#!/bin/sh # Eugene Plexus — one-command install for Linux and macOS. # # curl -fsSL https://raw.githubusercontent.com/eugene-plexus/specs/main/scripts/install.sh | sh # # With options (sh cannot take arguments from a pipe without -s): # # curl -fsSL .../install.sh | sh -s -- --user # curl -fsSL .../install.sh | sh -s -- --uninstall # # **On Linux, Eugene runs under its own account by default** (2026-09-24). # The install's signing key sits in a file on disk, and anything running # as the account the agent runs as -- an AI agent you started, say -- can # read that file, the agent's environment and its memory. No file # permission stops a program running as the same account; a different # account does. So the default is a system service running as # `eugene-plexus`, in /var/lib/eugene-plexus, and this script asks for # sudo once to set that up. `--user` keeps the old layout: everything # under your home, running as you, no sudo -- and anything you run can # control Eugene. # # **On macOS too, since row 8 (2026-10-21).** Eugene runs as a # LaunchDaemon in its own hidden account, `_eugeneplexus`, in # /usr/local/eugene-plexus: it starts at boot, before anyone signs in, and # a program the person runs cannot read its keys. A Mac that already runs # Eugene as a LaunchAgent (the old per-user layout) moves to the daemon on # a plain re-run: its identity, settings, port and Library come along, and # if anything fails the LaunchAgent is put back as it was. `--user` keeps # the LaunchAgent. # # What it does, in the order it does it, so that reading this comment is # a substitute for reading the script (install-paths §11: `curl | sh` # has to stay auditable): # # 0. (default) creates Eugene's own account (`eugene-plexus` on Linux, # `_eugeneplexus` on a Mac) and its prefix, with sudo; the steps # below then run AS that account, so no package's build step ever # runs as root, # 1. fetches `uv` into the install prefix and nowhere else -- and fetches # it again over one older than UV_MINIMUM, # 2. makes a virtualenv there with a Python `uv` downloads itself, # 3. installs the eight Eugene Plexus packages into it, # 4. checks that what landed can actually serve — see VERIFY below, # 5. writes a systemd unit (Linux: a system unit, or a user unit with # --user) or a launchd job (macOS: a LaunchDaemon, or a LaunchAgent # with --user), # 6. starts it and waits for the agent to answer. # # It touches nothing outside `$PREFIX` except the service file, the # account, and (by default) a `Eugene Models` folder in your home, and # `--uninstall` removes the first three. Only the default layout needs # root. # # WHERE THE PACKAGES COME FROM. GitHub source archives at pinned # commits — the same mechanism `SPECS_REF` has used in every consumer # since M0, which needs no package registry and no release. Nothing is # published to PyPI yet, deliberately: the release comes after tool # calling. At release time the PINS block below becomes one line, # `eugene-plexus`, and the rest of this script is unchanged. # # THE UI IS PINNED TO A `dist` BRANCH, AND THAT IS NOT AN OVERSIGHT. # `eugene-plexus-ui` is a wheel wrapping a Next.js static export, and # that export is `next build` output, gitignored on `main`. Installing # from a `main` archive therefore *succeeds* and produces a package with # no UI inside it — verified 2026-09-11, `static_dir()` was not even a # directory. The `dist` branch carries the built export so that all eight # packages install by one mechanism. See install-paths §12, step 3. set -eu # --- pins ------------------------------------------------------------- # Generated from release/manifest.json by scripts/release-inputs.py. PIN_AGENT=e00c4ecabe1fd78232d5b510a0b7328af304bf73 PIN_CONTROL=c25e467304e5daaa4d7213ab74b94478fde35f24 PIN_GATEWAY=02b30ac0a699dbe7e8e6c65902666a0de1275132 PIN_DRIVER=7fb4c875ef86ae65b601249818212b2934d8b506 PIN_LIBRARY=1b015632de2dddde6139719916b77128a9019869 PIN_STORE=92d59cb4f703c9564b0f41203d2d36f95feb9460 PIN_TOOL_DRIVER=a9c8b03439b60d2ba24275bf9f17da02c245190e PIN_UI=fd7149b2df87ed70b8834b0b701c11a6d351c17e # branch `dist`, not `main` # The job-site host (Linux system installs only; root installs and runs it, # see "a job site on a Linux system install" below). Not in the generated # block above: it is not one of the eight packages in the agent's prefix. It # must equal SITE_HOST_COMMIT in agent/src/eugene_plexus_agent/site_host.py, # and it moves at landing, with the agent's pin. PIN_SITE_HOST=a7442935379284401c170cbd257bf3ccdc56f134 PY_VERSION=3.12 # **The oldest uv this installer keeps** (2026-10-03). An install keeps the # uv it was first made with until something replaces it, and the app's own # updates re-run this script, so this is where an old one is replaced # (step 1). 0.12.18 fixes GHSA-2cv4-cqwr-gwf7, a path traversal while # unpacking a wheel in uv 0.12.7 to 0.12.17. That defect is Windows-only; # the number is kept equal to install.ps1's $UvMinimum so that both # installers promise the same uv. UV_MINIMUM=0.12.18 SERVICE_LABEL=eugene-plexus-agent LAUNCHD_LABEL=com.eugeneplexus.agent # The Mac's system job (row 8), root:wheel 0644, and the root-owned folder # beside it that keeps what removal needs to know: whether this installer # made Eugene's account, the firewall entry it added, the removal app, and # the removal script itself -- never inside the prefix, which Eugene's own # account can write. LAUNCHD_DAEMON=/Library/LaunchDaemons/$LAUNCHD_LABEL.plist MAC_RECEIPTS=/usr/local/lib/eugene-plexus SYSTEM_ACCOUNT=eugene-plexus SYSTEM_PREFIX=/var/lib/eugene-plexus USER_PREFIX=$HOME/.local/share/eugene-plexus PREFIX=${EUGENE_PLEXUS_HOME:-} USER_MODE=0 DO_SERVICE=1 DO_UNINSTALL=0 DO_START=1 JOIN_CONTROL= JOIN_TOKEN= JOIN_NAME= JOIN_LABEL= JOIN_ADVERTISE= JOIN_SITE=0 JOIN_OWNER= JOIN_ROOT_KEY= SITE_ACTION= SITE_PERSON= SITE_LINK_ACCOUNT= SITE_PASSKEY= SITE_COMMANDS= PASSWORD_STDIN=0 TTY_SAVED= JOINED=0 DO_PURGE_COPIES=0 DO_PURGE_DATA=0 DO_INTERACTIVE=0 ADVERTISED=0 UPDATE=0 while [ $# -gt 0 ]; do case "$1" in --prefix) PREFIX=$2; shift 2 ;; --prefix=*) PREFIX=${1#--prefix=}; shift ;; --user) USER_MODE=1; shift ;; --no-service) DO_SERVICE=0; shift ;; --no-start) DO_START=0; shift ;; --uninstall) DO_UNINSTALL=1; shift ;; --purge-data) DO_PURGE_DATA=1; shift ;; --interactive) DO_INTERACTIVE=1; shift ;; --purge-downloads|--purge-model-copies) DO_PURGE_COPIES=1; shift ;; --join) JOIN_CONTROL=$2; shift 2 ;; --token) JOIN_TOKEN=$2; shift 2 ;; --name) JOIN_NAME=$2; shift 2 ;; --label) [ $# -ge 2 ] || { echo "install.sh: --label needs the name to show, in quotes if it has spaces" >&2; exit 2; } JOIN_LABEL=$2; shift 2 ;; --label=*) JOIN_LABEL=${1#--label=}; shift ;; --advertise) JOIN_ADVERTISE=$2; shift 2 ;; --job-site) JOIN_SITE=1; shift ;; --owner) JOIN_OWNER=$2; shift 2 ;; --root-key) JOIN_ROOT_KEY=$2; shift 2 ;; --site-account|--account) SITE_LINK_ACCOUNT=$2; shift 2 ;; --site-link) SITE_ACTION=link; shift ;; --site-unlink) SITE_ACTION=unlink; shift ;; --site-pair) SITE_ACTION=pair; shift ;; --site-passkeys) SITE_ACTION=passkeys; shift ;; --site-unpair) SITE_ACTION=unpair; SITE_PASSKEY=$2; shift 2 ;; --site-commands) SITE_COMMANDS=yes; shift ;; --site-no-commands) SITE_COMMANDS=no; shift ;; --person) SITE_PERSON=$2; shift 2 ;; --password-stdin) PASSWORD_STDIN=1; shift ;; --update) UPDATE=1; shift ;; -h|--help) sed -n '2,66p' "$0" 2>/dev/null || true echo "options: --user --prefix DIR --no-service --no-start --uninstall" echo " --user (install under your own account, no sudo; anything you run" echo " can then control Eugene. On a Mac it starts when you sign in)" echo " --purge-downloads (with --uninstall: delete this install's model" echo " copies and engine builds)" echo " --purge-data (Mac/user install: delete settings, app data and logs)" echo " --interactive (Mac: show the removal choices)" echo " worker node: --join URL --token JWT [--name NAME] [--label \"SHOWN AS\"] [--advertise URL]" echo " job site (on a node): --join URL --token TOKEN --job-site --owner NAME [--root-key KEY] [--name NAME] [--label \"SHOWN AS\"]" echo " [--site-account USER] [--password-stdin]" echo " link a person to their account on a job site (Linux system install, as root):" echo " --site-link --person NAME [--site-account USER] [--password-stdin]" echo " --site-unlink --person NAME" echo " the owner's passkey from Workbench (Linux system install, as root):" echo " --site-pair (shows a code to type into Workbench, and waits)" echo " --site-passkeys --site-unpair ID" echo " commands from Workbench on a job site (Linux system install, as root; J9):" echo " --site-commands (allow them) --site-no-commands (take it back)" echo " also answers the join's question ahead, with --job-site" echo " standalone: --advertise URL (the address other devices reach this one at)" exit 0 ;; *) echo "install.sh: unknown option $1" >&2; exit 2 ;; esac done if [ "$DO_UNINSTALL" != 1 ] && { [ "$DO_PURGE_COPIES" = 1 ] || [ "$DO_PURGE_DATA" = 1 ] || [ "$DO_INTERACTIVE" = 1 ]; }; then echo 'Removal options require --uninstall. Nothing was installed or removed.' >&2 exit 2 fi say() { printf '\033[1m==>\033[0m %s\n' "$*"; } warn() { printf '\033[33mwarning:\033[0m %s\n' "$*" >&2; } die() { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; } # **--label names this machine when it joins** (row 8): the agent's # `join --label`, or a job site's `site join --label`. Nothing else reads # it, so without --join it would be dropped without a word. if [ -n "$JOIN_LABEL" ] && [ -z "$JOIN_CONTROL" ]; then printf '\033[31merror:\033[0m %s\n' "--label names this machine when it joins an install. The first machine's name is asked on its setup page." >&2 exit 2 fi # **Every network step said nothing about why it failed** (review §6.2 # #24). `uv venv` and `uv pip install` both ran under `>/dev/null 2>&1`, # so a TLS-intercepting corporate proxy -- the commonest reason either # fails on a machine that is otherwise fine -- read as *could not create # a virtualenv*, which sends a person to look at a directory. The output # still does not scroll past on a good install: it goes to a file, and # only a failure prints it. STEP_LOG= run_step() { _what=$1; shift if [ -z "$STEP_LOG" ]; then # On a system install the prefix belongs to Eugene's account and # this shell cannot write into it, so the log starts in /tmp and # stays there -- the path is printed on failure either way. if [ "$MODE" = system ]; then STEP_LOG=$(mktemp "${TMPDIR:-/tmp}/eugene-plexus-install.XXXXXX") else STEP_LOG=$PREFIX/logs/install.log mkdir -p "$PREFIX/logs" : > "$STEP_LOG" fi fi printf '\n### %s\n' "$_what" >> "$STEP_LOG" if "$@" >> "$STEP_LOG" 2>&1; then return 0 else # An if with no branch taken returns zero. Capture the command's # failure here, before fi can turn an incomplete install into success. _rc=$? fi printf '\033[31merror:\033[0m %s\n' "$_what" >&2 printf 'The command that failed:\n %s\n' "$*" >&2 printf 'What it said (full log: %s):\n' "$STEP_LOG" >&2 tail -n 20 "$STEP_LOG" | sed 's/^/ /' >&2 exit "$_rc" } # --- platform --------------------------------------------------------- OS=$(uname -s) ARCH=$(uname -m) case "$OS" in Linux) PLATFORM=linux ;; Darwin) PLATFORM=macos ;; *) die "unsupported operating system: $OS (this installer covers Linux and macOS; Windows uses install.ps1)" ;; esac case "$ARCH" in x86_64|amd64|aarch64|arm64) : ;; *) die "unsupported architecture: $ARCH (uv publishes x86_64 and arm64 builds)" ;; esac # uname describes the calling process under Rosetta. Ask the hardware too, # then qualify uv's request so an Intel uv (or cached Python) cannot choose # an Intel interpreter for an Apple Silicon install. PY_REQUEST=$PY_VERSION NATIVE_APPLE=0 if [ "$PLATFORM" = macos ]; then case "$ARCH" in arm64|aarch64) NATIVE_APPLE=1 ;; *) [ "$(sysctl -n hw.optional.arm64 2>/dev/null || true)" != 1 ] || NATIVE_APPLE=1 ;; esac if [ "$NATIVE_APPLE" = 1 ]; then PY_REQUEST=cpython-$PY_VERSION-macos-aarch64-none say "Apple Silicon detected; selecting native arm64 Python (also from a Rosetta terminal)" fi # Eugene's own account on a Mac: a hidden one, named as macOS names # its own service accounts. The prefix has no space in it: a space in # the virtualenv's path breaks every script's #! line. SYSTEM_ACCOUNT=_eugeneplexus SYSTEM_PREFIX=/usr/local/eugene-plexus fi # --- which layout ----------------------------------------------------- # **system**: with a service, the default on Linux and, since row 8, on # macOS. The agent runs as its own account, so a program running as the # person cannot read its key, its environment or its memory. It reaches # the person's model folders through their group (Troy's call, # 2026-09-24): the unit adds the person's primary group, which is what a # 0750 home lets in -- on a Mac that group is `staff`, and the account # joins it. It has no desktop session and so no keyring, so it unlocks # from a passphrase file only it can read (`securityMode: # passphrase_file`; on a Mac, Troy's call MAC-KEY, 2026-10-21). # # **user**: `--user`, and `--no-service` (nothing to run under an account # -- the container build and anyone starting the agent by hand). if [ "$USER_MODE" = 1 ] || [ "$DO_SERVICE" = 0 ]; then MODE=user else MODE=system fi PREFIX_GIVEN=0 [ -z "$PREFIX" ] || PREFIX_GIVEN=1 # The person this install is for: whoever ran it, or whoever ran sudo. # Nobody, when a root shell runs it directly -- then there is no group to # join and no home to offer a models folder in. if [ "$(id -u)" = 0 ]; then PERSON=${SUDO_USER:-}; else PERSON=$(id -un); fi [ "$PERSON" != root ] || PERSON= PERSON_HOME= PERSON_GROUP= PERSON_UID= if [ -n "$PERSON" ]; then if [ "$PLATFORM" = macos ]; then # No getent on a Mac; the directory service knows the home. PERSON_HOME=$(dscl . -read "/Users/$PERSON" NFSHomeDirectory 2>/dev/null \ | sed -n 's/^NFSHomeDirectory: //p' | head -n 1 || true) else PERSON_HOME=$(getent passwd "$PERSON" 2>/dev/null | cut -d: -f6 || true) fi [ -n "$PERSON_HOME" ] || PERSON_HOME=$HOME PERSON_GROUP=$(id -gn "$PERSON") PERSON_UID=$(id -u "$PERSON") fi # The person's own Mac install, the LaunchAgent layout this row moves from. PERSON_LAUNCH_AGENT= [ -z "$PERSON_HOME" ] || PERSON_LAUNCH_AGENT=$PERSON_HOME/Library/LaunchAgents/$LAUNCHD_LABEL.plist # **On a Mac, what is installed decides an update, a removal and a job # site**, not what the default is now: an update never moves an install # (`--update` keeps the LaunchAgent it finds), removal removes the install # that is there, and a job site joins beside the per-user install it was # built for. Only when no daemon is here and the person's LaunchAgent is. if [ "$PLATFORM" = macos ] && [ "$MODE" = system ] && [ "$PREFIX_GIVEN" = 0 ] \ && [ -z "${EUGENE_PLEXUS_HOME:-}" ] \ && { [ "$UPDATE" = 1 ] || [ "$DO_UNINSTALL" = 1 ] || [ "$JOIN_SITE" = 1 ]; } \ && [ ! -f "$LAUNCHD_DAEMON" ] && [ -n "$PERSON_LAUNCH_AGENT" ] && [ -f "$PERSON_LAUNCH_AGENT" ]; then MODE=user fi if [ -z "$PREFIX" ]; then if [ "$MODE" = system ]; then PREFIX=$SYSTEM_PREFIX; else PREFIX=$USER_PREFIX; fi fi VENV=$PREFIX/venv PYBIN=$VENV/bin/python UV=$PREFIX/bin/uv CONFIG=$PREFIX/agent.yaml # Run as root: directly when this is root, through sudo when not. as_root() { if [ "$(id -u)" = 0 ]; then "$@"; else sudo "$@"; fi } # Run as Eugene's account. sudo and runuser both start from a clean # environment, so the variables the steps below depend on are handed over # by name -- including a proxy, since uv and pip go to the network and a # TLS-intercepting proxy is the commonest reason they fail (review §6.2 # #24). `${VAR:+"VAR=$VAR"}` expands to nothing at all when VAR is unset. as_service() { set -- env HOME="$PREFIX" \ UV_PYTHON_INSTALL_DIR="$PREFIX/pythons" UV_CACHE_DIR="$PREFIX/.cache/uv" \ ${HTTPS_PROXY:+"HTTPS_PROXY=$HTTPS_PROXY"} ${https_proxy:+"https_proxy=$https_proxy"} \ ${HTTP_PROXY:+"HTTP_PROXY=$HTTP_PROXY"} ${http_proxy:+"http_proxy=$http_proxy"} \ ${NO_PROXY:+"NO_PROXY=$NO_PROXY"} ${no_proxy:+"no_proxy=$no_proxy"} \ ${SSL_CERT_FILE:+"SSL_CERT_FILE=$SSL_CERT_FILE"} "$@" # **From `/`, not from wherever this was started** (found 2026-09-26). # Eugene's account cannot read the directory a person runs this from # when it is root's home or a 0700 one (Fedora's default), and uv reads # `uv.toml` from the working directory upwards: "failed to open file # `/root/uv.toml`: Permission denied", and the install stopped there. if [ "$(id -u)" = 0 ] && command -v runuser >/dev/null 2>&1; then (cd / && runuser -u "$SYSTEM_ACCOUNT" -- "$@") else (cd / && sudo -u "$SYSTEM_ACCOUNT" -- "$@") fi } # Anything that reads or writes under the prefix: as Eugene's account on # a system install, whose prefix this shell cannot even look into, and # as this shell otherwise. in_prefix() { if [ "$MODE" = system ]; then as_service "$@"; else "$@"; fi } # As the person this install is for: this shell, or them when sudo started # it as root, so what is made in their home stays theirs. as_person() { if [ "$(id -u)" = 0 ] && [ -n "$PERSON" ]; then sudo -u "$PERSON" -- "$@"; else "$@"; fi } # The version the prefix's uv says it is -- its words are # `uv 0.12.22 (x86_64-unknown-linux-gnu)` -- as three numbers, or nothing # for a uv that is not there or cannot say what it is. uv_version() { in_prefix "$UV" --version 2>/dev/null | sed -n 's/^uv \([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/p' | head -n 1 } # version_older A B: true when dotted version A comes before B. Number by # number, because as text 0.12.9 sorts after 0.12.18, and 0.9.30 after # 0.12.18 -- both older, both read as newer by a comparison of strings. version_older() { awk -v a="$1" -v b="$2" 'BEGIN { n = split(a, x, "."); m = split(b, y, ".") if (m > n) n = m for (i = 1; i <= n; i++) { if (x[i] + 0 < y[i] + 0) exit 0 if (x[i] + 0 > y[i] + 0) exit 1 } exit 1 }' } # --- --update --------------------------------------------------------- # **How the app updates an install** (2026-09-27). The agent asks for it # -- a system install through the root unit below, a per-user one through # a transient user unit -- and this run replaces the packages with the # ones this script pins and restarts Eugene. Everything else about the # install stays exactly as it was written: its unit, its models folder, # who it runs as. Refused for anything that is not already an install, so # an update can never be the thing that makes a second one. if [ "$UPDATE" = 1 ]; then if [ -n "$JOIN_CONTROL" ] || [ "$DO_UNINSTALL" = 1 ]; then die "--update upgrades the install at $PREFIX; it cannot be combined with --join or --uninstall" fi if ! in_prefix test -x "$PYBIN" || ! in_prefix test -f "$CONFIG"; then die "--update found no install at $PREFIX to update" fi fi # --- the root unit a system install updates through --------------------- # **Root never runs anything from the prefix**: Eugene's account owns it, # so it could put code there and have root run it. The agent writes one # thing, a request naming a specs commit or a release tag. This root-owned # helper, outside the prefix, reads that request AS the account, checks # its shape, downloads our installer for it into a folder only root can # write, checks it against the release's checksums when there are any, # runs it, and hands the account a record to copy back -- so nothing it # writes lands through a path the account could have pointed elsewhere. UPDATE_HELPER=/usr/local/lib/eugene-plexus/update UPDATE_STAGE=/var/lib/eugene-plexus-update UPDATE_SERVICE=/etc/systemd/system/eugene-plexus-update.service UPDATE_PATH=/etc/systemd/system/eugene-plexus-update.path write_update_helper() { as_root install -d -m 0755 "$(dirname "$UPDATE_HELPER")" as_root install -d -m 0711 "$UPDATE_STAGE" in_prefix mkdir -p "$PREFIX/update" { printf '#!