepLimits)
var faults []string
if look.Failed != "" {
faults = append(faults, "the sweep could not look: "+apply.Pathless(errors.New(look.Failed)))
}
if len(look.Short) > 0 {
faults = append(faults, "the folder itself gives "+strings.Join(look.Short, ", ")+"; put back on the next "+
"apply")
}
if n := look.Sweep.Unrepaired + look.Sweep.LastUnrepaired; n > 0 {
faults = append(faults, fmt.Sprintf("%d entries under it give a user less than its right and cannot be "+
"put back: an owner's own bits, which the mesh never changes, or an entry the filesystem refused", n))
}
if len(faults) > 0 {
out.state, out.reason = link.StateUnhealthy, strings.Join(faults, "; ")
return out
}
switch {
case rec.Act != nil && rec.Act.State == link.ActRunning:
out.state, out.reason = link.StateStarting, "the take act is adding its users' entries under it"
case !sameUsersList(rec.Users, rec.Want):
out.state, out.reason = link.StateStarting, "the entries under it are being changed to its users now"
}
return out
}
// entriesOf is a kept folder's listing (ADR 0325 §4): each user, and beside the tool runner's what it stands for.
func entriesOf(users []store.KeptUser) []link.KeptEntry {
var out []link.KeptEntry
for _, u := range users {
e := link.KeptEntry{Identity: u.Identity, UID: int(u.UID), Use: u.Use, From: u.From}
if u.From == declaration.FromToolRunner {
e.Note = "the tool runner's account stands for every module whose tools use this folder, at the widest " +
"use any of them declares: a module that declared only read may write through it (novox/hq ADR " +
"0325 §4, until issue 569)"
}
out = append(out, e)
}
return out
}
func sameUsersList(a, b []store.KeptUser) bool {
if len(a) != len(b) {
return false
}
seen := map[uint32]string{}
for _, u := range a {
seen[u.UID] = u.Use
}
for _, u := range b {
if use, ok := seen[u.UID]; !ok || use != u.Use {
return false
}
}
return true
}
// keptNow is the record of one kept folder, as the engine's file holds it.
func keptNow(path string) (store.KeptFolder, bool) {
all, err := apply.KeptFolders.All()
if err != nil {
return store.KeptFolder{}, false
}
f, had := all[path]
return f, had
}
// look reads every access now. Whether any verdict changed since the last look, for the loop to say it.
func (j *accessJudge) look(now time.Time) ([]link.ResourceHealth, bool) {
j.mu.Lock()
as := append([]judgedAccess(nil), j.accesses...)
j.mu.Unlock()
read := make([]verdict, len(as))
for i, a := range as {
v, answered := j.judgeBounded(a)
if !answered {
v = verdict{state: link.StateUnhealthy, reason: "its folder does not answer: judging it did not return " +
"within " + lookBound.String()}
}
read[i] = v
}
// And the entries nobody wants that could not be taken out yet, each under the access that last named its
// folder, until its drop walk has run (ADR 0325 §8).
for _, l := range apply.Leftovers() {
as = append(as, judgedAccess{module: l.Module, id: l.Access + "~entries", name: l.Name, path: l.Path,
leftover: true})
read = append(read, verdict{state: link.StateUnhealthy, reason: l.Why})
}
j.mu.Lock()
defer j.mu.Unlock()
changed := false
out := make([]link.ResourceHealth, 0, len(as))
for i, a := range as {
r := read[i]
// Every kept or waiting access lists its users, the tool runner's account with the uid read here (§4).
if r.entries == nil && len(a.users) > 0 && !a.leftover {
r.entries = entriesOf(a.users)
}
kind := link.KindAccess
if a.leftover {
kind = link.KindKeptEntries
}
v := link.ResourceHealth{Module: a.module, Resource: a.id, Kind: kind, Target: a.path,
State: r.state, Reason: r.reason, Since: now.UTC(), AccessWaits: r.waits, Act: r.act, Entries: r.entries}
if was, had := j.was[a.id]; had && was.State == r.state && was.Reason == r.reason {
v.Since = was.Since
v.Streak = was.Streak
} else {
changed = true
}
if r.state == link.StateUnhealthy {
v.Streak++
}
j.was[a.id] = v
out = append(out, v)
}
return out, changed
}
// withAccesses adds to a statement every access, as its module's resource of kind access.
func withAccesses(h *link.Health, vs []link.ResourceHealth) *link.Health {
h.Resources = append(h.Resources, vs...)
return h
}
// accessesHealthy says no access in vs is anything but healthy.
func accessesHealthy(vs []link.ResourceHealth) bool {
for _, v := range vs {
if v.State != link.StateHealthy {
return false
}
}
return true
}
// keeper runs the walks under kept folders beside the applies, one at a time (ADR 0325 §8): poked after every
// apply and every look, it walks whatever folder's entries under it are not what was declared.
type keeper struct {
running, following atomic.Bool
say func(string)
watch *apply.Watcher
}
// keeping is the one keeper on this machine.
var keeping = &keeper{say: func(string) {}}
// poke starts a reconcile of the kept folders unless one is running, and has the watch follow what is kept.
func (k *keeper) poke(ctx context.Context) {
// The watch is set beside, never in the caller's way: watching a new folder's tree reads every folder of it.
if k.following.CompareAndSwap(false, true) {
go func() {
defer k.following.Store(false)
k.follow()
}()
}
if !k.running.CompareAndSwap(false, true) {
return
}
go func() {
defer k.running.Store(false)
for _, line := range apply.ReconcileKept(ctx) {
k.say(line)
}
}()
}
// follow has the watch watch every kept folder with its users.
func (k *keeper) follow() {
if k.watch == nil {
return
}
all, err := apply.KeptFolders.All()
if err != nil {
return
}
folders := map[string][]store.KeptUser{}
for path, f := range all {
if f.Kept && len(f.Want) > 0 {
folders[path] = f.Want
}
}
k.watch.Set(folders)
}
// startKeeping opens the watch and has the keeper say what it does. A machine without the watch is said so, and
// its sweep alone finds what is made.
func startKeeping(ctx context.Context, say func(string)) {
keeping.say = say
w, err := apply.NewWatcher()
if err != nil {
say(fmt.Sprintf("the kept folders are not watched (%v): the sweep alone finds what is made in them", err))
} else {
keeping.watch = w
go w.Run(ctx)
}
keeping.poke(ctx)
}
// accessActFrom is the take act as the controller asks it over the link (ADR 0325 §8): judged against the
// declaration this node keeps, and run beside the applies.
func accessActFrom(statePath string, timeout time.Duration) link.AccessActFunc {
return func(act link.AccessAct) (string, error) {
kept, err := store.ReadDeclared(store.DeclaredPath(statePath))
if errors.Is(err, store.ErrNothingDeclared) {
return "", errors.New("this node keeps no declaration, so it is declared no access")
}
if err != nil {
return "", err
}
d, err := declaration.Parse(kept.Declaration)
if err != nil {
return "", fmt.Errorf("the declaration this node keeps does not read: %w", err)
}
ctx, cancel := context.WithTimeout(context.Background(), timeout)
defer cancel()
_, said, err := apply.TakeFolder(ctx, d, act.Access, filepath.Clean(act.Path), act.Warrant, act.By,
apply.ExecRunner)
if err != nil {
fmt.Fprintf(os.Stderr, "mesh-host: the take act on %s was refused: %v\n", act.Access, err)
return "", err
}
return said, nil
}
}
// withWaiting is held with every id of waiting beside it: what liveness does not judge.
func withWaiting(held, waiting map[string]bool) map[string]bool {
if len(waiting) == 0 {
return held
}
out := map[string]bool{}
for id := range held {
out[id] = true
}
for id := range waiting {
out[id] = true
}
return out
}
cmd/mesh-host/kept_test.go
-117
View File
@@ -1,117 +0,0 @@
package main
import (
"context"
"encoding/json"
"os"
"path/filepath"
"strings"
"testing"
"time"
"github.com/novox/mesh-host/internal/apply"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/link"
"github.com/novox/mesh-host/internal/store"
)
// Row 4: the listing of a kept folder says, beside the tool runner's entry, that it stands for every module whose
// tools use the folder at the widest use (novox/hq ADR 0325 §4).
func TestTheListingSaysWhatTheToolRunnersEntryStandsFor(t *testing.T) {
entries := entriesOf([]store.KeptUser{
{Identity: "mesh-radarr", UID: 61001, Use: "read-write", From: declaration.FromContainer},
{Identity: "nox", UID: 61003, Use: "read-write", From: declaration.FromToolRunner},
})
if entries[0].Note != "" || !strings.Contains(entries[1].Note, "widest use") {
t.Fatalf("the listing: %+v", entries)
}
}
// Row 7, the engine's part: a folder that holds data and was never taken is said waiting with one wait of kind
// access — the access by its module's own id, the part its module, and words with no path (novox/hq ADR 0325 §7).
func TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind(t *testing.T) {
dir := t.TempDir()
lib := filepath.Join(dir, "movies")
if err := os.MkdirAll(filepath.Join(lib, "a film"), 0o755); err != nil {
t.Fatal(err)
}
// Run as root (the build seat's merge-check), the test's folders stand for an operator's, never root's.
if os.Geteuid() == 0 {
for _, p := range []string{dir, lib, filepath.Join(lib, "a film")} {
if err := os.Lchown(p, 65534, 65534); err != nil {
t.Fatal(err)
}
}
}
v := judgeAccess(judgedAccess{module: "radarr", id: "radarr.movies", name: "movies", path: lib,
users: []store.KeptUser{{Identity: "mesh-radarr", UID: 61001, Use: "read-write", From: "container"}}})
if v.state != link.StateWaiting || len(v.waits) != 1 {
t.Fatalf("not waiting with one wait: %+v", v)
}
raw, _ := json.Marshal(v.waits[0])
want := `{"kind":"access","access":"movies","part":"radarr","what":"let the mesh keep the shared folder movies",` +
`"placed":"` + v.waits[0].Placed + `","reason":"keep"}`
if string(raw) != want || !strings.HasPrefix(v.waits[0].Placed, "fs-") {
t.Fatalf("the wait reads %s", raw)
}
if strings.Contains(v.reason, dir) {
t.Fatalf("the reason names the path: %s", v.reason)
}
}
// An older controller's accesses (no users, no identities) are judged by nothing, as before ADR 0325: the statement
// carries no resource for them, waiting, unknown or kept-entries.
func TestAnOlderControllersAccessesSayNothing(t *testing.T) {
dir := t.TempDir()
d, err := declaration.Parse([]byte(`{"declaration":1,"resources":[
{"id":"radarr.library","type":"access","path":"` + filepath.Join(dir, "library") + `","mode":"read-write"},
{"id":"plex.movies","type":"access","path":"` + filepath.Join(dir, "absent") + `"}]}`))
if err != nil {
t.Fatal(err)
}
if err := os.Mkdir(filepath.Join(dir, "library"), 0o755); err != nil {
t.Fatal(err)
}
j := newAccessJudge()
j.set(d, nil)
if vs, _ := j.look(time.Now()); len(vs) != 0 {
t.Fatalf("an older controller's accesses are judged: %+v", vs)
}
}
// The waits' reasons and the tool runner's uid read here are said without words to parse (ADR 0325 §4, §7, §9).
func TestTheWaitsSayTheirReasonAndTheRunnersUid(t *testing.T) {
if link.ACLNeedsEnabling != apply.ACLNeedsEnabling || link.ACLUnsupported != apply.ACLUnsupported {
t.Fatal("the engine's ACL words are not the link's")
}
dir := t.TempDir()
was := apply.AccountIDs
apply.AccountIDs = func(context.Context, string) (int, int, bool, error) { return 61003, 1000, true, nil }
defer func() { apply.AccountIDs = was }()
d, err := declaration.Parse([]byte(`{"declaration":1,"resources":[{"id":"importer.books","type":"access",` +
`"path":"` + filepath.Join(dir, "no", "such") + `","mode":"read-write","users":[{"identity":"nox",` +
`"use":"read-write","from":"tool-runner"}]}]}`))
if err != nil {
t.Fatal(err)
}
j := newAccessJudge()
j.set(d, nil)
vs, _ := j.look(time.Now())
if len(vs) != 1 || len(vs[0].Entries) != 1 || vs[0].Entries[0].UID != 61003 {
t.Fatalf("the tool runner's uid read here is not said: %+v", vs)
}
// A folder whose disk is not there: its mount target named, not mounted.
disk := filepath.Join(dir, "disk")
if err := os.Mkdir(disk, 0o755); err != nil {
t.Fatal(err)
}
wasTargets := apply.MountTargets
apply.MountTargets = func(context.Context) []string { return []string{disk} }
defer func() { apply.MountTargets = wasTargets }()
v := judgeAccess(judgedAccess{module: "radarr", id: "radarr.movies", name: "movies",
path: filepath.Join(disk, "movies"), users: []store.KeptUser{{Identity: "mesh-radarr", UID: 61001,
Use: "read-write", From: "container"}}})
if len(v.waits) != 1 || v.waits[0].Reason != link.WaitDisk || link.WaitDisk != "disk" || link.WaitKeep != "keep" {
t.Fatalf("a disk wait does not say its reason: %+v", v.waits)
}
}
cmd/mesh-host/libraries.go
+274
View File
@@ -0,0 +1,274 @@
package main
import (
"context"
"errors"
"fmt"
"os"
"path/filepath"
"sort"
"sync"
"sync/atomic"
"time"
"github.com/novox/mesh-host/internal/apply"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/link"
"github.com/novox/mesh-host/internal/store"
)
// A library is judged on every look (novox/hq ADR 0328 §8, §9).
//
// Each library this machine is reached by is said as a resource `library:<name>` of kind library, with no module:
// healthy while it is kept (or, off its home, while its mount is there), waiting with an access wait of reason keep
// or disk, unknown while its filesystem could not be named, unhealthy otherwise. The root is the target, never in a
// reason nor in a wait's words: the controller says them on the operator's channel, which withholds a path (ADR
// 0234 §6). An access is judged by nothing, as before ADR 0325.
// libraryJudge reads every library on every look. Safe for the apply and the looking loop at once.
type libraryJudge struct {
mu sync.Mutex
libraries []declaration.Library
declared *declaration.Declaration
// was is each library's last verdict, with since when and how many looks in a row found it unhealthy.
was map[string]link.ResourceHealth
// reading guards inFlight: every library whose look has not returned yet.
reading sync.Mutex
inFlight map[string]bool
}
// accesses is the one library judge on this machine (its name from when it judged accesses).
var accesses = newLibraryJudge()
func newLibraryJudge() *libraryJudge {
return &libraryJudge{was: map[string]link.ResourceHealth{}, inFlight: map[string]bool{}}
}
// set is what the declaration just applied declares: every library. One no longer declared is forgotten.
func (j *libraryJudge) set(d *declaration.Declaration, _ map[string]bool) {
var ls []declaration.Library
if d != nil {
ls = append(ls, d.Libraries...)
}
sort.Slice(ls, func(a, b int) bool { return ls[a].Library < ls[b].Library })
j.mu.Lock()
defer j.mu.Unlock()
j.libraries, j.declared = ls, d
declared := map[string]bool{}
for _, l := range ls {
declared[apply.LibraryAccess(l.Library)] = true
}
for id := range j.was {
if !declared[id] {
delete(j.was, id)
}
}
}
// declaration is the declaration last set.
func (j *libraryJudge) declaration() *declaration.Declaration {
j.mu.Lock()
defer j.mu.Unlock()
return j.declared
}
// lookBound is how long a look waits for one library to answer. A hard network mount whose server is down blocks
// a stat for ever, and one library must never stop every health statement this machine makes.
var lookBound = 5 * time.Second
// verdict is one library's judgement in a look.
type verdict struct {
state, reason string
waits []link.AccessWait
act *link.AccessActRecord
}
// judgeBounded judges one library within lookBound, outside any lock. A look that has not answered is said so;
// while it still hangs, later looks start no other on the same library.
func (j *libraryJudge) judgeBounded(l declaration.Library) (verdict, bool) {
j.reading.Lock()
if j.inFlight[l.Library] {
j.reading.Unlock()
return verdict{}, false
}
j.inFlight[l.Library] = true
j.reading.Unlock()
done := make(chan verdict, 1)
go func() {
v := judgeLibrary(l)
j.reading.Lock()
delete(j.inFlight, l.Library)
j.reading.Unlock()
done <- v
}()
select {
case v := <-done:
return v, true
case <-time.After(lookBound):
return verdict{}, false
}
}
// judgeLibrary is one library's judgement now (ADR 0328 §7, §8, §9).
func judgeLibrary(l declaration.Library) verdict {
v := apply.JudgeLibrary(context.Background(), l)
access := apply.LibraryAccess(l.Library)
var out verdict
if a := v.Act; a != nil {
out.act = &link.AccessActRecord{Act: a.Act, Access: access, Warrant: a.Warrant, By: a.By, State: a.State,
Started: a.Started, Ended: a.Ended, Folders: a.Folders, Files: a.Files, Kept: a.Kept, Links: a.Links,
Other: a.Other, Mounts: a.Mounts, Shared: a.Shared, Linked: a.Linked, Stripped: a.Stripped, Why: a.Why}
}
switch v.Kind {
case apply.VerdictWaitKeep:
out.state, out.reason = link.StateWaiting, "its root holds data the mesh has not taken on the filesystem "+
"it is on now, and waits for the operator's word (novox/hq ADR 0328 §7, §8)"
out.waits = []link.AccessWait{{Kind: link.WaitKindAccess, Access: access, Part: l.Library,
What: apply.KeepWords(l.Library), Placed: v.Placed, Reason: link.WaitKeep}}
case apply.VerdictWaitDisk:
out.state, out.reason = link.StateWaiting, v.Why+" (novox/hq ADR 0328 §9)"
out.waits = []link.AccessWait{{Kind: link.WaitKindAccess, Access: access, Part: l.Library,
What: apply.DiskWords(l.Library), Reason: link.WaitDisk}}
case apply.VerdictUnknown:
// Not a fault and not the operator's: said as not known, and judged again on the next look.
out.state, out.reason = link.StateUnknown, v.Why+"; judged again on the next look"
case apply.VerdictBroken:
out.state, out.reason = link.StateUnhealthy, v.Why
default:
out.state = link.StateHealthy
switch {
case v.Act != nil && v.Act.State == link.ActRunning:
out.state, out.reason = link.StateStarting, "the take act is setting its group under its root"
case v.Act != nil && (v.Act.State == link.ActStopped || v.Act.State == link.ActFailed):
out.state, out.reason = link.StateStarting, "the take act goes on from where it stopped: "+v.Act.Why
}
}
return out
}
// look reads every library now. Whether any verdict changed since the last look, for the loop to say it.
func (j *libraryJudge) look(now time.Time) ([]link.ResourceHealth, bool) {
j.mu.Lock()
ls := append([]declaration.Library(nil), j.libraries...)
j.mu.Unlock()
read := make([]verdict, len(ls))
for i, l := range ls {
v, answered := j.judgeBounded(l)
if !answered {
v = verdict{state: link.StateUnknown, reason: "its root does not answer: judging it did not return " +
"within " + lookBound.String()}
}
read[i] = v
}
j.mu.Lock()
defer j.mu.Unlock()
changed := false
out := make([]link.ResourceHealth, 0, len(ls))
for i, l := range ls {
r := read[i]
id := apply.LibraryAccess(l.Library)
v := link.ResourceHealth{Resource: id, Kind: link.KindLibrary, Target: l.Root, State: r.state,
Reason: r.reason, Since: now.UTC(), AccessWaits: r.waits, Act: r.act}
if was, had := j.was[id]; had && was.State == r.state && was.Reason == r.reason {
v.Since = was.Since
v.Streak = was.Streak
} else {
changed = true
}
if r.state == link.StateUnhealthy {
v.Streak++
}
j.was[id] = v
out = append(out, v)
}
return out, changed
}
// withAccesses adds to a statement every library, as a resource of kind library.
func withAccesses(h *link.Health, vs []link.ResourceHealth) *link.Health {
h.Resources = append(h.Resources, vs...)
return h
}
// accessesHealthy says no library in vs is anything but healthy.
func accessesHealthy(vs []link.ResourceHealth) bool {
for _, v := range vs {
if v.State != link.StateHealthy {
return false
}
}
return true
}
// keeper goes on with take acts stopped at their bound, beside the applies, one at a time (ADR 0328 §7).
type keeper struct {
running atomic.Bool
say func(string)
}
// keeping is the one keeper on this machine.
var keeping = &keeper{say: func(string) {}}
// poke goes on with every stopped take act of the declaration last applied, unless that is running already.
func (k *keeper) poke(ctx context.Context) {
d := accesses.declaration()
if d == nil || len(d.Libraries) == 0 || !k.running.CompareAndSwap(false, true) {
return
}
go func() {
defer k.running.Store(false)
for _, line := range apply.ReconcileLibraries(ctx, d) {
k.say(line)
}
}()
}
// startKeeping has the keeper say what it does.
func startKeeping(ctx context.Context, say func(string)) {
keeping.say = say
keeping.poke(ctx)
}
// accessActFrom is the take act as the controller asks it over the link (ADR 0328 §7): judged against the
// declaration this node keeps, and run beside the applies.
func accessActFrom(statePath string, timeout time.Duration) link.AccessActFunc {
return func(act link.AccessAct) (string, error) {
kept, err := store.ReadDeclared(store.DeclaredPath(statePath))
if errors.Is(err, store.ErrNothingDeclared) {
return "", errors.New("this node keeps no declaration, so it is declared no library")
}
if err != nil {
return "", err
}
d, err := declaration.Parse(kept.Declaration)
if err != nil {
return "", fmt.Errorf("the declaration this node keeps does not read: %w", err)
}
ctx, cancel := context.WithTimeout(context.Background(), timeout)
defer cancel()
_, said, err := apply.TakeLibrary(ctx, d, act.Access, filepath.Clean(act.Path), act.Warrant, act.By)
if err != nil {
fmt.Fprintf(os.Stderr, "mesh-host: the take act on %s was refused: %v\n", act.Access, err)
return "", err
}
return said, nil
}
}
// withWaiting is held with every id of waiting beside it: what liveness does not judge.
func withWaiting(held, waiting map[string]bool) map[string]bool {
if len(waiting) == 0 {
return held
}
out := map[string]bool{}
for id := range held {
out[id] = true
}
for id := range waiting {
out[id] = true
}
return out
}
cmd/mesh-host/libraries_test.go
+56
View File
@@ -0,0 +1,56 @@
package main
import (
"encoding/json"
"os"
"path/filepath"
"strings"
"testing"
"time"
"github.com/novox/mesh-host/internal/apply"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/link"
)
// A library whose root holds data never taken is said waiting with one access wait: the access `library:<name>`, the
// part its name, words with no path, the filesystem's name, and reason keep (novox/hq ADR 0328 §8); one whose root
// is absent waits with reason disk (§9). Neither carries a module.
func TestALibrarySaysItsWaitWithoutWordsToParse(t *testing.T) {
was := apply.Libraries
apply.Libraries = apply.NewLibraryMemory()
defer func() { apply.Libraries = was }()
dir := t.TempDir()
root := filepath.Join(dir, "media")
if err := os.MkdirAll(filepath.Join(root, "a film"), 0o755); err != nil {
t.Fatal(err)
}
d, err := declaration.Parse([]byte(`{"declaration":1,"groups":[{"name":"mesh-media","gid":62000},` +
`{"name":"mesh-books","gid":62001}],"libraries":[` +
`{"library":"media","root":"` + root + `","group":"mesh-media","gid":62000,"home":true},` +
`{"library":"books","root":"` + filepath.Join(dir, "books") + `","group":"mesh-books","gid":62001,"home":true}],` +
`"owns_nothing":true,"resources":[]}`))
if err != nil {
t.Fatal(err)
}
j := newLibraryJudge()
j.set(d, nil)
vs, _ := j.look(time.Now())
if len(vs) != 2 {
t.Fatalf("the libraries are not said: %+v", vs)
}
books, media := vs[0], vs[1]
if media.Kind != link.KindLibrary || media.Resource != "library:media" || media.Module != "" ||
media.State != link.StateWaiting || len(media.AccessWaits) != 1 {
t.Fatalf("a library holding data is not said waiting: %+v", media)
}
raw, _ := json.Marshal(media.AccessWaits[0])
want := `{"kind":"access","access":"library:media","part":"media","what":"let the mesh keep the library media",` +
`"placed":"` + media.AccessWaits[0].Placed + `","reason":"keep"}`
if string(raw) != want || !strings.HasPrefix(media.AccessWaits[0].Placed, "fs-") {
t.Fatalf("the wait reads %s", raw)
}
if strings.Contains(media.Reason, dir) || len(books.AccessWaits) != 1 || books.AccessWaits[0].Reason != link.WaitDisk {
t.Fatalf("a missing root does not wait for its disk, or a reason names a path: %+v %+v", books, media)
}
}
cmd/mesh-host/main.go
+15 -16
View File
@@ -241,8 +241,8 @@ func run(ctx context.Context, command string, opts options) error {
// found (novox/hq issue 339). // found (novox/hq issue 339).
handedOverFrom(opts.state) handedOverFrom(opts.state)
foundState.Store(opts.state) foundState.Store(opts.state)
// And what it knows of the shared folders it keeps is beside its state (novox/hq ADR 0325 §5). // And what it knows of the libraries it keeps is beside its state (novox/hq ADR 0328 §6).
apply.KeptFolders = store.NewKeptFile(opts.state) apply.Libraries = store.NewLibraryFile(opts.state)
// And the guard asks the running container runtimes where they keep their data (novox/hq issue 339). // And the guard asks the running container runtimes where they keep their data (novox/hq issue 339).
apply.AskRuntimes = apply.ExecRunner apply.AskRuntimes = apply.ExecRunner
switch command { switch command {
@@ -1123,7 +1123,7 @@ func runLink(ctx context.Context, opts options) error {
// this process's, a `reconcile` run by hand, the installer's — reads it (novox/hq issue 224). // this process's, a `reconcile` run by hand, the installer's — reads it (novox/hq issue 224).
sched.RecordWindowsIn(apply.WindowsIn(filepath.Dir(opts.state))) sched.RecordWindowsIn(apply.WindowsIn(filepath.Dir(opts.state)))
go sched.Run(ctx) go sched.Run(ctx)
// The watch on every kept folder and the walks under them, beside the applies (novox/hq ADR 0325 §6, §8). // The take act's walks that stopped at their bound go on beside the applies (novox/hq ADR 0328 §7).
startKeeping(ctx, func(line string) { say(line) }) startKeeping(ctx, func(line string) { say(line) })
// The one liveness judge on this machine (novox/hq ADR 0240), made before anything applies: every // The one liveness judge on this machine (novox/hq ADR 0240), made before anything applies: every
@@ -1236,7 +1236,7 @@ func runLink(ctx context.Context, opts options) error {
// A read-only judgement of the directories this node is declared, asked by the controller (novox/hq // A read-only judgement of the directories this node is declared, asked by the controller (novox/hq
// issue 358): which the walk that follows no link another account could make would refuse. // issue 358): which the walk that follows no link another account could make would refuse.
JudgeDirectories: judgeDirectoriesFrom(opts.state), JudgeDirectories: judgeDirectoriesFrom(opts.state),
// The take act on an access's folder, on the operator's warrant (novox/hq ADR 0325 §8). // The take act on a library, on the operator's warrant (novox/hq ADR 0328 §7).
AccessAct: accessActFrom(opts.state, opts.timeout), AccessAct: accessActFrom(opts.state, opts.timeout),
Say: say, Say: say,
Timeout: opts.timeout, Timeout: opts.timeout,
@@ -1602,8 +1602,7 @@ const (
// judgeWhatRuns looks at every long-running resource every liveness.LookEvery and says the statement on // judgeWhatRuns looks at every long-running resource every liveness.LookEvery and says the statement on
// the bus when a state changed, again every minute while one is not healthy, and every five minutes // the bus when a state changed, again every minute while one is not healthy, and every five minutes
// anyway. A statement the bus did not take is said at the next look. It reads; it never acts (ADR 0240 // anyway. A statement the bus did not take is said at the next look. It reads; it never acts (ADR 0240
// rule 6) — but for the sweep of a kept folder, which ADR 0325 §10 has every look make: it puts back an entry or a // rule 6) — but for going on with a take act stopped at its bound (ADR 0328 §7), which runs beside it.
// mask an app narrowed, and nothing else.
func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, say link.Announce) { func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, say link.Announce) {
ticker := time.NewTicker(liveness.LookEvery) ticker := time.NewTicker(liveness.LookEvery)
defer ticker.Stop() defer ticker.Stop()
@@ -1642,8 +1641,8 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
} }
} }
} }
// Every access, judged on every look, its kept folder swept (novox/hq ADR 0325 §10); and a walk stopped // Every library, judged on every look (novox/hq ADR 0328 §8, §9); and a take act stopped at its bound
// at its bound goes on. // goes on, beside.
accessSt, accessesChanged := accesses.look(time.Now()) accessSt, accessesChanged := accesses.look(time.Now())
keeping.poke(ctx) keeping.poke(ctx)
owed = owed || accessesChanged owed = owed || accessesChanged
@@ -1700,10 +1699,10 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
// healthAsReported is a statement as the report and the event carry it. // healthAsReported is a statement as the report and the event carry it.
func healthAsReported(st liveness.Statement, ns *network.Statement) *link.Health { func healthAsReported(st liveness.Statement, ns *network.Statement) *link.Health {
// IdentityContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), judges a // LibraryContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), judges a
// user's declared `root` (novox/hq ADR 0266), and reads a declaration's identities, a container's identity and // user's declared `root` (novox/hq ADR 0266), and reads a declaration's identities, groups and libraries
// an access's users (novox/hq ADR 0325), which is what tells the controller it may be sent any of those fields. // (novox/hq ADR 0328), which is what tells the controller it may be sent any of those fields.
h := &link.Health{Contract: link.IdentityContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}} h := &link.Health{Contract: link.LibraryContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
for _, r := range st.Resources { for _, r := range st.Resources {
h.Resources = append(h.Resources, link.ResourceHealth{Module: r.Module, Resource: r.ID, Kind: r.Kind, h.Resources = append(h.Resources, link.ResourceHealth{Module: r.Module, Resource: r.ID, Kind: r.Kind,
Target: r.Target, State: r.State, Reason: r.Reason, Since: r.Since.UTC(), Streak: r.Streak, Target: r.Target, State: r.State, Reason: r.Reason, Since: r.Since.UTC(), Streak: r.Streak,
@@ -2084,9 +2083,9 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
// What runs here for a module, and how each is (novox/hq ADR 0240): judged from what was just // What runs here for a module, and how each is (novox/hq ADR 0240): judged from what was just
// applied, so every resource this apply started says `starting` and the gate waits for it. // applied, so every resource this apply started says `starting` and the gate waits for it.
if j := judging; j != nil { if j := judging; j != nil {
// A container that waits for an accessed folder not there was not created: the access says why, and // A container that waits for a library whose disk or mount is not there was not created: the library says
// liveness judges it neither alive nor dead (novox/hq ADR 0325 §9). // why, and liveness judges it neither alive nor dead (novox/hq ADR 0328 §9).
j.Set(liveness.LongRunning(declared, withWaiting(held, apply.WaitingOnAccess(declared)))) j.Set(liveness.LongRunning(declared, withWaiting(held, apply.WaitingOnLibrary(declared))))
st, _ := j.Look(ctx) st, _ := j.Look(ctx)
netJudge.declare(declaredResolvConf(declared)) netJudge.declare(declaredResolvConf(declared))
var netSt *network.Statement var netSt *network.Statement
@@ -2109,7 +2108,7 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
accountSt = &as accountSt = &as
} }
accesses.set(declared, held) accesses.set(declared, held)
// What the apply changed in who uses a kept folder is walked under it now, beside (ADR 0325 §8). // A take act stopped at its bound goes on, beside (ADR 0328 §7).
keeping.poke(ctx) keeping.poke(ctx)
accessSt, _ := accesses.look(time.Now()) accessSt, _ := accesses.look(time.Now())
report.Health = withAccesses(withFoundDirectories(withAccounts(withUnits(healthAsReported(st, netSt), unitSt), report.Health = withAccesses(withFoundDirectories(withAccounts(withUnits(healthAsReported(st, netSt), unitSt),
cmd/mesh-host/units_test.go
+4 -4
View File
@@ -87,10 +87,10 @@ func TestTheStatementSaysAnAccountJudgedForRoot(t *testing.T) {
Groups: []string{"openrazer"}}, State: accounts.Healthy, Since: at}, Groups: []string{"openrazer"}}, State: accounts.Healthy, Since: at},
}} }}
h := withAccounts(healthAsReported(liveness.Statement{At: at}, nil), as) h := withAccounts(healthAsReported(liveness.Statement{At: at}, nil), as)
// At RootContract or later: an engine that also reads identities and keeps shared folders says IdentityContract // At RootContract or later: an engine that also reads libraries says LibraryContract (novox/hq ADR 0328), one
// (novox/hq ADR 0325), one above ADR 0312's GrantContract. // above ADR 0325's IdentityContract.
if h.Contract < link.RootContract || link.RootContract != 3 || h.Contract != link.IdentityContract || if h.Contract < link.RootContract || link.RootContract != 3 || h.Contract != link.LibraryContract ||
link.IdentityContract != link.GrantContract+1 { link.LibraryContract != link.IdentityContract+1 {
t.Fatalf("contract %d", h.Contract) t.Fatalf("contract %d", h.Contract)
} }
got := map[string]string{} got := map[string]string{}
internal/apply/acl.go
-242
View File
@@ -1,242 +0,0 @@
package apply
// The POSIX ACL a kept folder carries, as the kernel stores it (novox/hq ADR 0325 §5, issue 567).
//
// **Read and written as the kernel's own extended attribute, never through setfacl.** Linux keeps a file's access
// ACL in the attribute system.posix_acl_access and a folder's default ACL in system.posix_acl_default, each a
// little-endian header (version 2) followed by entries of a tag, a permission and an id. The engine reads and
// writes them on a descriptor it opened itself (fgetxattr, fsetxattr), so a name swapped for a link between the
// look and the change changes nothing, and no program is run per file of a library of millions.
//
// **What the mesh changes is narrow.** It adds or sets one named-user entry per uid it keeps, widens the mask to
// what the entries need, and on a file with no ACL yet writes the owning group's entry as exactly the group bits
// the mode had: owner, owning group, the owner's bits, others' bits and every other entry stay as found.
import (
"encoding/binary"
"errors"
"fmt"
"sort"
)
// The attributes and the tags of the kernel's ACL format (linux/posix_acl_xattr.h).
const (
aclAccessXattr = "system.posix_acl_access"
aclDefaultXattr = "system.posix_acl_default"
aclVersion = 2
aclUserObj = 0x01
aclUser = 0x02
aclGroupObj = 0x04
aclGroup = 0x08
aclMask = 0x10
aclOther = 0x20
// aclUndefinedID is the id of an entry that names nobody: the owner, the owning group, the mask, others.
aclUndefinedID = 0xFFFFFFFF
)
// The permission bits of one entry.
const (
permRead = 4
permWrite = 2
permExec = 1
)
// aclEntry is one entry: its tag, its permission bits (rwx as 4, 2, 1) and, for a named user or group, its id.
type aclEntry struct {
Tag uint16
Perm uint16
ID uint32
}
// acl is a whole ACL as the kernel holds it.
type acl []aclEntry
// decodeACL reads an attribute's bytes. An attribute that is not version 2, or not whole entries, is refused.
func decodeACL(raw []byte) (acl, error) {
if len(raw) < 4 || (len(raw)-4)%8 != 0 {
return nil, fmt.Errorf("an ACL attribute of %d bytes is not a header and whole entries", len(raw))
}
if v := binary.LittleEndian.Uint32(raw); v != aclVersion {
return nil, fmt.Errorf("an ACL attribute of version %d, and the engine reads version %d", v, aclVersion)
}
out := make(acl, 0, (len(raw)-4)/8)
for at := 4; at < len(raw); at += 8 {
out = append(out, aclEntry{
Tag: binary.LittleEndian.Uint16(raw[at:]),
Perm: binary.LittleEndian.Uint16(raw[at+2:]),
ID: binary.LittleEndian.Uint32(raw[at+4:]),
})
}
return out, nil
}
// encode is the attribute's bytes, the entries in the order the kernel requires: by tag, then by id.
func (a acl) encode() []byte {
sorted := append(acl(nil), a...)
sort.SliceStable(sorted, func(i, j int) bool {
if sorted[i].Tag != sorted[j].Tag {
return sorted[i].Tag < sorted[j].Tag
}
return sorted[i].ID < sorted[j].ID
})
out := make([]byte, 4, 4+8*len(sorted))
binary.LittleEndian.PutUint32(out, aclVersion)
for _, e := range sorted {
var b [8]byte
binary.LittleEndian.PutUint16(b[0:], e.Tag)
binary.LittleEndian.PutUint16(b[2:], e.Perm)
binary.LittleEndian.PutUint32(b[4:], e.ID)
out = append(out, b[:]...)
}
return out
}
// minimalACL is the ACL a mode alone stands for: the owner's, the owning group's and others' bits.
func minimalACL(mode uint32) acl {
return acl{
{Tag: aclUserObj, Perm: uint16(mode>>6) & 7, ID: aclUndefinedID},
{Tag: aclGroupObj, Perm: uint16(mode>>3) & 7, ID: aclUndefinedID},
{Tag: aclOther, Perm: uint16(mode) & 7, ID: aclUndefinedID},
}
}
// find is the index of the entry with tag and id, or -1.
func (a acl) find(tag uint16, id uint32) int {
for i, e := range a {
if e.Tag == tag && (e.ID == id || (tag != aclUser && tag != aclGroup)) {
return i
}
}
return -1
}
// perm is the bits of the entry with tag and id, and whether there is one.
func (a acl) perm(tag uint16, id uint32) (uint16, bool) {
if i := a.find(tag, id); i >= 0 {
return a[i].Perm, true
}
return 0, false
}
// check refuses an ACL the kernel would: one owner's, owning group's and others' entry each, and a mask whenever
// a named entry is there.
func (a acl) check() error {
count := map[uint16]int{}
named := false
for _, e := range a {
count[e.Tag]++
if e.Tag == aclUser || e.Tag == aclGroup {
named = true
}
}
if count[aclUserObj] != 1 || count[aclGroupObj] != 1 || count[aclOther] != 1 || count[aclMask] > 1 {
return errors.New("an ACL without exactly one owner's, owning group's and others' entry")
}
if named && count[aclMask] != 1 {
return errors.New("an ACL with named entries and no mask")
}
return nil
}
// keptACL is a with the mesh's entries made: for each uid of need its entry set to exactly its bits, and the mask
// widened by what those entries need — never narrowed, so an app's wider mask stays. A mask already there keeps
// what it gave every other entry: one holding a bit the widening adds loses that bit alone; with none yet (a file the mode alone described) the mask starts at the owning
// group's bits, which minimalACL gave its entry, so the owning group keeps exactly the right its group bits gave.
