| 1 | package host |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "crypto/sha256" |
| 6 | "debug/buildinfo" |
| 7 | "encoding/hex" |
| 8 | "io" |
| 9 | "os" |
| 10 | |
| 11 | "github.com/carlosframework/platform/internal/hostbox" |
| 12 | "github.com/carlosframework/platform/internal/instancectl" |
| 13 | "github.com/carlosframework/platform/internal/rootstate" |
| 14 | "github.com/carlosframework/platform/internal/safefile" |
| 15 | ) |
| 16 | |
| 17 | func (h *ClaimLaunchRoot) rootInstalledProgram(ctx context.Context, q hostbox.RoleLaunchRequest, started instancectl.ClaimUnitStarted, observed ClaimLaunchObserved) (string, error) { |
| 18 | if q.Reservation == nil || q.Spec == nil || observed.TenantPID <= 0 || observed.TenantStart == "" || observed.Running != q.Reservation.Executable || observed.Executable != observed.Running { |
| 19 | return "", os.ErrPermission |
| 20 | } |
| 21 | if err := h.ValidateExecutable(q.Reservation.Target.Host, q.Executable, q.Spec.Digest); err != nil { |
| 22 | return "", err |
| 23 | } |
| 24 | f, err := safefile.OpenFile(q.Executable, os.O_RDONLY, 0) |
| 25 | if err != nil { |
| 26 | return "", err |
| 27 | } |
| 28 | defer f.Close() |
| 29 | id, err := rootstate.Identity(f) |
| 30 | if err != nil { |
| 31 | return "", err |
| 32 | } |
| 33 | if id.Device != observed.Running.Device || id.Inode != observed.Running.Inode { |
| 34 | return "", os.ErrPermission |
| 35 | } |
| 36 | digest := sha256.New() |
| 37 | if _, err := io.Copy(digest, f); err != nil { |
| 38 | return "", err |
| 39 | } |
| 40 | if hex.EncodeToString(digest.Sum(nil)) != q.Spec.Digest { |
| 41 | return "", os.ErrPermission |
| 42 | } |
| 43 | program := "" |
| 44 | if info, err := buildinfo.Read(f); err == nil { |
| 45 | program = info.Path |
| 46 | } |
| 47 | again, err := h.Kernel.Observe(started) |
| 48 | if err != nil || again != observed { |
| 49 | return "", os.ErrPermission |
| 50 | } |
| 51 | if err := h.Units.Same(ctx, started); err != nil { |
| 52 | return "", err |
| 53 | } |
| 54 | return program, nil |
| 55 | } |
| 56 | |
amadan