/bin/sh\n' printf "PREFIX='%s'\n" "$PREFIX" printf "ACCOUNT='%s'\n" "$SYSTEM_ACCOUNT" printf "STAGE='%s'\n" "$UPDATE_STAGE" cat <<'HELPER' # Installed by Eugene Plexus's install.sh; see "the root unit a system # install updates through" there. Run as root by eugene-plexus-update.service. set -u # systemd gives a unit with no User= no HOME, and the installer reads it. HOME=$(getent passwd root | cut -d: -f6) export HOME=${HOME:-/root} DIR=$PREFIX/update REPO=https://github.com/eugene-plexus/specs RAW=https://raw.githubusercontent.com/eugene-plexus/specs as_account() { (cd / && runuser -u "$ACCOUNT" -- "$@"); } # Read and remove the request as Eugene's account: a path it controls # could point anywhere root can read. LINE=$(as_account head -c 200 "$DIR/request" 2>/dev/null | head -n 1) as_account rm -f "$DIR/request" [ -n "$LINE" ] || exit 0 REF=${LINE%% *} STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ) WORK=$(mktemp -d "$STAGE/run.XXXXXX") || exit 1 chmod 0711 "$WORK" trap 'rm -rf "$WORK"' EXIT LOG=$WORK/update.log : >"$LOG" esc() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g' | tr -d '\000-\037'; } finish() { { printf '{"target":"%s","startedAt":"%s",' "$(esc "$REF")" "$STARTED" printf '"finishedAt":"%s","outcome":"%s",' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" printf '"detail":"%s","log":"%s"}' "$(esc "$2")" "$DIR/update.log" } >"$WORK/last.json" chmod 0644 "$WORK/last.json" "$LOG" # Copied in by the account, never written by root through its paths. as_account cp -f "$LOG" "$DIR/update.log" as_account cp -f "$WORK/last.json" "$DIR/last.json.tmp" \ && as_account mv -f "$DIR/last.json.tmp" "$DIR/last.json" as_account rm -f "$DIR/running.json" } if printf '%s' "$REF" | grep -Eq '^[0-9a-f]{40}$'; then URL=$RAW/$REF/scripts/install.sh SUMS= elif printf '%s' "$REF" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$'; then URL=$REPO/releases/download/$REF/install.sh SUMS=$REPO/releases/download/$REF/SHA256SUMS else # Never echoed back: it came from a file root does not own. REF=unrecognised finish failed "The update request did not name a specs commit or a release tag, so nothing was installed." exit 1 fi if ! curl -fsSL "$URL" -o "$WORK/install.sh" 2>>"$LOG"; then finish failed "Could not download $URL." exit 1 fi if [ -n "$SUMS" ]; then if ! curl -fsSL "$SUMS" -o "$WORK/SHA256SUMS" 2>>"$LOG" \ || ! (cd "$WORK" && grep ' install.sh$' SHA256SUMS | sha256sum -c - >>"$LOG" 2>&1); then finish failed "The installer for $REF did not match the checksum its release published, so it was not run." exit 1 fi fi sh "$WORK/install.sh" --update >>"$LOG" 2>&1 CODE=$? if [ "$CODE" = 0 ]; then finish succeeded "Installed $REF." else # Whatever the installer left behind, bring the agent back. systemctl start eugene-plexus-agent >/dev/null 2>&1 || true finish failed "The installer exited with $CODE. Its last lines: $(tail -n 12 "$LOG" | tr '\n' '|')" fi HELPER } | as_root tee "$UPDATE_HELPER.new" >/dev/null as_root chown root:root "$UPDATE_HELPER.new" as_root chmod 0755 "$UPDATE_HELPER.new" # Renamed into place, never rewritten: an update runs this function # from inside the helper it replaces, and sh reads a script as it goes, # so truncating the running file would hand it the new text mid-line. as_root mv -f "$UPDATE_HELPER.new" "$UPDATE_HELPER" as_root tee "$UPDATE_SERVICE" >/dev/null </dev/null </dev/null 2>&1 \ || warn "could not enable eugene-plexus-update.path, so this install cannot update itself from the app" } # --- apps in accounts of their own (C1) ------------------------------- # An app the agent installs runs as a systemd dynamic user, never as # eugene-plexus: in that account it could read node.yaml, agent.yaml, the # passphrase file and every other app's key (measured on a runner, # docs/design/workbench.md §1). The template unit below runs one app per # instance in a namespace where this prefix is an empty, read-only tmpfs # with only the app interpreters, the launcher and the app's own folder # bound back in; its key and admin token arrive as credentials, which # systemd reads as root, so they stay 0600 to eugene-plexus on disk. # # The agent cannot start a system unit itself: it is unprivileged and its # unit sets NoNewPrivileges, which rules out sudo. It writes a request into # $PREFIX/apps/ctl and this root helper, triggered by a path unit, carries # it out -- the shape the in-app updater uses. The helper reads and writes # that folder only as eugene-plexus, and takes nothing but start, stop, # restart or clean, of an eugene-plexus-app@ unit, for an id the registry # could have issued. APPS_HELPER=/usr/local/lib/eugene-plexus/apps-ctl APPS_TEMPLATE=/etc/systemd/system/eugene-plexus-app@.service APPS_CTL_SERVICE=/etc/systemd/system/eugene-plexus-apps-ctl.service APPS_CTL_PATH=/etc/systemd/system/eugene-plexus-apps-ctl.path write_app_units() { if ! command -v setfacl >/dev/null 2>&1; then if command -v apt-get >/dev/null 2>&1; then as_root apt-get install -y acl elif command -v dnf >/dev/null 2>&1; then as_root dnf install -y acl elif command -v yum >/dev/null 2>&1; then as_root yum install -y acl elif command -v zypper >/dev/null 2>&1; then as_root zypper --non-interactive install acl elif command -v pacman >/dev/null 2>&1; then as_root pacman -S --needed --noconfirm acl else warn "Folder access needs the acl package; this package manager is not supported." fi || warn "Could not install acl. Folder access needs the acl package; the update will continue." fi as_root install -d -m 0755 "$(dirname "$APPS_HELPER")" # ROW23_FOLDER_HELPER: installed root-owned, never loaded from the agent's prefix. as_root tee "$(dirname "$APPS_HELPER")/folder-access.py" >/dev/null <<'FOLDER_HELPER' """Root-owned Linux folder broker. Installed verbatim by write_app_units(). No imports from the agent or files it owns. All filesystem changes use held file descriptors. The command line accepts identifiers, never paths or ACLs. """ import contextlib import ctypes import hashlib import json import os import re import stat import struct import subprocess import sys from pathlib import Path SYSTEM = tuple( "/" + n for n in "bin boot dev etc lib lib32 lib64 libx32 opt proc root run sbin snap sys tmp usr var".split() ) def run(*args, **kwargs): try: result = subprocess.run( args, capture_output=True, text=True, check=False, **kwargs ) except FileNotFoundError: if args[0] in ("getfacl", "setfacl"): raise ValueError( "The acl package is missing. Folder access needs getfacl and setfacl." ) from None raise if result.returncode: raise ValueError( result.stderr.strip() or result.stdout.strip() or f"{args[0]} failed ({result.returncode})" ) return result.stdout def identity(fd): data = ctypes.create_string_buffer(256) libc = ctypes.CDLL(None, use_errno=True) if ( libc.statx(fd, b"", 0x1000, 0x800, data) or struct.unpack_from("=I", data)[0] & 0x800 != 0x800 ): raise ValueError( "The kernel or filesystem does not expose folder creation time." ) info = os.fstat(fd) seconds, nanos = struct.unpack_from("=qI", data, 80) return [ info.st_ino, seconds, nanos, ] def same_identity(observed, expected): return observed == (expected[1:4] if len(expected) == 5 else expected) def mount_id(fd): # Mount IDs belong to this operation's namespace, never the saved identity. for line in Path(f"/proc/self/fdinfo/{fd}").read_text().splitlines(): if line.startswith("mnt_id:"): return int(line.split()[1]) raise ValueError("The kernel does not expose this item's mount id.") def acl(fd): text = run("getfacl", "-cpnE", "--", f"/proc/self/fd/{fd}", pass_fds=(fd,)) return parse_acl(text) def parse_acl(text): return dict( (line.rsplit(":", 1)[0], line.rsplit(":", 1)[1].split()[0]) for line in text.splitlines() if line and not line.startswith("#") ) def acls(fds): text = run( "getfacl", "-cpnE", "--", *("/proc/self/fd/" + str(fd) for fd in fds), pass_fds=tuple(fds), ) blocks = text.strip().split("\n\n") if len(blocks) != len(fds): raise ValueError("getfacl returned an incomplete folder permission plan.") return [parse_acl(block) for block in blocks] def bits(value): return sum(bit for letter, bit in (("r", 4), ("w", 2), ("x", 1)) if letter in value) def words(value): return "".join( letter if value & bit else "-" for letter, bit in (("r", 4), ("w", 2), ("x", 1)) ) def plan(before, group, write, directory): """Preserve every existing entry; widening a masked entry is refused.""" after = before.copy() for prefix in ("", "default:") if directory else ("",): mask = bits(before.get(prefix + "mask:", "rwx")) desired = 6 if write else 4 if directory or any( bits(rights) & (mask if key.startswith(("group:", "user:")) and key != "user:" else 7) & 1 for key, rights in before.items() if not key.startswith("default:") and key != "mask:" ): desired |= 1 new_mask = ( mask | desired if prefix + "mask:" in before else desired | bits(before.get(prefix + "group:", before["group:"])) ) for key, rights in before.items(): if ( key.startswith(prefix) and ( key.startswith(prefix + "group:") or (key.startswith(prefix + "user:") and key != prefix + "user:") ) and bits(rights) & (new_mask & ~mask) ): raise ValueError( "A named or group ACL entry is masked out; changing the mask would widen its access." ) if prefix and not any(key.startswith(prefix) for key in before): for key in ("user:", "group:", "other:"): after[prefix + key] = before[key] key = prefix + f"group:{group}" after[key] = words(bits(before.get(key, "---")) | desired) # An explicit mask preserves the effective rights of every older entry. after[prefix + "mask:"] = words(new_mask) return after def set_acl(fd, entries): run( "setfacl", "--no-mask", "--set-file=-", "--", f"/proc/self/fd/{fd}", input="\n".join(k + ":" + v for k, v in entries.items()) + "\n", pass_fds=(fd,), ) if stat.S_ISDIR(os.fstat(fd).st_mode) and not any( k.startswith("default:") for k in entries ): run("setfacl", "--remove-default", "--", f"/proc/self/fd/{fd}", pass_fds=(fd,)) def write_record(path, data): temp = path.with_suffix(".new") fd = os.open(temp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600) try: with os.fdopen(fd, "w") as stream: json.dump(data, stream) stream.flush() os.fsync(stream.fileno()) os.replace(temp, path) finally: temp.unlink(missing_ok=True) def related(path, root): return ( path == root or path.startswith(root.rstrip("/") + "/") or root.startswith(path.rstrip("/") + "/") ) def mount_table(): return Path("/proc/self/mountinfo").read_text() def unescape(field): return re.sub(r"\\([0-7]{3})", lambda m: chr(int(m[1], 8)), field) def inside(path, root): return path == root or path.startswith(root.rstrip("/") + "/") def names_of(path): """Every name a folder has through the mounts that show its filesystem. `mount --bind /etc /srv/etc-alias` makes /srv/etc-alias/ssh the same folder as /etc/ssh, and realpath keeps the alias. A filesystem mounted twice, or a home's disk bound elsewhere, does the same. The deepest mount holding the path gives its place on that filesystem (the mount's root field); each mount of the same filesystem that shows that place gives another name. An unreadable table fails the request. """ mounts = [] for line in mount_table().splitlines(): fields = line.split() mounts.append((unescape(fields[4]), unescape(fields[3]), fields[2])) holding = [m for m in mounts if inside(path, m[0])] if not holding: return [path] deepest = max(len(m[0]) for m in holding) point, root, device = [m for m in holding if len(m[0]) == deepest][-1] place = "/" + "/".join( p for p in (root + "/" + path[len(point) :]).split("/") if p ) names = {path} for other_point, other_root, other_device in mounts: if other_device == device and inside(place, other_root): rest = place[len(other_root.rstrip("/")) :] names.add("/" + "/".join(p for p in (other_point + rest).split("/") if p)) return sorted(names) def refuse(path, prefix): """Match the agent: own prefix, system, home, then other install ancestors.""" if any(ord(c) < 32 or ord(c) == 127 for c in path) or not path.startswith("/"): raise ValueError( "not_a_folder: Use an absolute path without control characters." ) if path.startswith("//"): raise ValueError("network: Network folders are not supported.") if os.path.realpath(path, strict=True) != path: raise ValueError("link: Choose an existing folder, not a link or a path alias.") if not os.path.isdir(path): raise ValueError("not_a_folder: Choose an existing folder.") if os.path.ismount(path): raise ValueError("drive_root: Choose a folder inside the drive.") import pwd homes = ["/home"] + [ p.pw_dir for p in pwd.getpwall() if p.pw_dir.startswith("/") and p.pw_dir not in ("/", "/nonexistent") ] policy(path, prefix, homes) for name in names_of(path): if name == path: continue try: policy(name, prefix, homes) except ValueError as exc: cause, words = str(exc).split(":", 1) raise ValueError(f"{cause}: {path} is {name} through a mount.{words}") from None def policy(path, prefix, homes): if path == prefix or path.startswith(prefix.rstrip("/") + "/"): raise ValueError("eugene: This is Eugene's own folder.") parts = Path(path).parts if any(related(path, system) for system in SYSTEM) or ( len(parts) > 1 and parts[1].startswith("lib") ): raise ValueError("system: Eugene does not give apps system folders.") if any(related(path, home) for home in homes): raise ValueError("home: Use a Job Site to work in your own folders.") if related(path, prefix): raise ValueError("eugene: This is Eugene's own folder.") class UnsafeParent(ValueError): def __init__(self, path): self.path = path super().