// Nothing else is changed.
func keptACL(a acl, need map[uint32]uint16) acl {
out := append(acl(nil), a...)
var widen uint16
for uid, bits := range need {
widen |= bits
if i := out.find(aclUser, uid); i >= 0 {
out[i].Perm = bits
} else {
out = append(out, aclEntry{Tag: aclUser, Perm: bits, ID: uid})
}
}
if i := out.find(aclMask, 0); i >= 0 {
old := out[i].Perm
out[i].Perm |= widen
if added := out[i].Perm &^ old; added != 0 {
// **A wider mask widens nobody else.** The owning group's entry and every named entry the mesh does
// not set here were limited by the old mask: a file made at 0644 under a default ACL carries the
// owning group's rwx with a mask of r--. One mask serves them all, so an entry holding a bit the mask
// now adds cannot keep its effective right without losing that bit: exactly those bits are taken off
// it, and nothing else of it changes. An entry holding none of them is not touched at all.
for j := range out {
e := &out[j]
_, ours := need[e.ID]
if (e.Tag == aclGroupObj || e.Tag == aclGroup || (e.Tag == aclUser && !ours)) && e.Perm&added != 0 {
e.Perm &^= added
}
}
}
return out
}
if len(need) == 0 {
return out
}
group, _ := out.perm(aclGroupObj, 0)
return append(out, aclEntry{Tag: aclMask, Perm: group | widen, ID: aclUndefinedID})
}
// withoutUsers is a with the named-user entry of each uid of drop taken out, and nothing else changed: the mask
// stays as it was, so no other entry loses a right.
func withoutUsers(a acl, drop map[uint32]bool) acl {
out := make(acl, 0, len(a))
for _, e := range a {
if e.Tag == aclUser && drop[e.ID] {
continue
}
out = append(out, e)
}
return out
}
// effective is the right a uid has through a, given the file's owner and mode: the owner's bits for the owner,
// else its named entry limited by the mask, else nothing a named entry gives (the owning group's and others'
// rights are not the mesh's to count on). An ACL with no mask limits nothing.
func effective(a acl, uid, owner uint32, mode uint32) uint16 {
if uid == owner {
return uint16(mode>>6) & 7
}
bits, ok := a.perm(aclUser, uid)
if !ok {
return 0
}
if mask, has := a.perm(aclMask, 0); has {
bits &= mask
}
return bits
}
// needOn is what a use needs on a folder (read and enter; with read-write, write too) or on a file (read; with
// read-write, write): entering means nothing on a file, and an execute bit given to data would be a right nobody
// asked for.
func needOn(readWrite, folder bool) uint16 {
bits := uint16(permRead)
if readWrite {
bits |= permWrite
}
if folder {
bits |= permExec
}
return bits
}
// permWords is bits as ls writes them: "rwx", "r-x".
func permWords(bits uint16) string {
out := []byte("---")
if bits&permRead != 0 {
out[0] = 'r'
}
if bits&permWrite != 0 {
out[1] = 'w'
}
if bits&permExec != 0 {
out[2] = 'x'
}
return string(out)
}
internal/apply/apply.go
+87 -34
View File
@@ -262,7 +262,7 @@ func ApplyMindingWindows(
} }
report = Report{} report = Report{}
// **No module identity is root** (novox/hq ADR 0325 §11): an identity or a container told a root number refuses // **No module identity is root** (novox/hq ADR 0328 §15): an identity or a container told a root number refuses
// the declaration whole, before anything of it is made or started. // the declaration whole, before anything of it is made or started.
if err := refuseRootIdentities(d); err != nil { if err := refuseRootIdentities(d); err != nil {
return report, known, &Error{Resource: "the declaration's identities", Err: err, Done: report} return report, known, &Error{Resource: "the declaration's identities", Err: err, Done: report}
@@ -349,12 +349,8 @@ func ApplyMindingWindows(
case declaration.TypeUser: case declaration.TypeUser:
action, detail, err = removeUser(ctx, sys, orphan, run, wanted, handed) action, detail, err = removeUser(ctx, sys, orphan, run, wanted, handed)
case declaration.TypeAccess: case declaration.TypeAccess:
// The folder is left as it is: what the mesh added to it is taken out by the walk once no access names // The path is left as it is (novox/hq ADR 0051); what ADR 0312's grant put an account in is taken back.
// it (novox/hq ADR 0325 §8), never by removing the access's record.
action, detail = "forgotten", "an operator-owned path is never the host's to remove" action, detail = "forgotten", "an operator-owned path is never the host's to remove"
if _, kept := keptRecord(filepath.Clean(orphan.Target)); kept {
detail += "; the entries the mesh added go once no access names it"
}
gave, left, said := takeBackGranted(ctx, sys, orphan, run, wanted, handed) gave, left, said := takeBackGranted(ctx, sys, orphan, run, wanted, handed)
if said != "" { if said != "" {
detail = joinDetail(detail, said) detail = joinDetail(detail, said)
@@ -539,13 +535,6 @@ func ApplyMindingWindows(
// which declared directories were already here: one this apply makes is the mesh's, one found may not be. // which declared directories were already here: one this apply makes is the mesh's, one found may not be.
refreshRuntimeRoots(ctx) refreshRuntimeRoots(ctx)
in.refused = refusedPlaces(d.Resources) in.refused = refusedPlaces(d.Resources)
// What every declared access asks of its folder, several accesses of one folder as one (novox/hq ADR 0325 §5),
// and every accessed folder, which no container mounts while it is not there (§9).
// Every tool runner's account that came with no number, read by name here (ADR 0325 §4).
in.runners = ResolveRunners(ctx, d)
in.folders = foldersOf(d.Resources, in.refused)
in.identities = len(d.Identities) > 0
in.accesses = accessPaths(d.Resources, in.refused, in.identities)
in.agentHomes = rootNeverHomes(d) in.agentHomes = rootNeverHomes(d)
in.dirsBefore = map[string]bool{} in.dirsBefore = map[string]bool{}
for _, resource := range d.Resources { for _, resource := range d.Resources {
@@ -587,17 +576,46 @@ func ApplyMindingWindows(
sort.Strings(out) sort.Strings(out)
return out return out
} }
// **Every module's identity is made before anything of it is applied** (novox/hq ADR 0325 §3): a directory // **Every library's group, then every module's identity, is made before anything of it is applied** (novox/hq
// it owns is given to it, and a container is told to run as it. One that cannot be made — its name or numbers // ADR 0328 §3, §4): a directory a module owns is given to it, and its user is in its libraries' groups. One that
// another's here — fails, naming whose, and its module is not attempted; the rest of the machine is. // cannot be made — its name or numbers another's here — fails, naming whose, and what needs it is not
// attempted; the rest of the machine is.
var identityFailures []*Error var identityFailures []*Error
if len(d.Identities) > 0 { brokenGroups := map[int]bool{}
if len(d.Groups) > 0 || len(d.Identities) > 0 {
tool, toolErr := toolFor(sys) tool, toolErr := toolFor(sys)
for _, id := range d.Identities { for _, g := range d.Groups {
var outcome Outcome var outcome Outcome
err := toolErr err := toolErr
if err == nil { if err == nil {
outcome, err = applyIdentity(ctx, tool, id, &known, run) outcome, err = applyGroup(ctx, tool, g, &known, run)
}
if err != nil {
identityFailures = append(identityFailures, &Error{Resource: "group " + g.Name, Err: err})
log(fmt.Sprintf(" failed group %s: %v", g.Name, err))
brokenGroups[g.GID] = true
continue
}
report.Outcomes = append(report.Outcomes, outcome)
if outcome.Action != "unchanged" {
log(fmt.Sprintf(" %s %s: %s", outcome.Action, outcome.ID, outcome.Detail))
}
}
names := map[int]string{}
for _, g := range d.Groups {
names[g.GID] = g.Name
}
for _, id := range d.Identities {
var outcome Outcome
err := toolErr
for _, gid := range append([]int{id.GID}, id.Groups...) {
if brokenGroups[gid] && err == nil {
err = fmt.Errorf("its library group %s could not be made; nothing of the module was attempted",
names[gid])
}
}
if err == nil {
outcome, err = applyIdentity(ctx, tool, id, names, &known, run)
} }
if err != nil { if err != nil {
// Counted with the others once the resources are through: here, before the guard, it would read // Counted with the others once the resources are through: here, before the guard, it would read
@@ -615,6 +633,37 @@ func ApplyMindingWindows(
} }
} }
} }
// **Every library this machine is reached by, before anything mounts it** (ADR 0328 §6, §9, §11): kept on its
// home, its tool runner's account in its group, and the containers that mount one whose disk or mount is not
// there held. A tool runner that joined a group is a change of `library:<name>`, which the tool runner's unit
// names under restart-on to be restarted once.
verdicts := map[string]libraryVerdict{}
for _, l := range d.Libraries {
outcome, v, err := applyLibrary(ctx, l)
verdicts[l.Library] = v
if err == nil {
var moved bool
var said string
moved, said, err = joinRunner(ctx, sys, l, &known, run)
if moved {
changed[LibraryAccess(l.Library)] = true
outcome.Detail = joinDetail(outcome.Detail, said)
if outcome.Action == "unchanged" {
outcome.Action = "updated"
}
}
}
if err != nil {
identityFailures = append(identityFailures, &Error{Resource: LibraryAccess(l.Library), Err: err})
log(fmt.Sprintf(" failed %s (%s): %v", LibraryAccess(l.Library), l.Root, err))
continue
}
report.Outcomes = append(report.Outcomes, outcome)
if outcome.Action != "unchanged" {
log(fmt.Sprintf(" %s %s (%s): %s", outcome.Action, outcome.ID, outcome.Target, outcome.Detail))
}
}
in.held = heldRoots(verdicts, d.Libraries)
for i, resource := range ordered { for i, resource := range ordered {
if !orphansRemoved && i == guardFirst { if !orphansRemoved && i == guardFirst {
// **Only a guard that is up may let the filter go.** Removing the derived filter's // **Only a guard that is up may let the filter go.** Removing the derived filter's
@@ -1001,14 +1050,22 @@ func ApplyMindingWindows(
// Only the mesh says what is assigned: a carried bundle's silence undeclares no identity and no folder. // Only the mesh says what is assigned: a carried bundle's silence undeclares no identity and no folder.
if origin == store.OriginDeclared { if origin == store.OriginDeclared {
// A folder no access names any more has what the mesh added taken out by the next walk (ADR 0325 §8). // A tool runner no longer put in a library's group leaves it (ADR 0328 §11, ADR 0252 §3).
forgetUndeclared(in.folders) for _, o := range leaveRunners(ctx, sys, d.Libraries, &known, run, wanted) {
// And an identity no longer declared goes, once what ran as it went above (ADR 0325 §3). report.Outcomes = append(report.Outcomes, o)
log(fmt.Sprintf(" %s %s: %s", o.Action, o.ID, o.Detail))
}
// And an identity, then a library group, no longer declared goes, once what ran as it went above (ADR 0328
// §3, §4).
if tool, err := toolFor(sys); err == nil { if tool, err := toolFor(sys); err == nil {
for _, o := range removeIdentities(ctx, tool, d.Identities, &known, run) { for _, o := range removeIdentities(ctx, tool, d.Identities, &known, run) {
report.Outcomes = append(report.Outcomes, o) report.Outcomes = append(report.Outcomes, o)
log(fmt.Sprintf(" %s %s: %s", o.Action, o.ID, o.Detail)) log(fmt.Sprintf(" %s %s: %s", o.Action, o.ID, o.Detail))
} }
for _, o := range removeGroups(ctx, tool, d.Groups, &known, run) {
report.Outcomes = append(report.Outcomes, o)
log(fmt.Sprintf(" %s %s: %s", o.Action, o.ID, o.Detail))
}
} }
} }
@@ -1139,12 +1196,13 @@ func applyOne(ctx context.Context, sys system.System, r declaration.Resource, ru
if err := refuseMounts(res, in.refused); err != nil { if err := refuseMounts(res, in.refused); err != nil {
return begin(r), err return begin(r), err
} }
// Not created over an accessed folder not there, which the runtime would make as root (novox/hq ADR 0325 §9). // Not created over a library whose disk or mount is not there: the runtime would make the root as root,
if id := mountsMissing(ctx, res, in.accesses); id != "" { // and the container's writes would land on the filesystem below (novox/hq ADR 0328 §9).
if name := mountsHeld(res, in.held); name != "" {
out := begin(r) out := begin(r)
out.Action = "waiting" out.Action = "waiting"
out.Detail = "not created: it mounts the access " + id + ", whose folder or its disk is not there; " + out.Detail = "not created: it mounts the library " + name + ", whose disk or mount is not there; " +
"created once it is (novox/hq ADR 0325 §9)" "created once it is (novox/hq ADR 0328 §9)"
return out, nil return out, nil
} }
} }
@@ -2196,14 +2254,9 @@ type inputs struct {
// dirsBefore is every declared directory that was on the machine when this apply began (novox/hq issue // dirsBefore is every declared directory that was on the machine when this apply began (novox/hq issue
// 339): one the apply itself made — a file's parent — is the mesh's, one that was there may not be. // 339): one the apply itself made — a file's parent — is the mesh's, one that was there may not be.
dirsBefore map[string]bool dirsBefore map[string]bool
// folders is what every declared access asks of its folder, by path (novox/hq ADR 0325 §5); accesses every // held is the root of every library whose disk or mount is not there, with its name: no container that mounts
// accessed folder with its access's id, which no container mounts while it is not there (§9). // it is created (novox/hq ADR 0328 §9).
folders map[string]*folderWant held map[string]string
// identities is that the declaration carries identities: its controller speaks ADR 0325 for every access.
identities bool
// runners is every access refused for its tool runner's account (not here, or root's), by id.
runners map[string]error
accesses map[string]string
// handed is every group a record that went this apply handed to a resource still asking for it. // handed is every group a record that went this apply handed to a resource still asking for it.
handed Handed handed Handed
} }
internal/apply/contract_test.go
-128
View File
@@ -1,128 +0,0 @@
//go:build linux
package apply
import (
"context"
"os"
"path/filepath"
"strings"
"testing"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
)
// The contract the controller needs (novox/hq ADR 0325, issue 567): what it cannot know is read here, and what it
// names is matched as it names it.
// accountsHere stands in for the machine's user database: name → uid, gid.
func accountsHere(t *testing.T, known map[string][2]int) {
t.Helper()
was := AccountIDs
AccountIDs = func(_ context.Context, name string) (int, int, bool, error) {
ids, ok := known[name]
return ids[0], ids[1], ok, nil
}
t.Cleanup(func() { AccountIDs = was })
}
// A tool runner's account comes with its name alone: its uid is read here, and its entry kept with it.
func TestAToolRunnersAccountIsReadByName(t *testing.T) {
dir := aclFolder(t)
keeping(t, nil, nil)
accountsHere(t, map[string][2]int{"nox": {runner, 1000}})
lib := filepath.Join(dir, "books")
if err := os.Mkdir(lib, 0o755); err != nil {
t.Fatal(err)
}
a := `{"id":"importer.books","type":"access","path":"` + lib + `","mode":"read-write","users":[` +
`{"identity":"nox","use":"read-write","from":"tool-runner"}]}`
if _, _, err := applyAccesses(t, store.State{}, a); err != nil {
t.Fatal(err)
}
if got := effectiveOn(t, lib, runner); got != 7 {
t.Fatalf("the tool runner's account read by name may %s", permWords(got))
}
if rec, _ := keptRecord(lib); len(rec.Want) != 1 || rec.Want[0].UID != runner {
t.Errorf("the uid read is not what is kept: %+v", rec.Want)
}
}
// One that is not here, or is root's, refuses its access, naming why, and gives nothing an entry.
func TestAToolRunnersAccountThatIsNotHereOrIsRootsIsRefused(t *testing.T) {
was := RootGroupIDs
RootGroupIDs = func() map[int]string { return map[int]string{10: "wheel"} }
defer func() { RootGroupIDs = was }()
for name, says := range map[string]string{"ghost": "not on this machine", "root": "never root",
"admin": "root group"} {
dir := aclFolder(t)
keeping(t, nil, nil)
accountsHere(t, map[string][2]int{"root": {0, 0}, "admin": {1001, 10}})
lib := filepath.Join(dir, "books")
if err := os.Mkdir(lib, 0o755); err != nil {
t.Fatal(err)
}
a := `{"id":"importer.books","type":"access","path":"` + lib + `","mode":"read-write","users":[` +
`{"identity":"` + name + `","use":"read-write","from":"tool-runner"}]}`
_, _, err := applyAccesses(t, store.State{}, a)
if err == nil || !strings.Contains(err.Error(), says) {
t.Errorf("%s: not refused saying %q: %v", name, says, err)
}
if n := len(readACLsOrNil(t, lib)); n > 3 {
t.Errorf("%s: an entry was kept", name)
}
}
// And only a tool runner's account may come without a number.
if _, err := declaration.Parse([]byte(`{"declaration":1,"resources":[{"id":"m.a","type":"access","path":"/srv/x",` +
`"mode":"read-write","users":[{"identity":"mesh-m","use":"read","from":"container"}]}]}`)); err == nil {
t.Error("a container's identity without a uid was accepted")
}
}
func readACLsOrNil(t *testing.T, path string) acl {
a, _, _ := readACLs(t, path)
return a
}
// The take act names its access by the declared resource id exactly, `/` and all; anything not declared is refused.
func TestTheTakeActMatchesTheDeclaredAccessId(t *testing.T) {
dir := aclFolder(t)
keeping(t, nil, nil)
lib := filepath.Join(dir, "movies")
if err := os.MkdirAll(filepath.Join(lib, "a film"), 0o755); err != nil {
t.Fatal(err)
}
id := "radarr.access-services/media/movies"
a := `{"id":"` + id + `","type":"access","path":"` + lib + `","mode":"read-write","users":[` +
`{"identity":"mesh-radarr","uid":61001,"use":"read-write","from":"container"}]}`
toUser(t)
if _, _, err := TakeFolder(context.Background(), declare(t, a), "radarr.access-services/media", lib, "w", "op",
noServices); err == nil {
t.Fatal("an access not declared was taken")
}
toUser(t)
done, _, err := TakeFolder(context.Background(), declare(t, a), id, lib, "w", "op", noServices)
if err != nil {
t.Fatalf("the declared id with a slash was refused: %v", err)
}
<-done
}
// The words a keep wait says of ACLs: only a ZFS dataset is one the take act lets carry them.
func TestAKeepWaitSaysWhetherTheTakeActCanAllowACLs(t *testing.T) {
if aclWord("tank/media", "zfs") != ACLNeedsEnabling || aclWord("/dev/sdb1", "ext4") != ACLUnsupported ||
aclWord("", "zfs") != ACLUnsupported {
t.Fatal("the ACL words are not what the take act can do")
}
dir := aclFolder(t) // carries ACLs: the wait says nothing of them
keeping(t, nil, nil)
lib := filepath.Join(dir, "music")
if err := os.MkdirAll(filepath.Join(lib, "album"), 0o755); err != nil {
t.Fatal(err)
}
toUser(t)
if v := AccessVerdict(context.Background(), lib, false, true); v.Kind != VerdictWaitKeep || v.ACL != "" {
t.Fatalf("a folder whose filesystem allows ACLs is said %+v", v)
}
}
internal/apply/identities.go
+151 -22
View File
@@ -14,7 +14,7 @@ import (
"github.com/novox/mesh-host/internal/system" "github.com/novox/mesh-host/internal/system"
) )
// Every module is given an identity of its own (novox/hq ADR 0325 §3, §11, issue 567). // Every module is given an identity of its own (novox/hq ADR 0328 §3, §4, §15, issue 567).
// //
// The controller allocates each module a user and a group number once, from a range of its own, the same on every // The controller allocates each module a user and a group number once, from a range of its own, the same on every
// machine, and declares them as `mesh-<module>`. The engine makes the group and the account with exactly those // machine, and declares them as `mesh-<module>`. The engine makes the group and the account with exactly those
@@ -32,7 +32,8 @@ import (
// accountsTool is how the engine reads and changes the machine's accounts: the system's own tools through the // accountsTool is how the engine reads and changes the machine's accounts: the system's own tools through the
// runner, which is what a test stands in for. // runner, which is what a test stands in for.
type accountsTool interface { type accountsTool interface {
CreateSystemAccount(ctx context.Context, run system.Runner, name string, uid, gid int) error CreateSystemAccount(ctx context.Context, run system.Runner, name string, uid, gid int, groups []string) error
ModifyAccount(ctx context.Context, run system.Runner, name string, gid int, groups []string) error
CreateSystemGroup(ctx context.Context, run system.Runner, name string, gid int) error CreateSystemGroup(ctx context.Context, run system.Runner, name string, gid int) error
RemoveAccount(ctx context.Context, run system.Runner, name string) error RemoveAccount(ctx context.Context, run system.Runner, name string) error
RemoveGroup(ctx context.Context, run system.Runner, name string) error RemoveGroup(ctx context.Context, run system.Runner, name string) error
@@ -75,9 +76,22 @@ func lookUp(ctx context.Context, run Runner, database, key string) (entry, bool,
func refuseRootIdentities(d *declaration.Declaration) error { func refuseRootIdentities(d *declaration.Declaration) error {
var problems []string var problems []string
for _, id := range d.Identities { for _, id := range d.Identities {
if err := rootIdentity(id.UID, id.GID); err != nil { // Its user's number, its own group's (the same number), its primary group and every added group.
if err := rootIdentity(id.UID, id.UID); err != nil {
problems = append(problems, fmt.Sprintf("the identity %s: %v", id.Name, err)) problems = append(problems, fmt.Sprintf("the identity %s: %v", id.Name, err))
} }
for _, gid := range append([]int{id.GID}, id.Groups...) {
if why := rootGroup(gid); why != "" {
problems = append(problems, fmt.Sprintf("the identity %s is given gid %s, and a module's identity "+
"is never in a root group (novox/hq ADR 0328 §15)", id.Name, why))
}
}
}
for _, g := range d.Groups {
if why := rootGroup(g.GID); why != "" {
problems = append(problems, fmt.Sprintf("the library group %s is gid %s, and a library's group is never a "+
"root group (novox/hq ADR 0328 §15)", g.Name, why))
}
} }
for _, r := range d.Resources { for _, r := range d.Resources {
if c, ok := r.(*declaration.Container); ok && c.RunAs != nil { if c, ok := r.(*declaration.Container); ok && c.RunAs != nil {
@@ -94,10 +108,13 @@ func refuseRootIdentities(d *declaration.Declaration) error {
return fmt.Errorf("%s; nothing of this declaration was made or started", strings.Join(problems, "; ")) return fmt.Errorf("%s; nothing of this declaration was made or started", strings.Join(problems, "; "))
} }
// applyIdentity makes one identity as declared, or refuses it naming whose the name or the numbers are. What it // applyIdentity makes one identity as declared (ADR 0328 §4): its own group `mesh-<module>` with the number of its
// made is recorded on known; an identity already right is unchanged. // uid, and its user with that uid, its primary group gid (its own, or its first library's) and its other libraries'
func applyIdentity(ctx context.Context, tool accountsTool, id declaration.Identity, known *store.State, // groups as added groups — or refuses it naming whose the name or the numbers are. A user the engine made is given
run Runner) (Outcome, error) { // a changed primary or added groups; one that was there before is never changed, and is refused if it is not as
// declared. What it made is recorded on known; an identity already right is unchanged.
func applyIdentity(ctx context.Context, tool accountsTool, id declaration.Identity, names map[int]string,
known *store.State, run Runner) (Outcome, error) {
out := Outcome{ID: "identity " + id.Name, Type: "identity", Target: id.Name, Action: "unchanged"} out := Outcome{ID: "identity " + id.Name, Type: "identity", Target: id.Name, Action: "unchanged"}
user, hasUser, err := lookUp(ctx, run, "passwd", id.Name) user, hasUser, err := lookUp(ctx, run, "passwd", id.Name)
if err != nil { if err != nil {
@@ -111,42 +128,74 @@ func applyIdentity(ctx context.Context, tool accountsTool, id declaration.Identi
if err != nil { if err != nil {
return out, err return out, err
} }
byGID, gidUsed, err := lookUp(ctx, run, "group", strconv.Itoa(id.GID)) byGID, gidUsed, err := lookUp(ctx, run, "group", strconv.Itoa(id.UID))
if err != nil { if err != nil {
return out, err return out, err
} }
const never = "; nothing was made, and nothing of the module was attempted (novox/hq ADR 0325 §3)" rec := madeIdentity(known, id.Name)
const never = "; nothing was made, and nothing of the module was attempted (novox/hq ADR 0328 §4)"
switch { switch {
case hasUser && (user.id != id.UID || user.prim != id.GID): case hasUser && user.id != id.UID:
return out, fmt.Errorf("the account %s is here with uid %d and group %d, and the mesh allocated uid %d, "+ return out, fmt.Errorf("the account %s is here with uid %d, and the mesh allocated uid %d%s", id.Name,
"gid %d%s", id.Name, user.id, user.prim, id.UID, id.GID, never) user.id, id.UID, never)
case hasGroup && group.id != id.GID: case hasUser && user.prim != id.GID && !rec.MadeUser:
return out, fmt.Errorf("the group %s is here with gid %d, and the mesh allocated gid %d%s", id.Name, return out, fmt.Errorf("the account %s is here with group %d, was not made by the mesh, and the mesh "+
group.id, id.GID, never) "gives it group %d%s", id.Name, user.prim, id.GID, never)
case hasGroup && group.id != id.UID:
return out, fmt.Errorf("the group %s is here with gid %d, and a module's own group has its uid, %d%s",
id.Name, group.id, id.UID, never)
case uidUsed && byUID.name != id.Name: case uidUsed && byUID.name != id.Name:
return out, fmt.Errorf("uid %d is the account %s's here, and the mesh allocated it to %s%s", id.UID, return out, fmt.Errorf("uid %d is the account %s's here, and the mesh allocated it to %s%s", id.UID,
byUID.name, id.Name, never) byUID.name, id.Name, never)
case gidUsed && byGID.name != id.Name: case gidUsed && byGID.name != id.Name:
return out, fmt.Errorf("gid %d is the group %s's here, and the mesh allocated it to %s%s", id.GID, return out, fmt.Errorf("gid %d is the group %s's here, and the mesh allocated it to %s%s", id.UID,
byGID.name, id.Name, never) byGID.name, id.Name, never)
} }
rec := madeIdentity(known, id.Name) added := make([]string, 0, len(id.Groups))
for _, gid := range id.Groups {
added = append(added, names[gid])
}
sort.Strings(added)
rec.Module, rec.Name, rec.UID, rec.GID = id.Module, id.Name, id.UID, id.GID rec.Module, rec.Name, rec.UID, rec.GID = id.Module, id.Name, id.UID, id.GID
var made []string var made []string
if !hasGroup { if !hasGroup {
if err := tool.CreateSystemGroup(ctx, run, id.Name, id.GID); err != nil { if err := tool.CreateSystemGroup(ctx, run, id.Name, id.UID); err != nil {
return out, err return out, err
} }
rec.MadeGroup = true rec.MadeGroup = true
made = append(made, fmt.Sprintf("the group (gid %d)", id.GID)) made = append(made, fmt.Sprintf("its own group (gid %d)", id.UID))
} }
if !hasUser { if !hasUser {
if err := tool.CreateSystemAccount(ctx, run, id.Name, id.UID, id.GID); err != nil { if err := tool.CreateSystemAccount(ctx, run, id.Name, id.UID, id.GID, added); err != nil {
recordIdentity(known, rec) recordIdentity(known, rec)
return out, err return out, err
} }
rec.MadeUser = true rec.MadeUser = true
made = append(made, fmt.Sprintf("the account (uid %d), with no login, no home and no password", id.UID)) made = append(made, fmt.Sprintf("the account (uid %d, group %d%s), with no login, no home and no password",
id.UID, id.GID, alsoIn(added)))
} else if rec.MadeUser {
// The mesh's own account: its primary and added groups follow what is declared.
in, err := system.GroupsOf(ctx, system.Runner(run), id.Name)
if err != nil {
return out, err
}
have := map[string]bool{}
for _, g := range in {
if g != id.Name && g != names[user.prim] {
have[g] = true
}
}
same := user.prim == id.GID && len(have) == len(added)
for _, g := range added {
same = same && have[g]
}
if !same {
if err := tool.ModifyAccount(ctx, run, id.Name, id.GID, added); err != nil {
return out, err
}
out.Action = "updated"
out.Detail = fmt.Sprintf("gave the account group %d%s", id.GID, alsoIn(added))
}
} }
if rec.At.IsZero() { if rec.At.IsZero() {
rec.At = time.Now().UTC() rec.At = time.Now().UTC()
@@ -154,12 +203,92 @@ func applyIdentity(ctx context.Context, tool accountsTool, id declaration.Identi
recordIdentity(known, rec) recordIdentity(known, rec)
if len(made) > 0 { if len(made) > 0 {
out.Action, out.Detail = "created", "made "+strings.Join(made, " and ") out.Action, out.Detail = "created", "made "+strings.Join(made, " and ")
} else { } else if out.Detail == "" {
out.Detail = "here with its numbers" out.Detail = "here with its numbers"
} }
return out, nil return out, nil
} }
func alsoIn(groups []string) string {
if len(groups) == 0 {
return ""
}
return ", also in " + strings.Join(groups, ", ")
}
// applyGroup makes one library's group with the number the controller allocated (ADR 0328 §3), or refuses it naming
// whose the name or the number is, or that the number is a root group's (§15). What it made is recorded on known.
func applyGroup(ctx context.Context, tool accountsTool, g declaration.Group, known *store.State,
run Runner) (Outcome, error) {
out := Outcome{ID: "group " + g.Name, Type: "group", Target: g.Name, Action: "unchanged"}
if why := rootGroup(g.GID); why != "" {
return out, fmt.Errorf("its gid is %s, and a library's group is never a root group (novox/hq ADR 0328 §15); "+
"nothing was made", why)
}
byName, hasName, err := lookUp(ctx, run, "group", g.Name)
if err != nil {
return out, err
}
byGID, gidUsed, err := lookUp(ctx, run, "group", strconv.Itoa(g.GID))
if err != nil {
return out, err
}
switch {
case hasName && byName.id != g.GID:
return out, fmt.Errorf("the group %s is here with gid %d, and the mesh allocated gid %d; nothing was made",
g.Name, byName.id, g.GID)
case gidUsed && byGID.name != g.Name:
return out, fmt.Errorf("gid %d is the group %s's here, and the mesh allocated it to %s; nothing was made",
g.GID, byGID.name, g.Name)
case hasName:
out.Detail = "here with its number"
return out, nil
}
if err := tool.CreateSystemGroup(ctx, run, g.Name, g.GID); err != nil {
return out, err
}
known.Groups = append(known.Groups, store.MadeGroup{Name: g.Name, GID: g.GID, At: time.Now().UTC()})
out.Action, out.Detail = "created", fmt.Sprintf("made the library's group (gid %d)", g.GID)
return out, nil
}
// removeGroups removes every library group the engine made that is no longer declared, while it still has the
// number the engine gave it. Never fatal: one that could not be removed (still a user's primary group) stays
// recorded, said, for the next apply.
func removeGroups(ctx context.Context, tool accountsTool, declared []declaration.Group, known *store.State,
run Runner) []Outcome {
wanted := map[string]bool{}
for _, g := range declared {
wanted[g.Name] = true
}
var out []Outcome
var keep []store.MadeGroup
for _, m := range known.Groups {
if wanted[m.Name] {
keep = append(keep, m)
continue
}
o := Outcome{ID: "group " + m.Name, Type: "group", Target: m.Name, Action: "removed",
Detail: "no longer declared: removed the group"}
g, has, err := lookUp(ctx, run, "group", m.Name)
switch {
case err != nil || (has && g.id != m.GID):
o.Action, o.Detail = "forgotten", "no longer declared: the group was left, it no longer has the gid the "+
"mesh gave it, or the database did not answer"
case has:
if err := tool.RemoveGroup(ctx, run, m.Name); err != nil {
o.Action, o.Detail = "waiting", "no longer declared: the group could not be removed: "+err.Error()
keep = append(keep, m)
}
default:
o.Action, o.Detail = "forgotten", "no longer declared, and no longer here"
}
out = append(out, o)
}
known.Groups = keep
return out
}
// madeIdentity is what the engine recorded of name, or an empty record. // madeIdentity is what the engine recorded of name, or an empty record.
func madeIdentity(known *store.State, name string) store.MadeIdentity { func madeIdentity(known *store.State, name string) store.MadeIdentity {
for _, m := range known.Identities { for _, m := range known.Identities {
internal/apply/identities_test.go
+103 -5
View File
@@ -11,6 +11,7 @@ import (
"github.com/novox/mesh-host/internal/declaration" "github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store" "github.com/novox/mesh-host/internal/store"
"github.com/novox/mesh-host/internal/system"
) )
// The engine's half of ADR 0325 §3 and §11 (issue 567): every module given an account and a group of its own with // The engine's half of ADR 0325 §3 and §11 (issue 567): every module given an account and a group of its own with
@@ -19,7 +20,20 @@ import (
// accountsMachine is a user and group database the runner answers from, and every command that changed it. // accountsMachine is a user and group database the runner answers from, and every command that changed it.
type accountsMachine struct { type accountsMachine struct {
users, groups map[string][2]int // name → id, primary gid (a group's second is unused) users, groups map[string][2]int // name → id, primary gid (a group's second is unused)
ran []string // in is each account's added groups, by name; homes each account's home, "/" when not set.
in map[string][]string
homes map[string]string
ran []string
}
// groupNamed is the name of gid in m, or the number.
func (m *accountsMachine) groupNamed(gid int) string {
for n, ids := range m.groups {
if ids[0] == gid {
return n
}
}
return strconv.Itoa(gid)
} }
func (m *accountsMachine) run(_ context.Context, name string, args ...string) (string, error) { func (m *accountsMachine) run(_ context.Context, name string, args ...string) (string, error) {
@@ -36,14 +50,55 @@ func (m *accountsMachine) run(_ context.Context, name string, args ...string) (s
if db == "group" { if db == "group" {
return n + ":x:" + strconv.Itoa(ids[0]) + ":\n", nil return n + ":x:" + strconv.Itoa(ids[0]) + ":\n", nil
} }
return n + ":x:" + strconv.Itoa(ids[0]) + ":" + strconv.Itoa(ids[1]) + "::/:/usr/bin/nologin\n", nil home := m.homes[n]
if home == "" {
home = "/"
}
return n + ":x:" + strconv.Itoa(ids[0]) + ":" + strconv.Itoa(ids[1]) + "::" + home + ":/usr/bin/nologin\n", nil
} }
} }
return "", errors.New("getent exited 2") return "", errors.New("getent exited 2")
case "id":
name := args[len(args)-1]
u, ok := m.users[name]
if !ok {
return "", errors.New("id exited 1")
}
return strings.Join(append([]string{m.groupNamed(u[1])}, m.in[name]...), " ") + "\n", nil
case "groupadd": case "groupadd":
m.groups[args[len(args)-1]] = [2]int{mustAtoi(args[2]), 0} m.groups[args[len(args)-1]] = [2]int{mustAtoi(args[2]), 0}
case "useradd": case "useradd":
m.users[args[len(args)-1]] = [2]int{mustAtoi(args[2]), mustAtoi(args[4])} name := args[len(args)-1]
m.users[name] = [2]int{mustAtoi(args[2]), mustAtoi(args[4])}
if args[5] == "--groups" {
m.setIn(name, strings.Split(args[6], ","))
}
if m.homes == nil {
m.homes = map[string]string{}
}
m.homes[name] = "/nonexistent"
case "usermod":
name := args[len(args)-1]
if args[0] == "--append" {
m.setIn(name, append(m.in[name], args[2]))
} else if args[0] == "--home" {
if m.homes == nil {
m.homes = map[string]string{}
}
m.homes[name] = args[1]
} else {
u := m.users[name]
m.users[name] = [2]int{u[0], mustAtoi(args[1])}
m.setIn(name, strings.Split(args[3], ","))
}
case "gpasswd":
var kept []string
for _, g := range m.in[args[1]] {
if g != args[2] {
kept = append(kept, g)
}
}
m.setIn(args[1], kept)
case "userdel": case "userdel":
delete(m.users, args[0]) delete(m.users, args[0])
case "groupdel": case "groupdel":
@@ -55,11 +110,39 @@ func (m *accountsMachine) run(_ context.Context, name string, args ...string) (s
return "", nil return "", nil
} }
func (m *accountsMachine) setIn(name string, groups []string) {
if m.in == nil {
m.in = map[string][]string{}
}
var out []string
for _, g := range groups {
if g != "" {
out = append(out, g)
}
}
m.in[name] = out
}
func mustAtoi(s string) int { func mustAtoi(s string) int {
n, _ := strconv.Atoi(s) n, _ := strconv.Atoi(s)
return n return n
} }
// withGroups is a declaration with library groups, identities and resources.
func withGroups(t *testing.T, groups, identities, resources string) *declaration.Declaration {
t.Helper()
nothing := ""
if resources == "" {
nothing = `"owns_nothing":true,`
}
d, err := declaration.Parse([]byte(`{"declaration":1,"groups":[` + groups + `],"identities":[` + identities +
`],` + nothing + `"resources":[` + resources + `]}`))
if err != nil {
t.Fatal(err)
}
return d
}
func withIdentities(t *testing.T, identities, resources string) *declaration.Declaration { func withIdentities(t *testing.T, identities, resources string) *declaration.Declaration {
t.Helper() t.Helper()
d, err := declaration.Parse([]byte(`{"declaration":1,"identities":[` + identities + `],"resources":[` + d, err := declaration.Parse([]byte(`{"declaration":1,"identities":[` + identities + `],"resources":[` +
@@ -83,7 +166,7 @@ func TestAModulesIdentityIsMadeWithItsNumbersAndRemovedWhenUndeclared(t *testing
} }
want := []string{ want := []string{
"groupadd --system --gid 61001 mesh-radarr", "groupadd --system --gid 61001 mesh-radarr",
"useradd --system --uid 61001 --gid 61001 --no-create-home --home-dir / --shell /usr/bin/nologin mesh-radarr", "useradd --system --uid 61001 --gid 61001 --no-create-home --home-dir /nonexistent --shell /usr/bin/nologin mesh-radarr",
} }
if strings.Join(m.ran, "\n") != strings.Join(want, "\n") { if strings.Join(m.ran, "\n") != strings.Join(want, "\n") {
t.Fatalf("made with:\n%s\nwant:\n%s", strings.Join(m.ran, "\n"), strings.Join(want, "\n")) t.Fatalf("made with:\n%s\nwant:\n%s", strings.Join(m.ran, "\n"), strings.Join(want, "\n"))
@@ -163,7 +246,9 @@ func TestNoModuleIdentityIsRoot(t *testing.T) {
defer func() { RootGroupIDs = was }() defer func() { RootGroupIDs = was }()
dir := t.TempDir() dir := t.TempDir()
for _, d := range []*declaration.Declaration{ for _, d := range []*declaration.Declaration{
withIdentities(t, `{"module":"radarr","name":"mesh-radarr","uid":61001,"gid":10}`, withGroups(t, `{"name":"mesh-media","gid":10}`, `{"module":"radarr","name":"mesh-radarr","uid":61001,"gid":10}`,
`{"id":"radarr.config","type":"directory","path":"`+dir+`/config"}`),
withGroups(t, `{"name":"mesh-media","gid":10}`, ``,
`{"id":"radarr.config","type":"directory","path":"`+dir+`/config"}`), `{"id":"radarr.config","type":"directory","path":"`+dir+`/config"}`),
withIdentities(t, ``, `{"id":"radarr.config","type":"directory","path":"`+dir+`/config"},`+ withIdentities(t, ``, `{"id":"radarr.config","type":"directory","path":"`+dir+`/config"},`+
`{"id":"radarr.app","type":"container","name":"radarr","image":"`+pinned+`",`+ `{"id":"radarr.app","type":"container","name":"radarr","image":"`+pinned+`",`+
@@ -285,3 +370,16 @@ func TestAGrantsGroupThatCouldNotBeLeftIsTriedAgain(t *testing.T) {
t.Fatalf("the group was not taken back on the next apply: %+v (%s)", rec, groups) t.Fatalf("the group was not taken back on the next apply: %+v (%s)", rec, groups)
} }
} }
// Every system the engine runs on that makes accounts makes module identities: arch and alpine alike.
func TestArchAndAlpineMakeModuleIdentities(t *testing.T) {
for _, name := range []string{"arch", "alpine"} {
sys, err := system.For(name)
if err != nil {
t.Fatal(err)
}
if _, err := toolFor(sys); err != nil {
t.Errorf("%s makes no module identity: %v", name, err)
}
}
}
internal/apply/keep.go
+75 -845
View File
@@ -6,11 +6,8 @@ import (
"encoding/hex" "encoding/hex"
"errors" "errors"
"fmt" "fmt"
"github.com/novox/mesh-host/internal/accounts"
"os" "os"
"path/filepath"
"regexp" "regexp"
"sort"
"strings" "strings"
"sync" "sync"
"time" "time"
@@ -20,306 +17,101 @@ import (
"github.com/novox/mesh-host/internal/system" "github.com/novox/mesh-host/internal/system"
) )
// A shared folder is kept usable through access entries (novox/hq ADR 0325, issue 567). // An access is an operator's path a module mounts and the mesh does not own (novox/hq ADR 0051): mounted when
// // present, refused when absent, nothing changed on it. ADR 0325 kept a shared folder through ACL entries; ADR 0328
// Several modules use one folder of the operator's — a library one imports into, one renames in, one plays from — // supersedes it with libraries (library.go), and an access is again exactly what it was before: an access's `users`
// each as its own identity. The engine keeps, for every placed folder, one ACL entry per identity that uses it, // and `taken` are accepted and not acted on.
