55732a901d
nextPublisherSequence read and rewrote <dataRoot>/runtime-presence-sequence at mode 0600, which the next generation (a fresh DynamicUser uid in the shared state group) cannot open. Odin compares publisher_sequence only within one activation and Idunn mints a new activation per start, so PublisherSequence derives it from the observation clock, never below the previous value plus one, as Muninn does. openProviderHealthIdentity under GAMECULT_IDUNN_RUNTIME_BUNDLE now refuses when the presence descriptor is absent instead of enrolling an identity Idunn does not trust. Adds the cross-generation test (root only) and the sequence, no-dataRoot and missing-descriptor tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
81 lines
3.1 KiB
TypeScript
81 lines
3.1 KiB
TypeScript
import { execFile } from "node:child_process";
|
|
import { chmod, chown, mkdir, mkdtemp, readdir, stat } from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { promisify } from "node:util";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import { writePresenceFixtures } from "./fixtures/presence-descriptors.js";
|
|
|
|
const run = promisify(execFile);
|
|
|
|
const STATE_GID = 4242;
|
|
const GENERATION_N = 61184;
|
|
const GENERATION_N_PLUS_1 = 61185;
|
|
|
|
// Creating uids and groups needs root; the stopgap's node container runs as root.
|
|
const isRoot = process.getuid?.() === 0;
|
|
|
|
async function walk(dir: string): Promise<string[]> {
|
|
const found: string[] = [];
|
|
for (const entry of await readdir(dir, { withFileTypes: true })) {
|
|
const full = path.join(dir, entry.name);
|
|
found.push(full);
|
|
if (entry.isDirectory()) found.push(...(await walk(full)));
|
|
}
|
|
return found;
|
|
}
|
|
|
|
/**
|
|
* Idunn gives every generation a fresh DynamicUser uid and one shared group,
|
|
* UMask=0007, and a 2770 setgid state root. Generation N+1 runs beside or after
|
|
* N and must be able to read and replace everything N left there.
|
|
*/
|
|
describe.skipIf(!isRoot)("Idunn state root across generations", () => {
|
|
it("generation N+1, a different uid in the same group, reads and replaces generation N's state", async () => {
|
|
const base = await mkdtemp(path.join(os.tmpdir(), "heimdall-generations-"));
|
|
await chmod(base, 0o755);
|
|
|
|
// The fixtures stand in for what Idunn passes as descriptors.
|
|
const fixtures = path.join(base, "fixtures");
|
|
await writePresenceFixtures(fixtures);
|
|
|
|
const stateRoot = path.join(base, "state");
|
|
await mkdir(stateRoot);
|
|
await chown(stateRoot, 0, STATE_GID);
|
|
await chmod(stateRoot, 0o2770);
|
|
|
|
const child = path.join(import.meta.dirname, "fixtures", "state-root-generation-child.ts");
|
|
const generation = (role: "first" | "next", uid: number) =>
|
|
run(process.execPath, ["--import", "tsx", child, role, stateRoot, fixtures], {
|
|
uid,
|
|
gid: STATE_GID,
|
|
cwd: path.resolve(import.meta.dirname, ".."),
|
|
env: { PATH: process.env.PATH ?? "", HOME: fixtures },
|
|
});
|
|
|
|
await generation("first", GENERATION_N);
|
|
|
|
const left = await walk(stateRoot);
|
|
expect(left.map((entry) => path.relative(stateRoot, entry)).sort()).toEqual([
|
|
"cultcache",
|
|
path.join("cultcache", "heimdall.service.cc"),
|
|
"runtime-presence-sequence",
|
|
]);
|
|
|
|
await generation("next", GENERATION_N_PLUS_1);
|
|
|
|
// Generation N+1 replaced the snapshot, and no owner-only file is left
|
|
// behind for generation N+2: everything but the stale 0600 fixture is
|
|
// readable and writable by the state group.
|
|
const snapshot = await stat(path.join(stateRoot, "cultcache", "heimdall.service.cc"));
|
|
expect(snapshot.uid).toBe(GENERATION_N_PLUS_1);
|
|
expect(snapshot.gid).toBe(STATE_GID);
|
|
for (const entry of await walk(stateRoot)) {
|
|
if (path.basename(entry) === "runtime-presence-sequence") continue;
|
|
expect((await stat(entry)).mode & 0o060, path.relative(stateRoot, entry)).toBe(0o060);
|
|
}
|
|
expect((await readdir(stateRoot)).sort()).toEqual(["cultcache", "runtime-presence-sequence"]);
|
|
}, 60_000);
|
|
});
|