sashatrask
413 lines
14 KiB
Python
413 lines
14 KiB
Python
"""Durable fixed-path evidence for privileged runtime operations."""
|
|
|
|
import hashlib
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import stat
|
|
|
|
from host_agent_protocol import decode_request_payload, encode_request_payload
|
|
from runtime_security import fsync_directory, reject_reparse_components
|
|
|
|
|
|
HOST_ROOT_UID = 0
|
|
HOST_ROOT_GID = 0
|
|
HOST_RUNTIME_GID = 10001
|
|
|
|
HOST_STATE_ROOT = Path('/var/lib/truf/host-agent')
|
|
HOST_STATE_ROOT_MODE = 0o700
|
|
HOST_OPERATION_DIRECTORY = HOST_STATE_ROOT / 'operations'
|
|
HOST_OPERATION_DIRECTORY_MODE = 0o700
|
|
HOST_RESULT_DIRECTORY = HOST_STATE_ROOT / 'results'
|
|
HOST_RESULT_DIRECTORY_MODE = 0o750
|
|
HOST_FAILED_HOLD_PATH = HOST_STATE_ROOT / 'failed-hold.json'
|
|
|
|
MAX_STATE_BYTES = 16 * 1024
|
|
_PHASES = {
|
|
'prepared', 'forward_started', 'rollback_started',
|
|
'succeeded', 'failed', 'rolled_back', 'failed_hold',
|
|
}
|
|
_PUBLICATION_STATES = {'original', 'partial', 'candidate'}
|
|
_TERMINAL_RESULTS = {'succeeded', 'failed', 'rolled_back', 'failed_hold'}
|
|
_TRANSITIONS = {
|
|
'prepared': {'forward_started', 'rollback_started', 'failed'},
|
|
'forward_started': {'rollback_started', 'succeeded'},
|
|
'rollback_started': {'rolled_back', 'failed_hold'},
|
|
}
|
|
|
|
|
|
class HostStateError(RuntimeError):
|
|
def __init__(self, category, *, cancellation=None):
|
|
self.category = str(category)
|
|
self.cancellation = cancellation
|
|
super().__init__('host runtime state failed')
|
|
|
|
|
|
def _canonical(value):
|
|
try:
|
|
payload = json.dumps(
|
|
value, sort_keys=True, separators=(',', ':'), ensure_ascii=True,
|
|
allow_nan=False,
|
|
).encode('ascii')
|
|
except (TypeError, ValueError):
|
|
raise HostStateError('evidence') from None
|
|
if not payload or len(payload) > MAX_STATE_BYTES:
|
|
raise HostStateError('evidence')
|
|
return payload
|
|
|
|
|
|
def _require_directory(path, *, gid, mode):
|
|
try:
|
|
reject_reparse_components(path)
|
|
details = os.stat(path, follow_symlinks=False)
|
|
if not stat.S_ISDIR(details.st_mode):
|
|
raise OSError('not a directory')
|
|
if os.name != 'nt' and (
|
|
details.st_uid != HOST_ROOT_UID
|
|
or details.st_gid != gid
|
|
or stat.S_IMODE(details.st_mode) != mode
|
|
):
|
|
raise OSError('directory metadata')
|
|
except Exception:
|
|
raise HostStateError('filesystem') from None
|
|
|
|
|
|
def _read_file(path, *, gid, mode):
|
|
descriptor = None
|
|
try:
|
|
reject_reparse_components(Path(path).parent)
|
|
flags = os.O_RDONLY | getattr(os, 'O_CLOEXEC', 0)
|
|
if hasattr(os, 'O_BINARY'):
|
|
flags |= os.O_BINARY
|
|
if hasattr(os, 'O_NOFOLLOW'):
|
|
flags |= os.O_NOFOLLOW
|
|
descriptor = os.open(path, flags)
|
|
before = os.fstat(descriptor)
|
|
if (
|
|
not stat.S_ISREG(before.st_mode) or before.st_nlink != 1
|
|
or (
|
|
os.name != 'nt'
|
|
and (
|
|
before.st_uid != HOST_ROOT_UID or before.st_gid != gid
|
|
or stat.S_IMODE(before.st_mode) != mode
|
|
)
|
|
)
|
|
):
|
|
raise OSError('file metadata')
|
|
with os.fdopen(descriptor, 'rb') as handle:
|
|
descriptor = None
|
|
payload = handle.read(MAX_STATE_BYTES + 1)
|
|
after = os.fstat(handle.fileno())
|
|
current = os.stat(path, follow_symlinks=False)
|
|