// on the folder and as its default for everything made under it, and changes nothing else of the path (§5).
//
// **When it may keep a folder.** Only one that is the mesh's to keep: taken on the operator's warrant (§8), or
// holding no data yet — empty when first seen, or made by the engine (§9). A folder that holds data and was never
// taken is stated waiting, with a wait of kind access, until the operator lets the mesh keep it (§7); one whose disk
// is not there waits for the disk (§9); root's data on its placed filesystem is never kept, and is unhealthy (§12).
//
// **What every apply does.** It judges the folder (assessFolder), makes a missing one where its data lives, and
// sets the users' entries on the folder itself. What lies under a taken folder is the walks' (ReconcileKept): a
// user added has its entries added to everything under it, a user dropped has exactly its own removed, outside
// the apply and bounded. The watch and the sweep keep what is made later usable (§6, §10).
// keptRecords is where the engine keeps what it knows of each kept or seen folder: the file beside the state in // applyAccess is one access, applied as ADR 0051 has it; what ADR 0312's grant put an account in is taken back
// the engine, memory in a test. // first, so no account is in a group for data but a library's (ADR 0328 §11).
type keptRecords interface { func applyAccess(ctx context.Context, sys system.System, r *declaration.Access, run Runner, previous store.Applied,
All() (map[string]store.KeptFolder, error) in inputs) (Outcome, error) {
Update(path string, change func(f *store.KeptFolder, had bool) bool) error gave, left, said := takeBackGranted(ctx, sys, previous, run, in.groups, in.handed)
} out, err := legacyAccess(r)
if len(left) > 0 {
// KeptFolders is the engine's record of the folders it keeps. The engine sets the file beside its state. out.user, out.groups = previous.User, left
var KeptFolders keptRecords = NewKeptMemory()
// keptMemory is a keptRecords held in memory.
type keptMemory struct {
mu sync.Mutex
m map[string]store.KeptFolder
}
// NewKeptMemory is an empty record held in memory: a test's, or a one-shot apply's.
func NewKeptMemory() keptRecords { return &keptMemory{m: map[string]store.KeptFolder{}} }
func (k *keptMemory) All() (map[string]store.KeptFolder, error) {
k.mu.Lock()
defer k.mu.Unlock()
out := map[string]store.KeptFolder{}
for p, f := range k.m {
out[p] = f
} }
return out, nil if said != "" {
} out.Detail = joinDetail(out.Detail, said)
if gave && out.Action == "unchanged" {
func (k *keptMemory) Update(path string, change func(f *store.KeptFolder, had bool) bool) error { // Updated, so what names the access under restart-on — the tool runner — holds the groups it has now.
k.mu.Lock() out.Action = "updated"
defer k.mu.Unlock() }
f, had := k.m[path]
f.Path = path
if change(&f, had) {
k.m[path] = f
} else {
delete(k.m, path)
} }
return nil return out, err
} }
// keptRecord is the record of path, and whether there is one. A record that cannot be read is none: the folder // takeBackGranted takes an account out of every group ADR 0312's grant put it in for an access, as removeUser takes
// is judged afresh, which waits rather than keeps. // back a user's (ADR 0252 §3): unless another declared resource still asks for it, which is then handed the group.
func keptRecord(path string) (store.KeptFolder, bool) { // Whether any was taken back, the groups still to take back — one whose leaving failed stays recorded, so the next
all, err := KeptFolders.All() // apply tries again — and what was said; nothing for an access that granted nothing.
func takeBackGranted(ctx context.Context, sys system.System, previous store.Applied, run Runner, wanted Wanted,
handed Handed) (bool, []string, string) {
if previous.User == "" || len(previous.Groups) == 0 {
return false, nil, ""
}
account := previous.User
in, err := system.GroupsOf(ctx, system.Runner(run), account)
if err != nil { if err != nil {
return store.KeptFolder{}, false return false, previous.Groups, fmt.Sprintf("the groups ADR 0312's grant put %s in (%s) were not taken "+
"back, and are tried again: %v", account, strings.Join(previous.Groups, ", "), err)
} }
f, had := all[path] already := setOf(in)
return f, had gave := false
} var left, said []string
for _, g := range previous.Groups {
// folderWant is what every access naming one folder asks of it: the accesses, each uid at the widest use any of switch {
// them gives it (ADR 0325 §4: the tool runner's account stands for every module whose tools use it), and whether case !already[g]:
// the controller says it was taken. continue
type folderWant struct { case len(wanted.othersAsk(account, g, previous.ID)) > 0:
path string said = append(said, fmt.Sprintf("left in %s, which %s still asks for", g,
ids []string strings.Join(wanted.othersAsk(account, g, previous.ID), ", ")))
users map[uint32]store.KeptUser handed.hand(account, g)
taken bool
}
// foldersOf is every declared access's folder, by its clean path. A folder the guard refuses is not read (issue
// 339).
func foldersOf(resources []declaration.Resource, refused map[string]error) map[string]*folderWant {
out := map[string]*folderWant{}
for _, r := range resources {
a, ok := r.(*declaration.Access)
if !ok {
continue continue
} }
path := filepath.Clean(a.Path) gone, why := leaveGroup(ctx, sys, account, g, run)
if refused[path] != nil { if !gone {
continue left = append(left, g)
} why += "; tried again on the next apply"
f := out[path]
if f == nil {
f = &folderWant{path: path, users: map[uint32]store.KeptUser{}}
out[path] = f
}
f.ids = append(f.ids, a.ID)
f.taken = f.taken || a.Taken
for _, u := range a.Users {
had, seen := f.users[uint32(u.UID)]
if seen && (had.Use == declaration.AccessReadWrite || u.Use != declaration.AccessReadWrite) {
continue
}
f.users[uint32(u.UID)] = store.KeptUser{Identity: u.Identity, UID: uint32(u.UID), Use: u.Use, From: u.From}
} }
gave = gave || gone
said = append(said, why)
} }
return out return gave, left, "the group grant ADR 0312 made is taken back: " + account + " " + strings.Join(said, "; ")
} }
// list is the users, by uid. // legacyAccess is an access from a controller older than ADR 0325, applied exactly as before it (ADR 0051 §7).
func (f *folderWant) list() []store.KeptUser { //
if f == nil { // **Absent is refused, not created.** A bind mount whose source does not exist is made for you by the container
return nil // runtime, as root, with whatever mode it picks — which is exactly the silent wrong-ownership 04-ISSUES/026
} // records. So the host checks first and says plainly that the operator must provide the path, rather than
out := make([]store.KeptUser, 0, len(f.users)) // conjuring a directory it does not own and cannot give the right owner. Nothing is written, so this never reports
for _, u := range f.users { // a change: the machine did not move, the host merely confirmed a fact about it.
out = append(out, u) func legacyAccess(r *declaration.Access) (Outcome, error) {
} out := begin(r)
sort.Slice(out, func(i, j int) bool { return out[i].UID < out[j].UID }) info, err := os.Stat(r.Path)
return out
}
// usersOf is a list of users as each uid and whether it writes.
func usersOf(us []store.KeptUser) map[uint32]bool {
out := map[uint32]bool{}
for _, u := range us {
out[u.UID] = out[u.UID] || u.Use == declaration.AccessReadWrite
}
return out
}
// sameUsers is whether two lists give the same uids the same use.
func sameUsers(a, b []store.KeptUser) bool {
x, y := usersOf(a), usersOf(b)
if len(x) != len(y) {
return false
}
for uid, rw := range x {
if w, ok := y[uid]; !ok || w != rw {
return false
}
}
return true
}
// accessName is the module and its own id for an access, from the resource id `<module>.<id>`.
func accessName(id string) (module, name string) {
if m, ok := moduleOf(id); ok {
return m, id[len(m)+1:]
}
return "", id
}
// KeepWords and DiskWords are what an access wait says the operator gives (ADR 0325 §7): never a path.
func KeepWords(name string) string { return "let the mesh keep the shared folder " + name }
func DiskWords(name string) string { return "mount the disk that holds " + name }
// The judgements of a folder.
const (
// folderKeep is a folder the mesh keeps: taken, or holding no data yet.
folderKeep = "keep"
// folderMake is a folder absent under a parent on its placed filesystem, not root's: made, then kept.
folderMake = "make"
// folderWaitKeep is a folder that holds data and was never taken: it waits for the operator's word.
folderWaitKeep = "wait-keep"
// folderWaitDisk is a folder whose disk is not there.
folderWaitDisk = "wait-disk"
// folderRoot is root's data on its placed filesystem: never kept.
folderRoot = "root"
// folderUnknown is a folder whose filesystem could not be named: left as it is until it is.
folderUnknown = "unknown"
)
// folderVerdict is the judgement of one folder, with what it read.
type folderVerdict struct {
kind string
// how is why a folder kept is the mesh's: store.KeptByWarrant, store.KeptEmpty or store.KeptMade.
how string
// mount is the mount point that holds what is there.
mount string
// why is a root verdict's or a broken folder's reason; err a folder that is not one (a file, a link).
why string
err error
// moved is that the folder's recorded mount is mounted and another holds it: it is judged afresh.
moved bool
// unnamed is a folder whose filesystem cannot be named: never kept, nor taken.
unnamed bool
}
// assessFolder judges a folder as an apply, a look and every walk do (ADR 0325 §7, §9, §12): its disk first, then
// whose it is, then whether the mesh may keep it. Its words carry no path: they reach the operator's channel.
func assessFolder(ctx context.Context, path string, rec store.KeptFolder, taken bool) folderVerdict {
others := recordedMounts(path)
info, err := lstatWithin(path)
if errors.Is(err, os.ErrNotExist) { if errors.Is(err, os.ErrNotExist) {
m, err := NearestAncestor(path) return out, fmt.Errorf(
if err != nil { "%s is not there, and the mesh does not own it — the operator must provide it. It is "+
return folderVerdict{err: err} "shared, pre-existing data (novox/hq ADR 0051): the host mounts it and creates "+
} "nothing, so a missing one is said here rather than made as root by the container "+
if !m.Info.IsDir() { "runtime", r.Path)
return folderVerdict{err: errors.New("the folder is not there, and its nearest existing parent is not " +
"a folder (a file or a link); nothing is made under it")}
}
pl := placedOn(ctx, path, m.Ancestor, rec.Mount, others)
if pl.Away {
return folderVerdict{kind: folderWaitDisk, mount: pl.Mount}
}
uid, gid, ok := statOwner(m.Info)
if !ok {
return folderVerdict{err: errors.New("the owner of the folder's nearest existing parent cannot be read " +
"on this machine")}
}
if why := rootOwned(uint32(uid), uint32(gid)); why != "" {
return folderVerdict{kind: folderRoot, mount: pl.Mount, why: "it is not there, and its nearest " +
"existing parent is " + why}
}
return folderVerdict{kind: folderMake, mount: pl.Mount, how: store.KeptMade, moved: pl.Moved}
} }
if err != nil { if err != nil {
return folderVerdict{err: errors.New("the folder cannot be read: " + pathless(err))} return out, err
} }
if !info.IsDir() { if !info.IsDir() {
return folderVerdict{err: errors.New("the folder is not a directory, and an access is a shared directory")} return out, fmt.Errorf(
"%s is not a directory, and an access is a shared directory the operator provides",
r.Path)
} }
pl := placedOn(ctx, path, path, rec.Mount, others) mode := declaration.AccessRead
if pl.Away { if r.Mode != "" {
return folderVerdict{kind: folderWaitDisk, mount: pl.Mount} mode = r.Mode
} }
// Another filesystem at the same mount point (another pool, another disk) is a move too. A record from an earlier out.Action = "unchanged"
// build names its filesystem another way, and is not compared: the next keep names it this way. out.Detail = "operator-owned; present, " + mode + ", nothing managed"
here := PlacedID(pl.Mount) return out, nil
// **A filesystem that cannot be named now is unknown, never a move** (a name read that did not answer, a
// filesystem with no UUID, id or source): the folder holds what it is — nothing walked, nothing newly kept,
// nothing reset — and is judged again when it is named. One never kept is so never kept: it fails closed.
if here == "" {
return folderVerdict{kind: folderUnknown, mount: pl.Mount, unnamed: true,
why: "its filesystem could not be named this time (no UUID, filesystem id or source answered)"}
}
moved := pl.Moved || (rec.Fs != "" && rec.Mount == pl.Mount && rec.Placed != here)
facts, err := readFolder(path)
if err != nil {
return folderVerdict{err: errors.New("the folder cannot be read: " + pathless(err))}
}
if why := rootOwned(facts.UID, facts.GID); why != "" {
return folderVerdict{kind: folderRoot, mount: pl.Mount, why: "it is " + why}
}
// The controller's word that the folder was taken holds for the filesystem the warrant was carried out on: a
// folder moved to another is not taken, and asks again (§8).
takenHere := taken && (rec.TakenOn == here || (rec.TakenOn == "" && !moved))
switch {
case rec.Kept && !moved:
return folderVerdict{kind: folderKeep, mount: pl.Mount, how: rec.How}
case takenHere:
return folderVerdict{kind: folderKeep, mount: pl.Mount, how: store.KeptByWarrant, moved: moved}
case facts.Empty:
return folderVerdict{kind: folderKeep, mount: pl.Mount, how: store.KeptEmpty, moved: moved}
}
// What is there now holds data the mesh never took — a disk mounted over a folder kept while it was empty
// below it included (a move): it waits for the operator's word.
return folderVerdict{kind: folderWaitKeep, mount: pl.Mount, moved: moved}
}
// movedRecord is f judged afresh on the filesystem now at mount: the warrant's filesystem is kept so the
// controller's word is not read for the new one, and nothing else of what was kept there holds. What the mesh
// added on the old filesystem is left to be taken out once it holds the folder again (Left) only where it was
// walked onto data under a warrant: a folder kept because it was empty, or made, carries entries on that empty
// folder alone, hidden under the mount point and granting nothing on data, and they are forgotten (said once, by
// the apply that saw the move).
func movedRecord(f store.KeptFolder, mount string) store.KeptFolder {
left := f.Left
if f.How == store.KeptByWarrant && len(f.Users) > 0 && f.Mount != "" {
left = addLeft(left, f.Mount, f.Placed, f.Fs, f.Users)
}
placed, fs := placeOf(mount)
return store.KeptFolder{Path: f.Path, Mount: mount, Placed: placed, Fs: fs, Want: f.Want, IDs: f.IDs,
Act: f.Act, TakenOn: f.TakenOn, Left: left}
}
// placeOf is the name of the filesystem at mount, and what it was made from.
func placeOf(mount string) (placed, fs string) {
fs = filesystemKey(mount)
return placedFrom(mount, fs), fs
}
// addLeft adds users' entries left on mount, once per mount and uid.
func addLeft(left []store.KeptLeft, mount, placed, fs string, users []store.KeptUser) []store.KeptLeft {
for i := range left {
if left[i].Mount == mount && left[i].Placed == placed {
have := usersOf(left[i].Users)
for _, u := range users {
if _, had := have[u.UID]; !had {
left[i].Users = append(left[i].Users, u)
}
}
return left
}
}
return append(left, store.KeptLeft{Mount: mount, Placed: placed, Fs: fs, Since: time.Now().UTC(),
Users: append([]store.KeptUser(nil), users...)})
} }
// PlacedID names the filesystem at mount for a wait, with no path in it: the controller asks again when the // PlacedID names the filesystem at mount for a wait, with no path in it: the controller asks again when the
@@ -450,565 +242,3 @@ func pathless(err error) string {
} }
return absPath.ReplaceAllString(err.Error(), "${1}a path") return absPath.ReplaceAllString(err.Error(), "${1}a path")
} }
// recordedMounts is every mount point recorded for another kept folder: where a disk was once seen.
func recordedMounts(except string) []string {
all, err := KeptFolders.All()
if err != nil {
return nil
}
var out []string
for p, f := range all {
if p != except && f.Mount != "" && f.Mount != "/" {
out = append(out, f.Mount)
}
}
return out
}
// RootWords is the reason root's data is stated unhealthy with (ADR 0325 §12): never a path.
func RootWords(why string) string {
return why + ", and root's data is never kept: the operator places the data elsewhere or gives it an owner " +
"(novox/hq ADR 0325 §12)"
}
// applyAccess is one access, applied (ADR 0325): its folder judged, made when it is missing where its data lives,
// and its users' entries kept on it when the mesh may keep it; waiting otherwise, and failing for root's data.
// Nothing is changed on the folder but the entries the mesh adds and the mask that shows them.
func applyAccess(ctx context.Context, sys system.System, r *declaration.Access, run Runner, previous store.Applied,
in inputs) (Outcome, error) {
// A tool runner's account that is not here, or is root's, refuses its access (§4, §11).
if err := in.runners[r.ID]; err != nil {
return begin(r), err
}
// What ADR 0312's grant put an account in is taken back first: no account is in a group for data (§5).
gave, left, said := takeBackGranted(ctx, sys, previous, run, in.groups, in.handed)
out, err := applyAccessFolder(ctx, r, in)
if len(left) > 0 {
out.user, out.groups = previous.User, left
}
if said != "" {
out.Detail = joinDetail(out.Detail, said)
if gave && out.Action == "unchanged" {
// Updated, so what names the access under restart-on — the tool runner — holds the groups it has now.
out.Action = "updated"
}
}
return out, err
}
// applyAccessFolder is applyAccess's folder.
func applyAccessFolder(ctx context.Context, r *declaration.Access, in inputs) (Outcome, error) {
out := begin(r)
path := filepath.Clean(r.Path)
want := in.folders[path]
if !keeps(want, in.identities) {
return legacyAccess(r)
}
users := want.list()
_, name := accessName(r.ID)
rec, _ := keptRecord(path)
v := assessFolder(ctx, path, rec, want != nil && want.taken)
if v.err != nil {
return out, v.err
}
if v.moved {
// What is at the path now is not what was kept (a disk mounted over a folder kept while it was empty
// below it): judged afresh, the record of what was kept there no longer holds.
_ = KeptFolders.Update(path, func(f *store.KeptFolder, had bool) bool {
*f = movedRecord(*f, v.mount)
return had
})
}
note := ""
if v.moved {
note = "; what is at it now is on another filesystem than what the mesh kept there, so it was judged afresh"
if rec.How != store.KeptByWarrant {
note += "; the entries on the empty folder kept below are forgotten: hidden under the mount, they grant " +
"nothing on data"
}
}
if len(r.Grant) > 0 {
note += "; its grant is no longer acted on: the mesh puts no account in a group for data (novox/hq ADR 0325 §5)"
}
switch v.kind {
case folderUnknown:
out.Action = "waiting"
out.Detail = v.why + ": the folder is left exactly as it is, and judged again on the next apply" + note
return out, nil
case folderWaitDisk:
out.Action = "waiting"
out.Detail = "the disk that holds it is not there: nothing is made, and nothing mounts it until it is " +
"(novox/hq ADR 0325 §9); waits for the operator to " + DiskWords(name) + note
return out, nil
case folderRoot:
if len(users) == 0 {
out.Action, out.Detail = "unchanged", "present or not, nothing is kept: no identity uses it"+note
return out, nil
}
return out, errors.New(RootWords(v.why) + "; nothing was made or changed")
case folderMake:
made, err := CreatePath(path)
if err != nil {
return out, err
}
out.Action = "created"
out.Detail = fmt.Sprintf("made %d level(s) as its nearest existing parent is: owner, group and mode "+
"(novox/hq ADR 0325 §9)", made)
if len(users) == 0 {
out.Detail += note
return out, nil
}
case folderWaitKeep:
if len(users) == 0 {
out.Action, out.Detail = "unchanged", "present; nothing is kept: no identity uses it"+note
return out, nil
}
_ = KeptFolders.Update(path, func(f *store.KeptFolder, _ bool) bool {
f.Mount, f.Want, f.IDs = v.mount, users, want.ids
f.Placed, f.Fs = placeOf(v.mount)
return true
})
out.Action = "waiting"
out.Detail = "it holds data the mesh has not taken: nothing is changed on it until the operator's warrant " +
"(novox/hq ADR 0325 §7, §8); waits for the operator to " + KeepWords(name) + note
return out, nil
}
if len(users) == 0 {
// Nobody uses it any more: what the mesh added goes on the next walk.
dropping := false
_ = KeptFolders.Update(path, func(f *store.KeptFolder, had bool) bool {
f.Want = nil
dropping = len(f.Users) > 0
return had
})
if out.Action == "" {
out.Action, out.Detail = "unchanged", "present; nothing is kept: no identity uses it"
}
if dropping {
out.Detail += "; the entries the mesh added are taken out by the next walk"
}
out.Detail += note
return out, nil
}
changed, err := keepTop(path, usersOf(users))
if errors.Is(err, ErrNoACL) {
_ = KeptFolders.Update(path, func(f *store.KeptFolder, _ bool) bool {
f.Mount, f.Want = v.mount, users
f.Placed, f.Fs = placeOf(v.mount)
return true
})
out.Action = "waiting"
out.Detail = "its filesystem allows no access entries here: the take act lets it, on the operator's word " +
"(novox/hq ADR 0325 §8); waits for the operator to " + KeepWords(name) + note
return out, nil
}
if err != nil {
return out, err
}
var pending string
_ = KeptFolders.Update(path, func(f *store.KeptFolder, had bool) bool {
first := !f.Kept
f.Kept, f.Mount, f.Want, f.IDs = true, v.mount, users, want.ids
f.Placed, f.Fs = placeOf(v.mount)
if v.how == store.KeptByWarrant && f.TakenOn == "" {
// The controller says it was taken, and this engine has no record of where: here, now.
f.TakenOn = PlacedID(v.mount)
}
if first {
f.How, f.At = v.how, time.Now().UTC()
// A folder that held nothing has nothing under it to walk; one the controller says was taken
// without this engine's record is walked whole.
if v.how == store.KeptEmpty || v.how == store.KeptMade {
f.Users = users
}
}
if !sameUsers(f.Users, f.Want) {
pending = "; the entries under it follow on the next walk"
}
return true
})
if out.Action == "" {
out.Action = "unchanged"
if changed {
out.Action = "updated"
}
}
out.Detail = joinDetail(out.Detail, "kept for "+usersWords(users)+": its own entries and default, nothing "+
"else of it changed (novox/hq ADR 0325 §5)"+pending+note)
return out, nil
}
// takeBackGranted takes an account out of every group ADR 0312's grant put it in for an access, as removeUser takes
// back a user's (ADR 0252 §3): unless another declared resource still asks for it, which is then handed the group.
// Whether any was taken back, the groups still to take back — one whose leaving failed stays recorded, so the next
// apply tries again — and what was said; nothing for an access that granted nothing.
func takeBackGranted(ctx context.Context, sys system.System, previous store.Applied, run Runner, wanted Wanted,
handed Handed) (bool, []string, string) {
if previous.User == "" || len(previous.Groups) == 0 {
return false, nil, ""
}
account := previous.User
in, err := system.GroupsOf(ctx, system.Runner(run), account)
if err != nil {
return false, previous.Groups, fmt.Sprintf("the groups ADR 0312's grant put %s in (%s) were not taken "+
"back, and are tried again: %v", account, strings.Join(previous.Groups, ", "), err)
}
already := setOf(in)
gave := false
var left, said []string
for _, g := range previous.Groups {
switch {
case !already[g]:
continue
case len(wanted.othersAsk(account, g, previous.ID)) > 0:
said = append(said, fmt.Sprintf("left in %s, which %s still asks for", g,
strings.Join(wanted.othersAsk(account, g, previous.ID), ", ")))
handed.hand(account, g)
continue
}
gone, why := leaveGroup(ctx, sys, account, g, run)
if !gone {
left = append(left, g)
why += "; tried again on the next apply"
}
gave = gave || gone
said = append(said, why)
}
return gave, left, "the group grant ADR 0312 made is taken back: " + account + " " + strings.Join(said, "; ")
}
// usersWords names users for a person: "mesh-radarr (read-write), the tool runner's nox (read)".
func usersWords(users []store.KeptUser) string {
words := make([]string, 0, len(users))
for _, u := range users {
who := u.Identity
if u.From == declaration.FromToolRunner {
who = "the tool runner's " + who
}
words = append(words, who+" ("+u.Use+")")
}
return strings.Join(words, ", ")
}
// forgetUndeclared marks every recorded folder no declared access names any more: nobody wants its entries, and
// the next walk takes out exactly what the mesh added, then forgets it.
func forgetUndeclared(folders map[string]*folderWant) {
all, err := KeptFolders.All()
if err != nil {
return
}
for path := range all {
if folders[path] != nil {
continue
}
_ = KeptFolders.Update(path, func(f *store.KeptFolder, _ bool) bool {
f.Want = nil
// A folder never kept, or kept with nobody's entries left anywhere, is forgotten now.
return (f.Kept && len(f.Users) > 0) || len(f.Left) > 0
})
}
}
// MissingPath is an accessed folder that is not there, and its nearest existing ancestor.
type MissingPath struct {
Ancestor string
// Levels are the names to make below Ancestor, outermost first.
Levels []string
// Info is the ancestor as lstat reads it: a link is not a directory.
Info os.FileInfo
}
// NearestAncestor reads, for a path that is not there, its nearest existing ancestor by lstat. An error for a
// path that is there, one not stated exactly, or an ancestor that cannot be read.
func NearestAncestor(path string) (MissingPath, error) {
if err := keptPath(path); err != nil {
return MissingPath{}, err
}
if _, err := lstatWithin(path); err == nil || !errors.Is(err, os.ErrNotExist) {
return MissingPath{}, errors.New("the folder is there, or cannot be read")
}
var levels []string
for p := path; p != "/"; p = filepath.Dir(p) {
levels = append([]string{filepath.Base(p)}, levels...)
parent := filepath.Dir(p)
info, err := lstatWithin(parent)
if errors.Is(err, os.ErrNotExist) {
continue
}
if err != nil {
return MissingPath{}, errors.New("a parent of the folder cannot be read: " + pathless(err))
}
return MissingPath{Ancestor: parent, Levels: levels, Info: info}, nil
}
return MissingPath{}, errors.New("no part of the folder's path is there")
}
// accessPaths is every declared access's folder with its id: what no container mounts while it is not there.
//
// Only accesses the mesh keeps (Keeps): an older controller's access holds no container, as before ADR 0325.
func accessPaths(resources []declaration.Resource, refused map[string]error, identities bool) map[string]string {
folders := foldersOf(resources, refused)
out := map[string]string{}
for _, r := range resources {
a, ok := r.(*declaration.Access)
if !ok {
continue
}
if path := filepath.Clean(a.Path); refused[path] == nil && keeps(folders[path], identities) {
out[path] = a.ID
}
}
return out
}
// keeps is whether ADR 0325's keeping applies to a folder: some access naming it carries users, or the
// declaration carries identities — a controller that speaks link.IdentityContract. An older controller's access
// (no users, no identities) is applied exactly as before: mounted when present, refused when absent, nothing kept,
// nothing made, nothing judged (ADR 0051 §7).
func keeps(f *folderWant, identities bool) bool {
return identities || (f != nil && len(f.users) > 0)
}
// Keeps is keeps for a whole declaration's access at path, for the engine's looks.
func Keeps(d *declaration.Declaration, path string) bool {
if d == nil {
return false
}
return keeps(foldersOf(d.Resources, nil)[filepath.Clean(path)], len(d.Identities) > 0)
}
// mountsMissing is the access a container waits for: one whose folder it mounts, or mounts below, is not there
// now — its disk away, or not made yet. The runtime would make it as root (04-ISSUES/026).
func mountsMissing(ctx context.Context, c *declaration.Container, accesses map[string]string) string {
for _, v := range c.Volumes {
src := mountSource(v)
if !strings.HasPrefix(src, "/") {
continue
}
for path, id := range accesses {
if !atOrBelow(filepath.Clean(src), path) {
continue
}
if _, err := statWithin(path); errors.Is(err, os.ErrNotExist) || errors.Is(err, errNoAnswer) {
return id
}
// There, and its disk not: what is at the path is the empty mount point on the filesystem below, and
// a container's writes would land there (§9).
rec, _ := keptRecord(path)
if placedOn(ctx, path, path, rec.Mount, recordedMounts(path)).Away {
return id
}
}
}
return ""
}
// WaitingOnAccess is every container of the declaration that waits for an accessed folder not there, read now:
// not created by the apply, so not judged alive or dead — the access says why.
func WaitingOnAccess(d *declaration.Declaration) map[string]bool {
out := map[string]bool{}
if d == nil {
return out
}
accesses := accessPaths(d.Resources, refusedPlaces(d.Resources), len(d.Identities) > 0)
if len(accesses) == 0 {
return out
}
for _, r := range d.Resources {
if c, ok := r.(*declaration.Container); ok && mountsMissing(context.Background(), c, accesses) != "" {
out[c.ID] = true
}
}
return out
}
// The judgements of an access as a look says them.
const (
VerdictKeep = "keep"
VerdictMake = "make"
VerdictWaitKeep = "wait-keep"
VerdictWaitDisk = "wait-disk"
VerdictRoot = "root"
VerdictBroken = "broken"
// VerdictUnknown is a folder whose filesystem could not be named this look: neither kept nor faulted.
VerdictUnknown = "unknown"
// VerdictNobody is a folder no identity uses: nothing is kept, and only a missing disk is said.
VerdictNobody = "nobody"
)
// What a keep wait says of its folder's filesystem and ACLs: the same words as link's ACLNeedsEnabling and
// ACLUnsupported, which the engine says them as.
const (
ACLNeedsEnabling = "needs-enabling"
ACLUnsupported = "unsupported"
)
// AccessJudgement is a look's judgement of an access's folder, and why, in words; Placed names the filesystem at
// it for a wait, with no path (PlacedID); ACL is, on a keep wait, ACLNeedsEnabling or ACLUnsupported
// when its filesystem refuses access entries now.
type AccessJudgement struct {
Kind, Why, Placed, ACL string
}
// AccessVerdict judges an access's folder for a look, read only (ADR 0325 §7, §9, §12): taken is whether the
// controller says it was taken, used whether any identity uses it. A folder the mesh could keep that no apply has
// kept — its filesystem allowing no ACLs — waits as one not taken does.
func AccessVerdict(ctx context.Context, path string, taken, used bool) AccessJudgement {
rec, _ := keptRecord(path)
v := assessFolder(ctx, path, rec, taken)
switch {
case v.err != nil:
return AccessJudgement{Kind: VerdictBroken, Why: pathless(v.err)}
case v.kind == folderWaitDisk:
return AccessJudgement{Kind: VerdictWaitDisk}
case v.kind == folderUnknown:
return AccessJudgement{Kind: VerdictUnknown, Why: v.why}
case !used:
return AccessJudgement{Kind: VerdictNobody}
case v.kind == folderRoot:
return AccessJudgement{Kind: VerdictRoot, Why: v.why}
case v.kind == folderMake:
return AccessJudgement{Kind: VerdictMake}
case v.kind == folderWaitKeep, v.kind == folderKeep && !rec.Kept && !taken:
return AccessJudgement{Kind: VerdictWaitKeep, Placed: PlacedID(v.mount), ACL: aclProbe(path, v.mount)}
}
return AccessJudgement{Kind: VerdictKeep}
}
// Leftover is the mesh's entries that could not be taken out yet: under the accesses that last named the folder,
// why, in words with no path.
type Leftover struct {
Module, Access, Name, Path, Why string
}
// Leftovers is every folder the mesh still has entries on that nobody wants (ADR 0325 §8): a folder no access names
// any more whose disk is away, so its drop walk waits; and entries left on a filesystem no longer at a folder. Each
// is said until its drop walk has run.
func Leftovers() []Leftover {
all, err := KeptFolders.All()
if err != nil {
return nil
}
var out []Leftover
for path, f := range all {
module, name, access := recordName(path, f)
dropping := f.Kept && len(f.Want) == 0 && len(f.Users) > 0 && f.Act != nil && f.Act.State == "waiting"
switch {
case dropping:
// Why the walk could not run, as it recorded it: its disk not there, or its filesystem not named.
why := strings.TrimSuffix(strings.TrimPrefix(f.Act.Why, "not walked: "), "; walked once it is")
if why == "" {
why = "the walk could not run"
}
out = append(out, Leftover{Module: module, Access: access, Name: name, Path: path, Why: "the mesh's entries for " +
name + " could not be removed: " + why + "; they are removed once it can (novox/hq ADR 0325 §8)"})
case len(f.Left) > 0:
out = append(out, Leftover{Module: module, Access: access, Name: name, Path: path, Why: "the mesh's entries for " +
name + " on a filesystem no longer at its folder could not be removed: they are removed once that " +
"filesystem is back (novox/hq ADR 0325 §8)"})
}
}
sort.Slice(out, func(i, j int) bool { return out[i].Access < out[j].Access })
return out
}
// recordName is the module, the name and the access a kept folder's record is said under: the accesses that last
// named it, or for a record written before it kept them, a name with no path — the module of a container identity
// among its users, and a folder named by a digest of its path.
func recordName(path string, f store.KeptFolder) (module, name, access string) {
if len(f.IDs) > 0 {
module, name = accessName(f.IDs[0])
return module, name, f.IDs[0]
}
sum := sha256.Sum256([]byte(path))
name = "folder-" + hex.EncodeToString(sum[:4])
for _, u := range append(append([]store.KeptUser(nil), f.Users...), f.Want...) {
if m, ok := strings.CutPrefix(u.Identity, declaration.IdentityPrefix); ok && u.From == declaration.FromContainer {
return m, name, m + "." + name
}
}
return "", name, name
}
// legacyAccess is an access from a controller older than ADR 0325, applied exactly as before it (ADR 0051 §7).
//
// **Absent is refused, not created.** A bind mount whose source does not exist is made for you by the container
// runtime, as root, with whatever mode it picks — which is exactly the silent wrong-ownership 04-ISSUES/026
// records. So the host checks first and says plainly that the operator must provide the path, rather than
// conjuring a directory it does not own and cannot give the right owner. Nothing is written, so this never reports
// a change: the machine did not move, the host merely confirmed a fact about it.
func legacyAccess(r *declaration.Access) (Outcome, error) {
out := begin(r)
info, err := os.Stat(r.Path)
if errors.Is(err, os.ErrNotExist) {
return out, fmt.Errorf(
"%s is not there, and the mesh does not own it — the operator must provide it. It is "+
"shared, pre-existing data (novox/hq ADR 0051): the host mounts it and creates "+
"nothing, so a missing one is said here rather than made as root by the container "+
"runtime", r.Path)
}
if err != nil {
return out, err
}
if !info.IsDir() {
return out, fmt.Errorf(
"%s is not a directory, and an access is a shared directory the operator provides",
r.Path)
}
mode := declaration.AccessRead
if r.Mode != "" {
mode = r.Mode
}
out.Action = "unchanged"
out.Detail = "operator-owned; present, " + mode + ", nothing managed"
return out, nil
}
// AccountIDs reads an account's uid and primary gid by name from the machine's user database (getent, through the
// account judge's reader). A variable so a test can stand in for accounts it cannot make.
var AccountIDs = func(ctx context.Context, name string) (uid, gid int, found bool, err error) {
return accounts.Exec{Run: accounts.Runner(ExecRunner)}.IDs(ctx, name)
}
// ResolveRunners gives every tool runner's account that came with no uid its number, read by name on this machine
// (ADR 0325 §4): the controller cannot know the operator's account's. One that is not here, or is root's — uid 0 or
// a root group (§11) — is taken out of the access's users, and its access is refused, naming why, by id. Changes
// the declaration in place; a user that already has its number is left as it is.
func ResolveRunners(ctx context.Context, d *declaration.Declaration) map[string]error {
refused := map[string]error{}
if d == nil {
return refused
}
for _, r := range d.Resources {
a, ok := r.(*declaration.Access)
if !ok {
continue
}
kept := a.Users[:0]
for _, u := range a.Users {
if u.From != declaration.FromToolRunner || u.UID != 0 {
kept = append(kept, u)
continue
}
uid, gid, found, err := AccountIDs(ctx, u.Identity)
switch {
case err != nil:
refused[a.ID] = fmt.Errorf("the tool runner's account %s could not be read: %w", u.Identity, err)
continue
case !found:
refused[a.ID] = fmt.Errorf("the tool runner's account %s is not on this machine, so no entry can "+
"be kept for it (novox/hq ADR 0325 §4)", u.Identity)
continue
}
if err := rootIdentity(uid, gid); err != nil {
refused[a.ID] = fmt.Errorf("the tool runner's account %s is never given an entry: %w", u.Identity, err)
continue
}
u.UID = uid
kept = append(kept, u)
}
a.Users = kept
}
return refused
}
internal/apply/keeper_linux.go
-473
View File
@@ -1,473 +0,0 @@
//go:build linux
package apply
import (
"context"
"errors"
"fmt"
"path/filepath"
"sync"
"time"
"golang.org/x/sys/unix"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
)
// The walks under a kept folder, beside the apply (novox/hq ADR 0325 §6, §8, §10).