__init__(path + " can be changed by other accounts.") @contextlib.contextmanager def opened(path, *, parents_safe=True, allow_mount_root=False): held = [os.open("/", os.O_RDONLY | os.O_DIRECTORY)] try: parts = Path(path).parts[1:] for index, name in enumerate(parts): parent = held[-1] info = os.fstat(parent) if parents_safe: permissions = acl(parent) mask = bits(permissions.get("mask:", "rwx")) foreign_write = any( bits(rights) & (mask if key.startswith(("group:", "user:")) else 7) & 2 for key, rights in permissions.items() if key not in ("user:", "user:0", "mask:") and not key.startswith("default:") ) if info.st_uid != 0 or foreign_write: raise UnsafeParent(str(Path(path).parents[len(parts) - index - 1])) held.append( os.open( name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=parent ) ) if ( not allow_mount_root and index == len(parts) - 1 and mount_id(held[-1]) != mount_id(parent) ): raise ValueError( "drive_root: Choose a folder inside the mounted drive." ) yield held[-1] finally: for fd in reversed(held): os.close(fd) def inspect_folder(path, prefix): """Inspect as root; the agent may not traverse any part of this path.""" facts = dict(path=path) try: refuse(path, prefix) except (FileNotFoundError, NotADirectoryError): facts["is_dir"] = False except ValueError as exc: cause = str(exc).split(":", 1)[0] refused = { "not_a_folder": dict(is_dir=False), "link": dict(link=True), "network": dict(network=True), "drive_root": dict(mount_root=True), "system": dict(system=[path]), "eugene": dict(eugene=[path]), "home": dict(homes=[path]), } if cause not in refused: raise facts.update(refused[cause]) if not (facts.get("link") or facts.get("network") or facts.get("is_dir") is False): try: # Grant policy is separate from identity. Only inspect through safe # parents; revoke uses its private ledger if a parent is now unsafe. with opened(path, allow_mount_root=True) as fd: return dict(facts=facts, identity=identity(fd)) except UnsafeParent as exc: facts["unsafe_parent"] = exc.path except FileNotFoundError: facts["is_dir"] = False except NotADirectoryError: facts["link"] = True return dict(facts=facts, identity=[]) def tree(fd, mount, names=(), *, revoke=False, skipped=None): info = os.fstat(fd) if stat.S_ISLNK(info.st_mode): return if mount_id(fd) != mount: cause = "drive_root: A mounted descendant is not supported." if not revoke: raise ValueError(cause) skipped.append("/".join(names) + ": " + cause) return if not revoke and not stat.S_ISDIR(info.st_mode): if not stat.S_ISREG(info.st_mode): raise ValueError("A special file is inside this folder.") if info.st_nlink != 1: raise ValueError( "link: A file inside this folder has more than one hard link." ) ident = ( identity(fd) if stat.S_ISDIR(info.st_mode) or stat.S_ISREG(info.st_mode) else [] ) yield names, fd, ident if stat.S_ISDIR(os.fstat(fd).st_mode): for name in os.listdir(fd): try: info = os.stat(name, dir_fd=fd, follow_symlinks=False) if stat.S_ISLNK(info.st_mode): continue special = not stat.S_ISDIR(info.st_mode) and not stat.S_ISREG( info.st_mode ) if special and not revoke: raise ValueError("A special file is inside this folder.") # O_PATH avoids opening devices, blocking FIFOs, or connecting # sockets. ACL tools reach the held object through procfs. flags = os.O_PATH if special else os.O_RDONLY | os.O_NONBLOCK child = os.open(name, flags | os.O_NOFOLLOW, dir_fd=fd) except FileNotFoundError: if not revoke: raise continue except OSError as exc: if not revoke: raise skipped.append("/".join((*names, name)) + ": " + str(exc)) continue try: yield from tree( child, mount, (*names, name), revoke=revoke, skipped=skipped ) finally: os.close(child) def batches(fd, size=128, *, revoke=False, skipped=None): """Bound retained descriptors and subprocess argument size.""" pending = [] try: for names, child, ident in tree( fd, mount_id(fd), revoke=revoke, skipped=skipped ): pending.append((names, os.dup(child), ident)) if len(pending) == size: yield pending for _, held, _ in pending: os.close(held) pending = [] if pending: yield pending finally: for _, held, _ in pending: os.close(held) def grant(fd, group, write, ledger, save, check=None): """Preflight and save a complete plan before the first ACL change. `check` runs after the preflight and before the plan is saved: the last look at the folder's names before anything changes. """ ledger["group"] = group ledger["items"] = [] # Entries for the group that a grant leaves as they are: removal keeps them. ledger["kept"] = [] keys = ("group:" + group, "default:group:" + group) for batch in batches(fd): for (names, child, ident), before in zip(batch, acls([c for _, c, _ in batch])): after = plan(before, group, write, stat.S_ISDIR(os.fstat(child).st_mode)) if before != after: ledger["items"].append( dict(names=names, identity=ident, before=before, after=after) ) elif any(key in before for key in keys): ledger["kept"].append(dict(names=names, identity=ident)) if check is not None: check() save(ledger) plans = {tuple(item["names"]): item for item in ledger["items"]} for batch in batches(fd): content, held = [], [] for names, child, ident in batch: item = plans.get(names) if item is None: continue if not same_identity(ident, item["identity"]): raise ValueError( "A folder item was replaced before its permission change." ) held.append(child) content.append( "# file: /proc/self/fd/" + str(child) + "\n" + "\n".join(k + ":" + v for k, v in item["after"].items()) + "\n\n" ) if held: run("setfacl", "--restore=-", input="".join(content), pass_fds=tuple(held)) return bool(plans) def fingerprint_key(fingerprint): """What an owner's answer is about: the item and the entry, never its name. A rename keeps the inode, so it keeps the answer; the name is only shown. The link count is the item's state, checked when Remove is applied, not part of it.""" return json.dumps( {k: v for k, v in fingerprint.items() if k not in ("names", "links")}, sort_keys=True, ) def own_identity(fd, ident): """The item's identity; a special file has none from statx, so its device and inode. Each special file is its own decision: two pipes never share one answer.""" if ident: return list(ident) info = os.fstat(fd) return [info.st_dev, info.st_ino] def report(fingerprint, found): """List one entry the owner decides, or note the owner already kept it.""" unknown, retained, accepted = found key = fingerprint_key(fingerprint) target = retained if key in accepted else unknown if all(fingerprint_key(other) != key for other in target): target.append(fingerprint) # What an item with another name, and an entry Eugene did not add, are in words. HARDLINK = ( "it has another name outside the folder, so changing it here changes it there too" ) SPECIAL = ( "it is a pipe, socket or device, which Eugene never changes on its own" ) def held_back(fd, ident, allowed): """Why removal leaves this item for the owner: None, "hardlink" or "special". One rule on both systems: removal never changes a file with another name, nor a file that is not a regular file or a folder, unless the owner chose Remove for it at no more names than it has now. Read on the held descriptor every time.""" info = os.fstat(fd) if stat.S_ISDIR(info.st_mode): return None special = not stat.S_ISREG(info.st_mode) if not special and info.st_nlink == 1: return None limit = allowed.get(identity_key(own_identity(fd, ident))) if limit is not None and info.st_nlink <= limit: return None return "special" if special else "hardlink" def revoke(fd, ledger): # Revoke the group's entries throughout the current tree, including # children created since the grant, and every other principal's ACL # (including later chmod changes). An item nobody changed since the grant # gets its recorded ACL back; an entry the group held before stays. if not ledger["items"]: return True group = ledger["group"] skipped = [] plans = index(item for item in ledger["items"] if "names" in item) kept = index(ledger.get("kept", [])) # An entry for the group changed after the grant is not Eugene's to # take: it stays, and the owner decides (R23-UNKNOWN). ledger["unknown"] = [] # What the owner chose to keep, from this record: the truth, whatever the # agent saved. Only entries met again below are reported as retained. ledger["retained"] = [] accepted = {fingerprint_key(f) for f in ledger.get("accepted", [])} found = (ledger["unknown"], ledger["retained"], accepted) # What Eugene's own default gives what is made in each folder: a new item is # compared with its own folder's value only, never another folder's. expect = {} allowed = {identity_key(a["identity"]): a["links"] for a in ledger.get("allowed", [])} keys = ("group:" + group, "default:group:" + group) for batch in batches(fd, revoke=True, skipped=skipped): waiting, specials, normal = [], [], [] for item in batch: reason = held_back(item[1], item[2], allowed) if reason is not None: waiting.append((item, reason)) elif not item[2]: specials.append(item) # the owner chose Remove for this one else: normal.append(item) # Left for the owner: listed only when it holds an entry for the app. for (names, child, ident), reason in waiting: try: current = acl(child) except (OSError, ValueError) as exc: skipped.append("/".join(names) + ": " + str(exc)) continue if any(key in current for key in keys): report( dict( kind=reason, names=list(names), identity=own_identity(child, ident), links=os.fstat(child).st_nlink, ), found, ) for names, child, _ in specials: try: if "group:" + group in acl(child): run( "setfacl", "-n", "-x", "g:" + group, "--", f"/proc/self/fd/{child}", pass_fds=(child,), ) except (OSError, ValueError) as exc: skipped.append("/".join(names) + ": " + str(exc)) entries = list(zip(normal, acls([c for _, c, _ in normal]))) if normal else [] remove_entries(entries, group, plans, kept, found, expect) ledger["refusal"] = "; ".join(skipped) return not skipped def index(items): """Records by identity, which a rename keeps, and by path for the rest.""" found = {} for item in items: found[tuple(item["names"])] = item if item.get("identity"): found[("identity", *identity_key(item["identity"]))] = item return found def identity_key(value): return tuple(value[1:4] if len(value) == 5 else value) def recorded(records, names, ident): """The record for this item: by identity first, then by path.""" if ident and ("identity", *identity_key(ident)) in records: return records[("identity", *identity_key(ident))] return records.get(tuple(names)) def remove_entries(entries, group, plans, kept=None, found=None, expect=None): kept = kept or {} found = found if found is not None else ([], [], set()) keys = ("group:" + group, "default:group:" + group) default_key = "default:group:" + group restore, removable = [], [] spare = {} # fd -> keys that stay for the owner to decide left = set() # items whose default entry for the group stays for (names, child, ident), current in entries: item = recorded(plans, names, ident) planned = item is not None and same_identity(ident, item["identity"]) prior = recorded(kept, names, ident) # What Eugene's default gives this item, from its own folder alone. given = expect.get(tuple(names[:-1])) if expect is not None and names else None if expect is not None and stat.S_ISDIR(os.fstat(child).st_mode): value = current.get(default_key) if planned and value is not None and value == item["after"].get(default_key): expect[tuple(names)] = value # what Eugene's grant left on this folder elif not planned and value is not None and value == given: expect[tuple(names)] = value # a new folder inherits its folder's if planned and current == item["after"]: if current != item["before"]: restore.append((child, item["before"])) continue if prior is not None and same_identity(ident, prior["identity"]): continue # The group's own entries from before the grant. changed = [] if planned: for key in keys: if key in current and current[key] not in ( item["before"].get(key), item["after"].get(key), ): changed.append(key) report( dict( kind="entry", names=list(names), identity=list(ident), key=key, value=current[key], ), found, ) if "default:group:" + group in changed: left.add(child) if planned and (changed or any(key in item["before"] for key in keys)): # Changed since: put back what the grant widened, leave what was # changed by someone else, and keep everything else. wanted = {k: v for k, v in current.items() if k not in keys or k in changed} wanted.update( {k: item["before"][k] for k in keys if k in item["before"] and k not in changed} ) if wanted != current: restore.append((child, wanted)) continue if not planned and expect is not None: # Made, or replaced, after the grant: only what Eugene's default # puts on a new item in this folder is Eugene's. Any other value, # or any value under a default Eugene did not add, is the owner's. for key in keys: if key in current and (given is None or current[key] != given): spare.setdefault(child, set()).add(key) report( dict( kind="entry", names=list(names), identity=list(ident), key=key, value=current[key], ), found, ) removable.append(((names, child, ident), current)) if restore: run( "setfacl", "--restore=-", input="".join( "# file: /proc/self/fd/" + str(child) + "\n" + "\n".join(k + ":" + v for k, v in wanted.items()) + "\n\n" for child, wanted in restore ), pass_fds=tuple(child for child, _ in restore), ) everything, entries = entries, removable for default in (False, True): key = ("default:" if default else "") + "group:" + group held = [ child for (_, child, _), current in entries if key in current and key not in spare.get(child, ()) ] if held: run( "setfacl", "-n", "-x", ("d:" if default else "") + "g:" + group, "--", *("/proc/self/fd/" + str(child) for child in held), pass_fds=tuple(held), ) clear = [] base = {"default:user:", "default:group:", "default:other:", "default:mask:"} # Default ACLs the grant created go; setfacl --restore leaves them. for (names, child, ident), current in everything: item = recorded(plans, names, ident) defaults = {k for k in current if k.startswith("default:")} defaults.discard("default:group:" + group) if ( item is not None and child not in left and same_identity(ident, item["identity"]) and not any(k.startswith("default:") for k in item["before"]) and defaults == base and all(current[k] == item["after"].get(k) for k in base) ): clear.append(child) if clear: run( "setfacl", "-k", "--", *(f"/proc/self/fd/{c}" for c in clear), pass_fds=tuple(clear), ) def reapply(fd, record, records): """Restore remaining overlapping grants before completing this revoke.""" active = [] skipped = [] reapplied = set() for target, other in records.items(): if ( other.get("removed") or other == record or not related(other["path"], record["path"]) ): continue try: # These are existing root-owned grants too. Validate identity # without applying policy for a new grant during removal. with opened( other["path"], parents_safe=False, allow_mount_root=True ) as held: if same_identity(identity(held), other["identity"]): active.append((target, other)) except (FileNotFoundError, NotADirectoryError): continue # A missing related folder covers no items. except (OSError, ValueError) as exc: skipped.append(other["path"] + ": " + str(exc)) if not active: record["refusal"] = "; ".join(filter(None, [record.get("refusal"), *skipped])) return not skipped, [] plans = { target: {tuple(item["names"]): item for item in other["items"]} for target, other in active } for batch in batches(fd, revoke=True, skipped=skipped): changes = {} for names, child, ident in batch: path = record["path"].rstrip("/") + ("/" + "/".join(names) if names else "") covering = [ (target, r) for target, r in active if path == r["path"] or path.startswith(r["path"].rstrip("/") + "/") ] if not covering: continue try: info = os.fstat(child) directory = stat.S_ISDIR(info.st_mode) if not directory: if not stat.S_ISREG(info.st_mode): raise ValueError("A special file is inside this folder.") if info.st_nlink != 1: raise ValueError("A file has more than one hard link.") before = acl(child) target, owner = max( covering, key=lambda pair: bool(pair[1].get("write")) ) after = plan( before, record["group"], owner.get("write", False), directory, ) if before != after: relative = path[len(owner["path"]) :].strip("/") owned_names = tuple(relative.split("/")) if relative else () item = plans[target].get(owned_names) if item is None or not same_identity(ident, item["identity"]): if item is not None: owner["items"].remove(item) item = dict( names=owned_names, identity=ident, before=before, after=after, ) owner["items"].append(item) plans[target][owned_names] = item changes.setdefault(target, []).append((path, child, after)) except (OSError, ValueError) as exc: skipped.append(path + ": " + str(exc)) for target, additions in changes.items(): try: # Save each covering grant once per batch, before its additions. # Keep an existing item's original before/after values so an # owner's later default-ACL edits remain detectable on revoke. write_record(target, records[target]) reapplied.add(target.stem) except (OSError, ValueError) as exc: skipped.extend(path + ": " + str(exc) for path, _, _ in additions) continue for path, child, after in additions: try: set_acl(child, after) except (OSError, ValueError) as exc: skipped.append(path + ": " + str(exc)) if skipped: record["refusal"] = "; ".join(filter(None, [record.get("refusal"), *skipped])) return not skipped, sorted(reapplied) def dropin(app, group, records): directory = Path(f"/etc/systemd/system/eugene-plexus-app@{app}.service.d") directory.mkdir(mode=0o755, exist_ok=True) paths = [ record["path"] for record in records if record.get("write") and not record.get("removed") ] # systemd's quoted string syntax, including literal percent specifiers. quoted = ["-" + json.dumps(p.replace("%", "%%"), ensure_ascii=False) for p in paths] (directory / "20-folders.conf").write_text( "[Service]\nSupplementaryGroups=" + group + "\n" + ("ReadWritePaths=" + " ".join(quoted) + "\n" if paths else ""), encoding="utf-8", ) run("systemctl", "daemon-reload") def write_mount(path, mountinfo): """Read the effective namespace, not a reloaded unit's future settings.""" matches = [] for line in mountinfo.splitlines(): fields = line.split() point = re.sub(r"\\([0-7]{3})", lambda m: chr(int(m[1], 8)), fields[4]) if path == point or path.startswith(point.rstrip("/") + "/"): matches.append((len(point), "rw" in fields[5].split(","))) if not matches: return False longest = max(length for length, _ in matches) current = [writable for length, writable in matches if length == longest] if len(current) != 1: raise ValueError( "More than one mount describes this folder; its effective write access cannot be proved." ) return current[0] def running_access(app, group, path, write): pid = int( run( "systemctl", "show", f"eugene-plexus-app@{app}.service", "--property=MainPID", "--value", ).strip() or "0" ) if not pid: return pid, write status = Path(f"/proc/{pid}/status").read_text() groups = next( ( line.split()[1:] for line in status.splitlines() if line.startswith("Groups:") ), [], ) if group not in groups: raise ValueError( "Workbench's running process does not have its file group. Restart Workbench in Eugene, then give access." ) mounts = Path(f"/proc/{pid}/mountinfo").read_text() return