identity = lambda item: (
|
|
item.st_dev, item.st_ino, item.st_size,
|
|
getattr(item, 'st_mtime_ns', None),
|
|
None if os.name == 'nt' else getattr(item, 'st_ctime_ns', None),
|
|
)
|
|
if (
|
|
identity(before) != identity(after)
|
|
or identity(after) != identity(current)
|
|
or len(payload) > MAX_STATE_BYTES
|
|
):
|
|
raise OSError('file changed')
|
|
return payload
|
|
except FileNotFoundError:
|
|
raise
|
|
except Exception:
|
|
raise HostStateError('filesystem') from None
|
|
finally:
|
|
if descriptor is not None:
|
|
os.close(descriptor)
|
|
|
|
|
|
def _decode_canonical(payload):
|
|
try:
|
|
value = json.loads(payload.decode('ascii'))
|
|
except (UnicodeDecodeError, json.JSONDecodeError):
|
|
raise HostStateError('evidence') from None
|
|
if not isinstance(value, dict) or _canonical(value) != payload:
|
|
raise HostStateError('evidence')
|
|
return value
|
|
|
|
|
|
def _write_stage(path, payload, *, gid, mode):
|
|
stage = Path(path).parent / f'.{Path(path).name}.stage'
|
|
descriptor = None
|
|
created = False
|
|
published = False
|
|
try:
|
|
try:
|
|
details = os.stat(stage, follow_symlinks=False)
|
|
if (
|
|
not stat.S_ISREG(details.st_mode) or details.st_nlink != 1
|
|
or (os.name != 'nt' and details.st_uid != HOST_ROOT_UID)
|
|
):
|
|
raise OSError('unsafe stage')
|
|
os.unlink(stage)
|
|
fsync_directory(stage.parent)
|
|
except FileNotFoundError:
|
|
pass
|
|
flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, 'O_CLOEXEC', 0)
|
|
if hasattr(os, 'O_BINARY'):
|
|
flags |= os.O_BINARY
|
|
if hasattr(os, 'O_NOFOLLOW'):
|
|
flags |= os.O_NOFOLLOW
|
|
descriptor = os.open(stage, flags, mode)
|
|
created = True
|
|
if os.name != 'nt':
|
|
os.fchmod(descriptor, mode)
|
|
details = os.fstat(descriptor)
|
|
if details.st_uid != HOST_ROOT_UID or details.st_gid != gid:
|
|
os.fchown(descriptor, HOST_ROOT_UID, gid)
|
|
view = memoryview(payload)
|
|
written = 0
|
|
while written < len(view):
|
|
count = os.write(descriptor, view[written:])
|
|
if count <= 0:
|
|
raise OSError('short write')
|
|
written += count
|
|
os.fsync(descriptor)
|
|
os.close(descriptor)
|
|
descriptor = None
|
|
os.replace(stage, path)
|
|
created = False
|
|
published = True
|
|
fsync_directory(Path(path).parent)
|
|
stored = _read_file(path, gid=gid, mode=mode)
|
|
if not hashlib.sha256(stored).digest() == hashlib.sha256(payload).digest():
|
|
raise HostStateError('evidence')
|
|
except HostStateError:
|
|
if published:
|
|
raise HostStateError('uncertain') from None
|
|
raise
|
|
except BaseException as error:
|
|
if published:
|
|
cancellation = error if not isinstance(error, Exception) else None
|
|
raise HostStateError(
|
|
'uncertain', cancellation=cancellation,
|
|
) from None
|
|
if not isinstance(error, Exception):
|
|
raise
|
|
raise HostStateError('filesystem') from None
|
|
finally:
|
|
if descriptor is not None:
|
|
os.close(descriptor)
|
|
if created:
|
|
try:
|
|
os.unlink(stage)
|
|
fsync_directory(stage.parent)
|
|
except OSError:
|
|
pass
|
|
|
|
|
|
def _publish_exact(path, payload, *, gid, mode):
|
|
try:
|
|
existing = _read_file(path, gid=gid, mode=mode)
|
|
except FileNotFoundError:
|
|
_write_stage(path, payload, gid=gid, mode=mode)
|
|
return payload
|
|
if existing != payload:
|
|
raise HostStateError('conflict')