//
// The take act adds the users' entries to everything under a folder on the operator's warrant; ReconcileKept adds a
// joining user's and removes exactly a dropped user's under a folder already taken; the sweep looks at a bounded
// part of each kept folder on every look, going on where the last stopped, and puts back what an app narrowed.
// One walk at a time per folder: a sweep finds a folder being walked and waits for the next look.
// folderLocks is one lock per kept folder, held by every walk of it.
var folderLocks sync.Map
func folderLock(path string) *sync.Mutex {
l, _ := folderLocks.LoadOrStore(path, &sync.Mutex{})
return l.(*sync.Mutex)
}
// actRecord is a walk's counts as the record keeps them.
func actRecord(act, warrant, by string, started time.Time, w *aclWalk, err error) *store.KeptAct {
c := w.counts
rec := &store.KeptAct{Act: act, Warrant: warrant, By: by, State: "done", Started: started, Ended: time.Now().UTC(),
Folders: c.Folders, Files: c.Files, Kept: c.Kept, Links: c.Links, Other: c.Other, Mounts: c.Mounts}
switch {
case errors.Is(err, ErrWalkBound):
rec.State, rec.Why = "stopped", "it met its bound of entries or time; it goes on at the next apply"
case err != nil:
rec.State, rec.Why = "failed", err.Error()
case w.Failed != "":
rec.Why = fmt.Sprintf("%d entries could not be given their entries: %s", c.Unrepaired, w.Failed)
}
return rec
}
// ReconcileKept walks every kept folder whose entries under it are not what the last apply declared: a user that
// joined has its entries added to everything under it, a dropped user — or one whose use changed — has exactly its
// own taken out (ADR 0325 §8). Bounded by ActLimits; a walk stopped is gone on with at the next call. A folder
// nobody uses any more is forgotten once its entries are out. What it did, in words, for the engine to say.
func ReconcileKept(ctx context.Context) []string {
all, err := KeptFolders.All()
if err != nil {
return []string{"the kept folders could not be read: " + err.Error()}
}
var said []string
for path, f := range all {
if ctx.Err() != nil {
break
}
if len(f.Left) > 0 {
said = append(said, dropLeft(path, f)...)
if f, _ = keptRecord(path); f.Path == "" {
continue
}
}
if !f.Kept || sameUsers(f.Users, f.Want) {
continue
}
said = append(said, reconcileOne(ctx, path, f)...)
}
return said
}
// LeftFor is how long entries left on a filesystem are kept recorded, and said, while it is not back.
var LeftFor = 30 * 24 * time.Hour
// dropLeft takes out the entries the mesh left on a filesystem no longer at the folder, once that filesystem holds
// it again (§8): exactly those users' entries, nothing else. Left on the filesystem the folder is kept on now, they
// are that folder's own, and its walk takes out whichever are no longer wanted. Until then they stay recorded, and
// said (Leftovers).
func dropLeft(path string, f store.KeptFolder) []string {
lock := folderLock(path)
lock.Lock()
defer lock.Unlock()
holding := ""
if _, err := lstatWithin(path); err == nil {
holding = mountHolding(path, MountPoints())
}
holdingID := ""
if holding != "" {
holdingID = PlacedID(holding)
}
var said []string
var still []store.KeptLeft
var mine []store.KeptUser
for _, l := range f.Left {
// On the folder's own filesystem now: the same name, or a name of an earlier build's form at the same
// mount point (which cannot be compared, and is never walked away).
same := l.Mount == f.Mount && (l.Placed == "" || l.Placed == f.Placed || l.Fs == "")
back := l.Mount == holding && (l.Placed == "" || l.Placed == holdingID)
if l.Since.IsZero() {
l.Since = time.Now().UTC()
}
if !same && !back && time.Since(l.Since) > LeftFor {
// **A filesystem not back within LeftFor is gone** (a disk replaced, a pool destroyed): what was left
// on it is forgotten, said once, rather than said unhealthy for ever.
said = append(said, fmt.Sprintf("the kept folder %s: the entries left on a filesystem not back for %s "+
"are forgotten: it is taken for gone", path, LeftFor))
continue
}
switch {
case f.Kept && same:
// Left on the filesystem the folder is kept on now: the folder's own entries.
mine = append(mine, l.Users...)
case same:
// On the filesystem the folder is on now, not kept yet: never walked away; they are the folder's
// once it is kept there again.
still = append(still, l)
case !back:
still = append(still, l)
default:
drop := map[uint32]bool{}
for _, u := range l.Users {
drop[u.UID] = true
}
w, err := walkKept(path, ActLimits, machineStats, nil, dropVisit(drop))
if err != nil || w.Failed != "" {
still = append(still, l)
said = append(said, fmt.Sprintf("the kept folder %s: the entries left on a filesystem that is back "+
"were not all taken out, tried again: %s", path, firstOf(pathlessOr(err), w.Failed)))
continue
}
said = append(said, fmt.Sprintf("the kept folder %s: the entries left on a filesystem that is back "+
"were taken out (%d folders and %d files)", path, w.counts.Folders, w.counts.Files))
}
}
_ = KeptFolders.Update(path, func(k *store.KeptFolder, had bool) bool {
k.Left = still
for _, u := range mine {
if _, has := usersOf(k.Users)[u.UID]; !has {
k.Users = append(k.Users, u)
}
}
return had && ((k.Kept && (len(k.Users) > 0 || len(k.Want) > 0)) || len(k.Left) > 0)
})
return said
}
func pathlessOr(err error) string {
if err == nil {
return ""
}
return pathless(err)
}
func firstOf(a, b string) string {
if a != "" {
return a
}
return b
}
func reconcileOne(ctx context.Context, path string, f store.KeptFolder) []string {
lock := folderLock(path)
lock.Lock()
defer lock.Unlock()
// **Judged as an apply judges it, before every walk** (§9, §12): a disk not there leaves its mount point —
// an empty folder of root's on the filesystem below — at the path, and a walk there would write onto root's
// folder, or "drop" entries from a folder that never had them and forget the ones on the data. Nothing is
// walked then, and the record stays for the walk that can reach the data.
if v := assessFolder(ctx, path, f, false); v.err != nil || v.kind != folderKeep || v.moved {
why := "the disk that holds it is not there"
switch {
case v.err != nil:
why = pathless(v.err)
case v.kind == folderRoot:
why = RootWords(v.why)
case v.kind == folderUnknown:
why = v.why
case v.moved || v.kind == folderWaitKeep:
why = "what is at it now is not what the mesh kept there"
}
_ = KeptFolders.Update(path, func(k *store.KeptFolder, had bool) bool {
k.Act = &store.KeptAct{Act: "walk", State: "waiting", Started: time.Now().UTC(),
Why: "not walked: " + why + "; walked once it is"}
return had
})
return []string{fmt.Sprintf("the kept folder %s: not walked, %s", path, why)}
}
have, want := usersOf(f.Users), usersOf(f.Want)
drop := map[uint32]bool{}
adds := false
for uid, rw := range have {
if w, ok := want[uid]; !ok || w != rw {
drop[uid] = true
}
}
for uid, rw := range want {
if h, ok := have[uid]; !ok || h != rw {
adds = true
}
}
act, visit := "add", keepVisit(want)
switch {
case len(drop) > 0 && adds:
visit = dropThenKeep(drop, want)
case len(drop) > 0:
act, visit = "drop", dropVisit(drop)
}
started := time.Now().UTC()
w, err := walkKept(path, ActLimits, machineStats, nil, visit)
rec := actRecord(act, "", "", started, w, err)
_ = KeptFolders.Update(path, func(k *store.KeptFolder, _ bool) bool {
k.Act = rec
// Done only when every entry was reached and changed: one that failed is walked again.
if err == nil && w.Failed == "" {
k.Users = f.Want
}
return k.Kept && (len(k.Want) > 0 || len(k.Users) > 0)
})
return []string{fmt.Sprintf("the kept folder %s: %s walk %s (%d folders and %d files changed, %d had "+
"them)%s", path, act, rec.State, rec.Folders, rec.Files, rec.Kept, orWhy(rec.Why))}
}
func orWhy(why string) string {
if why == "" {
return ""
}
return ": " + why
}
// TakeFolder is the take act (ADR 0325 §8): on the operator's warrant, the users' entries added to the folder of
// the access id and everything under it. It judges the ask against the declaration last applied and the folder as
// it is, sets the filesystem's ACL type where a ZFS dataset allows none yet, and starts the walk: what it answers
// at once, and a channel closed when the walk is through. Refused, nothing is changed.
func TakeFolder(ctx context.Context, d *declaration.Declaration, id, path, warrant, by string,
run Runner) (<-chan struct{}, string, error) {
if d == nil {
return nil, "", errors.New("this engine has applied no declaration, and takes no folder it was not told of")
}
if err := ResolveRunners(ctx, d)[id]; err != nil {
return nil, "", err
}
var access *declaration.Access
for _, r := range d.Resources {
if a, ok := r.(*declaration.Access); ok && a.ID == id {
access = a
}
}
switch {
case access == nil:
return nil, "", fmt.Errorf("the access %s is not declared on this machine", id)
case filepath.Clean(access.Path) != path:
return nil, "", fmt.Errorf("the access %s is declared at another folder than the one asked", id)
}
folders := foldersOf(d.Resources, refusedPlaces(d.Resources))
want := folders[path]
users := want.list()
if len(users) == 0 {
return nil, "", errors.New("no identity uses the folder, so there is nothing to keep")
}
rec, _ := keptRecord(path)
v := assessFolder(ctx, path, rec, false)
switch {
case v.err != nil:
return nil, "", v.err
case v.kind == folderWaitDisk:
return nil, "", errors.New("the disk that holds the folder is not there")
case v.kind == folderRoot:
return nil, "", errors.New(RootWords(v.why))
case v.kind == folderMake:
return nil, "", errors.New("the folder is not there; the next apply makes it, and asks nobody")
case v.unnamed:
return nil, "", errors.New(v.why + ", so a warrant could name no filesystem it was given for")
}
lock := folderLock(path)
if !lock.TryLock() {
return nil, "", errors.New("a walk of the folder is running; asked again once it is through, the act goes on")
}
said := ""
_, err := keepTop(path, usersOf(users))
if errors.Is(err, ErrNoACL) {
allowed, aerr := allowACLs(ctx, v.mount, run)
if aerr != nil {
lock.Unlock()
return nil, "", aerr
}
said = allowed + "; "
_, err = keepTop(path, usersOf(users))
}
if err != nil {
lock.Unlock()
return nil, "", err
}
started := time.Now().UTC()
_ = KeptFolders.Update(path, func(f *store.KeptFolder, had bool) bool {
if v.moved {
*f = movedRecord(*f, v.mount)
}
if !f.Kept {
f.Kept, f.How, f.At, f.Users = true, store.KeptByWarrant, started, nil
}
f.Warrant, f.By, f.Mount, f.Want, f.IDs = warrant, by, v.mount, users, want.ids
// The warrant is for the filesystem it was carried out on (§8), named as a wait names it.
f.Placed, f.Fs = placeOf(v.mount)
f.TakenOn = f.Placed
f.Act = &store.KeptAct{Act: "take", Warrant: warrant, By: by, State: "running", Started: started}
return true
})
done := make(chan struct{})
go func() {
defer close(done)
defer lock.Unlock()
w, err := walkKept(path, ActLimits, machineStats, nil, keepVisit(usersOf(users)))
rec := actRecord("take", warrant, by, started, w, err)
_ = KeptFolders.Update(path, func(f *store.KeptFolder, _ bool) bool {
f.Act = rec
if err == nil {
f.Users = users
}
return true
})
}()
return done, said + "the take act started under the warrant " + warrant + ": the entries of " +
usersWords(users) + " are added to everything under the folder, following no link and entering no other " +
"filesystem", nil
}
// allowACLs lets the filesystem at mount carry ACLs, inside the take act only (ADR 0325 §8): a ZFS dataset's
// acltype set to posixacl, the dataset read from the machine's mounts. Any other filesystem is refused, naming why.
func allowACLs(ctx context.Context, mount string, run Runner) (string, error) {
source, fstype := mountSourceOf(mount)
if fstype != "zfs" || source == "" {
return "", fmt.Errorf("the filesystem that holds the folder (%s) allows no access entries, and only a ZFS "+
"dataset's can be let by the act; the operator mounts it with ACLs", orUnknown(fstype))
}
if _, err := run(ctx, "zfs", "set", "acltype=posixacl", source); err != nil {
return "", fmt.Errorf("the ZFS dataset that holds the folder could not be let carry access entries "+
"(zfs set acltype=posixacl): %w", err)
}
return "set acltype=posixacl on the ZFS dataset " + source, nil
}
func orUnknown(s string) string {
if s == "" {
return "of a type the machine does not say"
}
return s
}
// KeptLook is what one look found of a kept folder (ADR 0325 §10).
type KeptLook struct {
// Short is every user the folder itself gives less than its right, by entry and mask together, in words.
Short []string
// Busy is a walk of the folder running: the sweep waited.
Busy bool
// Sweep is the sweep's place after this look.
Sweep store.KeptSweep
// Repaired is how many entries this look found narrowed and put back; Unrepaired how many it could not.
Repaired, Unrepaired int
// Failed is why the sweep could not look, in words with no path.
Failed string
}
// LookKept looks at a kept folder once: the folder itself judged for each user, then the sweep's bounded part of
// what is under it, from where the last look stopped, putting back what an app narrowed. The sweep's place is
// recorded; a look that ran out of its bound says so.
func LookKept(path string, users []store.KeptUser, limits WalkLimits) KeptLook {
var out KeptLook
short, err := judgeTop(path, users)
if err != nil {
out.Failed = err.Error()
return out
}
out.Short = short
lock := folderLock(path)
if !lock.TryLock() {
out.Busy = true
rec, _ := keptRecord(path)
out.Sweep = rec.Sweep
return out
}
defer lock.Unlock()
rec, _ := keptRecord(path)
sw := rec.Sweep
w, err := walkKept(path, limits, machineStats, sw.Cursor, keepVisit(usersOf(users)))
out.Repaired, out.Unrepaired = w.counts.Narrowed-w.counts.Unrepaired, w.counts.Unrepaired
sw.Read += w.counts.Read
sw.Narrowed += w.counts.Narrowed
sw.Unrepaired += w.counts.Unrepaired
switch {
case errors.Is(err, ErrWalkBound):
sw.Cursor, sw.Bound = w.Cursor, true
case err != nil:
out.Failed = err.Error()
default:
// Covered whole: the next look starts a new pass, and what this one could not put back is kept until
// the next pass is through.
sw = store.KeptSweep{Covered: time.Now().UTC(), LastUnrepaired: sw.Unrepaired}
}
out.Sweep = sw
_ = KeptFolders.Update(path, func(f *store.KeptFolder, had bool) bool {
f.Sweep = sw
return had
})
return out
}
// judgeTop is every user the folder itself gives less than its right, read only.
func judgeTop(path string, users []store.KeptUser) ([]string, error) {
var short []string
_, fd, st, err := openKept(path, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
if err != nil {
return nil, err
}
defer unix.Close(fd)
a, err := getACL(fd, aclAccessXattr, uint32(st.Mode)&0o7777)
if err != nil {
return nil, err
}
for _, u := range users {
need := needOn(u.Use == declaration.AccessReadWrite, true)
if got := effective(a, u.UID, st.Uid, uint32(st.Mode)&0o7777); got&need != need {
short = append(short, fmt.Sprintf("%s has %s of the %s it needs", u.Identity, permWords(got),
permWords(need)))
}
}
return short, nil
}
// JudgeKept reads, without changing anything, how many entries under a kept folder give a user less than its
// right, within limits: what the access says while an entry an app narrowed is not put back yet (ADR 0325 §6).
func JudgeKept(path string, users []store.KeptUser, limits WalkLimits) (WalkCounts, error) {
um := usersOf(users)
w, err := walkKept(path, limits, machineStats, nil, func(fd int, st unix.Stat_t, folder bool) (bool, bool, bool,
error) {
a, err := getACL(fd, aclAccessXattr, uint32(st.Mode)&0o7777)
if err != nil {
return false, false, false, err
}
n, u := judgeACL(a, um, st, folder)
return false, n, u, nil
})
return w.counts, err
}
// aclProbe is what a keep wait says of its folder's filesystem and ACLs: ACLNeedsEnabling when it refuses them
// now and is a ZFS dataset the take act lets carry them, ACLUnsupported when no act can, "" when it allows
// them or the folder cannot be read (the wait says nothing then). Reads only.
func aclProbe(path, mount string) string {
_, fd, st, err := openKept(path, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
if err != nil {
return ""
}
defer unix.Close(fd)
if _, err := getACL(fd, aclAccessXattr, uint32(st.Mode)&0o7777); !errors.Is(err, ErrNoACL) {
return ""
}
return aclWord(mountSourceOf(mount))
}
// aclWord is what a keep wait says of a filesystem that refuses ACLs now, by its mount's source and type: only a
// ZFS dataset is one the take act lets carry them.
func aclWord(source, fstype string) string {
if fstype == "zfs" && source != "" {
return ACLNeedsEnabling
}
return ACLUnsupported
}
internal/apply/kept_test.go
-1523
View File
File diff suppressed because it is too large Load Diff
internal/apply/library.go
+506
View File
@@ -0,0 +1,506 @@
package apply
import (
"context"
"errors"
"fmt"
"os"
"path/filepath"
"sort"
"strings"
"sync"
"time"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
"github.com/novox/mesh-host/internal/system"
)
// A library is kept usable by its group (novox/hq ADR 0328, issue 567).
//
// A library is a named tree of shared data with one home (§1). On its home the engine keeps its root and every
// sub-path its modules ask for — those folders themselves, never what is in them — in the library's group with
// group read, write and enter and the setgid bit, so what is made beneath keeps the group (§6); a missing sub-path
// is made with the root's owner and the library's group (§9). The owner, the owner's bits and others' bits are
// never changed. What the root already holds joins only on the operator's word (§7): until then the library waits
// with reason keep and nothing under it is walked. A root that is absent, or whose disk is not there, makes
// nothing, holds every container that mounts the library, and waits with reason disk (§9). Off its home a library is
// a mount the mounts module makes: nothing is kept there, and a mount that is not there holds the containers too.
//
// **When a root is the mesh's to keep without asking.** When it holds nothing yet, or is already in the library's
// group with group write and setgid (kept so before, by hand or by the mesh). Every other root waits for the take
// act, which walks it whole (TakeLibrary). Kept, it stays kept on the filesystem it was kept on — named by UUID,
// filesystem id or source (PlacedID) — and another filesystem at its root is judged afresh.
// libraryRecords is where the engine keeps what it knows of each library it is home to: the file beside the state
// in the engine, memory in a test.
type libraryRecords interface {
All() (map[string]store.LibraryRecord, error)
Update(name string, change func(r *store.LibraryRecord, had bool) bool) error
}
// Libraries is the engine's record of the libraries it is home to. The engine sets the file beside its state.
var Libraries libraryRecords = NewLibraryMemory()
type libraryMemory struct {
mu sync.Mutex
m map[string]store.LibraryRecord
}
// NewLibraryMemory is an empty record held in memory: a test's, or a one-shot apply's.
func NewLibraryMemory() libraryRecords { return &libraryMemory{m: map[string]store.LibraryRecord{}} }
func (k *libraryMemory) All() (map[string]store.LibraryRecord, error) {
k.mu.Lock()
defer k.mu.Unlock()
out := map[string]store.LibraryRecord{}
for n, r := range k.m {
out[n] = r
}
return out, nil
}
func (k *libraryMemory) Update(name string, change func(r *store.LibraryRecord, had bool) bool) error {
k.mu.Lock()
defer k.mu.Unlock()
r, had := k.m[name]
r.Library = name
if change(&r, had) {
k.m[name] = r
} else {
delete(k.m, name)
}
return nil
}
// libraryRecord is the record of one library, and whether there is one. A record that cannot be read is none: the
// library is judged afresh, which waits rather than keeps.
func libraryRecord(name string) (store.LibraryRecord, bool) {
all, err := Libraries.All()
if err != nil {
return store.LibraryRecord{}, false
}
r, had := all[name]
return r, had
}
// libraryLocks is one lock per library, held by every change to its root and every walk under it.
var libraryLocks sync.Map
func libraryLock(name string) *sync.Mutex {
l, _ := libraryLocks.LoadOrStore(name, &sync.Mutex{})
return l.(*sync.Mutex)
}
// libraryWalks is every library a take walk is running under now, with the filesystem it walks: set once the walk
// has been judged and started, cleared when it ends.
var libraryWalks sync.Map
// LibraryAccess is the access a library's wait and its take act name.
func LibraryAccess(name string) string { return declaration.LibraryAccessPrefix + name }
// KeepWords and DiskWords are what a library's wait says the operator gives (ADR 0328 §8, §9): never a path.
func KeepWords(name string) string { return "let the mesh keep the library " + name }
func DiskWords(name string) string { return "mount the disk that holds the library " + name }
// The judgements of a library.
const (
// libraryKeep is a library the mesh keeps: taken, empty when first seen, or found in shape.
libraryKeep = "keep"
// libraryWaitKeep is a root that holds data never taken: it waits for the operator's word.
libraryWaitKeep = "wait-keep"
// libraryWaitDisk is a root that is absent, or whose disk (or, off its home, whose mount) is not there.
libraryWaitDisk = "wait-disk"
// libraryUnknown is a root whose filesystem could not be named now: left as it is until it is.
libraryUnknown = "unknown"
// libraryMounted is a library off its home whose mount is there: nothing to keep.
libraryMounted = "mounted"
)
// libraryVerdict is the judgement of one library, with what it read.
type libraryVerdict struct {
kind string
// how is why a kept library is the mesh's: store.KeptByWarrant, store.KeptEmpty or store.KeptInShape.
how string
// mount is the mount point that holds the root; placed and fs name its filesystem.
mount, placed, fs string
// moved is that another filesystem than the one the library was kept on is at its root.
moved bool
why string
err error
}
// assessLibrary judges a library as an apply, a look and the take act all do (ADR 0328 §7, §9, §15): its group
// first, then its disk, then whether the mesh may keep it. Its words carry no path: they reach the operator's
// channel. Reads only.
func assessLibrary(ctx context.Context, l declaration.Library, rec store.LibraryRecord) libraryVerdict {
if why := rootGroup(l.GID); why != "" {
return libraryVerdict{err: fmt.Errorf("its group is %s, and a library's group is never a root group "+
"(novox/hq ADR 0328 §15); nothing was made or changed", why)}
}
// Nowhere the machine's own trees are, as for an access (novox/hq issue 339): a library at /etc would be
// the machine's configuration given a group.
if err := refusePath(l.Root, placingAccess, "", ""); err != nil {
return libraryVerdict{err: errors.New(pathless(err) + "; nothing was made or changed")}
}
if !l.Home {
// Off its home the mounts module mounts it: there when its root is a mount point now.
for _, p := range MountPoints() {
if p == l.Root {
return libraryVerdict{kind: libraryMounted, mount: p}
}
}
return libraryVerdict{kind: libraryWaitDisk, why: "its mount is not there"}
}
info, err := lstatWithin(l.Root)
switch {
case errors.Is(err, os.ErrNotExist):
return libraryVerdict{kind: libraryWaitDisk, why: "its root is not there"}
case errors.Is(err, errNoAnswer):
return libraryVerdict{kind: libraryUnknown, why: "its root does not answer: a read of it did not return " +
"within its bound"}
case err != nil:
return libraryVerdict{err: errors.New("its root cannot be read: " + pathless(err))}
case !info.IsDir():
return libraryVerdict{err: errors.New("its root is not a folder (a file, or a link), and a library's root " +
"is a folder the engine reaches through no link")}
}
pl := placedOn(ctx, l.Root, l.Root, rec.Mount, recordedLibraryMounts(l.Library))
if pl.Away {
return libraryVerdict{kind: libraryWaitDisk, mount: pl.Mount, why: "the disk that holds its root is not there"}
}
fs := filesystemKey(pl.Mount)
here := placedFrom(pl.Mount, fs)
// **A filesystem that cannot be named now is unknown, never a move**: the library holds what it is — nothing
// walked, nothing newly kept, nothing reset — and is judged again when it is named. One never kept is so never
// kept: it fails closed.
if here == "" {
return libraryVerdict{kind: libraryUnknown, mount: pl.Mount,
why: "its filesystem could not be named this time (no UUID, filesystem id or source answered)"}
}
moved := pl.Moved || (rec.Fs != "" && rec.Mount == pl.Mount && rec.Placed != here)
v := libraryVerdict{mount: pl.Mount, placed: here, fs: fs, moved: moved}
// The controller's word that the library was taken holds for the filesystem the warrant was carried out on.
takenHere := l.Taken && (rec.KeptOn == here || (rec.KeptOn == "" && !moved))
switch {
case rec.Kept && rec.KeptOn == here && !moved && rec.How == store.KeptByWarrant, takenHere:
// Taken whole on the operator's word: every sub-path is the library's.
v.kind, v.how = libraryKeep, store.KeptByWarrant
return v
case rec.Kept && rec.KeptOn == here && !moved:
// Kept without a warrant (empty, or in shape): a sub-path asked for since that holds data not in the group
// waits for the operator's word as the root would (§7).
v.kind, v.how = libraryKeep, rec.How
if !pathsInShape(l, rec.Paths) {
v.kind, v.how = libraryWaitKeep, ""
}
return v
}
facts, err := readFolder(l.Root)
if err != nil {
return libraryVerdict{err: errors.New("its root cannot be read: " + pathless(err))}
}
switch {
case facts.Empty:
// Nothing there, so no sub-path either: every one is made.
v.kind, v.how = libraryKeep, store.KeptEmpty
case int(facts.GID) == l.GID && facts.Mode&0o2070 == 0o2070 && sampleInShape(l.Root, l.GID) &&
pathsInShape(l, nil):
// The root and a bounded sample beneath it already in the group with group write and setgid: data that
// is the library's already, kept without asking. One entry of the sample out of shape asks (§7).
v.kind, v.how = libraryKeep, store.KeptInShape
default:
// What is there holds data the mesh never took — a disk mounted over a root kept while it was empty below
// it included (a move): it waits for the operator's word, and nothing under it is walked.
v.kind = libraryWaitKeep
}
return v
}
// recordedLibraryMounts is every mount point recorded for another library: where a disk was once seen.
func recordedLibraryMounts(except string) []string {
all, err := Libraries.All()
if err != nil {
return nil
}
var out []string
for name, r := range all {
if name != except && r.Mount != "" && r.Mount != "/" {
out = append(out, r.Mount)
}
}
return out
}
// applyLibrary is one library, applied (ADR 0328 §6, §7, §9): kept on its home when the mesh may keep it, waiting
// otherwise, and failing for a root group. Nothing is changed on the root but the group, group rwx and setgid of
// the root and its requested sub-paths, and the sub-paths made.
func applyLibrary(ctx context.Context, l declaration.Library) (Outcome, libraryVerdict, error) {
out := Outcome{ID: LibraryAccess(l.Library), Type: "library", Target: l.Root}
lock := libraryLock(l.Library)
if !lock.TryLock() {
// **A take walk is running (up to its bound, half an hour): the apply does not wait for it.** The library is
// the walk's until it is through; it keeps it, and its containers are not held for it. Only a walk that
// has started, on the filesystem it judged: anything else holding the lock (a take act about to be
// refused, say) is short, and the apply waits for it and judges the library as always.
if on, walking := libraryWalks.Load(l.Library); walking {
out.Action = "unchanged"
out.Detail = "the take act is setting its group under its root now; this apply leaves the library to it"
return out, libraryVerdict{kind: libraryKeep, how: store.KeptByWarrant, placed: on.(string)}, nil
}
lock.Lock()
}
defer lock.Unlock()
rec, _ := libraryRecord(l.Library)
v := assessLibrary(ctx, l, rec)
if v.err != nil {
return out, v, v.err
}
switch v.kind {
case libraryMounted:
out.Action, out.Detail = "unchanged", "not its home: mounted, and nothing is kept here"
return out, v, nil
case libraryWaitDisk:
out.Action = "waiting"
out.Detail = v.why + ": nothing is made, and no container that mounts it is created until it is there " +
"(novox/hq ADR 0328 §9); waits for the operator to " + DiskWords(l.Library)
return out, v, nil
case libraryUnknown:
out.Action = "waiting"
out.Detail = v.why + ": the library is left exactly as it is, and judged again on the next apply"
return out, v, nil
case libraryWaitKeep:
_ = Libraries.Update(l.Library, func(r *store.LibraryRecord, had bool) bool {
if !had || v.moved {
r.Root, r.Mount, r.Placed, r.Fs = l.Root, v.mount, v.placed, v.fs
}
if v.moved {
// Kept on another filesystem: what was kept there no longer holds here.
r.Kept, r.How, r.Cursor = false, "", nil
}
return true
})
out.Action = "waiting"
out.Detail = "its root holds data the mesh has not taken: nothing is changed under it until the operator's " +
"warrant (novox/hq ADR 0328 §7); waits for the operator to " + KeepWords(l.Library)
return out, v, nil
}
changed, made, err := keepFolders(l.Root, l.Paths, l.GID)
if err != nil {
return out, v, err
}
_ = Libraries.Update(l.Library, func(r *store.LibraryRecord, _ bool) bool {
if !r.Kept || r.KeptOn != v.placed {
r.How, r.At = v.how, time.Now().UTC()
}
r.Root, r.Mount, r.Placed, r.Fs, r.GID = l.Root, v.mount, v.placed, v.fs, l.GID
r.Kept, r.KeptOn = true, v.placed
r.Paths = unionPaths(r.Paths, l.Paths)
return true
})
out.Action = "unchanged"
if changed+made > 0 {
out.Action = "updated"
}
out.Detail = fmt.Sprintf("kept in %s: its root and %d sub-path(s) with group rwx and setgid, %d made; owners "+
"and everyone else's rights unchanged (novox/hq ADR 0328 §6)", l.Group, len(l.Paths), made)
return out, v, nil
}
// heldRoots is every library root whose containers are held: its disk, or its mount, is not there (§9).
func heldRoots(verdicts map[string]libraryVerdict, libs []declaration.Library) map[string]string {
out := map[string]string{}
for _, l := range libs {
if v, ok := verdicts[l.Library]; ok && v.kind == libraryWaitDisk {
out[l.Root] = l.Library
}
}
return out
}
// mountsHeld is the library a container waits for: one whose root it mounts, or mounts below, is held.
func mountsHeld(c *declaration.Container, held map[string]string) string {
for _, v := range c.Volumes {
src := mountSource(v)
if !strings.HasPrefix(src, "/") {
continue
}
for root, name := range held {
if atOrBelow(filepath.Clean(src), root) {
return name
}
}
}
return ""
}
// WaitingOnLibrary is every container of the declaration that waits for a library whose disk or mount is not
// there, read now: not created by the apply, so not judged alive or dead — the library says why.
func WaitingOnLibrary(d *declaration.Declaration) map[string]bool {
out := map[string]bool{}
if d == nil || len(d.Libraries) == 0 {
return out
}
verdicts := map[string]libraryVerdict{}
for _, l := range d.Libraries {
rec, _ := libraryRecord(l.Library)
verdicts[l.Library] = assessLibrary(context.Background(), l, rec)
}
held := heldRoots(verdicts, d.Libraries)
for _, r := range d.Resources {
if c, ok := r.(*declaration.Container); ok && mountsHeld(c, held) != "" {
out[c.ID] = true
}
}
return out
}
// The judgements of a library as a look says them.
const (
VerdictKeep = "keep"
VerdictMounted = "mounted"
VerdictWaitKeep = "wait-keep"
VerdictWaitDisk = "wait-disk"
VerdictUnknown = "unknown"
VerdictBroken = "broken"
)
// LibraryJudgement is a look's judgement of a library, and why, in words with no path; Placed names its root's
// filesystem for a keep wait, with no path (PlacedID).
type LibraryJudgement struct {
Kind, Why, Placed string
// Act is the last walk under its root.
Act *store.KeptAct
}
// JudgeLibrary judges a library for a look, read only.
func JudgeLibrary(ctx context.Context, l declaration.Library) LibraryJudgement {
rec, _ := libraryRecord(l.Library)
v := assessLibrary(ctx, l, rec)
j := LibraryJudgement{Act: rec.Act}
switch {
case v.err != nil:
j.Kind, j.Why = VerdictBroken, pathless(v.err)
case v.kind == libraryWaitKeep:
j.Kind, j.Placed = VerdictWaitKeep, v.placed
case v.kind == libraryWaitDisk:
j.Kind, j.Why = VerdictWaitDisk, v.why
case v.kind == libraryUnknown:
j.Kind, j.Why = VerdictUnknown, v.why
case v.kind == libraryMounted:
j.Kind = VerdictMounted
default:
j.Kind = VerdictKeep
}
return j
}
// joinRunner puts a library's tool runner's account in its group (ADR 0328 §11), as ADR 0252 puts an account in a
// group: recorded only when the mesh put it there, so one it was in before is never taken back. Whether it moved.
func joinRunner(ctx context.Context, sys system.System, l declaration.Library, known *store.State,
run Runner) (bool, string, error) {
if l.Runner == "" {
return false, "", nil
}
in, err := system.GroupsOf(ctx, system.Runner(run), l.Runner)
if err != nil {
return false, "", fmt.Errorf("the tool runner's account %s could not be read: %w", l.Runner, err)
}
if setOf(in)[l.Group] {
return false, "", nil
}
if err := sys.AddUserToGroup(ctx, system.Runner(run), l.Runner, l.Group); err != nil {
return false, "", err
}
for _, m := range known.Members {
if m.Account == l.Runner && m.Group == l.Group {
return true, fmt.Sprintf("put the tool runner's %s back in %s", l.Runner, l.Group), nil
}
}
known.Members = append(known.Members, store.Membership{Account: l.Runner, Group: l.Group, Library: l.Library})
return true, fmt.Sprintf("put the tool runner's %s in %s; it holds it once restarted", l.Runner, l.Group), nil
}
// leaveRunners takes every tool runner's account the mesh put in a library's group out of it once no declared
// library puts it there and no declared user resource asks for it (ADR 0252 §3). Never fatal: what could not be
// left stays recorded, said, for the next apply.
func leaveRunners(ctx context.Context, sys system.System, libs []declaration.Library, known *store.State, run Runner,
wanted Wanted) []Outcome {
declared := map[string]bool{}
for _, l := range libs {
if l.Runner != "" {
declared[l.Runner+" "+l.Group] = true
}
}
var out []Outcome
var keep []store.Membership
for _, m := range known.Members {
if declared[m.Account+" "+m.Group] {
keep = append(keep, m)
continue
}
o := Outcome{ID: LibraryAccess(m.Library) + " runner", Type: "library", Target: m.Account}
if others := wanted.othersAsk(m.Account, m.Group, ""); len(others) > 0 {
o.Action, o.Detail = "forgotten", fmt.Sprintf("left %s in %s, which %s asks for", m.Account, m.Group,
strings.Join(others, ", "))
out = append(out, o)
continue
}
gone, why := leaveGroup(ctx, sys, m.Account, m.Group, run)
o.Action, o.Detail = "restored", m.Account+" "+why
if !gone {
o.Action = "waiting"
keep = append(keep, m)
}
out = append(out, o)
}
known.Members = keep
sort.Slice(out, func(i, j int) bool { return out[i].ID < out[j].ID })
return out
}
// pathsInShape is whether every requested sub-path not kept before is absent (it is made), empty, or already in the
// group with group write and setgid, it and a bounded sample beneath it: what may be kept without the operator's
// word (§7). One that cannot be read is not.
func pathsInShape(l declaration.Library, kept []string) bool {
done := map[string]bool{}
for _, p := range kept {
done[p] = true
}
for _, p := range l.Paths {
if done[p] {
continue
}
path := filepath.Join(l.Root, p)
if _, err := lstatWithin(path); errors.Is(err, os.ErrNotExist) {
continue
}
facts, err := readFolder(path)
if err != nil {
return false
}
if facts.Empty {
continue
}
if int(facts.GID) != l.GID || facts.Mode&0o2070 != 0o2070 || !sampleInShape(path, l.GID) {
return false
}
}
return true
}
// unionPaths is a with every path of b not in it.
func unionPaths(a, b []string) []string {
have := map[string]bool{}
for _, p := range a {
have[p] = true
}
for _, p := range b {
if !have[p] {
a = append(a, p)
have[p] = true
}
}
sort.Strings(a)
return a
}
internal/apply/library_linux.go
+161
View File
@@ -0,0 +1,161 @@
//go:build linux
package apply
import (
"context"
"errors"
"fmt"
"time"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
)
// The take act on a library, and the walk that goes on with one stopped at its bound (novox/hq ADR 0328 §7).