pid, write and not write_mount(path, mounts) def main(): if sys.version_info < (3, 10): raise ValueError( "Folder access needs Python 3.10 or newer at /usr/bin/python3." ) import grp prefix, account, verb, app, mode, ident = sys.argv[1:] if ( not re.fullmatch(r"[a-z][a-z0-9-]{1,39}", app) or not re.fullmatch(r"[0-9a-f]{32}", ident) or mode not in (("remove", "keep") if verb == "folder-decide" else ("read", "write")) or verb not in ("folder-inspect", "folder-grant", "folder-revoke", "folder-decide") ): raise ValueError("Invalid folder permission request identifiers.") if verb in ("folder-inspect", "folder-grant"): path = run( "runuser", "-u", account, "--", "head", "-c", "4097", "--", str(Path(prefix) / "apps/ctl" / (ident + ".path")), ) if not 0 < len(path) <= 4096: raise ValueError("Invalid folder path length.") if verb == "folder-inspect": print(json.dumps(inspect_folder(path, prefix))) return root = Path("/etc/eugene-plexus/folder-access") root.mkdir(parents=True, mode=0o700, exist_ok=True) directory = root / app directory.mkdir(mode=0o700, exist_ok=True) target = directory / (ident + ".json") group_name = "eapp-" + hashlib.sha256(app.encode()).hexdigest()[:12] + "-files" group = str(grp.getgrnam(group_name).gr_gid) if verb == "folder-grant": if target.exists(): raise ValueError("This access record already exists.") refuse(path, prefix) process, restart_needed = running_access(app, group, path, mode == "write") with opened(path) as fd: expected = json.loads( run( "runuser", "-u", account, "--", "head", "-c", "1024", "--", str(Path(prefix) / "apps/ctl" / (ident + ".identity")), ) ) if not same_identity(identity(fd), expected): raise ValueError( "The folder was replaced before the permission change." ) # Mount IDs are transient; use the longest containing mount # only to reject remote filesystems, never as persistent identity. mounts = [] for line in mount_table().splitlines(): point = re.sub( r"\\([0-7]{3})", lambda m: chr(int(m[1], 8)), line.split()[4] ) if path == point or path.startswith(point.rstrip("/") + "/"): mounts.append((len(point), line.split(" - ")[1].split()[0])) fs = max(mounts)[1] if fs.startswith(("nfs", "cifs", "smb", "9p", "fuse.ssh")): raise ValueError("network: Network folders are not supported.") record = dict( path=path, identity=identity(fd), write=mode == "write", removed=False, items=[], ) # A mount made since the first check can give the folder a # forbidden name without changing its identity: look again. added = grant( fd, group, mode == "write", record, lambda r: write_record(target, r), check=lambda: refuse(path, prefix), ) write_record(target, record) dropin( app, group_name, [json.loads(p.read_text()) for p in directory.glob("*.json")], ) print( json.dumps( dict(added=added, process=process, restartNeeded=restart_needed) ) ) else: if verb == "folder-decide": decide(prefix, account, group, ident, mode, target) return if not target.is_file(): print(json.dumps(dict(removed=True, kept=[], unknown=[]))) return record = json.loads(target.read_text()) if record.get("removed"): # Finished before; the agent may not have heard, so say what stays, # as it is now: a kept file since deleted, or its entry since taken # away, is no longer access the app has. retained = still_there(record, group) if retained != record.get("retained", []): record["retained"] = retained write_record(target, record) print( json.dumps( dict( removed=True, kept=[listing(f, group_name, record) for f in retained], unknown=[], ) ) ) return reapplied = [] with contextlib.ExitStack() as held: try: # This path and identity come only from the root-owned ledger. # Hold every component without following links, then compare the # saved identity before changing ACLs. New-grant policy cannot # prevent releasing an unchanged grant. fd = held.enter_context( opened(record["path"], parents_safe=False, allow_mount_root=True) ) except FileNotFoundError: removed = True # Also remove a deleted folder's namespace allowance. except NotADirectoryError: removed = False # A replacement link must never reach its target. else: removed = same_identity(identity(fd), record["identity"]) if removed: complete = revoke(fd, record) records = { p: json.loads(p.read_text()) for p in directory.glob("*.json") if p != target } restored, reapplied = reapply(fd, record, records) removed = complete and restored unknown = record.get("unknown") or [] if removed and not unknown: record["removed"] = True write_record(target, record) dropin( app, group_name, [json.loads(p.read_text()) for p in directory.glob("*.json")], ) elif unknown: write_record(target, record) # The ledger lists what waits for the owner. print( json.dumps( dict( removed=removed and not unknown, message=record.get("refusal") or "", reapplied=reapplied, unknown=[listing(found, group_name, record) for found in unknown], kept=[listing(found, group_name, record) for found in record.get("retained", [])], ) ) ) def still_there(record, group): """The owner's kept entries still in the folder, under their names now.""" retained = record.get("retained") or [] if not retained: return [] wanted = {identity_key(f["identity"]): f for f in retained} present = [] try: with opened(record["path"], parents_safe=False, allow_mount_root=True) as fd: if not same_identity(identity(fd), record["identity"]): return [] for names, child, ident in tree(fd, mount_id(fd), revoke=True, skipped=[]): found = wanted.get(identity_key(own_identity(child, ident))) if found is None: continue if found["kind"] == "entry": try: if acl(child).get(found["key"]) is None: continue except (OSError, ValueError): pass # cannot read it: it stays shown present.append(dict(found, names=list(names))) except (FileNotFoundError, NotADirectoryError): return [] return present def listing(found, group_name, record=None): """One entry for the agent: where it is, in words, and the ledger's fingerprint.""" root = (record or {}).get("path", "") if found["kind"] == "hardlink": words_for = HARDLINK elif found["kind"] == "special": words_for = SPECIAL else: words_for = ( f"group {group_name} has {found['value']}" + (" for new items" if found["key"].startswith("default:") else "") + " on this item, set outside Eugene" ) return dict( path="/".join([root.rstrip("/"), *found["names"]]) if root else "/".join(found["names"]), entry=words_for, fingerprint=found, ) @contextlib.contextmanager def entry_fd(fd, names, *, path_only=False): """Hold an item below `fd` by name, never following a link. `path_only` holds the last item without opening it, as a special file must be.""" held = [] try: current = fd for index, name in enumerate(names): flags = ( os.O_PATH if path_only and index == len(names) - 1 else os.O_RDONLY | os.O_NONBLOCK ) current = os.open(name, flags | os.O_NOFOLLOW, dir_fd=current) held.append(current) yield current finally: for item in reversed(held): os.close(item) def decide(prefix, account, group, ident, mode, target): """The owner's decision about one entry this ledger lists (R23-UNKNOWN). The agent names the entry; only an entry this root-owned ledger lists is acted on, so the agent can never point this at anything else. Remove checks the same item and the same value first, then deletes that entry. """ if not target.is_file(): raise ValueError("No such access record.") record = json.loads(target.read_text()) wanted = json.loads( run( "runuser", "-u", account, "--", "head", "-c", "4097", "--", str(Path(prefix) / "apps/ctl" / (ident + ".entry")), ) ) key = fingerprint_key(wanted) if ( mode == "keep" and key in {fingerprint_key(f) for f in record.get("accepted", [])} and wanted not in (record.get("unknown") or []) ): # Committed already, and the agent asks again after a crash. print(json.dumps(dict(decided=True))) return if wanted not in (record.get("unknown") or []): raise ValueError( "This entry is not waiting for a decision. " "Choose Remove access again to check the folder." ) if mode == "keep": record.setdefault("accepted", []).append(wanted) else: with opened(record["path"], parents_safe=False, allow_mount_root=True) as fd: if not same_identity(identity(fd), record["identity"]): raise ValueError("The folder was replaced, so the entry was left as it is.") with entry_fd(fd, wanted["names"], path_only=wanted["kind"] == "special") as child: info = os.fstat(child) regular = stat.S_ISREG(info.st_mode) now = ( identity(child) if regular or stat.S_ISDIR(info.st_mode) else [info.st_dev, info.st_ino] ) if not same_identity(now, wanted["identity"]): return stale( "The item changed since Eugene found it, so the entry was left as it is." ) if wanted["kind"] in ("hardlink", "special"): if info.st_nlink > wanted.get("links", 1): return stale( "The file has more names than when Eugene asked, so it was " "left as it is." ) # Only allows: the removal that follows changes the item. record.setdefault("allowed", []).append( dict(identity=wanted["identity"], links=info.st_nlink) ) else: allowed = { identity_key(a["identity"]): a["links"] for a in record.get("allowed", []) } limit = allowed.get(identity_key(now)) if ( not stat.S_ISDIR(info.st_mode) and (not regular or info.st_nlink > 1) and not (limit is not None and info.st_nlink <= limit) ): # Checked on the held file: an entry removed here would # be removed through every other name too. return stale( "The file has another name outside the folder now, so " "the entry was left as it is." ) if acl(child).get(wanted["key"]) != wanted["value"]: return stale( "The entry changed since Eugene found it, so it was left as it is." ) default = wanted["key"].startswith("default:") run( "setfacl", "-n", "-x", ("d:" if default else "") + "g:" + group, "--", f"/proc/self/fd/{child}", pass_fds=(child,), ) record["unknown"] = [f for f in record["unknown"] if f != wanted] write_record(target, record) print(json.dumps(dict(decided=True))) def stale(message): """Nothing applied: what the owner saw has changed. The agent asks again.""" print(json.dumps(dict(decided=False, stale=True, message=message))) if __name__ == "__main__": try: main() except Exception as exc: print(str(exc) or type(exc).__name__, file=sys.stderr) sys.exit(1) FOLDER_HELPER as_root chown root:root "$(dirname "$APPS_HELPER")/folder-access.py" as_root chmod 0755 "$(dirname "$APPS_HELPER")/folder-access.py" in_prefix mkdir -p "$PREFIX/apps/ctl" { printf '#!/bin/sh\n' printf "DIR='%s'\n" "$PREFIX/apps/ctl" printf "ACCOUNT='%s'\n" "$SYSTEM_ACCOUNT" cat <<'HELPER' # Installed by Eugene Plexus's install.sh; see "apps in accounts of their # own" there. Run as root by eugene-plexus-apps-ctl.service. set -uf as_account() { (cd / && runuser -u "$ACCOUNT" -- "$@"); } esc() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g' | tr -d '\000-\037'; } # Listed, read and removed as Eugene's account: a path it controls could # point anywhere root can read. Listed again until none is left, so a # request written while this runs is answered by this run. while :; do NAMES=$(as_account find "$DIR" -maxdepth 1 -type f -name '*.req' -printf '%f\n' 2>/dev/null) [ -n "$NAMES" ] || break for NAME in $NAMES; do ID=${NAME%.req} case "$ID" in ''|*[!0-9a-f]*) as_account rm -f "$DIR/$NAME"; continue ;; esac LINE=$(as_account head -c 100 "$DIR/$NAME" 2>/dev/null | head -n 1) as_account rm -f "$DIR/$NAME" VERB=${LINE%% *} APP=${LINE#* } MODE=read GRANT= case "$VERB" in folder-inspect|folder-grant|folder-revoke|folder-decide) set -- $APP if [ "$#" = 3 ]; then APP=$1; MODE=$2; GRANT=$3; else VERB=; fi # folder-decide carries the owner's answer (R23-UNKNOWN). case "$VERB:$MODE" in folder-decide:remove|folder-decide:keep) ;; folder-decide:*) VERB= ;; *:read|*:write) ;; *) VERB= ;; esac printf '%s' "$GRANT" | grep -Eq '^[0-9a-f]{32}$' || VERB= ;; start|stop|restart|clean) ;; *) VERB= ;; esac printf '%s' "$APP" | grep -Eq '^[a-z][a-z0-9-]{1,39}$' || VERB= if [ -z "$VERB" ]; then CODE=2 OUT="refused: this helper starts, stops, restarts or cleans one eugene-plexus-app@ unit" elif [ "$VERB" = folder-inspect ] || [ "$VERB" = folder-grant ] || [ "$VERB" = folder-revoke ] || [ "$VERB" = folder-decide ]; then OUT=$(/usr/bin/python3 -I /usr/local/lib/eugene-plexus/folder-access.py "${DIR%/apps/ctl}" "$ACCOUNT" "$VERB" "$APP" "$MODE" "$GRANT" 2>&1) CODE=$? elif [ "$VERB" = clean ]; then OUT=$(systemctl clean --what=state "eugene-plexus-app@$APP.service" 2>&1) CODE=$? else # A dynamic user per app, never one shared by every instance of the # template (which systemd names after the template: C1's first run # put two apps in one uid, able to see each other's processes). # systemd takes names of 31 characters at most and an id may be 40, # so the name is a hash of the id. DROPIN=/etc/systemd/system/eugene-plexus-app@$APP.service.d FILES_GROUP=eapp-$(printf '%s' "$APP" | sha256sum | cut -c1-12)-files if ! getent group "$FILES_GROUP" >/dev/null; then groupadd --system "$FILES_GROUP" || exit 1 fi mkdir -p "$DROPIN" if [ ! -f "$DROPIN/20-folders.conf" ]; then printf '[Service]\nSupplementaryGroups=%s\n' "$FILES_GROUP" >"$DROPIN/20-folders.conf" systemctl daemon-reload fi WANT="[Service] User=eapp-$(printf '%s' "$APP" | sha256sum | cut -c1-12)" if [ "$(cat "$DROPIN/10-user.conf" 2>/dev/null)" != "$WANT" ]; then mkdir -p "$DROPIN" && printf '%s\n' "$WANT" >"$DROPIN/10-user.conf" \ && systemctl daemon-reload fi OUT=$(systemctl "$VERB" "eugene-plexus-app@$APP.service" 2>&1) CODE=$? fi printf '{"code":%s,"output":"%s"}' "$CODE" "$(esc "$OUT")" \ | as_account tee "$DIR/.$ID.res" >/dev/null as_account mv -f "$DIR/.$ID.res" "$DIR/$ID.res" done done HELPER } | as_root tee "$APPS_HELPER.new" >/dev/null as_root chown root:root "$APPS_HELPER.new" as_root chmod 0755 "$APPS_HELPER.new" as_root mv -f "$APPS_HELPER.new" "$APPS_HELPER" as_root tee "$APPS_TEMPLATE" >/dev/null </dev/null </dev/null </dev/null 2>&1 \ || warn "could not enable eugene-plexus-apps-ctl.path, so apps will run as eugene-plexus" } # --- a job site on a Linux system install (2b.2) ----------------------------- # **Root installs, owns and runs the job-site host and every person's # worker** (job-sites-own-enrollment.md §2.4, §3.2; in-app-updates.md, "the # root helper follows one rule"). The agent runs as eugene-plexus, and a # worker runs as a *person*: whoever can write the program a person's worker # runs can become that person. So nothing under $PREFIX is ever executed as # root here, and nothing the agent's account can write is ever written # through. The program lives in /usr/local/lib/eugene-plexus/site-host # (root:root, nothing group- or world-writable), with its own uv and its # own Python, fetched and installed by root. The site's state is in the # home of an account of its own, eugene-plexus-site, which opens no one's # files. The links (who is which account) and the local-server list are # root's, in /etc/eugene-plexus/site; a link is made only by root, at the # machine, after the person has proved who they are (J36). SITE_SVC_ACCOUNT=eugene-plexus-site SITE_SVC_HOME=/var/lib/eugene-plexus-site SITE_ROOT=/usr/local/lib/eugene-plexus/site-host SITE_PY=$SITE_ROOT/venv/bin/python SITE_CONF=/etc/eugene-plexus/site SITE_CACHE=/var/cache/eugene-plexus-site SITE_WORKERS=/usr/local/lib/eugene-plexus/site-workers SITE_HOST_UNIT=/etc/systemd/system/eugene-plexus-site-host.service SITE_WORKER_UNIT=/etc/systemd/system/eugene-plexus-site-worker@.service SITE_WORKERS_UNIT=/etc/systemd/system/eugene-plexus-site-workers.service SITE_WORKERS_PATH=/etc/systemd/system/eugene-plexus-site-workers.path SITE_DEFAULT_PORT=8300 SITE_PW= SITE_UID= SITE_UNAME= SITE_PORT= # What the link program does, as one program so that every way of changing # the links follows the same rules: one link per person and one person per # account, an account that is a real person's (uid 1000 or more), and the # file replaced whole (a temporary file in the same folder, then a rename) # so a reader never sees half of one. No apostrophes in it: it sits in # single quotes. # J9's proof for commands (2b.4, J30, J89): the administrator's consent, in # the protected list beside the local servers, which the site host and every # worker read and cannot write. Run as root by this installer only. SITE_CONSENT_PY=' import datetime, os, sys, tempfile import yaml path, answer, by = sys.argv[1], sys.argv[2], sys.argv[3] try: with open(path, encoding="utf-8") as handle: value = yaml.safe_load(handle) or {} except FileNotFoundError: value = {} if not isinstance(value, dict): sys.stderr.write("error: " + path + " is not a list of local servers; fix it first\n") sys.exit(1) value.setdefault("servers", []) if answer == "yes": value["commands"] = { "consentedAt": datetime.datetime.now(datetime.timezone.utc).isoformat(), "by": by, } else: value.pop("commands", None) info = os.stat(path) if os.path.exists(path) else None fd, temporary = tempfile.mkstemp(dir=os.path.dirname(path), prefix=".servers.") with os.fdopen(fd, "w", encoding="utf-8") as handle: yaml.safe_dump(value, handle, sort_keys=False, allow_unicode=True) handle.flush() os.fsync(handle.fileno()) if info is not None: os.chown(temporary, info.st_uid, info.st_gid) os.chmod(temporary, info.st_mode & 0o777) os.replace(temporary, path) ' SITE_LINK_PY=' import json, os, sys, tempfile, time mode, path = sys.argv[1], sys.argv[2] def fail(message): sys.stderr.write("error: " + message + "\n") sys.exit(1) def load(): try: with open(path, encoding="utf-8") as handle: data = json.load(handle) except FileNotFoundError: return [] except (OSError, ValueError): fail("the links file " + path + " could not be read, so nothing