|
|
return existing
|
|
|
|
|
|
def failed_hold_operation():
|
|
try:
|
|
payload = _read_file(
|
|
HOST_FAILED_HOLD_PATH, gid=HOST_ROOT_GID, mode=0o600,
|
|
)
|
|
except FileNotFoundError:
|
|
return None
|
|
value = _decode_canonical(payload)
|
|
if (
|
|
set(value) != {
|
|
'schema', 'operation_id', 'action', 'forward_category',
|
|
'publication_state', 'containment_confirmed',
|
|
}
|
|
or value.get('schema') != 1
|
|
or not isinstance(value.get('operation_id'), str)
|
|
or value.get('publication_state') not in _PUBLICATION_STATES
|
|
or type(value.get('containment_confirmed')) is not bool
|
|
or not isinstance(value.get('forward_category'), str)
|
|
):
|
|
raise HostStateError('evidence')
|
|
return value['operation_id']
|
|
|
|
|
|
class HostOperationState:
|
|
def __init__(self, request):
|
|
self.request = decode_request_payload(encode_request_payload(request))
|
|
self.operation_path = (
|
|
HOST_OPERATION_DIRECTORY / f'{self.request.operation_id}.json'
|
|
)
|
|
self.result_path = HOST_RESULT_DIRECTORY / f'{self.request.operation_id}.json'
|
|
|
|
def _phase_record(
|
|
self, phase, publication_state, *, forward_category=None,
|
|
safe_detail=None, containment_confirmed=None,
|
|
):
|
|
if (
|
|
phase not in _PHASES
|
|
or publication_state not in _PUBLICATION_STATES
|
|
or forward_category is not None
|
|
and not isinstance(forward_category, str)
|
|
or safe_detail is not None
|
|
and not isinstance(safe_detail, str)
|
|
or containment_confirmed is not None
|
|
and type(containment_confirmed) is not bool
|
|
):
|
|
raise HostStateError('evidence')
|
|
return {
|
|
'schema': 1,
|
|
'operation_id': self.request.operation_id,
|
|
'action': self.request.action.value,
|
|
'active_config_sha256': self.request.active_config_sha256,
|
|
'active_secrets_sha256': self.request.active_secrets_sha256,
|
|
'candidate_config_sha256': self.request.candidate_config_sha256,
|
|
'candidate_secrets_sha256': self.request.candidate_secrets_sha256,
|
|
'phase': phase,
|
|
'publication_state': publication_state,
|
|
'forward_category': forward_category,
|
|
'safe_detail': safe_detail,
|
|
'containment_confirmed': containment_confirmed,
|
|
}
|
|
|
|
def _read_phase(self):
|
|
payload = _read_file(self.operation_path, gid=HOST_ROOT_GID, mode=0o600)
|
|
value = _decode_canonical(payload)
|
|
if set(value) != set(self._phase_record('prepared', 'original')):
|
|
raise HostStateError('evidence')
|
|
expected = self._phase_record(
|
|
value.get('phase'), value.get('publication_state'),
|
|
forward_category=value.get('forward_category'),
|
|
safe_detail=value.get('safe_detail'),
|
|
containment_confirmed=value.get('containment_confirmed'),
|
|
)
|
|
if value != expected:
|
|
raise HostStateError('evidence')
|
|
return value
|
|
|
|
def initialize(self, publication_state='original'):
|
|
_require_directory(
|
|
HOST_STATE_ROOT, gid=HOST_ROOT_GID, mode=HOST_STATE_ROOT_MODE,
|
|
)
|
|
_require_directory(
|
|
HOST_OPERATION_DIRECTORY,
|
|
gid=HOST_ROOT_GID,
|
|
mode=HOST_OPERATION_DIRECTORY_MODE,
|
|
)
|
|
hold = failed_hold_operation()
|
|
if hold is not None and hold != self.request.operation_id:
|
|
raise HostStateError('failed_hold')
|
|
try:
|
|
return self._read_phase()
|
|
except FileNotFoundError:
|
|