// actRecord is a walk's counts as the record keeps them.
func actRecord(warrant, by, on string, started time.Time, w *treeWalk, err error) *store.KeptAct {
c := w.counts
rec := &store.KeptAct{Act: "take", Warrant: warrant, By: by, On: on, State: "done", Started: started,
Ended: time.Now().UTC(), Folders: c.Folders, Files: c.Files, Kept: c.Kept, Links: c.Links, Other: c.Other,
Mounts: c.Mounts, Shared: c.Shared, Linked: c.Linked, Stripped: c.Stripped}
if c.Shared+c.Linked+c.Stripped > 0 {
rec.Why = fmt.Sprintf("%d file(s) with another name given the group, %d root's left as they are, %d whose "+
"setuid or setgid bit the group change took", c.Linked, c.Shared, c.Stripped)
}
switch {
case errors.Is(err, ErrWalkBound):
rec.State, rec.Why = "stopped", "it met its bound of entries or time; it goes on from where it stopped"
case err != nil:
rec.State, rec.Why = "failed", err.Error()
case w.Failed != "":
rec.State = "failed"
rec.Why = fmt.Sprintf("%d entries could not be given the group: %s; walked again on the next look", c.Failed,
w.Failed)
}
return rec
}
// TakeLibrary is the take act (ADR 0328 §7): on the operator's warrant, the library's group, group read and write,
// and on folders group enter and setgid, set on its root and everything under it — no link followed, no other
// filesystem entered, the owner and the owner's and others' bits unchanged, a file with another name elsewhere left
// as it is. It judges the ask against the declaration last applied and the root as it is, and starts the walk: what
// it answers at once, and a channel closed when the walk is through or stopped at its bound. Refused, nothing is
// changed.
func TakeLibrary(ctx context.Context, d *declaration.Declaration, access, path, warrant, by string) (<-chan struct{},
string, error) {
if d == nil {
return nil, "", errors.New("this engine has applied no declaration, and takes no library it was not told of")
}
var lib *declaration.Library
for i := range d.Libraries {
if LibraryAccess(d.Libraries[i].Library) == access {
lib = &d.Libraries[i]
}
}
switch {
case lib == nil:
return nil, "", fmt.Errorf("the access %s names no library declared on this machine", access)
case !lib.Home:
return nil, "", fmt.Errorf("this machine is not the home of the library %s, and a library is taken on its "+
"home", lib.Library)
case lib.Root != path:
return nil, "", fmt.Errorf("the library %s is declared at another root than the one asked", lib.Library)
}
lock := libraryLock(lib.Library)
if !lock.TryLock() {
return nil, "", errors.New("a walk of the library is running; asked again once it is through, the act goes on")
}
rec, _ := libraryRecord(lib.Library)
v := assessLibrary(ctx, *lib, rec)
var refused error
switch {
case v.err != nil:
refused = v.err
case v.kind == libraryWaitDisk:
refused = errors.New(v.why)
case v.kind == libraryUnknown:
refused = errors.New(v.why + ", so a warrant could name no filesystem it was given for")
}
if refused != nil {
lock.Unlock()
return nil, "", refused
}
if _, _, err := keepFolders(lib.Root, lib.Paths, lib.GID); err != nil {
lock.Unlock()
return nil, "", err
}
started := time.Now().UTC()
_ = Libraries.Update(lib.Library, func(r *store.LibraryRecord, _ bool) bool {
r.Root, r.Mount, r.Placed, r.Fs, r.GID = lib.Root, v.mount, v.placed, v.fs, lib.GID
r.Kept, r.KeptOn, r.How, r.At = true, v.placed, store.KeptByWarrant, started
r.Warrant, r.By, r.Cursor = warrant, by, nil
r.Act = &store.KeptAct{Act: "take", Warrant: warrant, By: by, On: v.placed, State: "running", Started: started}
return true
})
done := make(chan struct{})
go func() {
defer close(done)
defer lock.Unlock()
walkLibrary(lib.Library, lib.Root, lib.GID, warrant, by, v.placed, nil)
}()
return done, fmt.Sprintf("the take act started under the warrant %s: %s's group, group read and write, and "+
"setgid on its folders are set on everything under its root, following no link and entering no other "+
"filesystem", warrant, lib.Library), nil
}
// walkLibrary walks a library's root from resume with its group, and records what it did: a walk stopped at its
// bound keeps its cursor for the next. The caller holds the library's lock.
func walkLibrary(name, root string, gid int, warrant, by, on string, resume []string) {
libraryWalks.Store(name, on)
defer libraryWalks.Delete(name)
started := time.Now().UTC()
w, err := walkRoot(root, ActLimits, machineStats, resume, groupVisit(gid))
rec := actRecord(warrant, by, on, started, w, err)
_ = Libraries.Update(name, func(r *store.LibraryRecord, _ bool) bool {
r.Act = rec
r.Cursor = nil
if errors.Is(err, ErrWalkBound) {
r.Cursor = w.Cursor
}
return true
})
}
// ReconcileLibraries goes on with every take act that stopped at its bound or left entries it could not change,
// from where it stopped — only while the library is still kept on the filesystem it was taken on (judged as an apply
// judges it). What it did, in words, for the engine to say.
func ReconcileLibraries(ctx context.Context, d *declaration.Declaration) []string {
if d == nil {
return nil
}
var said []string
for _, l := range d.Libraries {
if ctx.Err() != nil {
break
}
if !l.Home {
continue
}
rec, _ := libraryRecord(l.Library)
if rec.Act == nil || (rec.Act.State != "stopped" && rec.Act.State != "failed") || rec.How != store.KeptByWarrant {
continue
}
lock := libraryLock(l.Library)
if !lock.TryLock() {
continue
}
v := assessLibrary(ctx, l, rec)
if v.err != nil || v.kind != libraryKeep || v.placed != rec.KeptOn || v.moved {
lock.Unlock()
continue
}
walkLibrary(l.Library, l.Root, l.GID, rec.Warrant, rec.By, rec.KeptOn, rec.Cursor)
lock.Unlock()
after, _ := libraryRecord(l.Library)
said = append(said, fmt.Sprintf("the library %s: the take act went on, %s (%d folders and %d files changed)",
l.Library, after.Act.State, after.Act.Folders, after.Act.Files))
}
return said
}
internal/apply/library_test.go
+834
View File
@@ -0,0 +1,834 @@
//go:build linux
package apply
import (
"context"
"encoding/json"
"errors"
"fmt"
"os"
"path/filepath"
"strconv"
"strings"
"testing"
"time"
"golang.org/x/sys/unix"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
)
// The engine's half of ADR 0328's checks (novox/hq ADR 0328, "How it is checked", issue 567). The engine runs as
// root; a test may not, and a non-root test gives its folders a group it is in itself.
// testGID is a group the test may give its folders: any number as root, else one of its own added groups that is
// no root group's.
func testGID(t *testing.T) int {
t.Helper()
if os.Geteuid() == 0 {
return 61000
}
groups, _ := os.Getgroups()
for _, g := range groups {
if g != os.Getgid() && g != 0 && rootGroup(g) == "" {
return g
}
}
t.Skip("the test runs as no root and in no group of its own beside its primary one, so it can give no " +
"folder a library's group")
return 0
}
// libraries has the test keep its own record of libraries and judge mounts as the test says.
func libraries(t *testing.T, points, targets []string) {
t.Helper()
was, wasPoints, wasTargets := Libraries, MountPoints, MountTargets
Libraries = NewLibraryMemory()
forgetMountHistory()
MountPoints = func() []string { return append([]string{"/"}, points...) }
MountTargets = func(context.Context) []string { return targets }
t.Cleanup(func() {
Libraries, MountPoints, MountTargets = was, wasPoints, wasTargets
forgetMountHistory()
})
}
func forgetMountHistory() {
mountHistory.Lock()
mountHistory.seen = map[string]bool{}
mountHistory.Unlock()
}
// libraryDecl is a declaration with one library, its group, and resources.
func libraryDecl(t *testing.T, lib string, resources ...string) *declaration.Declaration {
t.Helper()
var l declaration.Library
if err := jsonInto(lib, &l); err != nil {
t.Fatal(err)
}
raw := fmt.Sprintf(`{"declaration":1,"groups":[{"name":%q,"gid":%d}],"libraries":[%s],"resources":[%s]}`,
l.Group, l.GID, lib, strings.Join(resources, ","))
if len(resources) == 0 {
raw = strings.Replace(raw, `"resources":[]`, `"owns_nothing":true,"resources":[]`, 1)
}
d, err := declaration.Parse([]byte(raw))
if err != nil {
t.Fatal(err)
}
return d
}
// libJSON is a library's declaration.
func libJSON(name, root string, gid int, home, taken bool, paths ...string) string {
quoted := make([]string, len(paths))
for i, p := range paths {
quoted[i] = strconv.Quote(p)
}
return fmt.Sprintf(`{"library":%q,"root":%q,"group":"mesh-%s","gid":%d,"home":%v,"taken":%v,"paths":[%s]}`,
name, root, name, gid, home, taken, strings.Join(quoted, ","))
}
// applyLib applies d with a runner that answers the group database for the library group (already there) and runs
// nothing else.
func applyLib(t *testing.T, d *declaration.Declaration, known store.State) (Report, store.State, error) {
t.Helper()
run := func(_ context.Context, name string, args ...string) (string, error) {
if name == "getent" && args[0] == "group" {
for _, g := range d.Groups {
if args[1] == g.Name || args[1] == strconv.Itoa(g.GID) {
return fmt.Sprintf("%s:x:%d:\n", g.Name, g.GID), nil
}
}
return "", errors.New("getent exited 2")
}
return "", nil
}
return Apply(context.Background(), archHost(t), d, known, store.OriginDeclared, run, nil, nil)
}
func statOf(t *testing.T, path string) unix.Stat_t {
t.Helper()
var st unix.Stat_t
if err := unix.Lstat(path, &st); err != nil {
t.Fatal(err)
}
return st
}
// Row 6: the root and every requested sub-path kept in the library's group with group rwx and setgid on every apply —
// those folders alone, never what is in them; owner, owner's and others' bits unchanged.
func TestALibraryIsKeptInItsGroup(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
if err := os.Mkdir(root, 0o755); err != nil {
t.Fatal(err)
}
d := libraryDecl(t, libJSON("media", root, gid, true, false, "movies"))
if _, _, err := applyLib(t, d, store.State{}); err != nil {
t.Fatal(err)
}
// Kept since it was empty; an app then narrows a requested folder and writes beneath it.
movies := filepath.Join(root, "movies")
if err := os.Chown(movies, -1, os.Getgid()); err != nil {
t.Fatal(err)
}
if err := unix.Chmod(movies, 0o705); err != nil {
t.Fatal(err)
}
film := filepath.Join(movies, "film")
if err := os.WriteFile(film, []byte("data"), 0o640); err != nil {
t.Fatal(err)
}
filmBefore := statOf(t, film)
before := statOf(t, movies)
report, _, err := applyLib(t, d, store.State{})
if err != nil {
t.Fatal(err)
}
if o := outcomeOf(report, "library:media"); o.Action != "updated" {
t.Fatalf("a kept library was not put back: %+v", o)
}
after := statOf(t, movies)
if int(after.Gid) != gid || after.Mode&0o7777 != 0o2775 {
t.Fatalf("a requested path is not kept in the group with group rwx and setgid: gid %d, mode %o", after.Gid,
after.Mode&0o7777)
}
if after.Uid != before.Uid || after.Mode&0o707 != before.Mode&0o707 {
t.Errorf("the owner or the owner's and others' bits changed: %o to %o", before.Mode&0o7777, after.Mode&0o7777)
}
if f := statOf(t, film); f.Mode != filmBefore.Mode || f.Gid != filmBefore.Gid {
t.Error("a file under a kept path was changed without the take act")
}
if rec, _ := libraryRecord("media"); !rec.Kept || rec.How != store.KeptEmpty {
t.Errorf("not recorded kept as empty: %+v", rec)
}
}
// Row 9: a missing sub-path is made with the root's owner, the library's group, group rwx and setgid.
func TestAMissingSubPathIsMadeAsTheRootIs(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
if err := os.Mkdir(root, 0o751); err != nil {
t.Fatal(err)
}
if err := os.Chmod(root, 0o751); err != nil {
t.Fatal(err)
}
d := libraryDecl(t, libJSON("media", root, gid, true, false, "tv/shows"))
if _, _, err := applyLib(t, d, store.State{}); err != nil {
t.Fatalf("an empty root was not kept: %v", err)
}
rst := statOf(t, root)
for _, p := range []string{filepath.Join(root, "tv"), filepath.Join(root, "tv", "shows")} {
st := statOf(t, p)
if st.Uid != rst.Uid || int(st.Gid) != gid || st.Mode&0o7777 != 0o2771 {
t.Errorf("%s made as uid %d gid %d mode %o, and the root's owner, the group and 2771 were wanted", p,
st.Uid, st.Gid, st.Mode&0o7777)
}
}
if rec, _ := libraryRecord("media"); rec.How != store.KeptEmpty {
t.Errorf("an empty root is not kept as empty: %+v", rec)
}
}
// Row 7 (keep wait) and §8: a root that holds data not in the group waits with reason keep, and nothing is changed.
func TestARootThatHoldsDataWaitsForTheOperatorsWord(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
if err := os.MkdirAll(filepath.Join(root, "movies"), 0o755); err != nil {
t.Fatal(err)
}
before := statOf(t, root)
d := libraryDecl(t, libJSON("media", root, gid, true, false, "movies"))
report, _, err := applyLib(t, d, store.State{})
if err != nil {
t.Fatal(err)
}
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, KeepWords("media")) {
t.Fatalf("a root holding data did not wait for the operator: %+v", o)
}
if after := statOf(t, root); after.Gid != before.Gid || after.Mode != before.Mode {
t.Fatal("the root was changed without a warrant")
}
j := JudgeLibrary(context.Background(), d.Libraries[0])
if j.Kind != VerdictWaitKeep || j.Placed == "" || strings.Contains(KeepWords("media")+DiskWords("media"), "/") {
t.Fatalf("the look does not wait for the operator, naming the filesystem with no path: %+v", j)
}
}
// Row 7, the act: group, group write and setgid set under the root; no link followed; no other filesystem entered;
// a file with another name elsewhere left; owner, owner's and others' bits unchanged; nothing without a warrant
// (the act's ask, internal/link); an undeclared library refused; a walk over its bound goes on from its cursor.
func TestTheTakeActSetsTheGroupUnderTheRoot(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
base := t.TempDir()
root := filepath.Join(base, "media")
outside := filepath.Join(base, "outside")
for _, d := range []string{filepath.Join(root, "movies", "a film"), outside} {
if err := os.MkdirAll(d, 0o705); err != nil {
t.Fatal(err)
}
}
file := filepath.Join(root, "movies", "a film", "film.mkv")
if err := os.WriteFile(file, []byte("data"), 0o604); err != nil {
t.Fatal(err)
}
if err := unix.Chmod(file, 0o4604); err != nil { // its own setuid bit, which a group change drops
t.Fatal(err)
}
secret := filepath.Join(outside, "secret")
if err := os.WriteFile(secret, nil, 0o600); err != nil {
t.Fatal(err)
}
if err := os.Link(secret, filepath.Join(root, "movies", "hardlink")); err != nil {
t.Fatal(err)
}
if os.Geteuid() == 0 { // an account's file, as an *arr app's hardlinked download is
if err := os.Chown(secret, 65534, -1); err != nil {
t.Fatal(err)
}
}
if err := os.Symlink(outside, filepath.Join(root, "link")); err != nil {
t.Fatal(err)
}
d := libraryDecl(t, libJSON("media", root, gid, true, false, "movies"))
if _, _, err := applyLib(t, d, store.State{}); err != nil {
t.Fatal(err)
}
if _, _, err := TakeLibrary(context.Background(), d, "library:books", root, "w", "op"); err == nil {
t.Fatal("an undeclared library was taken")
}
// Bounded: three entries a walk, gone on from the cursor until done.
was := ActLimits
ActLimits = WalkLimits{Entries: 3, Time: time.Minute}
defer func() { ActLimits = was }()
done, said, err := TakeLibrary(context.Background(), d, "library:media", root, "w-1", "the operator")
if err != nil {
t.Fatalf("the take act was refused: %v", err)
}
<-done
if !strings.Contains(said, "w-1") {
t.Errorf("the act does not say its warrant: %s", said)
}
rec, _ := libraryRecord("media")
if rec.Act == nil || rec.Act.State != "stopped" || len(rec.Cursor) == 0 {
t.Fatalf("a walk over its bound does not say where it stopped: %+v %+v", rec.Act, rec.Cursor)
}
for i := 0; i < 10; i++ {
ReconcileLibraries(context.Background(), d)
if rec, _ = libraryRecord("media"); rec.Act.State == "done" {
break
}
}
if rec.Act.State != "done" || rec.Act.Linked != 1 || rec.Act.Stripped != 1 || !rec.Kept || rec.How != store.KeptByWarrant ||
rec.KeptOn == "" {
t.Fatalf("the act is not recorded done under its warrant on its filesystem: %+v %+v", rec, rec.Act)
}
for _, p := range []string{root, filepath.Join(root, "movies"), filepath.Join(root, "movies", "a film")} {
if st := statOf(t, p); int(st.Gid) != gid || st.Mode&0o7777 != 0o2775 {
t.Errorf("%s: gid %d mode %o, and the group with 2775 (705 plus group rwx and setgid) was wanted", p,
st.Gid, st.Mode&0o7777)
}
}
if st := statOf(t, file); int(st.Gid) != gid || st.Mode&0o7777 != 0o0664 {
t.Errorf("a file: gid %d mode %o, and the group with 0664 (its setuid bit taken by the group change and "+
"never put back) was wanted", st.Gid, st.Mode&0o7777)
}
if st := statOf(t, secret); int(st.Gid) != gid || st.Mode&0o7777 != 0o660 {
t.Error("an account's file with another name (a hardlinked download) was not given the group")
}
if st := statOf(t, outside); int(st.Gid) == gid {
t.Error("the act followed a link out of the library")
}
}
// Row 7, the act: another filesystem is not entered — a folder whose device is not the root's is passed by.
func TestTheTakeActEntersNoOtherFilesystem(t *testing.T) {
gid := testGID(t)
root := t.TempDir()
mount := filepath.Join(root, "elsewhere")
if err := os.Mkdir(mount, 0o755); err != nil {
t.Fatal(err)
}
stats := walkStats{
at: func(dirfd int, name string, st *unix.Stat_t) error {
err := unix.Fstatat(dirfd, name, st, unix.AT_SYMLINK_NOFOLLOW)
if name == "elsewhere" {
st.Dev++
}
return err
},
fd: unix.Fstat,
}
w, err := walkRoot(root, ActLimits, stats, nil, groupVisit(gid))
if err != nil {
t.Fatal(err)
}
if w.counts.Mounts != 1 || int(statOf(t, mount).Gid) == gid {
t.Fatalf("the walk entered another filesystem: %+v", w.counts)
}
}
// Row 9: a root that is absent, or whose disk is not mounted, makes nothing, holds the containers that mount it,
// and waits with reason disk; off its home, a mount that is not there holds them too.
func TestALibraryWhoseDiskIsNotThereHoldsItsContainers(t *testing.T) {
gid := testGID(t)
base := t.TempDir()
disk := filepath.Join(base, "disk")
if err := os.Mkdir(disk, 0o755); err != nil {
t.Fatal(err)
}
for _, tc := range []struct {
why, root string
home bool
targets []string
}{
{"its root absent", filepath.Join(base, "gone", "media"), true, nil},
{"its disk not mounted", filepath.Join(disk, "media"), true, []string{disk}},
{"its mount not there", disk, false, nil},
} {
libraries(t, nil, tc.targets)
d := libraryDecl(t, libJSON("media", tc.root, gid, tc.home, false, "movies"),
`{"id":"radarr.app","type":"container","name":"radarr","image":"`+pinned+`","volumes":["`+
filepath.Join(tc.root, "movies")+`:/movies"]}`)
var started bool
run := func(_ context.Context, name string, args ...string) (string, error) {
if len(args) > 0 && args[0] == "run" {
started = true
}
if name == "getent" && args[0] == "group" {
return fmt.Sprintf("mesh-media:x:%d:\n", gid), nil
}
return "", nil
}
report, _, _ := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginDeclared, run, nil, nil)
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, DiskWords("media")) {
t.Errorf("%s: the library does not wait for its disk: %+v", tc.why, o)
}
if o := outcomeOf(report, "radarr.app"); o.Action != "waiting" || started {
t.Errorf("%s: a container that mounts it was not held: %+v", tc.why, o)
}
if !WaitingOnLibrary(d)["radarr.app"] {
t.Errorf("%s: liveness is not told the container waits", tc.why)
}
if j := JudgeLibrary(context.Background(), d.Libraries[0]); j.Kind != VerdictWaitDisk {
t.Errorf("%s: the look judges it %s", tc.why, j.Kind)
}
if _, err := os.Stat(filepath.Join(tc.root, "movies")); !errors.Is(err, os.ErrNotExist) {
t.Errorf("%s: something was made", tc.why)
}
}
}
// Row 3: the library's group made with its number; a name or number that is another's refused; what was made, and
// only that, removed when no longer declared.
func TestALibrarysGroupIsMadeWithItsNumber(t *testing.T) {
m := &accountsMachine{users: map[string][2]int{}, groups: map[string][2]int{"media": {2000, 0}}}
d := withGroups(t, `{"name":"mesh-media","gid":62000}`, ``, ``)
report, known, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginDeclared, m.run, nil, nil)
if err != nil {
t.Fatal(err)
}
if strings.Join(m.ran, "\n") != "groupadd --system --gid 62000 mesh-media" {
t.Fatalf("made with: %v", m.ran)
}
if o := outcomeOf(report, "group mesh-media"); o.Action != "created" || len(known.Groups) != 1 {
t.Fatalf("not recorded as made: %+v %+v", o, known.Groups)
}
clash := withGroups(t, `{"name":"mesh-books","gid":2000}`, ``, ``)
if _, _, err := Apply(context.Background(), archHost(t), clash, known, store.OriginDeclared, m.run, nil, nil); err == nil ||
!strings.Contains(err.Error(), "media") {
t.Errorf("a number that is another group's was not refused naming it: %v", err)
}
m.ran = nil
none := withGroups(t, ``, ``, `{"id":"x.d","type":"directory","path":"`+t.TempDir()+`/x"}`)
if _, known, err = Apply(context.Background(), archHost(t), none, known, store.OriginDeclared, m.run, nil, nil); err != nil {
t.Fatal(err)
}
if _, still := m.groups["mesh-media"]; still || len(known.Groups) != 0 {
t.Fatalf("a library group no longer declared was not removed: %v", m.ran)
}
if _, kept := m.groups["media"]; !kept {
t.Fatal("a group the mesh did not make was removed")
}
}
// Row 4: a module's user with its own group (its uid's number), its first library's group as primary and its other
// libraries' as added groups.
func TestAModulesUserIsInItsLibrariesGroups(t *testing.T) {
m := &accountsMachine{users: map[string][2]int{}, groups: map[string][2]int{}}
d := withGroups(t, `{"name":"mesh-media","gid":62000},{"name":"mesh-books","gid":62001}`,
`{"module":"radarr","name":"mesh-radarr","uid":61001,"gid":62000,"groups":[62001]}`, ``)
if _, known, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginDeclared, m.run, nil,
nil); err != nil {
t.Fatal(err)
} else if len(known.Identities) != 1 {
t.Fatalf("the identity is not recorded: %+v", known.Identities)
}
want := []string{
"groupadd --system --gid 62000 mesh-media",
"groupadd --system --gid 62001 mesh-books",
"groupadd --system --gid 61001 mesh-radarr",
"useradd --system --uid 61001 --gid 62000 --groups mesh-books --no-create-home --home-dir /nonexistent --shell " +
"/usr/bin/nologin mesh-radarr",
}
if strings.Join(m.ran, "\n") != strings.Join(want, "\n") {
t.Fatalf("made with:\n%s\nwant:\n%s", strings.Join(m.ran, "\n"), strings.Join(want, "\n"))
}
}
// Row 11: the tool runner's account is put in each library's group once, its unit restarted for it (a change of
// library:<name>), and taken out once no library puts it there.
func TestTheToolRunnerIsInItsLibrariesGroups(t *testing.T) {
gid := testGID(t)
libraries(t, []string{"/srv/media"}, nil)
m := &accountsMachine{users: map[string][2]int{"nox": {1003, 1003}}, groups: map[string][2]int{"nox": {1003, 0}}}
lib := `{"library":"media","root":"/srv/media","group":"mesh-media","gid":` + strconv.Itoa(gid) +
`,"home":false,"runner":"nox"}`
d := libraryDecl(t, lib)
report, known, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginDeclared, m.run, nil, nil)
if err != nil {
t.Fatal(err)
}
if !strings.Contains(strings.Join(m.ran, "\n"), "usermod --append --groups mesh-media nox") {
t.Fatalf("the tool runner was not put in the library's group: %v", m.ran)
}
if o := outcomeOf(report, "library:media"); o.Action != "updated" || len(known.Members) != 1 {
t.Fatalf("its joining is not a change of library:media, or not recorded: %+v %+v", o, known.Members)
}
m.ran = nil
if _, known, err = Apply(context.Background(), archHost(t), d, known, store.OriginDeclared, m.run, nil, nil); err != nil {
t.Fatal(err)
}
if strings.Contains(strings.Join(m.ran, "\n"), "usermod") {
t.Fatal("the tool runner was put in its group again")
}
none := withGroups(t, ``, ``, `{"id":"x.d","type":"directory","path":"`+t.TempDir()+`/x"}`)
if _, known, err = Apply(context.Background(), archHost(t), none, known, store.OriginDeclared, m.run, nil, nil); err != nil {
t.Fatal(err)
}
if !strings.Contains(strings.Join(m.ran, "\n"), "gpasswd --delete nox mesh-media") || len(known.Members) != 0 {
t.Fatalf("the tool runner was not taken out of a group no library puts it in: %v", m.ran)
}
}
// Row 15: a library group, an identity's added group or an image told a root group's number is refused with its
// reason, and nothing is made or started.
func TestNoLibraryGroupIsRoot(t *testing.T) {
was := RootGroupIDs
RootGroupIDs = func() map[int]string { return map[int]string{10: "wheel"} }
defer func() { RootGroupIDs = was }()
dir := t.TempDir()
for _, d := range []*declaration.Declaration{
withGroups(t, `{"name":"mesh-media","gid":10}`, ``, `{"id":"m.d","type":"directory","path":"`+dir+`/d"}`),
withGroups(t, `{"name":"mesh-media","gid":10}`,
`{"module":"radarr","name":"mesh-radarr","uid":61001,"gid":61001,"groups":[10]}`,
`{"id":"m.d","type":"directory","path":"`+dir+`/d"}`),
} {
m := &accountsMachine{users: map[string][2]int{}, groups: map[string][2]int{}}
_, _, err := Apply(context.Background(), archHost(t), d, store.State{}, store.OriginDeclared, m.run, nil, nil)
if err == nil || !strings.Contains(err.Error(), "wheel") {
t.Errorf("a root group was not refused naming why: %v", err)
}
if len(m.ran) != 0 {
t.Errorf("something was made: %v", m.ran)
}
if _, err := os.Stat(filepath.Join(dir, "d")); err == nil {
t.Error("a resource of a declaration naming a root group was applied")
}
}
if _, err := declaration.Parse([]byte(`{"declaration":1,"groups":[{"name":"mesh-media","gid":0}],` +
`"owns_nothing":true,"resources":[]}`)); err == nil || !strings.Contains(err.Error(), "never root") {
t.Errorf("a library group of number 0 was not refused on arrival: %v", err)
}
}
// A library's filesystem that cannot be named this time is unknown, never a move; another filesystem at the root is.
func TestALibraryNotNamedIsUnknownAndAnotherFilesystemIsAMove(t *testing.T) {
gid := testGID(t)
base := t.TempDir()
pool := filepath.Join(base, "pool")
root := filepath.Join(pool, "media")
if err := os.MkdirAll(filepath.Join(root, "old"), 0o755); err != nil {
t.Fatal(err)
}
libraries(t, []string{pool}, nil)
uuid := "6f1c0a4e-1b2d-4c3e-8f00-aa11bb22cc33"
wasUUID := MountUUID
MountUUID = func(p string) string {
if p == pool {
return uuid
}
return "x"
}
defer func() { MountUUID = wasUUID }()
d := libraryDecl(t, libJSON("media", root, gid, true, false))
if _, _, err := applyLib(t, d, store.State{}); err != nil {
t.Fatal(err)
}
done, _, err := TakeLibrary(context.Background(), d, "library:media", root, "w-1", "op")
if err != nil {
t.Fatal(err)
}
<-done
taken := libraryDecl(t, libJSON("media", root, gid, true, true))
before, _ := libraryRecord("media")
uuid = "" // nothing names it now
wasFsid := MountFsid
MountFsid = func(string) string { return "" }
wasSource := MountSource
MountSource = func(string) (string, string) { return "", "" }
report, _, _ := applyLib(t, taken, store.State{})
MountFsid, MountSource = wasFsid, wasSource
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, "could not be named") {
t.Fatalf("an unnamed filesystem is not said so: %+v", o)
}
if after, _ := libraryRecord("media"); !after.Kept || after.KeptOn != before.KeptOn {
t.Fatalf("a name not read reset the record: %+v", after)
}
uuid = "00000000-1111-2222-3333-444444444444" // another pool at the same point, its root not in the group
if err := os.Chown(root, -1, os.Getgid()); err != nil {
t.Fatal(err)
}
if err := unix.Chmod(root, 0o755); err != nil {
t.Fatal(err)
}
report, _, _ = applyLib(t, taken, store.State{})
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, KeepWords("media")) {
t.Fatalf("another filesystem at the root was kept on the old warrant: %+v", o)
}
}
// Old-shape parity: a controller older than ADR 0328 sends no groups, identities or libraries, and an access is
// applied exactly as before ADR 0325 — mounted when present, refused when absent, nothing kept, made or held.
func TestAnOlderControllersDeclarationIsAppliedAsBefore(t *testing.T) {
libraries(t, nil, nil)
dir := t.TempDir()
present := filepath.Join(dir, "library")
absent := filepath.Join(dir, "media", "movies")
if err := os.Mkdir(present, 0o755); err != nil {
t.Fatal(err)
}
before := statOf(t, present)
resources := []string{
`{"id":"radarr.library","type":"access","path":"` + present + `","mode":"read-write","users":[` +
`{"identity":"mesh-radarr","uid":61001,"use":"read-write","from":"container"}],"taken":true}`,
`{"id":"plex.movies","type":"access","path":"` + absent + `"}`,
}
report, _, err := Apply(context.Background(), archHost(t), declare(t, strings.Join(resources, ",")), store.State{},
store.OriginDeclared, noServices, nil, nil)
if err == nil || !strings.Contains(err.Error(), absent+" is not there, and the mesh does not own it — the operator "+
"must provide it") {
t.Fatalf("an absent access is not refused as before: %v", err)
}
if o := outcomeOf(report, "radarr.library"); o.Action != "unchanged" ||
o.Detail != "operator-owned; present, read-write, nothing managed" {
t.Errorf("a present access is not as before: %+v", o)
}
if after := statOf(t, present); after.Gid != before.Gid || after.Mode != before.Mode {
t.Error("a present access was changed")
}
if n, _ := unix.Getxattr(present, "system.posix_acl_access", nil); n > 0 {
t.Error("an ACL was set on an access")
}
if _, err := os.Stat(absent); !errors.Is(err, os.ErrNotExist) {
t.Error("an absent access was made")
}
}
func jsonInto(raw string, into any) error { return json.Unmarshal([]byte(raw), into) }
// Row 4: a module that joins a library later is given its group as primary on the account the mesh made; an account
// the mesh did not make is never changed, and is refused if it is not as declared.
func TestAModuleThatJoinsALibraryLaterIsGivenItsGroup(t *testing.T) {
m := &accountsMachine{users: map[string][2]int{}, groups: map[string][2]int{}}
own := withGroups(t, `{"name":"mesh-media","gid":62000}`,
`{"module":"radarr","name":"mesh-radarr","uid":61001,"gid":61001}`, ``)
_, known, err := Apply(context.Background(), archHost(t), own, store.State{}, store.OriginDeclared, m.run, nil, nil)
if err != nil {
t.Fatal(err)
}
m.ran = nil
joined := withGroups(t, `{"name":"mesh-media","gid":62000}`,
`{"module":"radarr","name":"mesh-radarr","uid":61001,"gid":62000}`, ``)
if _, known, err = Apply(context.Background(), archHost(t), joined, known, store.OriginDeclared, m.run, nil, nil); err != nil {
t.Fatal(err)
}
if strings.Join(m.ran, "\n") != "usermod --gid 62000 --groups mesh-radarr" || m.users["mesh-radarr"][1] != 62000 {
t.Fatalf("the mesh's account was not given its library's group: %v", m.ran)
}
theirs := &accountsMachine{users: map[string][2]int{"mesh-radarr": {61001, 61001}},
groups: map[string][2]int{"mesh-radarr": {61001, 0}, "mesh-media": {62000, 0}}}
if _, _, err := Apply(context.Background(), archHost(t), joined, store.State{}, store.OriginDeclared, theirs.run,
nil, nil); err == nil || !strings.Contains(err.Error(), "was not made by the mesh") {
t.Fatalf("an account the mesh did not make was changed, or not refused: %v %v", err, theirs.ran)
}
}
// A library's root is never in the machine's own trees, as an access's never is (novox/hq issue 339).
func TestALibraryIsNeverTheMachinesOwnTree(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
for _, root := range []string{"/etc", "/usr/share", "/var/lib/mesh-host/x"} {
d := libraryDecl(t, libJSON("sys", root, gid, true, true))
if _, _, err := applyLib(t, d, store.State{}); err == nil {
t.Errorf("a library at %s was not refused", root)
}
if _, _, err := TakeLibrary(context.Background(), d, "library:sys", root, "w", "op"); err == nil {
t.Errorf("a library at %s was taken", root)
}
}
}
// §7: a root in shape with old data beneath it not in the group is asked about, never kept without a warrant; a root
// and sample all in shape are kept; once taken, never asked again on that filesystem.
func TestARootInShapeWithDataBelowNotInTheGroupWaits(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
movies := filepath.Join(root, "movies")
if err := os.MkdirAll(movies, 0o755); err != nil {
t.Fatal(err)
}
old := filepath.Join(movies, "old film")
if err := os.WriteFile(old, []byte("data"), 0o644); err != nil {
t.Fatal(err)
}
for _, p := range []string{root, movies} {
if err := os.Chown(p, -1, gid); err != nil {
t.Fatal(err)
}
if err := unix.Chmod(p, 0o2775); err != nil {
t.Fatal(err)
}
}
d := libraryDecl(t, libJSON("media", root, gid, true, false, "movies"))
report, _, err := applyLib(t, d, store.State{})
if err != nil {
t.Fatal(err)
}
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, KeepWords("media")) {
t.Fatalf("a root in shape with an old file below not in the group was kept without asking: %+v", o)
}
// The old file in the group too: the sample is in shape, and the library is kept.
if err := os.Chown(old, -1, gid); err != nil {
t.Fatal(err)
}
if err := unix.Chmod(old, 0o664); err != nil {
t.Fatal(err)
}
if report, _, _ = applyLib(t, d, store.State{}); outcomeOf(report, "library:media").Action == "waiting" {
t.Fatal("a root and sample in shape were not kept")
}
// Once kept, a file an app later leaves out of the group asks nothing again on that filesystem.
if err := os.WriteFile(filepath.Join(movies, "new"), nil, 0o600); err != nil {
t.Fatal(err)
}
if report, _, _ = applyLib(t, d, store.State{}); outcomeOf(report, "library:media").Action == "waiting" {
t.Fatal("a kept library asked again")
}
}
// Review: a file with another name that root owns is left as it is (its other name may be anywhere), and a setgid
// file never keeps its setgid bit once regrouped.
func TestRootsLinkedFilesAreLeftAndSetgidIsNeverKept(t *testing.T) {
gid := testGID(t)
f, err := os.CreateTemp(t.TempDir(), "file")
if err != nil {
t.Fatal(err)
}
defer f.Close()
if err := unix.Chmod(f.Name(), 0o2755); err != nil {
t.Fatal(err)
}
st := statOf(t, f.Name())
rootLinked := st
rootLinked.Uid, rootLinked.Nlink = 0, 2
if did, err := groupVisit(gid)(int(f.Fd()), rootLinked, false); err != nil || did != visitShared {
t.Fatalf("a root-owned file with another name was not left: %d %v", did, err)
}
if after := statOf(t, f.Name()); after.Gid != st.Gid || after.Mode != st.Mode {
t.Fatal("a root-owned file with another name was changed")
}
did, err := groupVisit(gid)(int(f.Fd()), st, false)
if err != nil || did&visitStripped == 0 {
t.Fatalf("a setgid file's bit is not said taken: %d %v", did, err)
}
if after := statOf(t, f.Name()); after.Mode&(unix.S_ISGID|unix.S_ISUID) != 0 || int(after.Gid) != gid {
t.Fatalf("a setgid file kept its bit in the library's group: %o", after.Mode&0o7777)
}
}
// Review: a sub-path asked for after the library was kept without a warrant, which holds data not in the group,
// waits for the operator's word as the root would, and nothing of it is changed; an empty one is kept.
func TestASubPathHoldingOldDataWaitsForTheOperatorsWord(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
if err := os.Mkdir(root, 0o755); err != nil {
t.Fatal(err)
}
if _, _, err := applyLib(t, libraryDecl(t, libJSON("media", root, gid, true, false, "movies")), store.State{}); err != nil {
t.Fatal(err)
}
// Someone puts old data at a sub-path the library is asked for only now.
music := filepath.Join(root, "music")
if err := os.MkdirAll(filepath.Join(music, "album"), 0o755); err != nil {
t.Fatal(err)
}
before := statOf(t, music)
report, _, err := applyLib(t, libraryDecl(t, libJSON("media", root, gid, true, false, "movies", "music")), store.State{})
if err != nil {
t.Fatal(err)
}
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, KeepWords("media")) {
t.Fatalf("a sub-path holding old data was kept without a warrant: %+v", o)
}
if after := statOf(t, music); after.Gid != before.Gid || after.Mode != before.Mode {
t.Fatal("a sub-path holding old data was changed")
}
// An empty one asked for is kept.
if err := os.RemoveAll(filepath.Join(music, "album")); err != nil {
t.Fatal(err)
}
report, _, _ = applyLib(t, libraryDecl(t, libJSON("media", root, gid, true, false, "movies", "music")), store.State{})
if o := outcomeOf(report, "library:media"); o.Action == "waiting" {
t.Fatalf("an empty sub-path was not kept: %+v", o)
}
}
// Review: an apply does not wait for a take walk that is running: it leaves the library to it.
func TestAnApplyDoesNotWaitForATakeWalk(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
if err := os.Mkdir(root, 0o755); err != nil {
t.Fatal(err)
}
lock := libraryLock("media")
lock.Lock()
defer lock.Unlock()
libraryWalks.Store("media", "fs-test")
defer libraryWalks.Delete("media")
done := make(chan Report, 1)
go func() {
r, _, _ := applyLib(t, libraryDecl(t, libJSON("media", root, gid, true, false)), store.State{})
done <- r
}()
select {
case r := <-done:
if o := outcomeOf(r, "library:media"); !strings.Contains(o.Detail, "take act") {
t.Fatalf("the apply does not say it left the library to the walk: %+v", o)
}
case <-time.After(2 * time.Second):
t.Fatal("the apply waited for the take walk")
}
}
// Review: a root in shape whose data beneath — in no requested sub-path — is not in the group waits: the sample, not
// the root alone, says whether the data is the library's already (§7).