was changed") links = data.get("links") if isinstance(data, dict) else None if not isinstance(links, list) or not all(isinstance(x, dict) for x in links): fail("the links file " + path + " is not a links file, so nothing was changed") return links def save(links): fd, temporary = tempfile.mkstemp(dir=os.path.dirname(path), prefix=".links-") with os.fdopen(fd, "w", encoding="utf-8") as handle: json.dump({"version": 1, "links": links}, handle, indent=2) handle.write("\n") handle.flush() os.fsync(handle.fileno()) os.chmod(temporary, 0o644) os.replace(temporary, path) def text(value): return value if isinstance(value, str) and value.strip() else None def add(subject, name, uid, uname): subject, name = text(subject), text(name) if subject is None or name is None: fail("the site did not say who this person is, so nobody was linked") if not (uid.isascii() and uid.isdigit() and int(uid) >= 1000): fail("an account below uid 1000 is not a person, so nobody was linked") links = load() for link in links: same_account = str(link.get("account")) == uid if link.get("subject") == subject: if same_account: link["accountName"] = uname save(links) print(name + " was already linked to " + uname + " (uid " + uid + ").") return fail(name + " is already linked to the account " + str(link.get("accountName")) + " (uid " + str(link.get("account")) + "). A person has one account on a machine. To move them, run --site-unlink --person " + name + " first.") if same_account: fail("the account " + uname + " is already linked to " + str(link.get("name")) + ". One account serves one person. To give it to someone else, run --site-unlink --person " + str(link.get("name")) + " first.") links.append({ "subject": subject, "name": name, "account": uid, "accountName": uname, "linkedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), }) save(links) print("Linked " + name + " to the account " + uname + " (uid " + uid + ").") if mode == "owner": try: with open(sys.argv[3], encoding="utf-8") as handle: site = json.load(handle) except (OSError, ValueError): fail("the record of this site could not be read, so its owner was not linked") add(site.get("owner"), site.get("ownerName"), sys.argv[4], sys.argv[5]) elif mode == "link": try: who = json.loads(sys.argv[3]) except ValueError: fail("the site answered with something that is not a person, so nobody was linked") if not isinstance(who, dict): fail("the site answered with something that is not a person, so nobody was linked") add(who.get("subject"), who.get("name"), sys.argv[4], sys.argv[5]) elif mode == "unlink": wanted = sys.argv[3].casefold() links = load() kept = [x for x in links if str(x.get("subject")) != sys.argv[3] and str(x.get("name")).casefold() != wanted] if len(kept) == len(links): fail("no one named " + sys.argv[3] + " is linked on this machine") save(kept) print("Removed the link for " + sys.argv[3] + ". Their worker stops now.") else: fail("unknown mode " + mode) ' # Root, with a clean environment, from `/`, with a umask that leaves what it # installs readable by the account that runs it. uv gets a root-only home # and cache; the proxy variables are carried by name, as `as_service` does, # because uv and curl go to the network and a TLS-intercepting proxy is the # commonest reason either fails. as_site_root() { set -- env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \ HOME="$SITE_CACHE/home" UV_CACHE_DIR="$SITE_CACHE/uv" \ UV_PYTHON_INSTALL_DIR="$SITE_ROOT/pythons" \ ${HTTPS_PROXY:+"HTTPS_PROXY=$HTTPS_PROXY"} ${https_proxy:+"https_proxy=$https_proxy"} \ ${HTTP_PROXY:+"HTTP_PROXY=$HTTP_PROXY"} ${http_proxy:+"http_proxy=$http_proxy"} \ ${NO_PROXY:+"NO_PROXY=$NO_PROXY"} ${no_proxy:+"no_proxy=$no_proxy"} \ ${SSL_CERT_FILE:+"SSL_CERT_FILE=$SSL_CERT_FILE"} "$@" (umask 022; cd / && as_root "$@") } # The site host's own account, for what only it may do (the join, the # check of a person's sign-in). Same clean environment, its own home. as_site_account() { set -- env -i PATH=/usr/local/bin:/usr/bin:/bin HOME="$SITE_SVC_HOME" \ ${HTTPS_PROXY:+"HTTPS_PROXY=$HTTPS_PROXY"} ${https_proxy:+"https_proxy=$https_proxy"} \ ${HTTP_PROXY:+"HTTP_PROXY=$HTTP_PROXY"} ${http_proxy:+"http_proxy=$http_proxy"} \ ${NO_PROXY:+"NO_PROXY=$NO_PROXY"} ${no_proxy:+"no_proxy=$no_proxy"} \ ${SSL_CERT_FILE:+"SSL_CERT_FILE=$SSL_CERT_FILE"} "$@" if [ "$(id -u)" = 0 ] && command -v runuser >/dev/null 2>&1; then (cd / && runuser -u "$SITE_SVC_ACCOUNT" -- "$@") else (cd / && sudo -u "$SITE_SVC_ACCOUNT" -- "$@") fi } # put_changed MODE OWNER:GROUP PATH < content. Written root-only beside the # target, given its owner and mode, and renamed over it -- never rewritten in # place. A file whose content is already right is left alone (its owner and # mode are still set), so an update does not touch a unit it did not change. put_changed() { _m=$1; _o=$2; _p=$3 (umask 077; as_root tee "$_p.new" >/dev/null) as_root chown "$_o" "$_p.new" as_root chmod "$_m" "$_p.new" if as_root test -f "$_p" && as_root cmp -s "$_p.new" "$_p"; then as_root rm -f "$_p.new" as_root chown "$_o" "$_p" as_root chmod "$_m" "$_p" return 0 fi as_root mv -f "$_p.new" "$_p" } # The account the site host runs as: a system user with a home of its own # and no shell. Its home is 0700: the site's key and enrollment are in it. ensure_site_account() { if ! id "$SITE_SVC_ACCOUNT" >/dev/null 2>&1; then say "creating the $SITE_SVC_ACCOUNT account (the job-site host runs as it)" _nologin=/usr/sbin/nologin [ -x "$_nologin" ] || _nologin=/sbin/nologin [ -x "$_nologin" ] || _nologin=/bin/false as_root useradd --system --user-group --home-dir "$SITE_SVC_HOME" --no-create-home \ --shell "$_nologin" "$SITE_SVC_ACCOUNT" \ || die "could not create the $SITE_SVC_ACCOUNT account" fi as_root install -d -m 0700 -o "$SITE_SVC_ACCOUNT" -g "$SITE_SVC_ACCOUNT" "$SITE_SVC_HOME" } # The program: its own uv, its own Python, a venv, and the site host at the # pin, all fetched and installed by root. Skipped when the recorded pin is # the wanted one. EUGENE_PLEXUS_SITE_HOST_SOURCE (a local checkout) is for # acceptance runs and always reinstalls. install_site_host() { _spec="eugene-plexus-site-host @ https://github.com/eugene-plexus/site-host/archive/$PIN_SITE_HOST.tar.gz" _want=$PIN_SITE_HOST _local=0 if [ -n "${EUGENE_PLEXUS_SITE_HOST_SOURCE:-}" ]; then _spec=$EUGENE_PLEXUS_SITE_HOST_SOURCE _want="local:$EUGENE_PLEXUS_SITE_HOST_SOURCE" _local=1 fi if [ "$_local" = 0 ] && as_root test -x "$SITE_PY" \ && [ "$(as_root cat "$SITE_ROOT/PIN" 2>/dev/null || true)" = "$_want" ]; then say "the job-site host is already installed at its pinned version" return 0 fi command -v curl >/dev/null 2>&1 || die "curl is required" as_root install -d -m 0755 -o root -g root /usr/local/lib/eugene-plexus "$SITE_ROOT" "$SITE_ROOT/bin" as_root install -d -m 0700 -o root -g root "$SITE_CACHE" "$SITE_CACHE/home" "$SITE_CACHE/uv" _uv=$SITE_ROOT/bin/uv _have=$(as_site_root "$_uv" --version 2>/dev/null \ | sed -n 's/^uv \([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*/\1/p' | head -n 1 || true) if [ -z "$_have" ] || version_older "$_have" "$UV_MINIMUM"; then say "fetching uv for the job-site host (into $SITE_ROOT/bin, as root)" # Fetched to a file only root can read or replace, the fetch checked, # then run -- the same shape as step 1, and never `sh -c "$(curl)"`. _boot=$(as_root mktemp "$SITE_CACHE/uv-install.XXXXXX") _err=$(as_root mktemp "$SITE_CACHE/uv-fetch.XXXXXX") if ! as_site_root sh -c 'curl -fsSL -o "$1" https://astral.sh/uv/install.sh 2>"$2"' sh "$_boot" "$_err"; then printf '\033[31merror:\033[0m could not fetch https://astral.sh/uv/install.sh\n' >&2 as_root cat "$_err" | sed 's/^/ /' >&2 printf ' A proxy that intercepts TLS is the usual cause. Set HTTPS_PROXY.\n' >&2 as_root rm -f "$_boot" "$_err" exit 1 fi run_step "installing uv for the job-site host" \ as_site_root UV_UNMANAGED_INSTALL="$SITE_ROOT/bin" sh "$_boot" as_root rm -f "$_boot" "$_err" as_root test -x "$_uv" || die "uv did not land at $_uv" fi if ! as_root test -x "$SITE_PY"; then run_step "creating a Python $PY_VERSION virtualenv for the job-site host" \ as_site_root "$_uv" venv --python "$PY_REQUEST" --python-preference only-managed "$SITE_ROOT/venv" as_root test -x "$SITE_PY" || die "uv reported success but there is no interpreter at $SITE_PY" fi run_step "installing the job-site host" \ as_site_root "$_uv" pip install --python "$SITE_PY" \ --reinstall-package eugene-plexus-site-host "$_spec" # Root's, and writable by nobody else, whatever uv's umask made. as_root chown -R root:root "$SITE_ROOT" as_root chmod -R go-w,a+rX "$SITE_ROOT" as_site_account "$SITE_PY" -I -c 'import eugene_plexus_site_host, eugene_plexus_site_host.worker' \ || die "the job-site host was installed, but the $SITE_SVC_ACCOUNT account cannot run it" printf '%s\n' "$_want" | put_changed 0644 root:root "$SITE_ROOT/PIN" } # Root's configuration: the links and the local servers (root's to write; the # site host reads them and cannot change them), and the site host's # environment. `links.json` and `servers.yaml` are made once and then left: # they are what the people at the machine have put in them. write_site_config() { as_root install -d -m 0755 -o root -g root /etc/eugene-plexus "$SITE_CONF" if ! as_root test -e "$SITE_CONF/links.json"; then printf '{"version": 1, "links": []}\n' | put_changed 0644 root:root "$SITE_CONF/links.json" fi if ! as_root test -e "$SITE_CONF/servers.yaml"; then printf 'servers: []\n' | put_changed 0640 "root:$SITE_SVC_ACCOUNT" "$SITE_CONF/servers.yaml" fi as_root chown root:root "$SITE_CONF/links.json" as_root chmod 0644 "$SITE_CONF/links.json" as_root chown "root:$SITE_SVC_ACCOUNT" "$SITE_CONF/servers.yaml" as_root chmod 0640 "$SITE_CONF/servers.yaml" SITE_PORT=$(as_root cat "$SITE_CONF/host.json" 2>/dev/null \ | sed -n 's/.*"port"[^0-9]*\([0-9][0-9]*\).*/\1/p' | head -n 1 || true) SITE_PORT=${SITE_PORT:-$SITE_DEFAULT_PORT} printf '{"port": %s}\n' "$SITE_PORT" | put_changed 0644 root:root "$SITE_CONF/host.json" # systemd reads an EnvironmentFile's quotes, so the JSON list is in # single quotes: everything inside them is literal. put_changed 0644 root:root "$SITE_CONF/host.env" <&2; exit 1; } LINKED=" " for U in $WANT; do case "$U" in ''|*[!0-9]*) continue ;; esac [ "${#U}" -le 9 ] || continue [ "$(expr "$U" + 0)" = "$U" ] || continue [ "$U" -ge 1000 ] || continue if ! getent passwd "$U" >/dev/null 2>&1; then echo "eugene-plexus-site-workers: no account has uid $U on this machine; skipped" >&2 continue fi LINKED="$LINKED$U " systemctl enable --now "$UNIT@$U.service" >/dev/null 2>&1 \ || echo "eugene-plexus-site-workers: could not start the worker for uid $U" >&2 done # Every worker that is loaded, or only enabled, for an account that is not # linked: stopped and disabled. HAVE=$( { systemctl list-units --all --plain --no-legend --type=service "$UNIT@*.service" 2>/dev/null | awk '{ for (i = 1; i <= NF; i++) if ($i ~ /^eugene-plexus-site-worker@/) { print $i; break } }' find /etc/systemd/system -name "$UNIT@*.service" 2>/dev/null | sed 's|.*/||' } | sed -n "s/^$UNIT@\([0-9][0-9]*\)\.service\$/\1/p" | sort -u ) for U in $HAVE; do case "$LINKED" in *" $U "*) continue ;; esac systemctl disable --now "$UNIT@$U.service" >/dev/null 2>&1 \ || systemctl stop "$UNIT@$U.service" >/dev/null 2>&1 || true done exit 0 SITEWORKERS } site_reconcile() { as_root "$SITE_WORKERS" || warn "could not start the workers for the linked people: sudo $SITE_WORKERS" } # Everything a site needs on disk, in one call: used by --job-site and by # an update. site_prepare() { ensure_site_account install_site_host write_site_config write_site_units } # An update (run as root by the update unit): the program at this # installer's pin, the units as this installer writes them, and the host and # its workers restarted. Does nothing on a machine that is not a job site. update_site_host() { as_root test -f "$SITE_CONF/host.env" || return 0 say "updating the job-site host" site_prepare as_root systemctl daemon-reload as_root systemctl restart eugene-plexus-site-host.service as_root systemctl try-restart 'eugene-plexus-site-worker@*.service' >/dev/null 2>&1 || true site_reconcile } # Removal. The state folder holds the site's key and its enrollment, so it # is handled like the prefix is: moved aside, handed to root (the account is # deleted next, and files left under its number would belong to whichever # system account is given that number later), and said. It is never deleted # here. The apps' state folders (systemd's) are left where they are, so # this is the one place a state folder is moved. remove_site_host() { as_root systemctl disable --now eugene-plexus-site-workers.path eugene-plexus-site-workers.service \ eugene-plexus-site-host.service >/dev/null 2>&1 || true for _u in $(as_root find /etc/systemd/system -name 'eugene-plexus-site-worker@[0-9]*.service' 2>/dev/null \ | sed 's|.*/||' | sort -u); do as_root systemctl disable --now "$_u" >/dev/null 2>&1 || as_root systemctl stop "$_u" >/dev/null 2>&1 || true done as_root rm -f "$SITE_HOST_UNIT" "$SITE_WORKER_UNIT" "$SITE_WORKERS_UNIT" "$SITE_WORKERS_PATH" "$SITE_WORKERS" as_root rm -rf "$SITE_ROOT" "$SITE_CONF" "$SITE_CACHE" as_root rmdir /etc/eugene-plexus >/dev/null 2>&1 || true as_root systemctl daemon-reload >/dev/null 2>&1 || true if as_root test -d "$SITE_SVC_HOME"; then _keep=$SITE_SVC_HOME.removed-$(date +%Y%m%d%H%M%S) as_root mv "$SITE_SVC_HOME" "$_keep" as_root chown -R root:root "$_keep" as_root chmod 0700 "$_keep" say "the job site's own records are at $_keep (readable by root only);" say " delete it when you are sure: sudo rm -rf '$_keep'. The install it joined still lists" say " this machine as a job site: remove it there (Workbench, Job sites)." fi if id "$SITE_SVC_ACCOUNT" >/dev/null 2>&1; then as_root userdel "$SITE_SVC_ACCOUNT" >/dev/null 2>&1 \ || warn "could not remove the $SITE_SVC_ACCOUNT account: sudo userdel $SITE_SVC_ACCOUNT" fi } # --- the person at the machine: a password and an account ----------------- # A password is read where only the person can see it -- the terminal, with # echo off -- or, for automation, from the first line of this script's own # standard input (--password-stdin). It is never an argument or part of the # environment of any process: it is written to the site host's stdin by a # shell builtin. site_read_password() { SITE_PW= if [ "$PASSWORD_STDIN" = 1 ]; then IFS= read -r SITE_PW || true else ( : /dev/null || die "this needs $1's Eugene password, typed at a terminal, and this has none. Run it from a terminal, or give the password as the first line of standard input with --password-stdin (save this script to a file first, so its own standard input is free)." printf "%s, your own Eugene password, the one you sign in to Workbench with: " "$1" >/dev/tty TTY_SAVED=$(stty -g /dev/null || true) stty -echo /dev/null || true IFS= read -r SITE_PW /dev/null || true; fi TTY_SAVED= printf '\n' >/dev/tty fi [ -n "$SITE_PW" ] || die "no password was given, so nothing was changed" } # Which account a person works as: --site-account, else the account that ran # sudo. Never root, never a system account, never one of Eugene's own. site_resolve_account() { if [ -n "$SITE_LINK_ACCOUNT" ]; then SITE_UID=$(id -u -- "$SITE_LINK_ACCOUNT" 2>/dev/null) \ || die "there is no account named $SITE_LINK_ACCOUNT on this machine" elif [ -n "${SUDO_UID:-}" ]; then SITE_UID=$SUDO_UID else die "say which account this person works as on this machine: --site-account USER (it is taken from sudo when you run this with sudo)" fi case "$SITE_UID" in ''|*[!0-9]*) die "that account's number ($SITE_UID) is not one this installer can use" ;; esac [ "$SITE_UID" != 0 ] || die "root cannot be linked to a person: their calls would run as root" [ "$SITE_UID" -ge 1000 ] || die "uid $SITE_UID is a system account, not a person (people are uid 1000 and up)" for _a in "$SITE_SVC_ACCOUNT" "$SYSTEM_ACCOUNT"; do if [ "$(id -u -- "$_a" 2>/dev/null || true)" = "$SITE_UID" ]; then die "$_a is one of Eugene's own accounts, not a person. Name the person's own account." fi done SITE_UNAME=$(getent passwd "$SITE_UID" | cut -d: -f1) [ -n "$SITE_UNAME" ] || die "no account on this machine has uid $SITE_UID" } site_link_py() { as_site_root "$SITE_PY" -I -c "$SITE_LINK_PY" "$@"; } # Commands from Workbench (J9, J30): the administrator's answer, recorded in # the protected list; the site host and the workers restart to read it (a # worker reads its copy of the list when it starts). site_commands_set() { as_root "$SITE_PY" -I -c "$SITE_CONSENT_PY" "$SITE_CONF/servers.yaml" "$1" "${SUDO_USER:-root}" \ || die "the answer about commands was not recorded (see above)" as_root systemctl try-restart eugene-plexus-site-host.service >/dev/null 2>&1 || true as_root systemctl try-restart 'eugene-plexus-site-worker@*.service' >/dev/null 2>&1 || true if [ "$1" = yes ]; then say "commands from Workbench may run on this machine now, each signed by its person," say " in their own workspaces whose rules ask about them. Take it back: --site-no-commands" else say "commands from Workbench do not run on this machine. Allow them later: --site-commands" fi } # J30's one question at the join, asked of the administrator running it, # unless --site-commands or --site-no-commands answered it ahead. Nobody at a # terminal is a no. site_commands_ask() { if [ -z "$SITE_COMMANDS" ]; then SITE_COMMANDS=no if ( : /dev/null; then printf "Allow tools that change this machine's settings or run programs? [y/N] " >/dev/tty _answer= IFS= read -r _answer /dev/null 2>&1 || die "this needs root, and sudo is not installed. Run it as root." sudo -v || die "sudo was refused, so nothing was changed" fi } site_require_installed() { as_root test -f "$SITE_CONF/host.env" && as_root test -f "$SITE_SVC_HOME/site.json" \ || die "this machine is not a job site yet. Add it first, with the join command Workbench gives you (Job sites -> Add a job site)." } # --site-link: who the person is, from their Eugene sign-in typed here, and # then a link written by root. The site host's own account asks the root; # root never takes the person's word for who they are. site_link_person() { [ -n "$SITE_PERSON" ] || die "--site-link needs --person NAME, how that person signs in to Eugene" site_system_preflight "--site-link" site_require_installed site_resolve_account site_read_password "$SITE_PERSON" _who=$(printf '%s\n' "$SITE_PW" | as_site_account "$SITE_PY" -I -m eugene_plexus_site_host \ check-person --name "$SITE_PERSON" --data-dir "$SITE_SVC_HOME") \ || die "$SITE_PERSON could not be checked (see above), so nobody was linked" SITE_PW= site_link_py link "$SITE_CONF/links.json" "$_who" "$SITE_UID" "$SITE_UNAME" \ || die "nobody was linked" # The path unit starts the worker too; this makes it immediate. site_reconcile say "done: $SITE_PERSON's job-site calls on this machine now run as $SITE_UNAME, in their own files" say " and with their own permissions." } # --site-pair (J14a.3): a Linux system install has no page at the machine, # so the code for pairing the owner's passkey is shown here, at the terminal # the owner is already at. The site host makes it and checks the passkey's # MAC with it; this script only asks the running host for it, as the host's # own account, which can read the host's loopback token. site_host_port() { as_root cat "$SITE_CONF/host.json" 2>/dev/null \ | sed -n 's/.