value = self._phase_record('prepared', publication_state)
|
|
_write_stage(
|
|
self.operation_path, _canonical(value),
|
|
gid=HOST_ROOT_GID, mode=0o600,
|
|
)
|
|
return value
|
|
|
|
def advance(
|
|
self, expected_phase, next_phase, publication_state, *,
|
|
forward_category=None, safe_detail=None, containment_confirmed=None,
|
|
):
|
|
current = self._read_phase()
|
|
value = self._phase_record(
|
|
next_phase, publication_state,
|
|
forward_category=forward_category,
|
|
safe_detail=safe_detail,
|
|
containment_confirmed=containment_confirmed,
|
|
)
|
|
if current == value:
|
|
return value
|
|
if (
|
|
current['phase'] != expected_phase
|
|
or next_phase not in _TRANSITIONS.get(expected_phase, set())
|
|
):
|
|
raise HostStateError('state')
|
|
_write_stage(
|
|
self.operation_path, _canonical(value),
|
|
gid=HOST_ROOT_GID, mode=0o600,
|
|
)
|
|
return value
|
|
|
|
def terminal_result(self):
|
|
try:
|
|
payload = _read_file(
|
|
self.result_path, gid=HOST_RUNTIME_GID, mode=0o640,
|
|
)
|
|
except FileNotFoundError:
|
|
return None
|
|
value = _decode_canonical(payload)
|
|
if (
|
|
set(value) != {
|
|
'schema', 'operation_id', 'action', 'result', 'safe_category',
|
|
'safe_detail', 'resulting_identity',
|
|
}
|
|
or value.get('schema') != 1
|
|
or value.get('operation_id') != self.request.operation_id
|
|
or value.get('action') != self.request.action.value
|
|
or value.get('result') not in _TERMINAL_RESULTS
|
|
):
|
|
raise HostStateError('evidence')
|
|
return value
|
|
|
|
def publish_result(
|
|
self, result, *, safe_category, safe_detail, resulting_identity,
|
|
):
|
|
if result not in _TERMINAL_RESULTS:
|
|
raise HostStateError('evidence')
|
|
if result == 'succeeded':
|
|
if safe_category is not None or safe_detail is not None:
|
|
raise HostStateError('evidence')
|
|
elif not isinstance(safe_category, str) or not isinstance(safe_detail, str):
|
|
raise HostStateError('evidence')
|
|
if resulting_identity is not None and (
|
|
not isinstance(resulting_identity, dict)
|
|
or set(resulting_identity) != {
|
|
'active_config_sha256', 'active_secrets_sha256',
|
|
}
|
|
or any(
|
|
not isinstance(value, str) or len(value) != 64
|
|
for value in resulting_identity.values()
|
|
)
|
|
):
|
|
raise HostStateError('evidence')
|
|
value = {
|
|
'schema': 1,
|
|
'operation_id': self.request.operation_id,
|
|
'action': self.request.action.value,
|
|
'result': result,
|
|
'safe_category': safe_category,
|
|
'safe_detail': safe_detail,
|
|
'resulting_identity': resulting_identity,
|
|
}
|
|
_require_directory(
|
|
HOST_RESULT_DIRECTORY,
|
|
gid=HOST_RUNTIME_GID,
|
|
mode=HOST_RESULT_DIRECTORY_MODE,
|
|
)
|
|
_publish_exact(
|
|
self.result_path, _canonical(value), gid=HOST_RUNTIME_GID, mode=0o640,
|
|
)
|
|
return value
|
|
|
|
def publish_failed_hold(
|
|
self, *, forward_category, publication_state, containment_confirmed,
|
|
):
|
|
marker = {
|
|
'schema': 1,
|
|
'operation_id': self.request.operation_id,
|
|
'action': self.request.action.value,
|
|
'forward_category': str(forward_category),
|
|
'publication_state': publication_state,
|
|
'containment_confirmed': bool(containment_confirmed),
|
|
}
|
|
_publish_exact(
|
|
HOST_FAILED_HOLD_PATH, _canonical(marker),
|
|
gid=HOST_ROOT_GID, mode=0o600,
|
|
)
|
|
return marker
|