func TestTheSampleBeneathARootInShapeIsJudged(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "media")
if err := os.MkdirAll(filepath.Join(root, "old"), 0o755); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(root, "old", "film"), []byte("data"), 0o644); err != nil {
t.Fatal(err)
}
if err := os.Chown(root, -1, gid); err != nil {
t.Fatal(err)
}
if err := unix.Chmod(root, 0o2775); err != nil {
t.Fatal(err)
}
report, _, err := applyLib(t, libraryDecl(t, libJSON("media", root, gid, true, false)), store.State{})
if err != nil {
t.Fatal(err)
}
if o := outcomeOf(report, "library:media"); o.Action != "waiting" {
t.Fatalf("a root in shape with data beneath not in the group was kept: %+v", o)
}
}
// Review: an apply that finds the library's lock held by something that is no take walk (a take act about to be
// refused) waits for it and judges the library as always: a library whose disk is not there still holds.
func TestAnApplyWaitsForALockThatIsNoWalk(t *testing.T) {
gid := testGID(t)
libraries(t, nil, nil)
root := filepath.Join(t.TempDir(), "gone", "media")
lock := libraryLock("media")
lock.Lock()
go func() { time.Sleep(50 * time.Millisecond); lock.Unlock() }()
report, _, _ := applyLib(t, libraryDecl(t, libJSON("media", root, gid, true, false)), store.State{})
if o := outcomeOf(report, "library:media"); o.Action != "waiting" || !strings.Contains(o.Detail, DiskWords("media")) {
t.Fatalf("a library whose root is not there was read as kept while its lock was held: %+v", o)
}
}
internal/apply/oldshape_test.go
-136
View File
@@ -1,136 +0,0 @@
//go:build linux
package apply
import (
"context"
"errors"
"os"
"path/filepath"
"strings"
"testing"
"golang.org/x/sys/unix"
"github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
)
// The engine delivers before the controller half (novox/hq ADR 0325): a controller that does not speak
// link.IdentityContract sends no identities, no users and no taken, and every access of its declarations is applied
// exactly as before this engine — mounted when present, refused when absent (ADR 0051 §7), nothing kept, nothing
// made, no container held, nothing judged. These are origin/main's outcomes, word for word.
func TestAnOlderControllersAccessesAreAppliedExactlyAsBefore(t *testing.T) {
keeping(t, nil, nil)
dir := userDir(t)
unwritable := filepath.Join(dir, "library") // its group may not write it
empty := filepath.Join(dir, "spool")
absent := filepath.Join(dir, "media", "movies")
for _, d := range []string{unwritable, empty} {
if err := os.Mkdir(d, 0o755); err != nil {
t.Fatal(err)
}
if err := os.Chmod(d, 0o755); err != nil {
t.Fatal(err)
}
}
// A root-owned empty folder, read only.
rootEmpty := ""
for _, c := range []string{"/var/empty", "/srv/http", "/srv/ftp"} {
if entries, err := os.ReadDir(c); err == nil && len(entries) == 0 {
if uid, _, _ := statOwner(mustLstat(t, c)); uid == 0 {
rootEmpty = c
break
}
}
}
resources := []string{
`{"id":"radarr.library","type":"access","path":"` + unwritable + `","mode":"read-write"}`,
`{"id":"sab.spool","type":"access","path":"` + empty + `","mode":"read-write"}`,
`{"id":"plex.movies","type":"access","path":"` + absent + `"}`,
`{"id":"plex.app","type":"container","name":"plex","image":"` + pinned + `","volumes":["` + absent + `:/movies"]}`,
}
if rootEmpty != "" {
resources = append(resources, `{"id":"web.root","type":"access","path":"`+rootEmpty+`","mode":"read-write"}`)
}
var started bool
run := func(_ context.Context, name string, args ...string) (string, error) {
if len(args) > 0 && args[0] == "run" {
started = true
}
if len(args) > 0 && args[0] == "container" {
if started {
return "true\t" + containerSpec(declare(t, resources[3]).Resources[0].(*declaration.Container), inputs{}), nil
}
return "", errors.New("no such container")
}
return "", nil
}
toUser(t)
report, _, err := Apply(context.Background(), archHost(t), declare(t, strings.Join(resources, ",")), store.State{},
store.OriginDeclared, run, nil, nil)
if err == nil || !strings.Contains(err.Error(), absent+" is not there, and the mesh does not own it — the operator "+
"must provide it") {
t.Fatalf("an absent access is not refused as before: %v", err)
}
for id, mode := range map[string]string{"radarr.library": "read-write", "sab.spool": "read-write"} {
o := outcomeOf(report, id)
if o.Action != "unchanged" || o.Detail != "operator-owned; present, "+mode+", nothing managed" {
t.Errorf("%s: %+v, and before it was unchanged, %q", id, o, "operator-owned; present, "+mode+", nothing managed")
}
}
if rootEmpty != "" {
if o := outcomeOf(report, "web.root"); o.Action != "unchanged" {
t.Errorf("a root-owned folder was judged: %+v", o)
}
}
if !started {
t.Error("a container mounting an absent access was held, and before it was created")
}
if _, err := os.Stat(absent); !errors.Is(err, os.ErrNotExist) {
t.Error("an absent access was made")
}
for _, d := range []string{unwritable, empty} {
if n, _ := unix.Getxattr(d, aclAccessXattr, nil); n > 0 {
t.Errorf("an ACL was set on %s", d)
}
if info := mustLstat(t, d); info.Mode().Perm() != 0o755 {
t.Errorf("%s changed mode: %o", d, info.Mode().Perm())
}
}
if all, _ := KeptFolders.All(); len(all) != 0 {
t.Errorf("folders were recorded as kept: %v", all)
}
if len(Leftovers()) != 0 || len(WaitingOnAccess(declare(t, strings.Join(resources, ",")))) != 0 {
t.Error("something was said or held for an older controller's access")
}
}
func mustLstat(t *testing.T, path string) os.FileInfo {
t.Helper()
info, err := os.Lstat(path)
if err != nil {
t.Fatal(err)
}
return info
}
// Review (low): a folder no access names, whose filesystem could not be named this look, is not said as its disk
// being away.
func TestALeftoverSaysWhyItsWalkCouldNotRun(t *testing.T) {
uuid, fsid, source := "6f1c0a4e-1b2d-4c3e-8f00-aa11bb22cc33", "0000080100000000", "/dev/sdb1"
_, lib, access := poolNamed(t, &uuid, &fsid, &source)
takeIt(t, lib, access)
other := `{"id":"x.dir","type":"directory","path":"` + filepath.Join(filepath.Dir(filepath.Dir(lib)), "x") + `"}`
if _, _, err := applyAccesses(t, store.State{}, other); err != nil {
t.Fatal(err)
}
uuid, fsid, source = "", "0000000000000000", "" // nothing names it now
toUser(t)
ReconcileKept(context.Background())
left := Leftovers()
if len(left) != 1 || strings.Contains(left[0].Why, "disk") || !strings.Contains(left[0].Why, "could not be named") {
t.Fatalf("the leftover does not say why its walk could not run: %+v", left)
}
}
internal/apply/placed.go
+2 -2
View File
@@ -11,7 +11,7 @@ import (
"time" "time"
) )
// Whether a shared folder's disk is there (novox/hq ADR 0325 §9). // Whether a library's disk is there (novox/hq ADR 0328 §9; first ADR 0325 §9).
// //
// **The rule the engine keeps.** A folder is placed on the filesystem it is first seen on: the mount point that // **The rule the engine keeps.** A folder is placed on the filesystem it is first seen on: the mount point that
// holds it — the longest mount point in /proc/self/mountinfo that is the folder or above it — is recorded beside the // holds it — the longest mount point in /proc/self/mountinfo that is the folder or above it — is recorded beside the
@@ -20,7 +20,7 @@ import (
// the disk not there. A recorded mount point that is mounted while another holds the folder is a **move**: what is // the disk not there. A recorded mount point that is mounted while another holds the folder is a **move**: what is
// at the path now is not what was kept (a disk mounted over a folder first seen empty below it, a mount made // at the path now is not what was kept (a disk mounted over a folder first seen empty below it, a mount made
// deeper), so the folder is judged afresh — kept again only if it holds nothing, else it waits for the operator's // deeper), so the folder is judged afresh — kept again only if it holds nothing, else it waits for the operator's
// word as any folder holding data does (ADR 0325 §8). // word as any folder holding data does (ADR 0328 §7).
// //
// **On first sight, with no record,** the engine knows a disk is missing only from where disks are meant to be: // **On first sight, with no record,** the engine knows a disk is missing only from where disks are meant to be:
// every mount target in /etc/fstab, every `Where=` of a systemd .mount unit, every mount point a ZFS dataset names // every mount target in /etc/fstab, every `Where=` of a systemd .mount unit, every mount point a ZFS dataset names
internal/apply/plan.go
+1 -1
View File
@@ -112,7 +112,7 @@ func Plan(d *declaration.Declaration, known store.State, origin string) []Step {
step.Verb, step.Why = "restore", "no longer declared; the original the mesh wrote over goes back "+ step.Verb, step.Why = "restore", "no longer declared; the original the mesh wrote over goes back "+
"from "+orphan.Kept+", unless the file was changed since the mesh last wrote it" "from "+orphan.Kept+", unless the file was changed since the mesh last wrote it"
case orphan.Type == string(declaration.TypeAccess) && orphan.User != "" && len(orphan.Groups) > 0: case orphan.Type == string(declaration.TypeAccess) && orphan.User != "" && len(orphan.Groups) > 0:
// In takeBackGranted's words (novox/hq ADR 0325 §5: no account is in a group for data). // In takeBackGranted's words (novox/hq ADR 0328 §11: no account is in a group for data but a library's).
step.Verb, step.Why = "restore", "no longer declared; the path is left as it is, and "+orphan.User+ step.Verb, step.Why = "restore", "no longer declared; the path is left as it is, and "+orphan.User+
" leaves "+strings.Join(orphan.Groups, ", ")+", which the mesh put it in, unless another declared "+ " leaves "+strings.Join(orphan.Groups, ", ")+", which the mesh put it in, unless another declared "+
"resource still asks for it" "resource still asks for it"
internal/apply/roots.go
+5 -5
View File
@@ -15,7 +15,7 @@ import (
"github.com/novox/mesh-host/internal/accounts" "github.com/novox/mesh-host/internal/accounts"
) )
// Root's numbers, which no module identity is and whose data is never kept (novox/hq ADR 0325 §11, §12). // Root's numbers, which no module identity is and whose data is never kept (novox/hq ADR 0328 §15).
// //
// A module identity whose uid or gid is 0, or whose gid is a group whose members act as root (accounts.RootGroups, // A module identity whose uid or gid is 0, or whose gid is a group whose members act as root (accounts.RootGroups,
// the account judge's own closed list), would be a way to root through a container or a shared folder: refused, // the account judge's own closed list), would be a way to root through a container or a shared folder: refused,
@@ -105,7 +105,7 @@ func rootGroup(gid int) string {
return "" return ""
} }
// rootOwned is why a folder owned by uid and gid is root's data (ADR 0325 §12), or "": owned by root, or by a // rootOwned is why a folder owned by uid and gid is root's data (ADR 0325 §12, kept for the legacy reader), or "": owned by root, or by a
// root group. // root group.
func rootOwned(uid, gid uint32) string { func rootOwned(uid, gid uint32) string {
if uid == 0 { if uid == 0 {
@@ -117,13 +117,13 @@ func rootOwned(uid, gid uint32) string {
return "" return ""
} }
// rootIdentity is why a module identity's numbers are refused (ADR 0325 §11), or nil. // rootIdentity is why a module identity's numbers are refused (ADR 0328 §15), or nil.
func rootIdentity(uid, gid int) error { func rootIdentity(uid, gid int) error {
if uid <= 0 { if uid <= 0 {
return fmt.Errorf("its uid is %d, and a module's identity is never root (novox/hq ADR 0325 §11)", uid) return fmt.Errorf("its uid is %d, and a module's identity is never root (novox/hq ADR 0328 §15)", uid)
} }
if why := rootGroup(gid); why != "" { if why := rootGroup(gid); why != "" {
return fmt.Errorf("its gid is %s, and a module's identity is never in a root group (novox/hq ADR 0325 §11)", why) return fmt.Errorf("its gid is %s, and a module's identity is never in a root group (novox/hq ADR 0328 §15)", why)
} }
return nil return nil
} }
internal/apply/walk.go
+22 -33
View File
@@ -6,60 +6,49 @@ import (
"time" "time"
) )
// A bounded walk under a kept folder (novox/hq ADR 0325 §8, §10, issue 567). // A bounded walk under a library's root (novox/hq ADR 0328 §7, issue 567).
// //
// **Walked by descriptor.** The folder is opened as a mesh directory is (meshWalk: no link another account could // **Walked by descriptor.** The root is opened as a mesh directory is (meshWalk: no link another account could
// make, the folder itself no link), and everything under it is reached from its parent's descriptor with // make, the root itself no link), and everything under it is reached from its parent's descriptor with O_NOFOLLOW:
// O_NOFOLLOW: a link met is passed by, a folder whose device is not the kept folder's is not entered, and an entry // a link met is passed by, a folder whose device is not the root's is not entered, and an entry opened is checked
// opened is checked to be the one that was looked at. An entry's ACL is read and written through its own // to be the one that was looked at. An entry's group and mode are set through its own descriptor, so a name
// descriptor, so a name swapped for a link between the look and the change changes nothing. // swapped for a link between the look and the change changes nothing.
// //
// **Bounded, and resumed.** A media library is millions of files, and a walk that never ends is a machine that // **Bounded, and resumed.** A library is millions of files, and a walk that never ends is a machine that cannot
// cannot say what it did. Each walk reads at most so many entries for at most so long; one that meets its bound // say what it did. Each walk reads at most so many entries for at most so long; one that meets its bound says how
// says how far it got (a cursor, the names of each level below the folder, kept in the engine's state and never // far it got (a cursor, the names of each level below the root, kept in the engine's state and never said) and the
// said) and the next goes on from there, in the order of the names, so successive looks cover a folder whole. // next goes on from there, in the order of the names, so successive walks cover the library whole.
// WalkLimits bound one walk under a folder: how many entries it reads, and for how long. // WalkLimits bound one walk under a root: how many entries it reads, and for how long.
type WalkLimits struct { type WalkLimits struct {
Entries int Entries int
Time time.Duration Time time.Duration
} }
// ActLimits bound the take act and the walk that adds or drops a user's entries. One stopped goes on at the next // ActLimits bound one walk of the take act; one stopped at its bound goes on from its cursor at the next look.
// apply, from the start: what already has its entries is passed quickly.
var ActLimits = WalkLimits{Entries: 5_000_000, Time: 30 * time.Minute} var ActLimits = WalkLimits{Entries: 5_000_000, Time: 30 * time.Minute}
// SweepLimits bound the sweep of one kept folder on one look (ADR 0325 §10): the look must come back within its // WalkCounts is what one walk did or found. Counts only: never a path below the root.
// own bound whatever the folder holds.
var SweepLimits = WalkLimits{Entries: 2000, Time: 2 * time.Second}
// WalkCounts is what one walk did or found. Counts only: never a path below the folder.
type WalkCounts struct { type WalkCounts struct {
// Folders and Files are the entries changed; Kept the ones that already had what they need. // Folders and Files are the entries changed; Kept the ones that already had what they need.
Folders, Files, Kept int Folders, Files, Kept int
// Links are links passed by, Other entries neither a file nor a folder, Mounts folders on another // Links are links passed by, Other entries neither a file nor a folder, Mounts folders on another filesystem
// filesystem not entered. // not entered; Linked files with another name an account owns, given the group; Shared files with another
Links, Other, Mounts int // name root owns, left as they are; Stripped files whose setuid or setgid bit the group change took.
// Read is every entry looked at. Links, Other, Mounts, Linked, Shared, Stripped int
Read int // Read is every entry looked at; Failed the entries that could not be changed (an immutable file, say).
// Narrowed is the entries that gave a user less than its right (judged by entry and mask together) and Read, Failed int
// were put back; Unrepaired the ones that could not be — the owner's bits, which the mesh never changes.
Narrowed, Unrepaired int
} }
// ErrWalkBound is a walk that met its bound before it was through: what it did stays, and the cursor says where // ErrWalkBound is a walk that met its bound before it was through: what it did stays, and the cursor says where
// the next one goes on. // the next one goes on.
var ErrWalkBound = errors.New("the walk met its bound") var ErrWalkBound = errors.New("the walk met its bound")
// ErrNoACL is a filesystem that allows no ACLs here (ENOTSUP): a ZFS dataset whose acltype is off, say. The access // keptPath refuses a root that is not stated exactly: absolute and clean, so `..` and a doubled separator never
// waits for the take act, which sets it where it can (ADR 0325 §8). // name it.
var ErrNoACL = errors.New("the filesystem allows no access entries")
// keptPath refuses a folder that is not stated exactly: absolute and clean, so `..` and a doubled separator
// never name it.
func keptPath(path string) error { func keptPath(path string) error {
if !filepath.IsAbs(path) || filepath.Clean(path) != path { if !filepath.IsAbs(path) || filepath.Clean(path) != path {
return errors.New("the folder is not stated as the engine states one (absolute, no `..`, no doubled or " + return errors.New("the root is not stated as the engine states one (absolute, no `..`, no doubled or " +
"trailing separator); nothing was changed") "trailing separator); nothing was changed")
} }
return nil return nil
internal/apply/walk_linux.go
+255 -292
View File
@@ -2,7 +2,7 @@
package apply package apply
// The descriptor half of walk.go and acl.go (novox/hq ADR 0325 §5, §8, §9, §10). // The descriptor half of walk.go and library.go (novox/hq ADR 0328 §6, §7, §9).
import ( import (
"errors" "errors"
@@ -10,6 +10,7 @@ import (
"io" "io"
"os" "os"
"sort" "sort"
"strings"
"time" "time"
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
@@ -29,29 +30,45 @@ var machineStats = walkStats{
fd: unix.Fstat, fd: unix.Fstat,
} }
// visitFunc is what a walk does to one folder or file, open on fd, whose stat is st: whether it changed it, and // What a visit did to one entry, as flags: nothing (it had what it needs), or changed, and beside it whether it was a
// whether it found the entry narrowed and could not put it back. An error stops the walk. // file with another name (linked, changed; shared, left), and whether its setuid or setgid bit went.
type visitFunc func(fd int, st unix.Stat_t, folder bool) (changed, narrowed, unrepaired bool, err error) const (
visitKept = 0
visitChanged = 1 << iota
visitLinked // a file with another name, owned by an account: given the group
visitShared // a file with another name, owned by root: left as it is
visitStripped // a file whose setuid or setgid bit the group change took, and which stays taken
)
// aclWalk is one walk under a kept folder, from the descriptor of the folder itself. // visitFunc is what a walk does to one folder or file, open on fd, whose stat is st: what it did, or the error
type aclWalk struct { // counted on that entry alone (errStopWalk stops the walk).
type visitFunc func(fd int, st unix.Stat_t, folder bool) (int, error)
// errStopWalk wraps an error that stops the whole walk, never one entry's alone.
type errStopWalk struct{ err error }
func (e errStopWalk) Error() string { return e.err.Error() }
func (e errStopWalk) Unwrap() error { return e.err }
// treeWalk is one walk under a library's root, from the descriptor of the root itself.
type treeWalk struct {
dev uint64 dev uint64
deadline time.Time deadline time.Time
limit int limit int
stats walkStats stats walkStats
visit visitFunc visit visitFunc
counts WalkCounts counts WalkCounts
// at is the names of the levels below the folder down to the entry being walked; Cursor, once the walk met // at is the names of the levels below the root down to the entry being walked; Cursor, once the walk met its
// its bound, where the next goes on. // bound, where the next goes on.
at []string at []string
Cursor []string Cursor []string
// Failed is the first failure on one entry, in words with no path. // Failed is the first failure on one entry, in words with no path.
Failed string Failed string
} }
// openKept opens a kept folder as a mesh directory is opened (no link another account could make, the folder // openRoot opens a library's root as a mesh directory is opened (no link another account could make, the root
// itself no link) and starts a walk from it on the folder's own device. // itself no link) and starts a walk from it on the root's own device.
func openKept(path string, limits WalkLimits, stats walkStats, visit visitFunc) (*aclWalk, int, unix.Stat_t, error) { func openRoot(path string, limits WalkLimits, stats walkStats, visit visitFunc) (*treeWalk, int, unix.Stat_t, error) {
var st unix.Stat_t var st unix.Stat_t
if err := keptPath(path); err != nil { if err := keptPath(path); err != nil {
return nil, -1, st, err return nil, -1, st, err
@@ -59,36 +76,36 @@ func openKept(path string, limits WalkLimits, stats walkStats, visit visitFunc)
mw := &meshWalk{want: path} mw := &meshWalk{want: path}
fd, err := mw.open() fd, err := mw.open()
if errors.Is(err, errNotThereYet) { if errors.Is(err, errNotThereYet) {
return nil, -1, st, errors.New("the folder is not there; nothing was changed") return nil, -1, st, errors.New("the root is not there; nothing was changed")
} }
if err != nil { if err != nil {
return nil, -1, st, errors.New("the folder is not walked: " + pathless(err)) return nil, -1, st, errors.New("the root is not walked: " + pathless(err))
} }
if mw.At != path { if mw.At != path {
unix.Close(fd) unix.Close(fd)
return nil, -1, st, errors.New("the folder is reached through a link, and the engine walks no folder " + return nil, -1, st, errors.New("the root is reached through a link, and the engine walks no root through " +
"through one; nothing was changed") "one; nothing was changed")
} }
if err := stats.fd(fd, &st); err != nil { if err := stats.fd(fd, &st); err != nil {
unix.Close(fd) unix.Close(fd)
return nil, -1, st, fmt.Errorf("the folder cannot be read: %v; nothing was changed", err) return nil, -1, st, fmt.Errorf("the root cannot be read: %v; nothing was changed", err)
} }
return &aclWalk{dev: uint64(st.Dev), deadline: time.Now().Add(limits.Time), limit: limits.Entries, return &treeWalk{dev: uint64(st.Dev), deadline: time.Now().Add(limits.Time), limit: limits.Entries,
stats: stats, visit: visit}, fd, st, nil stats: stats, visit: visit}, fd, st, nil
} }
// walkKept walks path whole, or from resume, with visit: the walk, with what it did and the cursor where it // walkRoot walks path whole, or from resume, with visit: the walk, with what it did and the cursor where it stopped
// stopped when it met its bound (with ErrWalkBound), and the walk's own error otherwise. // when it met its bound (with ErrWalkBound), and the walk's own error otherwise.
func walkKept(path string, limits WalkLimits, stats walkStats, resume []string, visit visitFunc) (*aclWalk, error) { func walkRoot(path string, limits WalkLimits, stats walkStats, resume []string, visit visitFunc) (*treeWalk, error) {
w, fd, st, err := openKept(path, limits, stats, visit) w, fd, st, err := openRoot(path, limits, stats, visit)
if err != nil { if err != nil {
return &aclWalk{}, err return &treeWalk{}, err
} }
return w, w.dir(fd, st, resume) return w, w.dir(fd, st, resume)
} }
// read counts one entry, and says the bound when it is met, keeping where the walk stood as the cursor. // read counts one entry, and says the bound when it is met, keeping where the walk stood as the cursor.
func (w *aclWalk) read() error { func (w *treeWalk) read() error {
if w.counts.Read >= w.limit || time.Now().After(w.deadline) { if w.counts.Read >= w.limit || time.Now().After(w.deadline) {
w.Cursor = append([]string(nil), w.at...) w.Cursor = append([]string(nil), w.at...)
return ErrWalkBound return ErrWalkBound
@@ -97,27 +114,9 @@ func (w *aclWalk) read() error {
return nil return nil
} }
// count adds one visit's result.
func (w *aclWalk) count(folder, changed, narrowed, unrepaired bool) {
switch {
case changed && folder:
w.counts.Folders++
case changed:
w.counts.Files++
default:
w.counts.Kept++
}
if narrowed {
w.counts.Narrowed++
}
if unrepaired {
w.counts.Unrepaired++
}
}
// dir is one folder, open on fd, whose stat is st: the folder itself (unless the walk resumes below it, which an // dir is one folder, open on fd, whose stat is st: the folder itself (unless the walk resumes below it, which an
// earlier walk visited), then every entry in it in the order of their names. It closes fd. // earlier walk visited), then every entry in it in the order of their names. It closes fd.
func (w *aclWalk) dir(fd int, st unix.Stat_t, resume []string) error { func (w *treeWalk) dir(fd int, st unix.Stat_t, resume []string) error {
f := os.NewFile(uintptr(fd), "") f := os.NewFile(uintptr(fd), "")
defer f.Close() defer f.Close()
if len(resume) == 0 { if len(resume) == 0 {
@@ -154,9 +153,9 @@ func (w *aclWalk) dir(fd int, st unix.Stat_t, resume []string) error {
return nil return nil
} }
// entry is one name in the folder open on dirfd: a link passed by, a folder on this device walked, a file // entry is one name in the folder open on dirfd: a link passed by, a folder on this device walked, a file visited
// visited through its own descriptor, anything else left. // through its own descriptor, anything else left.
func (w *aclWalk) entry(dirfd int, name string, resume []string) error { func (w *treeWalk) entry(dirfd int, name string, resume []string) error {
var st unix.Stat_t var st unix.Stat_t
if err := w.stats.at(dirfd, name, &st); err != nil { if err := w.stats.at(dirfd, name, &st); err != nil {
if errors.Is(err, unix.ENOENT) { if errors.Is(err, unix.ENOENT) {
@@ -212,192 +211,88 @@ func (w *aclWalk) entry(dirfd int, name string, resume []string) error {
return w.visited(fd, opened, false) return w.visited(fd, opened, false)
} }
// visited visits one entry and counts what it did. A filesystem that allows no ACLs stops the walk; any other // visited visits one entry and counts what it did. An error that stops the walk stops it; any other failure on
// failure on one entry (an immutable file, say) is counted unrepaired, its words kept once, and the walk goes on. // one entry (an immutable file, say) is counted failed, its words kept once, and the walk goes on.
func (w *aclWalk) visited(fd int, st unix.Stat_t, folder bool) error { func (w *treeWalk) visited(fd int, st unix.Stat_t, folder bool) error {
changed, narrowed, unrepaired, err := w.visit(fd, st, folder) did, err := w.visit(fd, st, folder)
if errors.Is(err, ErrNoACL) { var stop errStopWalk
return err if errors.As(err, &stop) {
return stop.err
} }
if err != nil { if err != nil {
unrepaired = true w.counts.Failed++
if w.Failed == "" { if w.Failed == "" {
w.Failed = err.Error() w.Failed = err.Error()
} }
return nil
} }
w.count(folder, changed, narrowed, unrepaired)
return nil
}
// getACL reads one of an entry's ACLs through its descriptor: the access ACL, or a folder's default. An access
// ACL that is not there is the one its mode stands for; a default that is not there is nil.
func getACL(fd int, name string, mode uint32) (acl, error) {
buf := make([]byte, 4+8*32)
for {
n, err := unix.Fgetxattr(fd, name, buf)
switch {
case errors.Is(err, unix.ENODATA):
if name == aclAccessXattr {
return minimalACL(mode), nil
}
return nil, nil
case errors.Is(err, unix.ERANGE):
buf = make([]byte, 2*len(buf))
continue
case errors.Is(err, unix.ENOTSUP), errors.Is(err, unix.EOPNOTSUPP):
return nil, ErrNoACL
case err != nil:
return nil, fmt.Errorf("an entry's ACL could not be read: %v", err)
}
return decodeACL(buf[:n])
}
}
// setACL writes one of an entry's ACLs through its descriptor, refusing one the kernel would.
func setACL(fd int, name string, a acl) error {
if err := a.check(); err != nil {
return err
}
err := unix.Fsetxattr(fd, name, a.encode(), 0)
switch { switch {
case errors.Is(err, unix.ENOTSUP), errors.Is(err, unix.EOPNOTSUPP): case did&visitShared != 0:
return ErrNoACL w.counts.Shared++
case err != nil: case did&visitChanged != 0 && folder:
return fmt.Errorf("an entry's ACL could not be written: %v", err) w.counts.Folders++
case did&visitChanged != 0:
w.counts.Files++
default:
w.counts.Kept++
}
if did&visitLinked != 0 {
w.counts.Linked++
}
if did&visitStripped != 0 {
w.counts.Stripped++
} }
return nil return nil
} }
// sameACL is whether a and b hold the same entries, whatever their order. // groupVisit gives each entry the library's group gid, group read and write, and on a folder group enter and the
func sameACL(a, b acl) bool { // setgid bit, so what is made beneath keeps the group (ADR 0328 §6, §7). The owner, the owner's bits and others'
return string(a.encode()) == string(b.encode()) // bits are never changed — but for what the group change itself takes:
} //
// - **A file's setuid and setgid bits stay taken.** The kernel drops them when a file's group changes; a setgid
// needs is, for a folder or a file, each kept uid's bits — except its owner's, which its owner's bits give and the // file in the library's group would hand anyone who runs it the group, and a setuid one is no library data. They
// mesh never changes. // are never put back, setgid is taken off a file the group change left it on, and each such file is counted.
func needs(users map[uint32]bool, owner uint32, folder bool) map[uint32]uint16 { // - **A file with another name** (the *arr apps hardlink downloads into the library) is given the group when an
out := map[uint32]uint16{} // account owns it: the kernel's protected_hardlinks already keeps an account from linking a file it does not
for uid, rw := range users { // own. One root owns is left as it is: its other name may be anywhere, and the group would reach it. Both are
if uid != owner { // counted.
out[uid] = needOn(rw, folder) func groupVisit(gid int) visitFunc {
} return func(fd int, st unix.Stat_t, folder bool) (int, error) {
} did := visitKept
return out if !folder && st.Nlink > 1 {
} if st.Uid == 0 {
return visitShared, nil
// keepVisit makes users' entries on each entry (ADR 0325 §5): the access ACL with each uid's entry and a mask
// that covers it, and on a folder the same as its default, so what is made under it inherits them. An entry that
// had them is not written. A user that owns the entry is judged by its owner's bits, never given an entry: an
// owner whose bits fall short is unrepaired, said, and never changed.
func keepVisit(users map[uint32]bool) visitFunc {
return func(fd int, st unix.Stat_t, folder bool) (bool, bool, bool, error) {
mode := uint32(st.Mode) & 0o7777
need := needs(users, st.Uid, folder)
access, err := getACL(fd, aclAccessXattr, mode)
if err != nil {
return false, false, false, err
}
narrowed, unrepaired := judgeACL(access, users, st, folder)
changed := false
if kept := keptACL(access, need); !sameACL(kept, access) {
if err := setACL(fd, aclAccessXattr, kept); err != nil {
return false, narrowed, true, err
} }
changed = true did |= visitLinked
} }
mode := uint32(st.Mode) & 0o7777
want := mode | 0o060
if folder { if folder {
def, err := getACL(fd, aclDefaultXattr, mode) want = mode | 0o070 | unix.S_ISGID
if err != nil { }
return changed, narrowed, unrepaired, err regroup := int(st.Gid) != gid
} if !folder && regroup {
base := def want &^= unix.S_ISUID | unix.S_ISGID
if base == nil { }
// No default yet: one whose owner's, owning group's and others' entries are the folder's own, as if !regroup && want == mode {
// setfacl -d derives it. return did &^ visitLinked, nil
base = minimalACL(mode) }
if g, ok := access.perm(aclGroupObj, 0); ok { if regroup {
base[1].Perm = g if err := unix.Fchown(fd, -1, gid); err != nil {
} return 0, fmt.Errorf("an entry's group could not be set: %v", err)
}
// The default is for what anyone makes under the folder, never its owner alone: every user's entry.
all := map[uint32]uint16{}
for uid, rw := range users {
all[uid] = needOn(rw, true)
}
if kept := keptACL(base, all); def == nil || !sameACL(kept, def) {
if err := setACL(fd, aclDefaultXattr, kept); err != nil {
return changed, narrowed, true, err
}
changed = true
} }
} }
return changed, narrowed, unrepaired, nil if err := unix.Fchmod(fd, want); err != nil {
return 0, fmt.Errorf("an entry's mode could not be set: %v", err)
}
if !folder && mode&(unix.S_ISUID|unix.S_ISGID) != 0 && want&(unix.S_ISUID|unix.S_ISGID) == 0 {
did |= visitStripped
}
return did | visitChanged, nil
} }
} }
// judgeACL is whether an entry with access ACL a gives a user less than its right — by entry and mask together // folderEmpty is whether the folder open on fd holds nothing yet: a root the mesh may keep without asking.
// (ADR 0325 §6) — and whether that is one the mesh cannot put back: the owner's own bits.
func judgeACL(a acl, users map[uint32]bool, st unix.Stat_t, folder bool) (narrowed, unrepaired bool) {
mode := uint32(st.Mode) & 0o7777
for uid, rw := range users {
need := needOn(rw, folder)
if effective(a, uid, st.Uid, mode)&need == need {
continue
}
narrowed = true
if uid == st.Uid {
unrepaired = true
}
}
return narrowed, unrepaired
}
// dropVisit takes exactly the entries of each uid of drop out of each entry's access ACL and a folder's default
// (ADR 0325 §8): no other entry, and not the mask, so nobody else loses a right.
func dropVisit(drop map[uint32]bool) visitFunc {
return func(fd int, st unix.Stat_t, folder bool) (bool, bool, bool, error) {
mode := uint32(st.Mode) & 0o7777
changed := false
for _, name := range []string{aclAccessXattr, aclDefaultXattr} {
if name == aclDefaultXattr && !folder {
continue
}
a, err := getACL(fd, name, mode)
if errors.Is(err, ErrNoACL) {
continue
}
if err != nil {
// Counted unrepaired and said by the walk, which then walks it again: never read as "nothing to drop".
return changed, false, true, err
}
if a == nil {
continue
}
if left := withoutUsers(a, drop); len(left) != len(a) {
if err := setACL(fd, name, left); err != nil {
return changed, false, true, err
}
changed = true
}
}
return changed, false, false, nil
}
}
// dropThenKeep is drop then keep, on one walk: a user whose use changed, or one gone beside one come.
func dropThenKeep(drop map[uint32]bool, users map[uint32]bool) visitFunc {
d, k := dropVisit(drop), keepVisit(users)
return func(fd int, st unix.Stat_t, folder bool) (bool, bool, bool, error) {
c1, _, _, err := d(fd, st, folder)
if err != nil {
return c1, false, false, err
}
c2, n, u, err := k(fd, st, folder)
return c1 || c2, n, u, err
}
}
// folderEmpty is whether the folder open on fd holds nothing yet: the data the mesh may keep without asking.
func folderEmpty(fd int) (bool, error) { func folderEmpty(fd int) (bool, error) {
dup, err := unix.Dup(fd) dup, err := unix.Dup(fd)
if err != nil { if err != nil {
@@ -415,20 +310,11 @@ func folderEmpty(fd int) (bool, error) {
return false, fmt.Errorf("the folder could not be read: %v", err) return false, fmt.Errorf("the folder could not be read: %v", err)
} }
// keepTop keeps users' entries on the kept folder itself (ADR 0325 §5): what every apply does, beside the walks. // FolderFacts is what the engine reads of a library's root before keeping it: its owner, group, mode and whether
func keepTop(path string, users map[uint32]bool) (changed bool, err error) { // it holds data.
w, fd, st, err := openKept(path, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, keepVisit(users))
if err != nil {
return false, err
}
defer unix.Close(fd)
changed, _, _, err = w.visit(fd, st, true)
return changed, err
}
// FolderFacts is what the engine reads of a folder before keeping it: its owner, group and whether it holds data.
type FolderFacts struct { type FolderFacts struct {
UID, GID uint32 UID, GID uint32
Mode uint32
Empty bool Empty bool
} }
@@ -455,87 +341,105 @@ func readFolder(path string) (FolderFacts, error) {
if err != nil { if err != nil {
return FolderFacts{}, err return FolderFacts{}, err
} }
return FolderFacts{UID: st.Uid, GID: st.Gid, Empty: empty}, nil return FolderFacts{UID: st.Uid, GID: st.Gid, Mode: uint32(st.Mode) & 0o7777, Empty: empty}, nil
} }
// CreatePath makes a missing accessed folder (ADR 0325 §9): each missing level made from the nearest existing // keepFolders keeps a library's root and each of its requested sub-paths — the folders themselves, never what is
// ancestor down, each with that ancestor's owner, group and mode. No link is followed (the ancestor is reached as // in them — in the group gid with group read, write and enter and the setgid bit (ADR 0328 §6). A sub-path that is
// a mesh directory is, and each level is opened with O_NOFOLLOW), no level is made on another filesystem, no file // missing is made, each level with the root's owner, the group, and the root's owner's and others' bits beside
// is made, and nothing that was there is changed: a level that appears meanwhile stops it. The caller has judged // group rwx and setgid (§9). No link is followed (the root is reached as a mesh directory is, and every level below
// that the ancestor is on the placed filesystem and not root's. How many levels it made. // it by O_NOFOLLOW), nothing is made or changed on another filesystem, and the owner and the owner's and others'
func CreatePath(path string) (int, error) { // bits of a folder that was there are never changed. How many folders it changed and made.
return createPath(path, machineStats) func keepFolders(root string, paths []string, gid int) (changed, made int, err error) {
} _, fd, rst, err := openRoot(root, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
func createPath(path string, stats walkStats) (int, error) {
m, err := NearestAncestor(path)
if err != nil { if err != nil {
return 0, fmt.Errorf("the folder cannot be made: %v; nothing was changed", err) return 0, 0, err
} }
if !m.Info.IsDir() { defer unix.Close(fd)
return 0, errors.New("its nearest existing parent is not a folder (a file or a link), and a folder is " + keep := func(fd int, st unix.Stat_t) error {
"made only below a folder; nothing was changed") mode := uint32(st.Mode) & 0o7777
} want := mode | 0o070 | unix.S_ISGID
mw := &meshWalk{want: m.Ancestor} if int(st.Gid) == gid && want == mode {
fd, err := mw.open() return nil
if err != nil {
return 0, fmt.Errorf("the nearest existing parent is not walked: %v; nothing was changed", err)
}
if mw.At != m.Ancestor {
unix.Close(fd)
return 0, errors.New("the nearest existing parent is reached through a link, and nothing is made " +
"through one; nothing was changed")
}
var anc unix.Stat_t
if err := stats.fd(fd, &anc); err != nil {
unix.Close(fd)
return 0, fmt.Errorf("the nearest existing parent cannot be read: %v; nothing was changed", err)
}
if why := rootOwned(anc.Uid, anc.Gid); why != "" {
unix.Close(fd)
return 0, fmt.Errorf("its nearest existing parent is %s, and nothing is made under root's data "+
"(novox/hq ADR 0325 §12); nothing was changed", why)
}
mode := uint32(anc.Mode) & 0o7777
made := 0
for _, name := range m.Levels {
// Made for its maker alone (the engine, as root), so it is nobody else's until it is the ancestor's.