*"port"[^0-9]*\([0-9][0-9]*\).*/\1/p' | head -n 1 || true } site_passkey_command() { site_system_preflight "$1" site_require_installed _port=$(site_host_port) [ -n "$_port" ] || die "the job site's port is not recorded in $SITE_CONF/host.json" shift as_site_account "$SITE_PY" -I -m eugene_plexus_site_host "$@" \ --data-dir "$SITE_SVC_HOME" --port "$_port" } site_unlink_person() { [ -n "$SITE_PERSON" ] || die "--site-unlink needs --person NAME" site_system_preflight "--site-unlink" site_require_installed site_link_py unlink "$SITE_CONF/links.json" "$SITE_PERSON" || die "nobody was unlinked" site_reconcile } # --job-site on a system install: the program, the account, the root's # configuration and units; the site host's own `join`, run as its own # account with the owner's password on its standard input; the owner's link; # then the site host and the workers started. site_join_system() { site_system_preflight "a job site" as_root test -x "$VENV/bin/eugene-plexus-agent" || die "this machine is not a node yet. Install Eugene here and join it to your install first, then run this again. A machine that is only a job site waits for the standalone install." # --label first (row 8), then --name, then this machine's host name. SITE_LABEL=${JOIN_LABEL:-${JOIN_NAME:-$(hostname)}} # Before anything is changed: a link that cannot be made stops the run # now, not after the machine has joined. site_resolve_account site_prepare as_root systemctl daemon-reload site_read_password "$JOIN_OWNER" set -- join --data-dir "$SITE_SVC_HOME" --url "$JOIN_CONTROL" --token "$JOIN_TOKEN" \ --owner "$JOIN_OWNER" --label "$SITE_LABEL" if [ -n "$JOIN_ROOT_KEY" ]; then set -- "$@" --root-key "$JOIN_ROOT_KEY"; fi say "adding $SITE_LABEL as a job site of $JOIN_OWNER" printf '%s\n' "$SITE_PW" | as_site_account "$SITE_PY" -I -m eugene_plexus_site_host "$@" \ || die "the job site was not added (see above). Its program and accounts are installed; run the same command again once that is fixed." SITE_PW= site_link_py owner "$SITE_CONF/links.json" "$SITE_SVC_HOME/site.json" "$SITE_UID" "$SITE_UNAME" \ || die "the site joined, but its owner was not linked to an account. Run: --site-link --person $JOIN_OWNER" as_root systemctl enable --now eugene-plexus-site-host.service eugene-plexus-site-workers.path \ >/dev/null 2>&1 || warn "could not enable the job-site units: sudo systemctl enable --now eugene-plexus-site-host.service eugene-plexus-site-workers.path" # The host reads its enrollment at start, and may have run before it. as_root systemctl restart eugene-plexus-site-host.service \ || warn "the job-site host did not start: sudo journalctl -u eugene-plexus-site-host" site_reconcile site_commands_ask say "done: $SITE_LABEL is a job site of $JOIN_OWNER. Its owner manages it from Workbench (Job sites)." say " $JOIN_OWNER's calls on this machine run as the account $SITE_UNAME, in their own files." say " Anyone else's run in that same worker, confined to the folders $JOIN_OWNER shares." say " To let another person work as their own account here, they or you run, on this machine:" say " curl -fsSL $INSTALLER_URL | sudo sh -s -- --site-link --person NAME --account USER" say " No tool runs here until $JOIN_OWNER pairs a passkey from Workbench (at its https" say " address) and approves this machine's rules with it. To show the code for that, run:" say " curl -fsSL $INSTALLER_URL | sudo sh -s -- --site-pair" } # --- service plumbing ------------------------------------------------- # A *user* service in the per-user layout: it reads the user's own model # directories and writes to the user's own keyring, and the cost is # stated where it bites, at enable-linger below. A *system* service in the # default Linux layout, for the reasons above. SYSTEMD_UNIT=$HOME/.config/systemd/user/$SERVICE_LABEL.service SYSTEM_UNIT=/etc/systemd/system/$SERVICE_LABEL.service LAUNCHD_PLIST=$HOME/Library/LaunchAgents/$LAUNCHD_LABEL.plist service_stop() { if [ "$MODE" = system ]; then [ -f "$SYSTEM_UNIT" ] || return 0 as_root systemctl stop "$SERVICE_LABEL" >/dev/null 2>&1 || true as_root systemctl disable "$SERVICE_LABEL" >/dev/null 2>&1 || true elif [ "$PLATFORM" = linux ]; then [ -f "$SYSTEMD_UNIT" ] || return 0 systemctl --user stop "$SERVICE_LABEL" >/dev/null 2>&1 || true systemctl --user disable "$SERVICE_LABEL" >/dev/null 2>&1 || true else [ -f "$LAUNCHD_PLIST" ] || return 0 launchctl bootout "gui/$(id -u)/$LAUNCHD_LABEL" >/dev/null 2>&1 || true fi } # What says a system install is here: the systemd unit on Linux, the # LaunchDaemon on a Mac. SYSTEM_SERVICE_FILE=$SYSTEM_UNIT [ "$PLATFORM" != macos ] || SYSTEM_SERVICE_FILE=$LAUNCHD_DAEMON # --- the Mac's system install (row 8) ---------------------------------- # A LaunchDaemon in Eugene's own hidden account, as the Linux system # install is a system unit in its own: the Mac's tools are dscl for the # account, launchctl's system domain for the job, and a passphrase file for # the unlock, because the Keychain stays locked until somebody signs in. NL=' ' MIGRATE=0 MIGRATING=0 MIGRATE_DONE=0 MIGRATE_FRESH_PREFIX=0 MIGRATED_ENGINES=0 MAC_COPY_EXCLUDE= MOVE_REPORT= MIGRATE_PORT= MIGRATE_HOST= GROUP_CREATED=0 DAEMON_STARTED=0 # plist_get FILE KEY.PATH: one value out of a plist, or a failure. plutil # reads it on macOS 12 and later, PlistBuddy on anything older. plist_get() { if _pv=$(plutil -extract "$2" raw -o - "$1" 2>/dev/null); then printf '%s' "$_pv" return 0 fi _pv=$(/usr/libexec/PlistBuddy -c "Print :$(printf '%s' "$2" | tr . :)" "$1" 2>/dev/null) || return 1 printf '%s' "$_pv" } # The same, out of a plist of the person's, read as the person. person_plist_get() { if _pv=$(as_person plutil -extract "$2" raw -o - "$1" 2>/dev/null); then printf '%s' "$_pv" return 0 fi _pv=$(as_person /usr/libexec/PlistBuddy -c "Print :$(printf '%s' "$2" | tr . :)" "$1" 2>/dev/null) || return 1 printf '%s' "$_pv" } # PATH, as the person sees it, is on the disk that holds the new prefix. mac_same_disk() { _here=$(as_person df -P "$1" 2>/dev/null | awk 'NR == 2 {print $1}') _there=$(df -P "${PREFIX%/*}" 2>/dev/null | awk 'NR == 2 {print $1}') [ -n "$_here" ] && [ "$_here" = "$_there" ] } # Text for a plist's : &, < and > escaped, so a path holding one # is still that path. The heredoc this replaced wrote invalid XML for it. xml_text() { case "$1" in *"$NL"*) die "a path with a line break in it cannot go into a launchd job: $1" ;; esac printf '%s' "$1" | sed -e 's/&/\&/g' -e 's//\>/g' } plist_env() { printf ' %s%s\n' "$1" "$(xml_text "$2")"; } # One word for sh, whatever it holds: single quotes, each ' closed, escaped, reopened. sh_quote() { printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"; } # launchd_xml daemon|agent: the job, on standard output. Each environment # value on one line with its key, so `--update` reads the port back as it # always has. The daemon runs as Eugene's account (UserName, GroupName) with # the Linux system unit's environment; the agent runs as the person. launchd_xml() { printf '%s\n' '' \ '' \ '' '' printf ' Label%s\n' "$LAUNCHD_LABEL" if [ "$1" = daemon ]; then printf ' UserName%s\n' "$(xml_text "$SYSTEM_ACCOUNT")" printf ' GroupName%s\n' "$(xml_text "$SYSTEM_ACCOUNT")" fi printf ' ProgramArguments\n \n' printf ' %s\n' "$(xml_text "$VENV/bin/eugene-plexus-agent")" printf ' --unattended\n \n' printf ' EnvironmentVariables\n \n' if [ "$1" = daemon ]; then plist_env HOME "$PREFIX" plist_env USER "$SYSTEM_ACCOUNT" fi plist_env EUGENE_PLEXUS_AGENT_CONFIG_FILE "$CONFIG" if [ "$1" = daemon ]; then plist_env EUGENE_PLEXUS_AGENT_ENGINE_ROOT "$PREFIX/engines" # No Keychain before somebody signs in: the passphrase is kept here, # readable by Eugene's account only (MAC-KEY), and the control root # on this machine reads the same file. plist_env EUGENE_PLEXUS_AGENT_PASSPHRASE_FILE "$PREFIX/passphrase" plist_env EUGENE_PLEXUS_CONTROL_PASSPHRASE_FILE "$PREFIX/passphrase" plist_env EUGENE_PLEXUS_LIBRARY_DEFAULT_MODEL_ROOTS "$MODELS_DIR" fi if [ "$WIDE" = 1 ]; then plist_env EUGENE_PLEXUS_AGENT_BIND_HOST 0.0.0.0; fi if [ "$PORT" != 8079 ]; then plist_env EUGENE_PLEXUS_AGENT_BIND_PORT "$PORT"; fi printf ' \n' printf ' WorkingDirectory%s\n' "$(xml_text "$PREFIX")" printf ' RunAtLoad\n' if [ "$1" = daemon ]; then # Always brought back, so the agent can restart itself by ending: # its account cannot ask launchd to restart a system job. printf ' KeepAlive\n' printf ' ThrottleInterval10\n' else printf ' KeepAliveSuccessfulExit\n' fi printf ' StandardOutPath%s\n' "$(xml_text "$PREFIX/logs/launchd.out.log")" printf ' StandardErrorPath%s\n' "$(xml_text "$PREFIX/logs/launchd.err.log")" printf '%s\n' '' '' } # **Never root** (row 8). A system job with no UserName runs as root, and # this one's program lives in a folder Eugene's account can write -- so a # job naming nobody, root or anyone but that account would hand it root. # Read back from the file as written, and the account itself checked: a # service account below 500, never uid 0, never in wheel or admin. check_daemon_account() { _du=$(plist_get "$1" UserName) || _du= _dg=$(plist_get "$1" GroupName) || _dg= case "$_du" in ''|root|0) die "refusing a startup job that would run Eugene as root (UserName '${_du}'). Nothing was started." ;; esac if [ "$_du" != "$SYSTEM_ACCOUNT" ] || [ "$_dg" != "$SYSTEM_ACCOUNT" ]; then die "refusing a startup job that runs Eugene as $_du:$_dg; it runs as $SYSTEM_ACCOUNT. Nothing was started." fi _duid=$(id -u "$SYSTEM_ACCOUNT" 2>/dev/null) || die "the $SYSTEM_ACCOUNT account does not exist. Nothing was started." _dgid=$(id -g "$SYSTEM_ACCOUNT" 2>/dev/null) || _dgid=0 if [ "$_duid" = 0 ] || [ "$_dgid" = 0 ] || [ "$_duid" -ge 500 ]; then die "the $SYSTEM_ACCOUNT account has uid $_duid and gid $_dgid. Eugene's account must be a service account, numbered below 500 and outside wheel. Nothing was started." fi for _priv in admin wheel; do if dseditgroup -o checkmember -m "$SYSTEM_ACCOUNT" "$_priv" >/dev/null 2>&1; then die "the $SYSTEM_ACCOUNT account is in the $_priv group. Eugene's account must hold no privilege. Nothing was started." fi done } # A number from 400 down to 200 that is neither an account's nor a group's. mac_free_id() { _taken=$( { dscl . -list /Users UniqueID; dscl . -list /Groups PrimaryGroupID; } 2>/dev/null \ | awk '{print $NF}') _fid=400 while [ "$_fid" -ge 200 ]; do if ! printf '%s\n' "$_taken" | grep -qx "$_fid"; then printf '%s' "$_fid" return 0 fi _fid=$((_fid - 1)) done return 1 } # Eugene's account: hidden, no password, no login shell, its home the # prefix. Its group first, under the same number when that is free. What # was made is recorded root-only outside the prefix, so removal deletes # only an account (and a group) this installer made. mac_create_account() { _aid=$(mac_free_id) || die "no account number from 200 to 400 is free for $SYSTEM_ACCOUNT" say "creating the $SYSTEM_ACCOUNT account (hidden, no password, no login shell)" if dscl . -read "/Groups/$SYSTEM_ACCOUNT" PrimaryGroupID >/dev/null 2>&1; then _agid=$(dscl . -read "/Groups/$SYSTEM_ACCOUNT" PrimaryGroupID | awk '{print $2}') else { as_root dscl . -create "/Groups/$SYSTEM_ACCOUNT" \ && as_root dscl . -create "/Groups/$SYSTEM_ACCOUNT" PrimaryGroupID "$_aid" \ && as_root dscl . -create "/Groups/$SYSTEM_ACCOUNT" RealName "Eugene Plexus" \ && as_root dscl . -create "/Groups/$SYSTEM_ACCOUNT" Password '*'; } \ || die "could not create the $SYSTEM_ACCOUNT group" _agid=$_aid GROUP_CREATED=1 fi { as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" UniqueID "$_aid" \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" PrimaryGroupID "$_agid" \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" UserShell /usr/bin/false \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" NFSHomeDirectory "$PREFIX" \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" RealName "Eugene Plexus" \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" IsHidden 1 \ && as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" Password '*'; } \ || die "could not create the $SYSTEM_ACCOUNT account" ACCOUNT_CREATED=1 printf 'account %s %s %s\n' "$_aid" "$_agid" "$GROUP_CREATED" \ | as_root tee "$MAC_RECEIPTS/account.txt" >/dev/null as_root chmod 0644 "$MAC_RECEIPTS/account.txt" # Exactly one account holds that number, and it is this one. _holders=$(dscl . -list /Users UniqueID 2>/dev/null | awk -v id="$_aid" '$2 == id {print $1}') [ "$_holders" = "$SYSTEM_ACCOUNT" ] \ || die "account number $_aid is held by '$(printf '%s' "$_holders" | tr '\n' ' ')' as well as $SYSTEM_ACCOUNT" } # Undo mac_create_account, for a run that is putting the machine back. mac_delete_account() { [ -f "$MAC_RECEIPTS/account.txt" ] || return 0 read -r _k _did _dgid _dgroup < "$MAC_RECEIPTS/account.txt" || true if [ -n "$_did" ] && [ "$_did" != 0 ] && [ "$(id -u "$SYSTEM_ACCOUNT" 2>/dev/null)" = "$_did" ]; then as_root dseditgroup -o edit -d "$SYSTEM_ACCOUNT" -t user "$MODELS_GROUP" >/dev/null 2>&1 || true as_root dscl . -delete "/Users/$SYSTEM_ACCOUNT" >/dev/null 2>&1 || true fi if [ "$_dgroup" = 1 ] && [ -n "$_dgid" ] && [ "$_dgid" != 0 ] \ && [ "$(dscl . -read "/Groups/$SYSTEM_ACCOUNT" PrimaryGroupID 2>/dev/null | awk '{print $2}')" = "$_dgid" ]; then as_root dscl . -delete "/Groups/$SYSTEM_ACCOUNT" >/dev/null 2>&1 || true fi as_root rm -f "$MAC_RECEIPTS/account.txt" } # Every run: the account stays without a login shell and hidden, and in no # group but its own and the models group. A build of this row before its # review put it in the person's group (`staff` on a Mac, every person's); # a membership listed by name there is taken back. Only one listed by # name: everyone on a Mac is in staff through a nested group, which no # installer added. mac_account_settings() { as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" UserShell /usr/bin/false \ || die "could not set $SYSTEM_ACCOUNT's shell" as_root dscl . -create "/Users/$SYSTEM_ACCOUNT" IsHidden 1 || true for _g in staff ${PERSON_GROUP:+"$PERSON_GROUP"}; do case "$_g" in "$SYSTEM_ACCOUNT"|"$MODELS_GROUP") continue ;; esac if dscl . -read "/Groups/$_g" GroupMembership 2>/dev/null | sed 's/^GroupMembership://' \ | tr ' ' '\n' | grep -qx "$SYSTEM_ACCOUNT"; then if as_root dseditgroup -o edit -d "$SYSTEM_ACCOUNT" -t user "$_g" >/dev/null 2>&1; then say "took $SYSTEM_ACCOUNT out of the $_g group, which an earlier build put it in" else warn "$SYSTEM_ACCOUNT is in the $_g group and could not be taken out: sudo dseditgroup -o edit -d $SYSTEM_ACCOUNT -t user $_g" fi fi done mac_models_group } # **The models folder has a group of its own** (row 8 review, least # privilege). On a Mac the person's primary group is `staff`, which every # person on the Mac shares, so Eugene's account in `staff` could read every # person's group-readable files. Instead a group holds Eugene's account and # the person who installed it, owns `~/Eugene Models` (2770), and may only # pass through the person's home (an ACL entry, `search`: no listing). Made # once, recorded like the account, so removal deletes only what this # installer made. MODELS_GROUP=_eugeneplexusmodels MODELS_GROUP_CREATED=0 MODELS_ACE="group:$MODELS_GROUP allow search" MODELS_ACE_ADDED=0 mac_models_group() { if ! dscl . -read "/Groups/$MODELS_GROUP" PrimaryGroupID >/dev/null 2>&1; then _mgid=$(mac_free_id) || die "no group number from 200 to 400 is free for $MODELS_GROUP" { as_root dscl . -create "/Groups/$MODELS_GROUP" \ && as_root dscl . -create "/Groups/$MODELS_GROUP" PrimaryGroupID "$_mgid" \ && as_root dscl . -create "/Groups/$MODELS_GROUP" RealName "Eugene Plexus models" \ && as_root dscl . -create "/Groups/$MODELS_GROUP" Password '*'; } \ || die "could not create the $MODELS_GROUP group" MODELS_GROUP_CREATED=1 printf 'group %s\n' "$_mgid" | as_root tee "$MAC_RECEIPTS/models-group.txt" >/dev/null as_root chmod 0644 "$MAC_RECEIPTS/models-group.txt" fi for _member in "$SYSTEM_ACCOUNT" ${PERSON:+"$PERSON"}; do as_root dseditgroup -o edit -a "$_member" -t user "$MODELS_GROUP" >/dev/null 2>&1 \ || warn "could not add $_member to the $MODELS_GROUP group, so Eugene may not reach the models in your home: sudo dseditgroup -o edit -a $_member -t user $MODELS_GROUP" done } # The person's home carries the models group's entry. macOS lists a # folder's ACL entries under it, one a line, with `ls -le` -- by name, and # only without `-n`, which prints each entry's group by its UUID instead # (re-review 5). mac_has_models_ace() { as_root ls -led "$1" 2>/dev/null | grep -qF -- "$MODELS_ACE" } # **The home's entry goes on every way out of a run that added it** # (row 8 re-review): a refused run, a move put back, a fresh install that # stopped before its startup job was in place. Once the job is in place # the install exists, and its removal takes the entry out by the receipt. # An entry that will not come out is said, and its receipt stays, so the # removal can still find it. mac_remove_models_ace() { [ -n "$PERSON_HOME" ] || return 0 as_root chmod -h -a "$MODELS_ACE" "$PERSON_HOME" >/dev/null 2>&1 || true if mac_has_models_ace "$PERSON_HOME"; then warn "could not take Eugene's entry out of $PERSON_HOME's ACL: sudo chmod -a '$MODELS_ACE' '$PERSON_HOME'" return 0 fi as_root rm -f "$MAC_RECEIPTS/models-ace.txt" MODELS_ACE_ADDED=0 } # Undo mac_models_group: the home's ACL entry, then the group, if this # installer made it and it still has the number it was given. mac_delete_models_group() { mac_remove_models_ace [ -f "$MAC_RECEIPTS/models-group.txt" ] || return 0 read -r _k _mgid < "$MAC_RECEIPTS/models-group.txt" || true if [ -n "$_mgid" ] && [ "$_mgid" != 0 ] \ && [ "$(dscl . -read "/Groups/$MODELS_GROUP" PrimaryGroupID 2>/dev/null | awk '{print $2}')" = "$_mgid" ]; then as_root dscl . -delete "/Groups/$MODELS_GROUP" >/dev/null 2>&1 || true fi as_root rm -f "$MAC_RECEIPTS/models-group.txt" } # `~/Eugene Models`: the person's, group-owned by the models group, 2770; # and the person's home lets that group pass through and nothing more. Not # through a link: the folder is checked, and the group and mode are set on # what is there, never on what a link points to (`-h`). mac_prepare_models_dir() { if [ -z "$PERSON_HOME" ]; then MODELS_DIR=$PREFIX/models as_service mkdir -p "$MODELS_DIR" return 0 fi MODELS_DIR="$PERSON_HOME/Eugene Models" if [ -L "$MODELS_DIR" ]; then die "$MODELS_DIR is a link. Eugene keeps its models in a real folder there; move the link away, then run this again." fi if [ ! -d "$MODELS_DIR" ]; then as_person mkdir -p "$MODELS_DIR" say "made $MODELS_DIR for your models (Eugene reaches it through its own group, $MODELS_GROUP)" fi { as_root chgrp -h "$MODELS_GROUP" "$MODELS_DIR" && as_root chmod -h 2770 "$MODELS_DIR"; } \ || die "could not give $MODELS_DIR to the $MODELS_GROUP group" # Once: an entry already there (an install before this one made it) is # left as it is, and is not this run's to take out again. Where it was # put is recorded root-only, so removal by root alone finds it. if ! mac_has_models_ace "$PERSON_HOME"; then if as_root chmod -h +a "$MODELS_ACE" "$PERSON_HOME"; then MODELS_ACE_ADDED=1 else warn "could not let Eugene's group pass through $PERSON_HOME, so it may not reach $MODELS_DIR: sudo chmod +a '$MODELS_ACE' '$PERSON_HOME'" return 0 fi fi printf '%s\n' "$PERSON_HOME" | as_root tee "$MAC_RECEIPTS/models-ace.txt" >/dev/null as_root chmod 0644 "$MAC_RECEIPTS/models-ace.txt" } # The daemon's plist: written under a temporary name, checked, renamed. write_launch_daemon() { as_root rm -f "$LAUNCHD_DAEMON.new" launchd_xml daemon | (umask 022; as_root tee "$LAUNCHD_DAEMON.new" >/dev/null) as_root chown root:wheel "$LAUNCHD_DAEMON.new" as_root chmod 0644 "$LAUNCHD_DAEMON.new" _lint=$(as_root plutil -lint "$LAUNCHD_DAEMON.new" 2>&1) \ || die "the startup job written for Eugene is not a valid plist: $_lint" check_daemon_account "$LAUNCHD_DAEMON.new" as_root mv -f "$LAUNCHD_DAEMON.new" "$LAUNCHD_DAEMON" } # Start (or restart) the daemon. launchd sometimes refuses a bootstrap for # a moment after a bootout of the same label, so a refusal is tried again # for a few seconds before its words are the answer. start_launch_daemon() { as_root launchctl bootout "system/$LAUNCHD_LABEL" >/dev/null 2>&1 || true _try=0 while :; do if _said=$(as_root launchctl bootstrap system "$LAUNCHD_DAEMON" 2>&1); then DAEMON_STARTED=1 return 0 fi _try=$((_try + 1)) [ "$_try" -lt 5 ] || die "macOS refused to start Eugene's startup job: ${_said:-launchctl gave no reason}" sleep 1 done } # When the agent binds wide, macOS's firewall would ask whether to allow # incoming connections -- and a daemon has nobody to ask. Allow this # install's own Python, and record it where removal looks. mac_allow_firewall() { _fw=/usr/libexec/ApplicationFirewall/socketfilterfw [ -x "$_fw" ] || return 0 _py=$(in_prefix "$PYBIN" -I -c 'import os, sys; print(os.path.realpath(sys.executable))' 2>/dev/null) || _py= case "$_py" in "$PREFIX"/*) ;; *) warn "could not find this install's Python to allow it through the macOS firewall"; return 0 ;; esac case "$_py" in *"$NL"*) return 0 ;; esac if as_root "$_fw" --add "$_py" >/dev/null 2>&1 && as_root "$_fw" --unblockapp "$_py" >/dev/null 2>&1; then if ! as_root grep -qxF -- "$_py" "$MAC_RECEIPTS/firewall.txt" 2>/dev/null; then printf '%s\n' "$_py" | as_root tee -a "$MAC_RECEIPTS/firewall.txt" >/dev/null fi else warn "the macOS firewall did not take Eugene's Python ($_py); allow it in System Settings > Network > Firewall > Options if other devices cannot connect" fi } # Root's own copy of the removal script, outside the prefix, and the # Finder app that runs it -- in the person's Applications, as theirs. A # move writes the app only once it has finished: until then the app there # is the old install's, and a move that is put back keeps it. mac_write_removal() { removal_script | (umask 022; as_root tee "$MAC_RECEIPTS/remove.sh.new" >/dev/null) as_root chown root:wheel "$MAC_RECEIPTS/remove.sh.new" as_root chmod 0755 "$MAC_RECEIPTS/remove.sh.new" as_root mv -f "$MAC_RECEIPTS/remove.sh.new" "$MAC_RECEIPTS/remove.sh" if [ "$MIGRATE" != 1 ] || [ "$MIGRATE_DONE" = 1 ]; then mac_write_removal_app; fi } mac_write_removal_app() { [ -n "$PERSON_HOME" ] || return 0 _app="$PERSON_HOME/Applications/Remove Eugene Plexus.app" as_person mkdir -p "$_app/Contents/MacOS" "$_app/Contents/Resources" || return 0 { printf '%s\n' '' \ '' \ '' '' \ ' CFBundleIdentifiercom.eugeneplexus.remove' \ ' CFBundleNameRemove Eugene Plexus' \ ' CFBundleDisplayNameRemove Eugene Plexus' \ ' CFBundleExecutableremove' \ ' CFBundlePackageTypeAPPL' \ ' CFBundleVersion1' \ ' LSUIElement' '' '' } | as_person tee "$_app/Contents/Info.plist" >/dev/null printf '#!/bin/sh\nexec /bin/sh %s --prefix %s --interactive\n' \ "$(sh_quote "$MAC_RECEIPTS/remove.sh")" "$(sh_quote "$PREFIX")" \ | as_person tee "$_app/Contents/MacOS/remove" >/dev/null as_person chmod 0755 "$_app/Contents/MacOS/remove" printf '%s\n' "$PREFIX" | as_person tee "$_app/Contents/Resources/prefix.txt" >/dev/null printf '%s\n' "$_app" | as_root tee "$MAC_RECEIPTS/mac-app.txt" >/dev/null say "removal: open \"Remove Eugene Plexus\" in $PERSON_HOME/Applications" } # --- moving a Mac's LaunchAgent install to the daemon -------------------- # A plain re-run over the old per-user layout (row 8, "Migration"). The old # prefix is never written: its state is COPIED into the new prefix, the # copy becomes the daemon, and only once the daemon answers is the old # LaunchAgent removed and its folder moved aside (not deleted). Until then # any failure -- a refused download, launchd's refusal, an agent that never # answers, an interrupt -- boots the daemon out, removes the copy and the # account this run made, and starts the untouched LaunchAgent again. mac_migrate_check() { _old=$PERSON_USER_PREFIX if [ -f "$LAUNCHD_DAEMON" ]; then die "this Mac has two Eugene startup jobs: the daemon ($LAUNCHD_DAEMON) and your own LaunchAgent ($PERSON_LAUNCH_AGENT). Remove the per-user one first: curl -fsSL $INSTALLER_URL | sh -s -- --user --uninstall then run this again." fi # The person's files are read as the person: root reads nothing through # a path the person controls (row 8 re-review). _old_program=$(person_plist_get "$PERSON_LAUNCH_AGENT" ProgramArguments.0) || _old_program= case "$_old_program" in "$_old"/*) ;; *) die "Eugene's startup job in your account ($PERSON_LAUNCH_AGENT) starts ${_old_program:-nothing this installer can read}, which is not the install at $_old. Remove that install with its own removal, then run this again. Nothing was changed." ;; esac as_person test -f "$_old/agent.yaml" || die "Eugene's startup job in your account names $_old, which holds no install. Remove $PERSON_LAUNCH_AGENT, then run this again. Nothing was changed." ! as_person test -L "$_old" || die "$_old is a link, so Eugene was not moved from it: its folder is kept once the move is done, and never through a link. Nothing was changed." # **One disk** (re-review): the old folder is kept, out of the person's # reach, by one rename beside the new prefix. Across disks a rename is a # copy, so it is refused before anything changes. if ! mac_same_disk "$_old"; then die "$_old is on another disk than ${PREFIX%/*}, so Eugene was not moved to start at boot. Its folder holds this machine's keys, and is kept out of your account's reach by renaming it beside $PREFIX, which works only on one disk. Nothing was changed. To keep Eugene as it is, starting when you sign in, and update it: re-run with --user To start it at boot as a new machine: remove it (--user --uninstall keeps its files), then run this again; machines joined to it join again." fi if as_person grep -q '^signingKey:' "$_old/node.yaml" 2>/dev/null; then die "the Eugene install at $_old is from alpha.2 or earlier and cannot move. Remove it (--user --uninstall keeps its files), then run this again." fi # Keep the port and the bind host the old job started the agent with. MIGRATE_PORT=$(person_plist_get "$PERSON_LAUNCH_AGENT" EnvironmentVariables.EUGENE_PLEXUS_AGENT_BIND_PORT) || MIGRATE_PORT= MIGRATE_HOST=$(person_plist_get "$PERSON_LAUNCH_AGENT" EnvironmentVariables.EUGENE_PLEXUS_AGENT_BIND_HOST) || MIGRATE_HOST= case "$MIGRATE_PORT" in ''|*[!0-9]*) MIGRATE_PORT= ;; esac # The move is checked by starting the daemon; without that it could end # with two startup jobs, or none that works. [ "$DO_START" = 1 ] || die "moving Eugene to start at boot starts it once to check the move. Re-run without --no-start. Nothing was changed." mac_migrate_room # The words first, then the one password. say "Eugene will start when this Mac starts, before anyone signs in, in an account of its own." say " This needs your password once. After the move, sign in to Eugene once; from then on" say " it unlocks by itself." if [ "$(id -u)" != 0 ]; then sudo -v || die "sudo was refused, so Eugene was left as it is: it starts when you sign in. To keep it that way and update it, re-run with --user." fi if [ -e "$PREFIX" ] || [ -L "$PREFIX" ]; then if as_root test -L "$PREFIX" || [ -n "$(as_root ls -A "$PREFIX" 2>/dev/null)" ]; then die "$PREFIX already holds files, so Eugene was not moved there. Move them away, then run this again. Nothing was changed." fi else MIGRATE_FRESH_PREFIX=1 fi MIGRATE=1 } # Stop the LaunchAgent and copy what it keeps. Called once the account and # the new prefix exist, before anything is downloaded into it. mac_migrate_copy() { _old=$PERSON_USER_PREFIX _engines=$PERSON_HOME/.eugene-plexus/engines MIGRATING=1 say "stopping Eugene in your account; it starts again from $PREFIX" # From a root shell, the person's own launchctl if root's is refused. launchctl bootout "gui/$PERSON_UID/$LAUNCHD_LABEL" >/dev/null 2>&1 \ || as_person launchctl bootout "gui/$PERSON_UID/$LAUNCHD_LABEL" >/dev/null 2>&1 || true _waited=0 while :; do _left=$(ps -axo pid=,comm= | awk -v a="$_old/" -v b="$_engines/" \ '{pid=$1; sub(/^[[:space:]]*[0-9]+[[:space:]]+/, ""); if (index($0, a) == 1 || index($0, b) == 1) print pid}') [ -n "$_left" ] || break [ "$_waited" -lt 15 ] || die "Eugene is still running from $_old (process $(printf '%s' "$_left" | tr '\n' ' ')) 15 seconds after it was asked to stop, so it was not moved." sleep 1 _waited=$((_waited + 1)) done say "copying its identity, settings and Library state to $PREFIX (nothing that runs crosses)" set -- MAC_COPY_EXCLUDE= for _item in "$_old"/* "$_old"/.[!.]*; do as_person test -e "$_item" || as_person test -L "$_item" || continue mac_migrate_carries "$_item" || continue set -- "$@" "./${_item##*/}" done # An app's data and keys cross; its environment, the shared app # interpreters and caches do not: the agent builds them again. for _app in "$_old"/apps/*; do as_person test -d "$_app" && ! as_person test -L "$_app" || continue _id=${_app##*/} case "$_id" in *[!A-Za-z0-9._-]*) die "an app folder in $_old/apps has a name Eugene does not make ($_id), so Eugene was not moved. Nothing was changed." ;; esac # In any case: a Mac's volume ignores it, so `Versions` would be # the app's `versions` to the daemon (8c re-review). case "$(mac_lower "$_id")" in launcher|pythons|.cache|ctl) MAC_COPY_EXCLUDE="$MAC_COPY_EXCLUDE --exclude=./apps/$_id" ;; *) MAC_COPY_EXCLUDE="$MAC_COPY_EXCLUDE --exclude=./apps/$_id/versions" for _entry in "$_app"/*; do _entry=${_entry##*/} if [ "$_entry" != versions ] && [ "$(mac_lower "$_entry")" = versions ]; then MAC_COPY_EXCLUDE="$MAC_COPY_EXCLUDE --exclude=./apps/$_id/$_entry" fi done ;; esac done _bin_before=$(in_prefix ls -A "$PREFIX/bin") if [ "$#" -gt 0 ]; then mac_copy_as_person "$_old" . "$@"; fi MAC_COPY_EXCLUDE= mac_migrate_reserved "$_bin_before" mac_migrate_engine_records in_prefix chmod 0750 "$PREFIX" } # NAME in lower case, to match a name the way a Mac's volume does. mac_lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]' } # **Names that never cross are taken out of the copy by lookup** (row 8c, # second re-review). A Mac's volume takes more spellings as one name than # any list here can hold -- it folds case and more (`exec-approvalſ.json`, # with U+017F, is `exec-approvals.json`) -- so after the copy each reserved # name is removed by its own spelling, and the volume decides what that # reaches. Anything still there stops the move, naming it. `bin` was made # before the copy: it must hold what it held then. An app's `versions` goes # the same way. Python code needs nothing more: imports check a name # exactly, even where the volume ignores case. MAC_RESERVED="exec-approvals.json venv pythons .cache uninstall update engines eugene-mlx install-check.py release-requirements.lock .engine-records" mac_migrate_reserved() { for _reserved in $MAC_RESERVED; do mac_remove_by_lookup "$PREFIX/$_reserved" done for _app in "$PREFIX"/apps/*; do in_prefix test -d "$_app" || continue mac_remove_by_lookup "$_app/versions" done if [ "$(in_prefix ls -A "$PREFIX/bin")" != "$1" ]; then die "the copy put something into $PREFIX/bin, under a name this volume takes for bin, so Eugene was not moved. Nothing of the old install was changed." fi } mac_remove_by_lookup() { if in_prefix test -e "$1" || in_prefix test -L "$1"; then say "did not carry ${1#"$PREFIX"/} (the old install held a name this volume takes for it)" fi in_prefix rm -rf "$1" if in_prefix test -e "$1" || in_prefix test -L "$1"; then die "the copy still holds $1 after it was removed, so Eugene was not moved. Nothing of the old install was changed." fi } # What the move leaves behind: what this install makes again, and what # runs -- the engine store and an MLX environment among it. mac_migrate_skips() { case "$(mac_lower "$1")" in venv|pythons|bin|.cache|uninstall|update|engines|eugene-mlx|install-check.py|release-requirements.lock) return 0 ;; esac return 1 } # **Only state crosses, never anything that runs** (row 8 review). An item # at the top of the old folder crosses when it is a plain file or folder # (no link), is not code (a Python module, a `.pth` or a compiled # library: a component starts with the prefix as its folder) and is not a # Python environment or package; and the copy then holds no link and no # file that can be executed (mac_copy_as_person). Read as the person. mac_migrate_carries() { _name=${1##*/} mac_migrate_skips "$_name" && return 1 if as_person test -L "$1"; then say "did not carry $_name: a link" return 1 fi if as_person test -d "$1"; then if as_person test -e "$1/pyvenv.cfg" || as_person test -e "$1/__init__.py"; then say "did not carry $_name: Python code" return 1 fi return 0 fi if ! as_person test -f "$1"; then say "did not carry $_name: not a file or a folder" return 1 fi # Matched in any case: a Mac's volume ignores it, so `Exec-Approvals.json` # is the daemon's `exec-approvals.json` (8c re-review). case "$(mac_lower "$_name")" in *.py|*.pyc|*.pyo|*.pth|*.so|*.dylib|*.pyd) say "did not carry $_name: code" return 1 ;; # What an owner approved for Eugene's own account to run (row 8c): # a program running as the person could have written it, and # carried it would let the daemon run what nobody approved. exec-approvals.json) say "did not carry $_name: the owner approves programs again for Eugene's own account" return 1 ;; esac return 0 } # The person's engine builds are not carried (R8-ENGINES-COPY): only their # install records cross, as data, so the agent knows which builds to fetch # again. Links among them are dropped with the rest. mac_migrate_engine_records() { _store=$PERSON_HOME/.eugene-plexus/engines as_person test -d "$_store" && ! as_person test -L "$_store" || return 0 MIGRATED_ENGINES=1 set -- for _record in "$_store"/*/*/install.json; do _build=${_record%/install.json} as_person test -f "$_record" && ! as_person test -L "$_record" || continue ! as_person test -L "$_build" && ! as_person test -L "${_build%/*}" || continue set -- "$@" "./${_record#"$_store"/}" done [ "$#" -gt 0 ] || return 0 mac_copy_as_person "$_store" .engine-records "$@" } # PATH's size in KiB as the person reads it (links not followed), or a # failure: a size that cannot be read is never taken as nothing. mac_size_kb() { _sz=$(as_person du -sk "$1" 2>/dev/null | awk 'NR == 1 && $1 ~ /^[0-9]+$/ {print $1}') [ -n "$_sz" ] || return 1 printf '%s' "$_sz" } # **Room for the move, said in numbers before anything stops** (row 8 # re-review). The copy is staged in the new prefix and then unpacked # beside it, so it needs twice what it copies (sized as the person reads # it), plus room for Eugene's own Python and packages. A size or a free # space that cannot be read stops the move: it is never taken as enough. MIGRATE_HEADROOM_KB=524288 mac_migrate_room() { _old=$PERSON_USER_PREFIX _parent=${PREFIX%/*} _need=0 for _item in "$_old"/* "$_old"/.