if err := unix.Mkdirat(fd, name, 0o700); err != nil {
unix.Close(fd)
if errors.Is(err, unix.EEXIST) {
return made, errors.New("a level of the folder appeared while it was made, and nothing that is " +
"there is changed; it stopped there")
}
return made, fmt.Errorf("a level could not be made: %v", err)
} }
next, err := unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0) if int(st.Gid) != gid {
unix.Close(fd) if err := unix.Fchown(fd, -1, gid); err != nil {
return fmt.Errorf("a folder's group could not be set: %v", err)
}
}
if err := unix.Fchmod(fd, want); err != nil {
return fmt.Errorf("a folder's mode could not be set: %v", err)
}
changed++
return nil
}
if err := keep(fd, rst); err != nil {
return changed, made, err
}
madeMode := uint32(rst.Mode)&0o0707 | 0o070 | unix.S_ISGID
for _, p := range paths {
n, err := keepPath(fd, rst, p, gid, madeMode, keep)
made += n
if err != nil { if err != nil {
return made, fmt.Errorf("a level made could not be opened: %v", err) return changed, made, err
} }
fd = next }
made++ return changed, made, nil
}
// keepPath walks one sub-path down from the root open on rootFd, making each missing level, and keeps the last.
func keepPath(rootFd int, rst unix.Stat_t, p string, gid int, madeMode uint32,
keep func(int, unix.Stat_t) error) (int, error) {
made := 0
cur, err := unix.Dup(rootFd)
if err != nil {
return made, err
}
defer func() { unix.Close(cur) }()
const dirFlags = unix.O_RDONLY | unix.O_DIRECTORY | unix.O_NOFOLLOW | unix.O_CLOEXEC
levels := strings.Split(p, "/")
for i, name := range levels {
next, err := unix.Openat(cur, name, dirFlags, 0)
if errors.Is(err, unix.ENOENT) {
// Made for its maker alone (the engine, as root), so it is nobody else's until it is the root's.
if mkErr := unix.Mkdirat(cur, name, 0o700); mkErr != nil && !errors.Is(mkErr, unix.EEXIST) {
return made, fmt.Errorf("a level of the path %s could not be made: %v", p, mkErr)
}
if next, err = unix.Openat(cur, name, dirFlags, 0); err == nil {
if err = unix.Fchown(next, int(rst.Uid), gid); err == nil {
err = unix.Fchmod(next, madeMode)
}
if err != nil {
unix.Close(next)
return made, fmt.Errorf("a level of the path %s made could not be given the root's owner "+
"and the library's group: %v", p, err)
}
made++
}
}
if errors.Is(err, unix.ELOOP) || errors.Is(err, unix.ENOTDIR) {
return made, fmt.Errorf("the path %s is not a folder below the root (a link, or a file), and the "+
"engine keeps no path through one", p)
}
if err != nil {
return made, fmt.Errorf("the path %s could not be opened: %v", p, err)
}
unix.Close(cur)
cur = next
var st unix.Stat_t var st unix.Stat_t
if err := stats.fd(fd, &st); err != nil { if err := unix.Fstat(cur, &st); err != nil {
unix.Close(fd) return made, err
return made, fmt.Errorf("a level made could not be read: %v", err)
} }
if uint64(st.Dev) != uint64(anc.Dev) { if st.Dev != rst.Dev {
unix.Close(fd) return made, fmt.Errorf("the path %s lies on another filesystem than the root, and the engine keeps "+
return made, errors.New("a level made is on another filesystem than its parent, and it stopped there") "nothing there", p)
} }
if st.Uid != anc.Uid || st.Gid != anc.Gid { if i == len(levels)-1 {
if err := unix.Fchown(fd, int(anc.Uid), int(anc.Gid)); err != nil { if err := keep(cur, st); err != nil {
unix.Close(fd) return made, err
return made, fmt.Errorf("a level made could not be given its parent's owner: %v", err)
} }
}
if err := unix.Fchmod(fd, mode); err != nil {
unix.Close(fd)
return made, fmt.Errorf("a level made could not be given its parent's mode: %v", err)
} }
} }
unix.Close(fd)
return made, nil return made, nil
} }
@@ -570,3 +474,62 @@ var MountUUID = func(point string) string {
} }
return "" return ""
} }
// SampleLimits bound the sample that judges whether a root's data is already the library's: so many entries a
// folder, so many levels down, for so long. A sample that runs out of time is not in shape: it asks.
var SampleLimits = struct {
PerFolder, Levels int
Time time.Duration
}{PerFolder: 20, Levels: 3, Time: 2 * time.Second}
// sampleInShape is whether the first entries of each folder under root, a few levels down, are all in the group gid
// with group read and write, and folders with group enter and setgid (ADR 0328 §7). Reads only, by descriptor: no
// link followed, no other filesystem entered. A file with more than one name is not judged (the take act leaves it).
func sampleInShape(root string, gid int) bool {
_, fd, st, err := openRoot(root, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
if err != nil {
return false
}
deadline := time.Now().Add(SampleLimits.Time)
return sampleFolder(fd, uint64(st.Dev), gid, SampleLimits.Levels, deadline)
}
// sampleFolder judges the folder open on fd's first entries, and the folders among them levels further. It closes fd.
func sampleFolder(fd int, dev uint64, gid, levels int, deadline time.Time) bool {
f := os.NewFile(uintptr(fd), "")
defer f.Close()
names, err := f.Readdirnames(SampleLimits.PerFolder)
if err != nil && !errors.Is(err, io.EOF) {
return false
}
for _, name := range names {
if time.Now().After(deadline) {
return false
}
var st unix.Stat_t
if err := unix.Fstatat(fd, name, &st, unix.AT_SYMLINK_NOFOLLOW); err != nil {
return false
}
if uint64(st.Dev) != dev {
continue
}
mode := uint32(st.Mode)
switch mode & unix.S_IFMT {
case unix.S_IFREG:
if st.Nlink == 1 && (int(st.Gid) != gid || mode&0o060 != 0o060) {
return false
}
case unix.S_IFDIR:
if int(st.Gid) != gid || mode&0o2070 != 0o2070 {
return false
}
if levels > 1 {
next, err := unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
if err != nil || !sampleFolder(next, dev, gid, levels-1, deadline) {
return false
}
}
}
}
return true
}
internal/apply/walk_other.go
+12 -36
View File
@@ -7,57 +7,33 @@ import (
"errors" "errors"
"github.com/novox/mesh-host/internal/declaration" "github.com/novox/mesh-host/internal/declaration"
"github.com/novox/mesh-host/internal/store"
) )
// The node-engine runs on Linux: a folder is kept only by descriptor and through the kernel's ACL attributes, // The node-engine runs on Linux: a library is kept only by descriptor, which this system cannot. Everything refuses,
// which this system has not. Everything refuses, saying so, and changes nothing. // saying so, and changes nothing.
var errNoKeeping = errors.New("a shared folder is kept only by descriptor, which this system cannot; nothing was changed") var errNoKeeping = errors.New("a library is kept only by descriptor, which this system cannot; nothing was changed")
// FolderFacts is what the engine reads of a folder before keeping it. // FolderFacts is what the engine reads of a library's root before keeping it.
type FolderFacts struct { type FolderFacts struct {
UID, GID uint32 UID, GID uint32
Mode uint32
Empty bool Empty bool
} }
func readFolder(string) (FolderFacts, error) { return FolderFacts{}, errNoKeeping } func readFolder(string) (FolderFacts, error) { return FolderFacts{}, errNoKeeping }
func keepTop(string, map[uint32]bool) (bool, error) { return false, errNoKeeping } func keepFolders(string, []string, int) (int, int, error) { return 0, 0, errNoKeeping }
func CreatePath(string) (int, error) { return 0, errNoKeeping } func ReconcileLibraries(context.Context, *declaration.Declaration) []string { return nil }
func ReconcileKept(context.Context) []string { return nil }
func JudgeKept(string, []store.KeptUser, WalkLimits) (WalkCounts, error) {
return WalkCounts{}, errNoKeeping
}
// KeptLook is what one look found of a kept folder. func TakeLibrary(context.Context, *declaration.Declaration, string, string, string, string) (<-chan struct{},
type KeptLook struct {
Short []string
Busy bool
Sweep store.KeptSweep
Repaired, Unrepaired int
Failed string
}
func LookKept(string, []store.KeptUser, WalkLimits) KeptLook {
return KeptLook{Failed: errNoKeeping.Error()}
}
func TakeFolder(context.Context, *declaration.Declaration, string, string, string, string, Runner) (<-chan struct{},
string, error) { string, error) {
return nil, "", errNoKeeping return nil, "", errNoKeeping
} }
// Watcher watches nothing where a folder is not kept. // MountFsid reads no filesystem id where a library is not kept.
type Watcher struct{}
func NewWatcher() (*Watcher, error) { return nil, errNoKeeping }
func (*Watcher) Set(map[string][]store.KeptUser) {}
func (*Watcher) Run(context.Context) {}
// MountFsid reads no filesystem id where a folder is not kept.
var MountFsid = func(string) string { return "" } var MountFsid = func(string) string { return "" }
// MountUUID reads no UUID where a folder is not kept. // MountUUID reads no UUID where a library is not kept.
var MountUUID = func(string) string { return "" } var MountUUID = func(string) string { return "" }
func aclProbe(string, string) string { return "" } func sampleInShape(string, int) bool { return false }
internal/apply/watch_linux.go
-350
View File
@@ -1,350 +0,0 @@
//go:build linux
package apply
import (
"context"
"errors"
"strconv"
"sync"
"time"
"unsafe"
"golang.org/x/sys/unix"
"github.com/novox/mesh-host/internal/store"
)
// The watch on each kept folder (novox/hq ADR 0325 §6).
//
// What an identity makes in a kept folder inherits the default entries, and its mask follows the mode its maker
// asked for: a file made at 0644 gives a read-write user only read until its mask is widened. The engine watches
// every folder of each kept tree (inotify: made, moved in, attributes changed) and, on notice, gives the entry its
// users' entries and a mask that covers them — the same keepVisit the walks use, through the entry's own
// descriptor, reached from the kept folder down by O_NOFOLLOW, never through a link and never on another
// filesystem. Notice can be lost (the kernel's queue overflowed) and watches run out (the machine's limit, ENOSPC):
// then the record says so and the sweep finds what was made where no watch is (§10).
// watchMask is what a watch hears: an entry made or moved in, and an entry's mode or ACL changed.
// It is added through /proc/self/fd, whose link is the folder's own descriptor: following it is what reaches the
// folder that was opened, so the watch takes no IN_DONT_FOLLOW.
const watchMask = unix.IN_CREATE | unix.IN_MOVED_TO | unix.IN_ATTRIB | unix.IN_ONLYDIR
// MaxWatchedPerFolder bounds the folders watched under one kept folder: beyond it the sweep alone keeps the rest.
var MaxWatchedPerFolder = 100_000
// Watcher watches every kept folder's tree.
type Watcher struct {
mu sync.Mutex
fd int
dirs map[int]watchedDir
roots map[string]*watchedRoot
}
// watchedDir is one watched folder: its kept folder and the names below it.
type watchedDir struct {
root string
rel []string
}
// watchedRoot is one kept folder watched: its users, its device, and its watches.
type watchedRoot struct {
users map[uint32]bool
dev uint64
wds []int
out bool
}
// NewWatcher opens the machine's notice of changes.
func NewWatcher() (*Watcher, error) {
// Not blocking: Run polls it, so the end of its context ends it whatever the kernel has to say.
fd, err := unix.InotifyInit1(unix.IN_CLOEXEC | unix.IN_NONBLOCK)
if err != nil {
return nil, err
}
return &Watcher{fd: fd, dirs: map[int]watchedDir{}, roots: map[string]*watchedRoot{}}, nil
}
// Set is every kept folder to watch, with its users: one newly kept is watched whole (within
// MaxWatchedPerFolder), one no longer kept is let go, and one whose users changed is repaired with the new ones.
func (w *Watcher) Set(folders map[string][]store.KeptUser) {
w.mu.Lock()
defer w.mu.Unlock()
for path, root := range w.roots {
if _, still := folders[path]; !still {
for _, wd := range root.wds {
_, _ = unix.InotifyRmWatch(w.fd, uint32(wd))
delete(w.dirs, wd)
}
delete(w.roots, path)
}
}
for path, users := range folders {
if root, had := w.roots[path]; had {
root.users = usersOf(users)
continue
}
root := &watchedRoot{users: usersOf(users)}
w.roots[path] = root
w.watchTree(path, root)
w.say(path, root)
}
}
// say records how many folders of a kept folder are watched, and whether the watches ran out.
func (w *Watcher) say(path string, root *watchedRoot) {
n, out := len(root.wds), root.out
_ = KeptFolders.Update(path, func(f *store.KeptFolder, had bool) bool {
f.Watches, f.OutOfWatches = n, out
return had
})
}
// watchTree watches a kept folder and every folder under it on its device, by descriptor: each watch is added
// through /proc/self/fd of the folder's own descriptor, so no name is followed to another place.
func (w *Watcher) watchTree(path string, root *watchedRoot) {
_, fd, st, err := openKept(path, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
if err != nil {
return
}
root.dev = uint64(st.Dev)
w.watchBelow(path, root, fd, nil)
}
// watchBelow watches the folder open on fd, rel below root, and every folder under it. It closes fd.
func (w *Watcher) watchBelow(path string, root *watchedRoot, fd int, rel []string) {
defer unix.Close(fd)
if root.out || len(root.wds) >= MaxWatchedPerFolder {
root.out = true
return
}
wd, err := unix.InotifyAddWatch(w.fd, "/proc/self/fd/"+strconv.Itoa(fd), watchMask)
if errors.Is(err, unix.ENOSPC) {
root.out = true
return
}
if err != nil {
return
}
root.wds = append(root.wds, wd)
w.dirs[wd] = watchedDir{root: path, rel: append([]string(nil), rel...)}
dup, err := unix.Dup(fd)
if err != nil {
return
}
names, err := readNames(dup)
if err != nil {
return
}
for _, name := range names {
var st unix.Stat_t
if unix.Fstatat(fd, name, &st, unix.AT_SYMLINK_NOFOLLOW) != nil || st.Mode&unix.S_IFMT != unix.S_IFDIR ||
uint64(st.Dev) != root.dev {
continue
}
next, err := unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
if err != nil {
continue
}
w.watchBelow(path, root, next, append(rel, name))
}
}
// watchPoll is how long Run waits for notice before it looks whether its context ended.
const watchPoll = 250 * time.Millisecond
// Run reads notices until ctx ends, repairing each entry made or changed in a watched folder, and then closes the
// watch: polled, so a quiet machine's watch ends as soon as a busy one's.
func (w *Watcher) Run(ctx context.Context) {
defer unix.Close(w.fd)
buf := make([]byte, 64*1024)
for ctx.Err() == nil {
ready, err := unix.Poll([]unix.PollFd{{Fd: int32(w.fd), Events: unix.POLLIN}}, int(watchPoll/time.Millisecond))
if err != nil && !errors.Is(err, unix.EINTR) {
return
}
if ready <= 0 {
continue
}
n, err := unix.Read(w.fd, buf)
if errors.Is(err, unix.EAGAIN) || errors.Is(err, unix.EINTR) {
continue
}
if err != nil || n <= 0 {
return
}
for at := 0; at+unix.SizeofInotifyEvent <= n; {
ev := (*unix.InotifyEvent)(unsafe.Pointer(&buf[at]))
nameAt := at + unix.SizeofInotifyEvent
name := cString(buf[nameAt : nameAt+int(ev.Len)])
at = nameAt + int(ev.Len)
if ev.Mask&unix.IN_Q_OVERFLOW != 0 {
w.lost()
continue
}
if ev.Mask&unix.IN_IGNORED != 0 {
// The watch is gone — its folder removed, or let go by Set: what pointed at it goes too.
w.forget(int(ev.Wd))
continue
}
w.heard(int(ev.Wd), name, ev.Mask)
}
}
}
// lost is notice lost (the kernel's queue overflowed): every kept folder is watched afresh, and what was made
// meanwhile is the sweep's.
func (w *Watcher) lost() {
w.mu.Lock()
defer w.mu.Unlock()
for path, root := range w.roots {
for _, wd := range root.wds {
_, _ = unix.InotifyRmWatch(w.fd, uint32(wd))
delete(w.dirs, wd)
}
root.wds, root.out = nil, false
w.watchTree(path, root)
w.say(path, root)
}
}
// forget lets go of a watch the kernel removed.
func (w *Watcher) forget(wd int) {
w.mu.Lock()
defer w.mu.Unlock()
dir, ok := w.dirs[wd]
if !ok {
return
}
delete(w.dirs, wd)
if root := w.roots[dir.root]; root != nil {
for i, had := range root.wds {
if had == wd {
root.wds = append(root.wds[:i], root.wds[i+1:]...)
break
}
}
w.say(dir.root, root)
}
}
// watched is how many folders are watched now.
func (w *Watcher) watched() int {
w.mu.Lock()
defer w.mu.Unlock()
return len(w.dirs)
}
// heard repairs one entry a watch heard of: name in the watched folder wd, or the folder itself.
func (w *Watcher) heard(wd int, name string, mask uint32) {
w.mu.Lock()
dir, ok := w.dirs[wd]
root := w.roots[dir.root]
var users map[uint32]bool
var dev uint64
if root != nil {
// Read under the lock: Set gives a root new users while notices are heard.
users, dev = root.users, root.dev
}
w.mu.Unlock()
if !ok || root == nil {
return
}
fd, err := openBelow(dir.root, dir.rel, dev)
if err != nil {
return
}
defer unix.Close(fd)
visit := keepVisit(users)
if name == "" {
var st unix.Stat_t
if unix.Fstat(fd, &st) == nil {
_, _, _, _ = visit(fd, st, true)
}
return
}
var st unix.Stat_t
if unix.Fstatat(fd, name, &st, unix.AT_SYMLINK_NOFOLLOW) != nil || uint64(st.Dev) != dev {
return
}
isDir := st.Mode&unix.S_IFMT == unix.S_IFDIR
if !isDir && st.Mode&unix.S_IFMT != unix.S_IFREG {
return
}
flags := unix.O_RDONLY | unix.O_NOFOLLOW | unix.O_CLOEXEC | unix.O_NOCTTY | unix.O_NONBLOCK
if isDir {
flags |= unix.O_DIRECTORY
}
efd, err := unix.Openat(fd, name, flags, 0)
if err != nil {
return
}
var opened unix.Stat_t
if unix.Fstat(efd, &opened) != nil || opened.Ino != st.Ino || opened.Dev != st.Dev {
unix.Close(efd)
return
}
_, _, _, _ = visit(efd, opened, isDir)
if isDir && mask&(unix.IN_CREATE|unix.IN_MOVED_TO) != 0 {
// A folder made or moved in is watched, and what was moved in with it is the sweep's.
w.mu.Lock()
defer w.mu.Unlock()
if w.roots[dir.root] != root {
// Let go by Set meanwhile: nothing more is watched for it.
unix.Close(efd)
return
}
w.watchBelow(dir.root, root, efd, append(append([]string(nil), dir.rel...), name))
w.say(dir.root, root)
return
}
unix.Close(efd)
}
// openBelow opens the folder rel below the kept folder root, each level by O_NOFOLLOW on root's device.
func openBelow(root string, rel []string, dev uint64) (int, error) {
_, fd, _, err := openKept(root, WalkLimits{Entries: 1, Time: time.Minute}, machineStats, nil)
if err != nil {
return -1, err
}
for _, name := range rel {
next, err := unix.Openat(fd, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
unix.Close(fd)
if err != nil {
return -1, err
}
var st unix.Stat_t
if err := unix.Fstat(next, &st); err != nil || uint64(st.Dev) != dev {
unix.Close(next)
return -1, errors.New("a level is on another filesystem")
}
fd = next
}
return fd, nil
}
// readNames reads every name in the folder open on fd, and closes it.
func readNames(fd int) ([]string, error) {
var names []string
buf := make([]byte, 32*1024)
defer unix.Close(fd)
for {
n, err := unix.ReadDirent(fd, buf)
if err != nil {
return names, err
}
if n <= 0 {
return names, nil
}
_, _, names = unix.ParseDirent(buf[:n], -1, names)
}
}
func cString(b []byte) string {
for i, c := range b {
if c == 0 {
return string(b[:i])
}
}
return string(b)
}
internal/declaration/declaration.go
+150 -23
View File
@@ -12,6 +12,7 @@ import (
"fmt" "fmt"
"io" "io"
"net" "net"
"path/filepath"
"reflect" "reflect"
"regexp" "regexp"
"slices" "slices"
@@ -456,10 +457,9 @@ const (
// **The distinction 04-ISSUES/036 and 026 turn on.** A `directory` resource is the mesh's own — // **The distinction 04-ISSUES/036 and 026 turn on.** A `directory` resource is the mesh's own —
// it creates it, sets its owner and mode, and removes it when empty ([ADR 0030](novox/hq)). A // it creates it, sets its owner and mode, and removes it when empty ([ADR 0030](novox/hq)). A
// media library, a download spool is the operator's: it existed before the mesh, several modules // media library, a download spool is the operator's: it existed before the mesh, several modules
// read and write it at once, and the mesh must not chown, chmod or remove it. The host confirms it // read and write it at once, and the mesh must not create, chown, chmod or remove it. The host
// is there and mounts it, and keeps it usable by the identities that use it through ACL entries it // confirms it is there and mounts it; nothing else. Library data is a library's (novox/hq ADR 0328),
// adds and nothing else (novox/hq ADR 0325 §5); a missing one is made only below a parent on the // not an access.
// filesystem the data was placed on (§9).
type Access struct { type Access struct {
ID string `json:"id"` ID string `json:"id"`
Type Type `json:"type"` Type Type `json:"type"`
@@ -467,15 +467,11 @@ type Access struct {
// Mode is how this module reaches the path: read or read-write. Absent narrows to read. // Mode is how this module reaches the path: read or read-write. Absent narrows to read.
Mode string `json:"mode,omitempty"` Mode string `json:"mode,omitempty"`
// Users are the identities that use the folder, resolved by the controller (novox/hq ADR 0325 §3, §4): each // Users and Taken are what a controller speaking ADR 0325 sends (the identities that use the folder, and
// module identity whose container mounts it, and the tool runner's account standing for every module whose // that the operator's warrant was carried out): accepted, so its declaration is not refused whole, and not
// tools use it. The engine keeps one ACL entry per user on the folder and as its default (§5); several // acted on since ADR 0328 superseded ADR 0325 — no ACL entry is kept.
// accesses naming one folder are kept as one, each uid at the widest use any of them gives it. Absent is a
// controller older than ADR 0325, or an access nobody but others' bits reach (§2): nothing is kept.
Users []AccessUser `json:"users,omitempty"` Users []AccessUser `json:"users,omitempty"`
// Taken is the controller saying the operator's warrant for this folder was carried out (§8): the folder is Taken bool `json:"taken,omitempty"`
// kept although it holds data. The engine also keeps a folder it took itself, on the act, or found empty.
Taken bool `json:"taken,omitempty"`
// Grant is what a controller older than ADR 0325 still sends (ADR 0312's group grant, superseded): accepted // Grant is what a controller older than ADR 0325 still sends (ADR 0312's group grant, superseded): accepted
// so its declaration is not refused whole, and never acted on — no account is put in a group for data (§5). // so its declaration is not refused whole, and never acted on — no account is put in a group for data (§5).
@@ -1542,19 +1538,129 @@ type Declaration struct {
// not refused for it. // not refused for it.
PutBack bool PutBack bool
// Identities is the identity of every module assigned to this machine (novox/hq ADR 0325 §3): an account // Identities is the identity of every module assigned to this machine (novox/hq ADR 0328 §4): an account
// and a group `mesh-<module>` with the numbers the controller allocated once for the module, the same on // and a group `mesh-<module>` with the numbers the controller allocated once for the module, the same on
// every machine. The engine makes each before any resource is applied, and removes what it made of one no // every machine. The engine makes each before any resource is applied, and removes what it made of one no
// longer declared. Absent is a controller older than ADR 0325. // longer declared. Absent is a controller older than ADR 0325.
Identities []Identity Identities []Identity
// Groups is the group of every library this machine is reached by (novox/hq ADR 0328 §3): `mesh-<library>`
// with the number the controller allocated once, mesh-wide. The engine makes each, and removes what it made of
// one no longer declared. Absent is a controller older than ADR 0328.
Groups []Group
// Libraries is every library this machine is reached by (ADR 0328 §1, §6, §9): its root here, its group, whether
// this is its home, whether the operator's warrant to take it was carried out, the sub-paths its modules ask for,
// and the tool runner's account to put in its group (§11). Absent is a controller older than ADR 0328.
Libraries []Library
} }
// Identity is one module's identity, as the controller allocated it. // Identity is one module's identity, as the controller allocated it (ADR 0328 §4): its user `mesh-<module>` with
// uid, its own group of the same name and number, its primary group gid (its own, or its first library's group),
// and the groups of its other libraries as added groups.
type Identity struct { type Identity struct {
Module string `json:"module"` Module string `json:"module"`
Name string `json:"name"` Name string `json:"name"`
UID int `json:"uid"` UID int `json:"uid"`
GID int `json:"gid"` GID int `json:"gid"`
Groups []int `json:"groups,omitempty"`
}
// Group is one library's group, as the controller allocated it (ADR 0328 §3).
type Group struct {
Name string `json:"name"`
GID int `json:"gid"`
}
// GroupPrefix starts every library group's name, as IdentityPrefix starts every module's.
const GroupPrefix = "mesh-"
// LibraryAccessPrefix starts the access a library's wait and its take act name: `library:<name>`.
const LibraryAccessPrefix = "library:"
// Library is one library as this machine sees it (ADR 0328).
type Library struct {
Library string `json:"library"`
// Root is the library's root on this machine: on its home the data itself, elsewhere the mount point the mounts
// module mounts it at.
Root string `json:"root"`
Group string `json:"group"`
GID int `json:"gid"`
// Home is that the library's data lives on this machine: only there does the engine keep it.
Home bool `json:"home"`
// Taken is the controller saying the operator's warrant to take it was carried out (§7).
Taken bool `json:"taken,omitempty"`
// Paths are the sub-paths its modules ask for, relative to the root.
Paths []string `json:"paths,omitempty"`
// Runner is the tool runner's account, put in the library's group (§11). Absent when no module's tools use it.
Runner string `json:"runner,omitempty"`
}
// checkLibraries judges the groups and libraries on arrival: every library's group declared, named for it, never
// root's number; paths that stay below the root; a runner that is an account's name; and no two roots that nest
// (§13).
func checkLibraries(groups []Group, libs []Library) []string {
var problems []string
byName := map[string]int{}
numbers := map[int]string{}
for _, g := range groups {
where := fmt.Sprintf("group %q", g.Name)
if !strings.HasPrefix(g.Name, GroupPrefix) || !accountName.MatchString(g.Name) {
problems = append(problems, fmt.Sprintf("%s: a library's group is named %s<library>", where, GroupPrefix))
}
if g.GID <= 0 {
problems = append(problems, fmt.Sprintf("%s: gid %d, and a library's group is never root, nor a number "+
"below it (novox/hq ADR 0328 §15); nothing of this declaration was made", where, g.GID))
}
if _, twice := byName[g.Name]; twice {
problems = append(problems, where+": declared twice")
}
if other, used := numbers[g.GID]; used {
problems = append(problems, fmt.Sprintf("%s: gid %d is %s's too", where, g.GID, other))
}
byName[g.Name], numbers[g.GID] = g.GID, g.Name
}
seen := map[string]bool{}
for _, l := range libs {
where := fmt.Sprintf("library %q", l.Library)
switch {
case l.Library == "" || strings.ContainsAny(l.Library, "/ \t\n"):
problems = append(problems, where+": a library is named by one word")
case seen[l.Library]:
problems = append(problems, where+": declared twice")
}
seen[l.Library] = true
if !filepath.IsAbs(l.Root) || filepath.Clean(l.Root) != l.Root || l.Root == "/" {
problems = append(problems, fmt.Sprintf("%s: its root %q is not an absolute, clean path below /", where,
l.Root))
}
if gid, ok := byName[l.Group]; !ok || gid != l.GID {
problems = append(problems, fmt.Sprintf("%s: its group %s (gid %d) is not one this declaration makes",
where, l.Group, l.GID))
}
if l.Group != GroupPrefix+l.Library {
problems = append(problems, fmt.Sprintf("%s: its group is %s%s, and %s is not", where, GroupPrefix,
l.Library, l.Group))
}
for _, p := range l.Paths {
if p == "" || filepath.IsAbs(p) || filepath.Clean(p) != p || p == ".." || strings.HasPrefix(p, "../") {
problems = append(problems, fmt.Sprintf("%s: the path %q is not a clean path below its root", where, p))
}
}
if l.Runner != "" && !accountName.MatchString(l.Runner) {
problems = append(problems, fmt.Sprintf("%s: its runner %q is not an account's name", where, l.Runner))
}
}
for i, a := range libs {
for _, b := range libs[i+1:] {
if a.Root != "" && b.Root != "" && (a.Root == b.Root || strings.HasPrefix(a.Root, b.Root+"/") ||
strings.HasPrefix(b.Root, a.Root+"/")) {
problems = append(problems, fmt.Sprintf("library %q: its root and library %q's nest, and libraries "+
"never overlap (novox/hq ADR 0328 §13)", a.Library, b.Library))
}
}
}
return problems
} }
// IdentityPrefix starts every module identity's name. // IdentityPrefix starts every module identity's name.
@@ -1562,9 +1668,13 @@ const IdentityPrefix = "mesh-"
// checkIdentities judges the identities on arrival: each named for its module, never root, and no name or number // checkIdentities judges the identities on arrival: each named for its module, never root, and no name or number
// twice — two modules with one account would write as each other. // twice — two modules with one account would write as each other.
func checkIdentities(ids []Identity) []string { func checkIdentities(ids []Identity, groups []Group) []string {
var problems []string var problems []string
names, uids, gids := map[string]bool{}, map[int]string{}, map[int]string{} names, uids := map[string]bool{}, map[int]string{}
libraryGroups := map[int]bool{}
for _, g := range groups {
libraryGroups[g.GID] = true
}
for _, id := range ids { for _, id := range ids {
where := fmt.Sprintf("identity %q", id.Name) where := fmt.Sprintf("identity %q", id.Name)
if id.Module == "" || id.Name != IdentityPrefix+id.Module || !accountName.MatchString(id.Name) { if id.Module == "" || id.Name != IdentityPrefix+id.Module || !accountName.MatchString(id.Name) {
@@ -1573,7 +1683,7 @@ func checkIdentities(ids []Identity) []string {
} }
if id.UID <= 0 || id.GID <= 0 { if id.UID <= 0 || id.GID <= 0 {
problems = append(problems, fmt.Sprintf("%s: uid %d, gid %d, and a module's identity is never root, "+ problems = append(problems, fmt.Sprintf("%s: uid %d, gid %d, and a module's identity is never root, "+
"nor a number below it (novox/hq ADR 0325 §11); nothing of this declaration was made", where, "nor a number below it (novox/hq ADR 0328 §15); nothing of this declaration was made", where,
id.UID, id.GID)) id.UID, id.GID))
} }
if names[id.Name] { if names[id.Name] {
@@ -1582,10 +1692,22 @@ func checkIdentities(ids []Identity) []string {
if other, used := uids[id.UID]; used { if other, used := uids[id.UID]; used {
problems = append(problems, fmt.Sprintf("%s: uid %d is %s's too", where, id.UID, other)) problems = append(problems, fmt.Sprintf("%s: uid %d is %s's too", where, id.UID, other))
} }
if other, used := gids[id.GID]; used { // Its primary group is its own (gid == uid) or a library's this declaration makes (ADR 0328 §4); so is
problems = append(problems, fmt.Sprintf("%s: gid %d is %s's too", where, id.GID, other)) // every added group. A module's own number is never a library group's.
if id.GID != id.UID && !libraryGroups[id.GID] {
problems = append(problems, fmt.Sprintf("%s: its primary group gid %d is neither its own (%d) nor a "+
"library's this declaration makes", where, id.GID, id.UID))
} }
names[id.Name], uids[id.UID], gids[id.GID] = true, id.Name, id.Name if libraryGroups[id.UID] {
problems = append(problems, fmt.Sprintf("%s: uid %d is a library group's number too", where, id.UID))
}
for _, g := range id.Groups {
if !libraryGroups[g] {
problems = append(problems, fmt.Sprintf("%s: its added group gid %d is not a library's this "+
"declaration makes", where, g))
}
}
names[id.Name], uids[id.UID] = true, id.Name
} }
return problems return problems
} }
@@ -1757,9 +1879,13 @@ type envelope struct {
// sends them only to a host whose reports say `reads_generation`. // sends them only to a host whose reports say `reads_generation`.
Generation int64 `json:"generation,omitempty"` Generation int64 `json:"generation,omitempty"`
PutBack bool `json:"put_back,omitempty"` PutBack bool `json:"put_back,omitempty"`
// Identities is optional on the wire too (novox/hq ADR 0325 §3). **An older host refuses this key**; a // Identities is optional on the wire too (novox/hq ADR 0325 §3, ADR 0328 §4). **An older host refuses this key**; a
// controller sends it only to a host whose health says link.IdentityContract. // controller sends it only to a host whose health says link.IdentityContract.
Identities []Identity `json:"identities,omitempty"` Identities []Identity `json:"identities,omitempty"`
// Groups and Libraries are optional too (novox/hq ADR 0328). **An older host refuses these keys**; a controller
// sends them only to a host whose health says link.LibraryContract.
Groups []Group `json:"groups,omitempty"`
Libraries []Library `json:"libraries,omitempty"`
} }
func parse(raw []byte, allowActions bool) (*Declaration, error) { func parse(raw []byte, allowActions bool) (*Declaration, error) {
@@ -1778,8 +1904,9 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
d := &Declaration{Version: env.Version, For: env.For, Adoption: env.Adoption, Sequence: env.Sequence, d := &Declaration{Version: env.Version, For: env.For, Adoption: env.Adoption, Sequence: env.Sequence,
Epoch: env.Epoch, LeftOut: env.LeftOut, Generation: env.Generation, PutBack: env.PutBack, Epoch: env.Epoch, LeftOut: env.LeftOut, Generation: env.Generation, PutBack: env.PutBack,
Identities: env.Identities} Identities: env.Identities, Groups: env.Groups, Libraries: env.Libraries}
problems := checkIdentities(env.Identities) problems := checkIdentities(env.Identities, env.Groups)
problems = append(problems, checkLibraries(env.Groups, env.Libraries)...)
if env.Generation < 0 { if env.Generation < 0 {
// Below zero would read as "none claimed" and pass every refusal of an older generation. // Below zero would read as "none claimed" and pass every refusal of an older generation.
problems = append(problems, fmt.Sprintf("an assignment generation below zero (%d) is not one the "+ problems = append(problems, fmt.Sprintf("an assignment generation below zero (%d) is not one the "+
internal/link/handover.go
+11 -17
View File
@@ -328,16 +328,15 @@ type DirectoryJudgements interface {
HearDirectoryJudgements(JudgeDirectoriesFunc) HearDirectoryJudgements(JudgeDirectoriesFunc)
} }
// The take act on an accessed folder, asked over the bus (novox/hq ADR 0325 §8, issue 567). // The take act on a library, asked over the bus (novox/hq ADR 0328 §7, issue 567).
// //
// A folder that already holds data is kept only on the operator's word: the access waits (§7), the controller asks // A library whose root already holds data is kept only on the operator's word: it waits (§8), the controller asks
// the operator once for that folder on that machine (ADR 0259), and on the approved warrant asks this node's engine // the operator once for that library (ADR 0259), and on the approved warrant asks the library's home engine on
// on AskAccessActSubject, signed as a hand-over is and held to the same checks (believed), under a signing context // AskAccessActSubject, signed as a hand-over is and held to the same checks (believed), under a signing context of
// of its own, naming the act, the access, its folder as the engine states it, and the warrant. The engine judges // its own, naming the act, the access `library:<name>`, its root as the engine states it, and the warrant. The engine
// every value against what it was last declared and what is on disk, answers at once that the act started or why // judges every value against what it was last declared and what is on disk, answers at once that the act started or
// it is refused, adds the users' entries to everything under the folder (following no link, entering no other // why it is refused, sets the library's group, group write and setgid on everything under the root (following no
// filesystem), and states the act on the access's verdict (Act). Adding or dropping a user of a folder already // link, entering no other filesystem), and states the act on the library's verdict (Act).
// taken asks nobody: the engine does it on the apply that declares it.
// AskAccessActSubject is where the controller asks this node's engine to run an act on one access's folder. // AskAccessActSubject is where the controller asks this node's engine to run an act on one access's folder.
func AskAccessActSubject(node string) string { return "mesh.node." + node + ".ask.access-act" } func AskAccessActSubject(node string) string { return "mesh.node." + node + ".ask.access-act" }
@@ -345,14 +344,9 @@ func AskAccessActSubject(node string) string { return "mesh.node." + node + ".as
// AccessActContext is prefixed to an act ask's bytes before signing: never another ask's, nor a declaration's. // AccessActContext is prefixed to an act ask's bytes before signing: never another ask's, nor a declaration's.
const AccessActContext = "novox-mesh access-act v2\n" const AccessActContext = "novox-mesh access-act v2\n"
// The walks under an accessed folder. Only ActTake is asked; ActAdd and ActDrop are what an apply starts. // ActTake is the one act asked: the library's group, group write and setgid set on everything under its root, on
const ( // a warrant (ADR 0328 §7).
// ActTake adds the users' entries to the folder and everything under it, on a warrant (ADR 0325 §8). const ActTake = "take"
ActTake = "take"
// ActAdd adds the entries of a user that joined a taken folder; ActDrop removes exactly a dropped user's.
ActAdd = "add"
ActDrop = "drop"
)
// AccessActAsk is an act's own fields, beside a hand-over's (node, path, by, expires, nonce): which act, the // AccessActAsk is an act's own fields, beside a hand-over's (node, path, by, expires, nonce): which act, the
// access by its declared resource id exactly as the declaration names it (`/` allowed), and the warrant the // access by its declared resource id exactly as the declaration names it (`/` allowed), and the warrant the
internal/link/hearing_nats.go
+2 -2
View File
@@ -66,7 +66,7 @@ type natsLink struct {
searching *nats.Subscription searching *nats.Subscription
// judging hears the controller asking for a read-only judgement of this node's directories (issue 358). // judging hears the controller asking for a read-only judgement of this node's directories (issue 358).
judging *nats.Subscription judging *nats.Subscription
// acting hears the controller asking for the take act on an access's folder (novox/hq ADR 0325 §8). // acting hears the controller asking for the take act on a library (novox/hq ADR 0328 §7).
acting *nats.Subscription acting *nats.Subscription
node string node string
// signer is the mesh's key, which a hand-over ask is verified with as a declaration is (issue 356). // signer is the mesh's key, which a hand-over ask is verified with as a declaration is (issue 356).
@@ -262,7 +262,7 @@ func (l *natsLink) HearDirectoryJudgements(handle JudgeDirectoriesFunc) {
} }
// HearAccessActs listens for the controller asking this node to run the take act on an access's folder (novox/hq ADR // HearAccessActs listens for the controller asking this node to run the take act on an access's folder (novox/hq ADR
// 0325 §8), on this machine's own subject, verified as a hand-over is (AnswerAccessAct). A bus whose user list is older // 0328 §7), on this machine's own subject, verified as a hand-over is (AnswerAccessAct). A bus whose user list is older
// than the grant refuses the subscription, said by the client; the controller then hears no answer. // than the grant refuses the subscription, said by the client; the controller then hears no answer.
func (l *natsLink) HearAccessActs(handle AccessActFunc) { func (l *natsLink) HearAccessActs(handle AccessActFunc) {
if handle == nil { if handle == nil {
internal/link/messages.go
+32 -40
View File
@@ -266,6 +266,14 @@ const GrantContract = 4
// tells the controller this host may be sent those fields; an older host refuses the whole declaration for them. // tells the controller this host may be sent those fields; an older host refuses the whole declaration for them.
const IdentityContract = 5 const IdentityContract = 5
// LibraryContract is the statement of a host that reads a declaration's `groups` and `libraries` and an identity's
// `groups` (novox/hq ADR 0328, which supersedes ADR 0325): it makes each library's group and each module's user in
// its libraries' groups, keeps each library it is home to under its group, holds the containers of a library whose
// disk is not there, states a library it may not keep yet as waiting, and hears the take act for `library:<name>`.
// It keeps no ACL entries: an access's `users` and `taken` are accepted and not acted on. Like the fields before
// it, its presence is what tells the controller this host may be sent those fields.
const LibraryContract = 6
// Health is one statement of every long-running resource's state on this machine (to-be 48 §4). Said in // Health is one statement of every long-running resource's state on this machine (to-be 48 §4). Said in
// every report, as an event on each change, and again every minute while anything is not healthy — so a // every report, as an event on each change, and again every minute while anything is not healthy — so a
// lost statement is not a lost fault. // lost statement is not a lost fault.
@@ -304,15 +312,14 @@ const KindAccount = "account"
// starting ReasonUsedAsFound, until the operator hands it to the mesh (`nox node hand-over <node> <path>` on the control-node, novox/hq issue 356). // starting ReasonUsedAsFound, until the operator hands it to the mesh (`nox node hand-over <node> <path>` on the control-node, novox/hq issue 356).
const KindDirectory = "directory" const KindDirectory = "directory"
// KindAccess is an access whose folder the engine keeps for its users (novox/hq ADR 0325): healthy while every user // KindAccess is an access (novox/hq ADR 0051): no engine since ADR 0328 states one; kept for the controller's reading
// has its effective right on the folder and the sweep's sample under it (§10), waiting while the mesh may not keep // of an older engine's statements.
// it yet or its disk is not there (§7), unhealthy otherwise — root's data on its placed filesystem among it (§12).
const KindAccess = "access" const KindAccess = "access"
// KindKeptEntries is the mesh's entries on a shared folder that nobody wants and that could not be taken out yet // KindLibrary is a library this machine is reached by (novox/hq ADR 0328), said under resource `library:<name>`
// (novox/hq ADR 0325 §8): a folder no access names whose disk is away, or entries left on a filesystem no longer at // with no module: healthy while it is kept (or, not home, while its mount is there), waiting with an access wait of
// a folder. Unhealthy, said under the access that last named it, until the drop walk has run. // reason keep or disk, unknown while its filesystem could not be named, unhealthy otherwise.
const KindKeptEntries = "kept-entries" const KindLibrary = "library"
// ReasonUsedAsFound starts the reason of a directory used as found. // ReasonUsedAsFound starts the reason of a directory used as found.
const ReasonUsedAsFound = "used as found:" const ReasonUsedAsFound = "used as found:"
@@ -426,24 +433,21 @@ type ResourceHealth struct {
// Waits is what a resource stated waiting waits for (novox/hq ADR 0283): each one own secret or one // Waits is what a resource stated waiting waits for (novox/hq ADR 0283): each one own secret or one
// setting of the module by name, the part, and what the operator gives, in words. Absent otherwise. // setting of the module by name, the part, and what the operator gives, in words. Absent otherwise.
Waits []health.Wait `json:"waits,omitempty"` Waits []health.Wait `json:"waits,omitempty"`
// AccessWaits is what an access stated waiting waits for (novox/hq ADR 0325 §7). Beside Waits rather than in // AccessWaits is what a library stated waiting waits for (novox/hq ADR 0328 §8, §9). Beside Waits rather than in
// it because mesh-sdk's health.Wait names a secret or a setting and nothing else; it moves there once that type // it because mesh-sdk's health.Wait names a secret or a setting and nothing else; it moves there once that type
// has a kind. Absent otherwise. // has a kind. Absent otherwise.
AccessWaits []AccessWait `json:"access-waits,omitempty"` AccessWaits []AccessWait `json:"access-waits,omitempty"`
// Act is the last walk under an access's folder (ADR 0325 §8): a take on a warrant, or an add or a drop of a // Act is the last walk under a library's root (ADR 0328 §7): the take on a warrant. Absent on every other
// user's entries. Absent on every other verdict, and on a folder never walked. // verdict, and on a library never walked.
Act *AccessActRecord `json:"act,omitempty"` Act *AccessActRecord `json:"act,omitempty"`
// Entries is the listing of a kept folder's users, for an access's verdict (ADR 0325 §4): each identity, its
// use, and a note beside the tool runner's entry. Absent on a folder not kept.
Entries []KeptEntry `json:"entries,omitempty"`
} }
// WaitKindAccess is the kind of a wait on an access (novox/hq ADR 0325 §7). // WaitKindAccess is the kind of a wait on a library (novox/hq ADR 0328 §8, §9; first ADR 0325 §7).
const WaitKindAccess = "access" const WaitKindAccess = "access"
// AccessWait is one access waiting for the operator: the access by its module's own id for it, the part (its // AccessWait is one library waiting for the operator (ADR 0328 §8, §9): the access `library:<name>`, the part (the
// module), and what the operator gives, in words with no path (ADR 0234 §6): "let the mesh keep the shared folder // library), and what the operator gives, in words with no path (ADR 0234 §6): "let the mesh keep the library media",
// movies", or "mount the disk that holds books". // or "mount the disk that holds the library media".
type AccessWait struct { type AccessWait struct {
// Kind is WaitKindAccess. // Kind is WaitKindAccess.
Kind string `json:"kind"` Kind string `json:"kind"`
@@ -456,31 +460,14 @@ type AccessWait struct {
// Reason is what the wait is for, for the controller to read without parsing words: WaitKeep (the operator's // Reason is what the wait is for, for the controller to read without parsing words: WaitKeep (the operator's
// word to keep it) or WaitDisk (its disk mounted). // word to keep it) or WaitDisk (its disk mounted).
Reason string `json:"reason"` Reason string `json:"reason"`
// ACL is said on a keep wait whose folder's filesystem refuses access entries now: ACLNeedsEnabling when the
// take act will let it (a ZFS dataset's acltype, which the ask then says it sets), ACLUnsupported when no act
// can (the operator mounts it with ACLs). Absent when it allows them.
ACL string `json:"acl,omitempty"`
} }
// The reasons of an access wait, and what its filesystem says of ACLs. // The reasons of an access wait.
const ( const (
WaitKeep = "keep" WaitKeep = "keep"
WaitDisk = "disk" WaitDisk = "disk"
ACLNeedsEnabling = "needs-enabling"
ACLUnsupported = "unsupported"
) )
// KeptEntry is one user of a kept folder as its listing says it.
type KeptEntry struct {
Identity string `json:"identity"`
UID int `json:"uid"`
Use string `json:"use"`
From string `json:"from"`
// Note is said beside the tool runner's entry (ADR 0325 §4): it stands for every module whose tools use the
// folder, at the widest use any of them declares.
Note string `json:"note,omitempty"`
}
// The states of a walk under an accessed folder. // The states of a walk under an accessed folder.
const ( const (
ActRunning = "running" ActRunning = "running"
@@ -491,10 +478,10 @@ const (
ActFailed = "failed" ActFailed = "failed"
) )
// AccessActRecord is one walk under an access's folder, as the engine records it (novox/hq ADR 0325 §8). Counts // AccessActRecord is one walk under a library's root, as the engine records it (novox/hq ADR 0328 §7). Counts only:
// only: never a path. // never a path.
type AccessActRecord struct { type AccessActRecord struct {
// Act is ActTake, ActAdd or ActDrop. // Act is ActTake.
Act string `json:"act"` Act string `json:"act"`
Access string `json:"access"` Access string `json:"access"`
Warrant string `json:"warrant,omitempty"` Warrant string `json:"warrant,omitempty"`
@@ -511,6 +498,11 @@ type AccessActRecord struct {
Links int `json:"links,omitempty"` Links int `json:"links,omitempty"`
Other int `json:"other,omitempty"` Other int `json:"other,omitempty"`
Mounts int `json:"mounts,omitempty"` Mounts int `json:"mounts,omitempty"`
// Shared is the files with another name root owns, left as they are; Linked those an account owns, given the
// group; Stripped the files whose setuid or setgid bit the group change took.
Shared int `json:"shared,omitempty"`
Linked int `json:"linked,omitempty"`
Stripped int `json:"stripped,omitempty"`
// Why is what stopped or failed it, in words with no path. // Why is what stopped or failed it, in words with no path.
Why string `json:"why,omitempty"` Why string `json:"why,omitempty"`
} }
internal/link/queue.go
+1 -1
View File
@@ -63,7 +63,7 @@ type Queue struct {
// link (novox/hq issue 358). Nil answers every such ask with a refusal. // link (novox/hq issue 358). Nil answers every such ask with a refusal.
JudgeDirectories JudgeDirectoriesFunc JudgeDirectories JudgeDirectoriesFunc
// AccessAct judges and runs the take act on an access's folder, asked by the controller on an approved // AccessAct judges and runs the take act on an access's folder, asked by the controller on an approved
// warrant (novox/hq ADR 0325 §8). Nil answers every such ask with a refusal. // warrant (novox/hq ADR 0328 §7). Nil answers every such ask with a refusal.
AccessAct AccessActFunc AccessAct AccessActFunc
Say Announce Say Announce
Timeout time.Duration Timeout time.Duration
internal/link/run.go
+1 -1
View File
@@ -252,7 +252,7 @@ func serve(ctx context.Context, link Link, m Membership, queue *Queue, say Annou
if j, ok := link.(DirectoryJudgements); ok { if j, ok := link.(DirectoryJudgements); ok {
j.HearDirectoryJudgements(queue.JudgeDirectories) j.HearDirectoryJudgements(queue.JudgeDirectories)
} }
// And asking for the take act on an access's folder, on a warrant (novox/hq ADR 0325 §8). // And asking for the take act on a library, on a warrant (novox/hq ADR 0328 §7).
if s, ok := link.(AccessActs); ok { if s, ok := link.(AccessActs); ok {
s.HearAccessActs(queue.AccessAct) s.HearAccessActs(queue.AccessAct)
} }
internal/store/kept.go
-212
View File
@@ -1,212 +0,0 @@
package store
import (
"encoding/json"
"errors"
"fmt"
"io/fs"
"os"
"path/filepath"
"sync"
"time"
)
// KeptName is the file, beside the node's state, of every shared folder the engine keeps (novox/hq ADR 0325 §5):
// whose entries it added, on which filesystem it was placed, whether it was taken and under which warrant, and how
// far its sweep got. Its own file for the reason the hand-overs have theirs: the take act, the watch and the sweep
// run beside an apply, whose save of the state would lose a record written into it meanwhile.
const KeptName = "kept-folders.json"
// KeptPath is that file beside the state at statePath.
func KeptPath(statePath string) string {
return filepath.Join(filepath.Dir(statePath), KeptName)
}
// KeptUser is one identity the mesh keeps an entry for on a folder: its name, its number, its use and where it
// runs (a container, or the tool runner standing for every module whose tools use the folder, ADR 0325 §4).
type KeptUser struct {
Identity string `json:"identity"`
UID uint32 `json:"uid"`
Use string `json:"use"`
From string `json:"from"`
}
// How a folder came to be kept.
const (
// KeptByWarrant is a folder that held data, taken on the operator's word (ADR 0325 §8).
KeptByWarrant = "warrant"
// KeptEmpty is a folder that held nothing yet when it was first kept (§5).
KeptEmpty = "empty"
// KeptMade is a folder the engine made under a parent on its placed filesystem (§9).
KeptMade = "made"
)
// KeptFolder is one shared folder the engine keeps, or has seen and waits to keep. Counts and mount points only
// beside its own path: never a path under it.
type KeptFolder struct {
Path string `json:"path"`
// Mount is the mount point of the filesystem the folder was placed on when the engine first saw it there:
// later, a nearest existing parent on another one is the disk not there (ADR 0325 §9).
Mount string `json:"mount,omitempty"`
// Kept is that the mesh keeps it; How why (KeptByWarrant, KeptEmpty, KeptMade); Warrant and By the warrant and
// who asked, for a folder taken on one; At since when.
Kept bool `json:"kept,omitempty"`
How string `json:"how,omitempty"`
Warrant string `json:"warrant,omitempty"`
By string `json:"by,omitempty"`
At time.Time `json:"at,omitzero"`
// Users are the identities whose entries are on everything under the folder; Want what the last apply
// declared. Where they differ a walk adds or removes exactly the difference.
Users []KeptUser `json:"users,omitempty"`
Want []KeptUser `json:"want,omitempty"`
// IDs are the accesses that last named the folder: what a leftover is said under once none does.
IDs []string `json:"ids,omitempty"`
// Placed names the filesystem the folder was kept on (the engine's PlacedID: its mount point, source and type),
// so another filesystem mounted at the same point is a move, as another mount point is.
Placed string `json:"placed,omitempty"`
// Fs is what Placed was made from beside the mount point: "uuid:<the filesystem's UUID>", "fsid:<statfs's id>"
// or "source:<type>:<mountinfo's source>". Kept on this machine only, never said. Absent on a record from an
// earlier build, whose Placed is then not compared.
Fs string `json:"fs,omitempty"`
// TakenOn names, as Placed does, the filesystem the operator's warrant was carried out on (ADR 0325 §8): the
// controller's word that the folder was taken holds for that filesystem alone, and a folder moved to another
// asks again. One that names no filesystem this way (a mount point, from an unmerged build) is not taken.
TakenOn string `json:"taken_on,omitempty"`
// Left is the entries the mesh added on a filesystem no longer at the folder (a disk mounted over it, or
// one gone): taken out by a drop walk once that filesystem holds the folder again, said until then.
Left []KeptLeft `json:"left,omitempty"`
// Act is the last walk under the folder: a take, an add or a drop.
Act *KeptAct `json:"act,omitempty"`
// Sweep is how far the sweep got (ADR 0325 §10).
Sweep KeptSweep `json:"sweep"`
// Watches is how many folders under it are watched; OutOfWatches that the machine's watch limit was met, and
// the sweep alone finds what is made where no watch is (§6).
Watches int `json:"watches,omitempty"`
OutOfWatches bool `json:"out_of_watches,omitempty"`
}
// KeptLeft is the mesh's entries left on one filesystem: its mount point and whose entries they are.
type KeptLeft struct {
Mount string `json:"mount"`
// Placed names that filesystem as KeptFolder.Placed does: entries left on the filesystem the folder is on
// now are the folder's own, never walked away.
Placed string `json:"placed,omitempty"`
Fs string `json:"fs,omitempty"`
Users []KeptUser `json:"users"`
// Since is when they were left: a filesystem not back at its mount point within LeftFor is gone, and what was
// left on it is forgotten (said once).
Since time.Time `json:"since,omitzero"`
}
// KeptAct is one walk under a kept folder, as the engine records it. Counts only: never a path.
type KeptAct struct {
// Act is take, add or drop.
Act string `json:"act"`
Warrant string `json:"warrant,omitempty"`
By string `json:"by,omitempty"`
State string `json:"state"`
Started time.Time `json:"started"`
Ended time.Time `json:"ended,omitzero"`
// Folders and Files are the entries changed; Kept the ones that already had what they need; Links the links
// passed by unfollowed; Other the entries neither a file nor a folder; Mounts the folders on another
// filesystem not entered.
Folders int `json:"folders,omitempty"`
Files int `json:"files,omitempty"`
Kept int `json:"kept,omitempty"`
Links int `json:"links,omitempty"`
Other int `json:"other,omitempty"`
Mounts int `json:"mounts,omitempty"`
// Why is what stopped or failed it, in words with no path.
Why string `json:"why,omitempty"`
}
// KeptSweep is the sweep's place in a kept folder: where the last look stopped, below the folder, by the names
// of each level (never said, only resumed from); when it last covered the folder whole; and what this pass found.
type KeptSweep struct {
Cursor []string `json:"cursor,omitempty"`
Covered time.Time `json:"covered,omitzero"`
// Read is how many entries this pass read so far; Narrowed how many gave a user less than its right and were
// put back; Unrepaired how many could not be (an owner's bits, which the mesh never changes, or a write that
// failed).
Read int `json:"read,omitempty"`
Narrowed int `json:"narrowed,omitempty"`
Unrepaired int `json:"unrepaired,omitempty"`
// LastUnrepaired is what the last whole pass could not put back: said until the next pass is through.
LastUnrepaired int `json:"last_unrepaired,omitempty"`
// Bound is that the last look ran out of its bound before the folder was covered.
Bound bool `json:"bound,omitempty"`
}
// KeptFile is the kept folders' file, one writer at a time in this process.
type KeptFile struct {
path string
mu sync.Mutex
}
// NewKeptFile is the kept folders' file beside the state at statePath.
func NewKeptFile(statePath string) *KeptFile { return &KeptFile{path: KeptPath(statePath)} }
// All is every kept or seen folder, by path. None is an empty map; a file that cannot be read is an error.
func (k *KeptFile) All() (map[string]KeptFolder, error) {
k.mu.Lock()
defer k.mu.Unlock()
return k.load()
}
// Update changes the record of one folder under the file's lock: change is given the record (empty when there is
// none) and whether there was one, and says whether to keep it; a record not kept is removed.
func (k *KeptFile) Update(path string, change func(f *KeptFolder, had bool) bool) error {
k.mu.Lock()
defer k.mu.Unlock()
all, err := k.load()
if err != nil {
return err
}
f, had := all[path]
f.Path = path
if change(&f, had) {
all[path] = f
} else {
delete(all, path)
}
return k.save(all)
}
func (k *KeptFile) load() (map[string]KeptFolder, error) {
raw, err := os.ReadFile(k.path)
if errors.Is(err, fs.ErrNotExist) {
return map[string]KeptFolder{}, nil
}
if err != nil {
return nil, fmt.Errorf("reading the kept folders: %w", err)
}
out := map[string]KeptFolder{}
if err := json.Unmarshal(raw, &out); err != nil {
return nil, fmt.Errorf("the kept folders (%s) are unreadable: %w", k.path, err)
}
return out, nil
}
func (k *KeptFile) save(all map[string]KeptFolder) error {
raw, err := json.MarshalIndent(all, "", " ")
if err != nil {
return err
}
tmp, err := os.CreateTemp(filepath.Dir(k.path), ".kept-folders-*.json")
if err != nil {
return err
}
defer os.Remove(tmp.Name())
if _, err := tmp.Write(append(raw, '\n')); err != nil {
tmp.Close()
return err
}
if err := tmp.Sync(); err != nil {
tmp.Close()
return err
}
if err := tmp.Close(); err != nil {
return err
}
return os.Rename(tmp.Name(), k.path)
}
internal/store/libraries.go
+166
View File
@@ -0,0 +1,166 @@
package store
import (
"encoding/json"
"errors"
"fmt"
"io/fs"
"os"
"path/filepath"
"sync"
"time"
)
// LibrariesName is the file, beside the node's state, of every library this machine is home to (novox/hq ADR 0328
// §6, §7, §9): which filesystem its root was kept on, whether and how it is kept, and the last walk under it. Its own
// file for the reason the hand-overs have theirs: the take act runs beside an apply, whose save of the state would
// lose a record written into it meanwhile.
const LibrariesName = "libraries.json"
// LibrariesPath is that file beside the state at statePath.
func LibrariesPath(statePath string) string {
return filepath.Join(filepath.Dir(statePath), LibrariesName)
}
// How a library came to be kept.
const (
// KeptByWarrant is a root that held data, taken on the operator's word (ADR 0328 §7).
KeptByWarrant = "warrant"
// KeptEmpty is a root that held nothing yet when it was first kept.
KeptEmpty = "empty"
// KeptInShape is a root found already in the library's group with group write and setgid.
KeptInShape = "in-shape"
)
// LibraryRecord is one library as the engine keeps it on its home. Counts, names and mount points only beside its
// root: never a path under it.
type LibraryRecord struct {
Library string `json:"library"`
Root string `json:"root"`
// GID is the library's group as it was last kept: what a walk stopped at its bound goes on with.
GID int `json:"gid,omitempty"`
// Mount is the mount point that held the root when the engine first saw it; Placed and Fs name that filesystem
// (the engine's PlacedID, and what it was made from: UUID, filesystem id or source).
Mount string `json:"mount,omitempty"`
Placed string `json:"placed,omitempty"`
Fs string `json:"fs,omitempty"`
// Kept is that the mesh keeps it, on the filesystem KeptOn names (a Placed): another filesystem at the root is
// judged afresh. How is why; Warrant and By the warrant and who asked, for one taken on a warrant.
Kept bool `json:"kept,omitempty"`
KeptOn string `json:"kept_on,omitempty"`
How string `json:"how,omitempty"`
Warrant string `json:"warrant,omitempty"`
By string `json:"by,omitempty"`
At time.Time `json:"at,omitzero"`
// Act is the last walk under the root; Cursor where a walk that met its bound stopped (the names of each level
// below the root, never said), for the next to go on from.
Act *KeptAct `json:"act,omitempty"`
// Paths are the sub-paths kept so far on the filesystem KeptOn names: one asked for later that holds data not
// in the group waits for the operator's word as a root would, unless the library was taken whole.
Paths []string `json:"paths,omitempty"`
Cursor []string `json:"cursor,omitempty"`
}
// KeptAct is one walk under a library's root, as the engine records it. Counts only: never a path.
type KeptAct struct {
Act string `json:"act"`
Warrant string `json:"warrant,omitempty"`
By string `json:"by,omitempty"`
State string `json:"state"`
Started time.Time `json:"started"`
Ended time.Time `json:"ended,omitzero"`
// On names the filesystem it walked (a Placed).
On string `json:"on,omitempty"`
// Folders and Files are the entries changed; Kept the ones that already had what they need; Links the links
// passed by unfollowed; Other the entries neither a file nor a folder; Mounts the folders on another filesystem
// not entered; Shared the files with another name root owns, left as they are.
Folders int `json:"folders,omitempty"`
Files int `json:"files,omitempty"`
Kept int `json:"kept,omitempty"`
Links int `json:"links,omitempty"`
Other int `json:"other,omitempty"`
Mounts int `json:"mounts,omitempty"`
Shared int `json:"shared,omitempty"`
// Linked is the files with another name an account owns, given the group; Stripped the files whose setuid or
// setgid bit the group change took, and which stays taken.
Linked int `json:"linked,omitempty"`
Stripped int `json:"stripped,omitempty"`
// Why is what stopped or failed it, in words with no path.
Why string `json:"why,omitempty"`
}
// LibraryFile is the libraries' file, one writer at a time in this process.
type LibraryFile struct {
path string
mu sync.Mutex
}
// NewLibraryFile is the libraries' file beside the state at statePath.
func NewLibraryFile(statePath string) *LibraryFile {
return &LibraryFile{path: LibrariesPath(statePath)}
}
// All is every library's record, by name. None is an empty map; a file that cannot be read is an error.
func (k *LibraryFile) All() (map[string]LibraryRecord, error) {
k.mu.Lock()
defer k.mu.Unlock()
return k.load()
}
// Update changes one library's record under the file's lock: change is given the record (empty when there is none)
// and whether there was one, and says whether to keep it; a record not kept is removed.
func (k *LibraryFile) Update(name string, change func(r *LibraryRecord, had bool) bool) error {
k.mu.Lock()
defer k.mu.Unlock()
all, err := k.load()
if err != nil {
return err
}
r, had := all[name]
r.Library = name
if change(&r, had) {
all[name] = r
} else {
delete(all, name)
}
return k.save(all)
}
func (k *LibraryFile) load() (map[string]LibraryRecord, error) {
raw, err := os.ReadFile(k.path)
if errors.Is(err, fs.ErrNotExist) {
return map[string]LibraryRecord{}, nil
}
if err != nil {
return nil, fmt.Errorf("reading the libraries: %w", err)
}
out := map[string]LibraryRecord{}
if err := json.Unmarshal(raw, &out); err != nil {
return nil, fmt.Errorf("the libraries (%s) are unreadable: %w", k.path, err)
}
return out, nil
}
func (k *LibraryFile) save(all map[string]LibraryRecord) error {
raw, err := json.MarshalIndent(all, "", " ")
if err != nil {
return err
}
tmp, err := os.CreateTemp(filepath.Dir(k.path), ".libraries-*.json")
if err != nil {
return err
}
defer os.Remove(tmp.Name())
if _, err := tmp.Write(append(raw, '\n')); err != nil {
tmp.Close()
return err
}
if err := tmp.Sync(); err != nil {
tmp.Close()
return err
}
if err := tmp.Close(); err != nil {
return err
}
return os.Rename(tmp.Name(), k.path)
}
internal/store/store.go
+23 -1
View File
@@ -242,10 +242,32 @@ type State struct {
// assigned again finds the tunnel's configuration retired rather than missing. // assigned again finds the tunnel's configuration retired rather than missing.
Retired []Retired `json:"retired,omitempty"` Retired []Retired `json:"retired,omitempty"`
// Identities is every module identity the engine made here (novox/hq ADR 0325 §3): its account and group, // Identities is every module identity the engine made here (novox/hq ADR 0328 §4): its account and group,
// by name and number, and which of the two it made. An identity no longer declared is removed, and only // by name and number, and which of the two it made. An identity no longer declared is removed, and only
// what the engine made: an account or group that was there before is never the mesh's to remove. // what the engine made: an account or group that was there before is never the mesh's to remove.
Identities []MadeIdentity `json:"identities,omitempty"` Identities []MadeIdentity `json:"identities,omitempty"`
// Groups is every library group the engine made here (novox/hq ADR 0328 §3), removed when no longer declared;
// a group that was there before is never the mesh's to remove.
Groups []MadeGroup `json:"groups,omitempty"`
// Members is every library group the engine put a tool runner's account in that it was not in before (ADR 0328
// §11, as ADR 0252 records an account's groups): taken back when no longer declared.
Members []Membership `json:"members,omitempty"`
}
// MadeGroup is one library group the engine made.
type MadeGroup struct {
Name string `json:"name"`
GID int `json:"gid"`
At time.Time `json:"at"`
}
// Membership is one account the engine put in one library's group.
type Membership struct {
Account string `json:"account"`
Group string `json:"group"`
Library string `json:"library"`
} }
// MadeIdentity is one module identity as the engine made it. // MadeIdentity is one module identity as the engine made it.
internal/system/identities.go
+93 -7
View File
@@ -7,7 +7,7 @@ import (
"strings" "strings"
) )
// A module's identity as a system account (novox/hq ADR 0325 §3): an account and a group with exactly the numbers // A module's identity as a system account (novox/hq ADR 0328 §3, §4): an account and a group with exactly the numbers
// the controller allocated, no login shell, no home and no password. Optional beside System: a system that has // the controller allocated, no login shell, no home and no password. Optional beside System: a system that has
// none (android) makes no module identity, and the engine says so. // none (android) makes no module identity, and the engine says so.
@@ -19,16 +19,52 @@ func (arch) CreateSystemGroup(ctx context.Context, run Runner, name string, gid
return nil return nil
} }
// CreateSystemAccount makes a system account with uid and the group gid as its own: no home made, `/` as the // NoHome is the home field of every module account: a path that is not there, so nothing that follows an account's
// home — usermod regrouping every file under it, for one — ever walks a real tree. Never `/`: `usermod --gid` on
// an account whose home is `/` regroups every file it owns on the machine.
const NoHome = "/nonexistent"
// CreateSystemAccount makes a system account with uid and the group gid as its own: no home made, NoHome as the
// home field, nologin as its shell, and the password useradd leaves locked. // home field, nologin as its shell, and the password useradd leaves locked.
func (arch) CreateSystemAccount(ctx context.Context, run Runner, name string, uid, gid int) error { func (arch) CreateSystemAccount(ctx context.Context, run Runner, name string, uid, gid int, groups []string) error {
if _, err := run(ctx, "useradd", "--system", "--uid", strconv.Itoa(uid), "--gid", strconv.Itoa(gid), args := []string{"--system", "--uid", strconv.Itoa(uid), "--gid", strconv.Itoa(gid)}
"--no-create-home", "--home-dir", "/", "--shell", "/usr/bin/nologin", name); err != nil { if len(groups) > 0 {
args = append(args, "--groups", strings.Join(groups, ","))
}
args = append(args, "--no-create-home", "--home-dir", NoHome, "--shell", "/usr/bin/nologin", name)
if _, err := run(ctx, "useradd", args...); err != nil {
return fmt.Errorf("cannot create the account %q: %w", name, err) return fmt.Errorf("cannot create the account %q: %w", name, err)
} }
return nil return nil
} }
// ModifyAccount gives an account the mesh made its primary group gid and exactly groups as its added groups.
//
// **Its home is moved to NoHome first, never its files.** `usermod --gid` regroups every file under the account's
// home that the account owns; an account made with `/` as its home (an earlier engine's) would have the whole
// machine walked as root. So an account whose home is not NoHome is given NoHome first, without -m: no file moves.
func (arch) ModifyAccount(ctx context.Context, run Runner, name string, gid int, groups []string) error {
passwd, err := run(ctx, "getent", "passwd", name)
if err != nil {
return fmt.Errorf("cannot read the account %q: %w", name, err)
}
fields := strings.Split(strings.TrimSpace(passwd), ":")
if len(fields) < 6 {
return fmt.Errorf("the user database gave %q for %q, which is not a passwd entry", strings.TrimSpace(passwd),
name)
}
if fields[5] != NoHome {
if _, err := run(ctx, "usermod", "--home", NoHome, name); err != nil {
return fmt.Errorf("cannot give the account %q no home before its groups: %w", name, err)
}
}
if _, err := run(ctx, "usermod", "--gid", strconv.Itoa(gid), "--groups", strings.Join(groups, ","),
name); err != nil {
return fmt.Errorf("cannot give the account %q its groups: %w", name, err)
}
return nil
}
// RemoveAccount removes an account, leaving every file it owns where it is. // RemoveAccount removes an account, leaving every file it owns where it is.
func (arch) RemoveAccount(ctx context.Context, run Runner, name string) error { func (arch) RemoveAccount(ctx context.Context, run Runner, name string) error {
if _, err := run(ctx, "userdel", name); err != nil { if _, err := run(ctx, "userdel", name); err != nil {
@@ -54,7 +90,7 @@ func (alpine) CreateSystemGroup(ctx context.Context, run Runner, name string, gi
} }
// CreateSystemAccount makes a system account with busybox's adduser: -S system, -D no password, -H no home made. // CreateSystemAccount makes a system account with busybox's adduser: -S system, -D no password, -H no home made.
func (alpine) CreateSystemAccount(ctx context.Context, run Runner, name string, uid, gid int) error { func (alpine) CreateSystemAccount(ctx context.Context, run Runner, name string, uid, gid int, groups []string) error {
group, err := run(ctx, "getent", "group", strconv.Itoa(gid)) group, err := run(ctx, "getent", "group", strconv.Itoa(gid))
if err != nil { if err != nil {
return fmt.Errorf("cannot create the account %q: its group gid %d is not here: %w", name, gid, err) return fmt.Errorf("cannot create the account %q: its group gid %d is not here: %w", name, gid, err)
@@ -63,10 +99,60 @@ func (alpine) CreateSystemAccount(ctx context.Context, run Runner, name string,
if n, _, ok := strings.Cut(group, ":"); ok { if n, _, ok := strings.Cut(group, ":"); ok {
groupName = n groupName = n
} }
if _, err := run(ctx, "adduser", "-S", "-D", "-H", "-h", "/", "-s", "/sbin/nologin", "-u", strconv.Itoa(uid), if _, err := run(ctx, "adduser", "-S", "-D", "-H", "-h", NoHome, "-s", "/sbin/nologin", "-u", strconv.Itoa(uid),
"-G", groupName, name); err != nil { "-G", groupName, name); err != nil {
return fmt.Errorf("cannot create the account %q: %w", name, err) return fmt.Errorf("cannot create the account %q: %w", name, err)
} }
for _, g := range groups {
if _, err := run(ctx, "addgroup", name, g); err != nil {
return fmt.Errorf("cannot put the account %q in %q: %w", name, g, err)
}
}
return nil
}
// ModifyAccount gives an account the mesh made exactly groups as its added groups, with busybox's addgroup and
// delgroup. Its primary group busybox cannot change (it has no usermod, and the mesh edits no passwd by hand):
// an account whose primary group must change is refused, saying so, and left as it is.
func (alpine) ModifyAccount(ctx context.Context, run Runner, name string, gid int, groups []string) error {
passwd, err := run(ctx, "getent", "passwd", name)
if err != nil {
return fmt.Errorf("cannot read the account %q: %w", name, err)
}
fields := strings.Split(strings.TrimSpace(passwd), ":")
if len(fields) < 4 || fields[3] != strconv.Itoa(gid) {
return fmt.Errorf("this system cannot change the account %q's primary group to %d: busybox has no usermod, "+
"and the mesh edits no passwd by hand: %w", name, gid, ErrUnsupported)
}
primary := ""
if g, err := run(ctx, "getent", "group", fields[3]); err == nil {
primary, _, _ = strings.Cut(strings.TrimSpace(g), ":")
}
out, err := run(ctx, "id", "-nG", name)
if err != nil {
return fmt.Errorf("cannot read the account %q's groups: %w", name, err)
}
have, want := map[string]bool{}, map[string]bool{}
for _, g := range strings.Fields(out) {
if g != primary && g != name {
have[g] = true
}
}
for _, g := range groups {
want[g] = true
if !have[g] {
if _, err := run(ctx, "addgroup", name, g); err != nil {
return fmt.Errorf("cannot put the account %q in %q: %w", name, g, err)
}
}
}
for g := range have {
if !want[g] {
if _, err := run(ctx, "delgroup", name, g); err != nil {
return fmt.Errorf("cannot take the account %q out of %q: %w", name, g, err)
}
}
}
return nil return nil
} }
internal/system/identities_test.go
+91
View File
@@ -0,0 +1,91 @@
package system
import (
"context"
"errors"
"strings"
"testing"
)
// busybox has no usermod (novox/hq ADR 0328 §4): an account the mesh made is given its added groups with addgroup
// and delgroup, and a change of its primary group is refused, saying why.
func TestBusyboxGivesAnAccountItsAddedGroupsAndRefusesAnotherPrimary(t *testing.T) {
var ran []string
run := func(_ context.Context, name string, args ...string) (string, error) {
ran = append(ran, name+" "+strings.Join(args, " "))
switch {
case name == "getent" && args[0] == "passwd":
return "mesh-radarr:x:61001:62000::/:/sbin/nologin\n", nil
case name == "getent" && args[0] == "group":
return "mesh-media:x:62000:\n", nil
case name == "id":
return "mesh-media mesh-old\n", nil
}
return "", nil
}
if err := (alpine{}).ModifyAccount(context.Background(), run, "mesh-radarr", 62000, []string{"mesh-books"}); err != nil {
t.Fatal(err)
}
got := strings.Join(ran, "\n")
if !strings.Contains(got, "addgroup mesh-radarr mesh-books") || !strings.Contains(got, "delgroup mesh-radarr mesh-old") ||
strings.Contains(got, "delgroup mesh-radarr mesh-media") {
t.Fatalf("not given exactly its added groups:\n%s", got)
}
err := (alpine{}).ModifyAccount(context.Background(), run, "mesh-radarr", 62005, nil)
if !errors.Is(err, ErrUnsupported) || !strings.Contains(err.Error(), "primary group") {
t.Fatalf("a change of primary group was not refused saying why: %v", err)
}
}
// An account is made with no home, and a change of its groups moves an old home of `/` away first: `usermod --gid`
// regroups every file under the home the account owns, and under `/` that is the whole machine.
func TestAnAccountsGroupsChangeOnlyWithNoHome(t *testing.T) {
var ran []string
home := "/"
run := func(_ context.Context, name string, args ...string) (string, error) {
line := name + " " + strings.Join(args, " ")
ran = append(ran, line)
if name == "getent" {
return "mesh-radarr:x:61001:61001::" + home + ":/usr/bin/nologin\n", nil
}
if name == "usermod" && args[0] == "--home" {
home = args[1]
}
if name == "usermod" && args[0] == "--gid" && home != NoHome {
t.Fatalf("usermod --gid ran with the home %s: every file there would be regrouped", home)
}
return "", nil
}
if err := (arch{}).CreateSystemAccount(context.Background(), run, "mesh-radarr", 61001, 61001, nil); err != nil {
t.Fatal(err)
}
if !strings.Contains(ran[0], "--no-create-home --home-dir "+NoHome+" ") {
t.Fatalf("an account is made with a home: %s", ran[0])
}
if err := (arch{}).ModifyAccount(context.Background(), run, "mesh-radarr", 62000, nil); err != nil {
t.Fatal(err)
}
got := strings.Join(ran, "\n")
if !strings.Contains(got, "usermod --home "+NoHome+" mesh-radarr") || strings.Contains(got, " -m") ||
strings.Contains(got, "--move-home") {
t.Fatalf("the home was not moved away first, without moving files:\n%s", got)
}
}
// busybox removes what the mesh made of an identity with deluser and delgroup.
func TestBusyboxRemovesAnAccountAndAGroup(t *testing.T) {
var ran []string
run := func(_ context.Context, name string, args ...string) (string, error) {
ran = append(ran, name+" "+strings.Join(args, " "))
return "", nil
}
if err := (alpine{}).RemoveAccount(context.Background(), run, "mesh-radarr"); err != nil {
t.Fatal(err)
}
if err := (alpine{}).RemoveGroup(context.Background(), run, "mesh-media"); err != nil {
t.Fatal(err)
}
if strings.Join(ran, "\n") != "deluser mesh-radarr\ndelgroup mesh-media" {
t.Fatalf("removed with: %v", ran)
}
}