[!.]*; do [ -e "$_item" ] || [ -L "$_item" ] || continue mac_migrate_skips "${_item##*/}" && continue _k=$(mac_size_kb "$_item") \ || die "could not tell how big $_item is, so Eugene was not moved. Nothing was changed." _need=$((_need + _k)) done _free=$(df -Pk "$_parent" 2>/dev/null | awk 'NR == 2 {print $4}') case "$_free" in ''|*[!0-9]*) die "could not tell how much room the disk holding $_parent has, so Eugene was not moved. Nothing was changed." ;; esac _room=$((2 * _need + MIGRATE_HEADROOM_KB)) if [ "$_free" -lt "$_room" ]; then die "the move needs $(( (_room + 1023) / 1024 )) MiB on the disk that holds $_parent: twice $(( (_need + 1023) / 1024 )) MiB to copy Eugene's settings and Library state (staged, then unpacked), and $((MIGRATE_HEADROOM_KB / 1024)) MiB for its own Python and packages. That disk has $((_free / 1024)) MiB free. Make room, then run this again. Nothing was changed." fi } # **The copy never uses root's access** (row 8 review), **passes through # nothing the person could swap, and is bounded, and is data only** # (re-reviews). MAC_COPY_EXCLUDE holds `--exclude` options for what stays # behind inside the items (an app's environment). The person's tar reads # the old folder -- what the person can read, links kept as links, never # followed -- and streams it to Eugene's account, # which keeps the stream in its own prefix (closed to the person) and # stops it at what was measured just before, plus a tenth and 64 MiB: a # folder that grows while it is copied is refused, not copied without end. # The account's tar then unpacks it, restoring nothing but names, contents # and links: no owner, no permissions, no ACL, no extended attribute, no # file flag, no Mac metadata -- an entry that grants someone the prefix # opens nothing. The modes are then the account's own: nothing it copied # is open to its group or to others. The person's tar's own status comes # back on fd 3, which neither side holds. COPY_SLACK_BYTES=67108864 mac_copy_as_person() { _from=$1 _dest=$2; shift 2 _bytes=0 for _item in "$@"; do _k=$(mac_size_kb "$_from/${_item#./}") \ || die "could not tell how big $_from/${_item#./} is, so it was not copied" _bytes=$((_bytes + _k * 1024)) done _limit=$((_bytes + _bytes / 10 + COPY_SLACK_BYTES)) _staged=$PREFIX/.move.tar in_prefix rm -f "$_staged" # shellcheck disable=SC2086 # MAC_COPY_EXCLUDE: --exclude options, app ids checked by the caller if ! _read=$( { { as_person env COPYFILE_DISABLE=1 tar -cf - -C "$_from" $MAC_COPY_EXCLUDE "$@" 3>&-; printf '%s' "$?" >&3; } \ | as_service sh -c 'umask 077 && head -c "$1" > "$2"' sh "$((_limit + 1))" "$_staged" \ >&2 3>&-; } 3>&1 ); then in_prefix rm -f "$_staged" die "could not keep the copy of $_from in $PREFIX (see above)" fi _got=$(in_prefix wc -c "$_staged" 2>/dev/null | awk 'NR == 1 {print $1}') case "$_got" in ''|*[!0-9]*) _got=$((_limit + 1)) ;; esac if [ "$_got" -gt "$_limit" ]; then in_prefix rm -f "$_staged" die "$_from grew past $((_limit / 1048576)) MiB while it was being copied (it measured $((_bytes / 1048576)) MiB just before), so it was not moved." fi if [ "$_read" != 0 ]; then in_prefix rm -f "$_staged" die "could not read $_from to move it (see above)" fi in_prefix mkdir -p "$PREFIX/$_dest" if ! as_service tar -x --no-same-owner --no-same-permissions --no-acls --no-xattrs \ --no-fflags --no-mac-metadata -f "$_staged" -C "$PREFIX/$_dest"; then in_prefix rm -f "$_staged" die "could not copy $_from into $PREFIX (see above)" fi in_prefix rm -f "$_staged" # Nothing copied can be run: no link stays (one could name a program # of the person's), no file keeps an execute bit, and nothing is open # to the account's group or to others. for _item in "$@"; do _here=$PREFIX/$_dest/${_item#./} { in_prefix find "$_here" -type l -exec rm -f {} + \ && in_prefix find "$_here" -type f -exec chmod u-x,go-rwx {} + \ && in_prefix find "$_here" -type d -exec chmod go-rwx {} +; } \ || die "could not make what was copied into $PREFIX data only, closed to everyone but Eugene's account" done } # The copy's settings named the old folder; they name the new one now. And # an install that unlocked from the Keychain unlocks from the passphrase # file: the daemon has no Keychain (MAC-KEY). Its first sign-in writes it. mac_migrate_rewrite() { MOVE_REPORT= # **A setting that named a program in the old install is turned off** # (row 8 review): nothing that runs crosses the move, so what it named # is not there, and the same path in the new prefix must never come to # name something. Each one is said, and kept in root's receipt. _said=$(in_prefix "$PYBIN" -I - "$PERSON_USER_PREFIX" "$PREFIX" "$PERSON_HOME/.eugene-plexus/engines" <<'PYEOF' import pathlib import re import sys old, new, old_store = sys.argv[1], sys.argv[2], sys.argv[3] KEYS = ("vllmBinary", "mlxBinary", "strataServer", "kevPython", "uvBinary") def clean(value): value = value.strip() if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"": value = value[1:-1] return value def in_old(value): value = clean(value) return any(value == root or value.startswith(root.rstrip("/") + "/") for root in (old, old_store)) said = [] def turn_off(name, value): said.append( f"turned off {name}: it named {clean(value)}, in the old install, and nothing that runs " "crosses the move. Install it again, or let Eugene fetch its own build." ) agent = pathlib.Path(new) / "agent.yaml" if agent.is_file() and not agent.is_symlink(): lines = agent.read_text(encoding="utf-8").splitlines(keepends=True) out = [] roots = False for line in lines: keyed = re.match(r"^(%s):\s*(.*?)\s*$" % "|".join(KEYS), line) if keyed and in_old(keyed.group(2)): turn_off(keyed.group(1), keyed.group(2)) out.append(f"{keyed.group(1)}: null\n") roots = False continue if re.match(r"^engineBinaryRoots:", line): roots = True inline = line.split(":", 1)[1].strip() if inline.startswith("[") and inline.endswith("]"): roots = False kept = [] for item in inline[1:-1].split(","): if item.strip() and in_old(item): turn_off("an engineBinaryRoots folder", item) elif item.strip(): kept.append(item.strip()) out.append("engineBinaryRoots: [" + ", ".join(kept) + "]\n") continue out.append(line) continue if roots: item = re.match(r"^(\s*)-\s*(.+?)\s*$", line) if item: if in_old(item.group(2)): turn_off("an engineBinaryRoots folder", item.group(2)) continue out.append(line) continue roots = False runtime = re.match(r"^(\s+(?:-\s+)?)binary:\s*(.*?)\s*$", line) if runtime and runtime.group(2) and in_old(runtime.group(2)): turn_off("a runtime's binary", runtime.group(2)) out.append(f"{runtime.group(1)}binary: null\n") continue out.append(line) moved = "".join(out) if moved != "".join(lines): staged = agent.with_name("agent.yaml.moving") staged.write_text(moved, encoding="utf-8", newline="\n") staged.replace(agent) inside = re.compile(re.escape(old) + r"(?=[/\"'\s,\]}]|$)", re.M) for path in sorted(pathlib.Path(new).glob("*.yaml")) + sorted(pathlib.Path(new).glob("*.json")): if path.is_symlink() or not path.is_file(): continue text = path.read_text(encoding="utf-8") moved = inside.sub(lambda _: new, text) if path.name in ("agent.yaml", "control.yaml"): moved = re.sub(r"(?m)^securityMode:\s*os_keyring\s*$", "securityMode: passphrase_file", moved) if moved != text: temporary = path.with_name(path.name + ".moving") temporary.write_text(moved, encoding="utf-8", newline="\n") temporary.replace(path) for line in said: print(line) PYEOF ) || die "could not point the moved settings at $PREFIX" if [ -n "$_said" ]; then printf '%s\n' "$_said" | while IFS= read -r _line; do [ -z "$_line" ] || say "$_line" done MOVE_REPORT=$_said fi mac_migrate_relist } # **What the move left behind is listed for the agent to build again** # (row 8, R8-ENGINES-COPY Choice 2): no engine build crosses, so the newest # of each engine's builds the person had -- read from the install records # the copy carried as data -- goes in engines/refetch.json, which the agent # fetches again from upstream when it starts; and every app whose data # crossed goes in apps/rebuild.json, which the agent installs again from # its own catalogue (an app the person added waits to be installed again # by hand). Done as Eugene's account. mac_migrate_relist() { _said=$(in_prefix "$PYBIN" -I - "$PREFIX" <<'PYEOF' import json import shutil import sys from pathlib import Path prefix = Path(sys.argv[1]) records = prefix / ".engine-records" refetch = [] if records.is_dir() and not records.is_symlink(): for engine in sorted(records.iterdir()): if engine.is_symlink() or not engine.is_dir(): continue newest = None for build in sorted(engine.iterdir()): record = build / "install.json" if build.is_symlink() or record.is_symlink() or not record.is_file(): continue try: meta = json.loads(record.read_text(encoding="utf-8")) except (OSError, ValueError): continue meta = meta if isinstance(meta, dict) else {} when = str(meta.get("installedAt") or "") if newest is None or when > newest[0]: entry = {"engine": engine.name, "version": str(meta.get("version") or build.name)} if meta.get("variant"): entry["variant"] = str(meta["variant"]) newest = (when, entry) if newest is not None: refetch.append(newest[1]) print(f"Eugene fetches {engine.name} {newest[1]['version']} again from GitHub when it starts " "(no engine build crosses the move)") shutil.rmtree(records) if refetch: store = prefix / "engines" store.mkdir(exist_ok=True) staged = store / "refetch.json.new" staged.write_text(json.dumps({"builds": refetch}, indent=2), encoding="utf-8", newline="\n") staged.replace(store / "refetch.json") apps = prefix / "apps" rebuild = [] if apps.is_dir() and not apps.is_symlink(): for app in sorted(apps.iterdir()): if app.is_dir() and not app.is_symlink() and app.name not in ("launcher", "pythons", ".cache", "ctl"): rebuild.append(app.name) if rebuild: staged = apps / "rebuild.json.new" staged.write_text(json.dumps({"apps": rebuild}, indent=2), encoding="utf-8", newline="\n") staged.replace(apps / "rebuild.json") print(f"Eugene installs {', '.join(rebuild)} again when it starts (an app's data and keys cross " "the move, its environment does not; an app you added yourself waits to be installed again)") PYEOF ) || die "could not list what Eugene builds again after the move (see above)" printf '%s\n' "$_said" | while IFS= read -r _line; do [ -z "$_line" ] || say "$_line" done } # **A copied setting that names a program Eugene's own account does not # run as it is is kept, and said** (row 8, part 8c). The daemon's agent runs # an engine binary, and the uv it installs apps with, when the file and # every folder above it belong to root or to Eugene's account and none can # be written by its group or others. One that a single other account can # change (a program in the person's home) runs once an owner approves it in # the console; one that a group, others or two accounts can change never # runs. The move keeps those settings as they were, and lists each one -- # here, and in root's receipt (move-report.txt) -- as "Eugene will ask # before running it" or "It will not run until moved". Read as Eugene's # account, which is how the daemon will see them; the agent's own check # (`exec_trust`) walks every link and interpreter too, and decides. mac_migrate_report_settings() { _said=$(in_prefix "$PYBIN" -I - "$PREFIX/agent.yaml" <<'PYEOF' import os import re import stat import sys from pathlib import Path KEYS = ("vllmBinary", "mlxBinary", "strataServer", "kevPython", "uvBinary") me = os.geteuid() def clean(value): value = value.strip() if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"": value = value[1:-1] return "" if value in ("", "null", "~", "[]") else value def name_of(uid): try: import pwd return pwd.getpwuid(uid).pw_name except (ImportError, KeyError): return f"user {uid}" def judged(path): """None when Eugene's account runs PATH; ("ask", why) when one other account can change it and nobody else can; ("refuse", why) otherwise.""" given = Path(os.path.abspath(os.path.expanduser(path))) real = Path(os.path.realpath(given)) parts = [real, *real.parents] parts += [p for p in given.parents if p not in parts] owners = set() for part in parts: try: info = os.lstat(part) except OSError as e: return ("refuse", f"it cannot be checked ({e.strerror})") if stat.S_ISLNK(info.st_mode): continue if info.st_mode & (stat.S_IWGRP | stat.S_IWOTH): return ("refuse", f"{part} can be changed by others") if info.st_uid not in (0, me): owners.add(info.st_uid) if len(owners) > 1: names = ", ".join(sorted(name_of(uid) for uid in owners)) return ("refuse", f"more than one account can change it ({names})") if owners: return ("ask", f"{name_of(owners.pop())} can change it") return None found = [] try: text = Path(sys.argv[1]).read_text(encoding="utf-8") except OSError: text = "" roots = False for line in text.splitlines(): keyed = re.match(r"^(%s):\s*(.*)$" % "|".join(KEYS), line) if keyed: roots = False if clean(keyed.group(2)): found.append((keyed.group(1), clean(keyed.group(2)))) continue if re.match(r"^engineBinaryRoots:\s*(.*)$", line): roots = True inline = line.split(":", 1)[1].strip() if inline.startswith("[") and inline.endswith("]"): roots = False for item in inline[1:-1].split(","): if clean(item): found.append(("engineBinaryRoots", clean(item))) continue if roots: item = re.match(r"^\s*-\s*(.+)$", line) if item: if clean(item.group(1)): found.append(("engineBinaryRoots", clean(item.group(1)))) continue roots = False runtime = re.match(r"^\s+(?:-\s+)?binary:\s*(.*)$", line) if runtime and clean(runtime.group(1)): found.append(("a runtime's binary", clean(runtime.group(1)))) for label, path in found: verdict = judged(path) if verdict is None: continue kind, why = verdict if kind == "ask": print(f"{label} names {path}: {why}. Eugene will ask before running it.") else: print(f"{label} names {path}: {why}. It will not run until moved.") PYEOF ) || die "could not read the settings copied into $PREFIX (see above)" if [ -n "$_said" ]; then say "these settings name programs someone besides root or Eugene's account can change" say " (approve one in the console when Eugene asks, move it into a folder only root or" say " Eugene's account can change, or let Eugene fetch its own build):" printf '%s\n' "$_said" | while IFS= read -r _line; do [ -z "$_line" ] || say " $_line" done MOVE_REPORT="${MOVE_REPORT:+$MOVE_REPORT }$_said" fi [ -n "$MOVE_REPORT" ] || return 0 printf '%s\n' "$MOVE_REPORT" | as_root tee "$MAC_RECEIPTS/move-report.txt" >/dev/null as_root chmod 0644 "$MAC_RECEIPTS/move-report.txt" } # DIR is a real folder (no link), root's (0:0), mode 0700, with no ACL # entry: nobody but root reaches anything inside it, by any path. macOS # prints a folder's ACL entries on lines of their own under `ls -le`. mac_closed() { as_root test -d "$1" && ! as_root test -L "$1" || return 1 _ls=$(as_root ls -lden "$1" 2>/dev/null) || return 1 [ "$(printf '%s\n' "$_ls" | wc -l | tr -d ' ')" = 1 ] || return 1 set -f # shellcheck disable=SC2086 # the fields of ls's line, on purpose set -- $_ls set +f case "$1" in drwx------|drwx------@) ;; *) return 1 ;; esac [ "$3" = 0 ] && [ "$4" = 0 ] } # The fields of `ls -ldn PATH`'s line, as LS_MODE, LS_UID; read as RUNNER # (as_root or as_person). mac_ls_fields() { _ls=$("$1" ls -ldn "$2" 2>/dev/null | head -n 1) || return 1 set -f # shellcheck disable=SC2086 # the fields of ls's line, on purpose set -- $_ls set +f LS_MODE=${1:-} LS_UID=${3:-} [ -n "$LS_UID" ] } # PATH, as the person sees it, is a real folder (no link) of the person's. mac_persons_own_folder() { as_person test -d "$1" && ! as_person test -L "$1" || return 1 mac_ls_fields as_person "$1" && [ -n "$PERSON_UID" ] && [ "$LS_UID" = "$PERSON_UID" ] } # **The old folder is kept as root's, beside the new prefix** (row 8 # review): its node.yaml holds this machine's private keys in clear, and a # program running as the person could otherwise read them and sign as the # machine. # # **Inside a folder root makes for it, put there by the person's own # rename** (re-reviews A and 1-3). Root makes `.moved-