diff --git a/orchestrator/src/commands/install.ts b/orchestrator/src/commands/install.ts index e2fa799..626918d 100644 --- a/orchestrator/src/commands/install.ts +++ b/orchestrator/src/commands/install.ts @@ -1,5 +1,5 @@ import type { InstallContext, InstallOptions } from "../types/context"; -import { exists, readText, writeText } from "../lib/fs"; +import { exists, readText, writeText, writeTextAtomic } from "../lib/fs"; import { runVisible } from "../lib/process"; import { step } from "../lib/log"; import { readPackageValue } from "../lib/packageMeta"; @@ -81,9 +81,11 @@ export async function install(options: InstallOptions): Promise { await prepareFilesystem(context); step("write runtime env"); await runVisible`mkdir -p /etc/hy2xs`; - await writeText(options.runtimeConfigPath, renderRuntimeEnv(config), 0o600); - await runVisible`chown root:root ${options.runtimeConfigPath}`; - await runVisible`chmod 0600 ${options.runtimeConfigPath}`; + await writeTextAtomic(options.runtimeConfigPath, renderRuntimeEnv(config), { + mode: 0o600, + owner: "root", + group: "root" + }); step("bundled UI"); await deployUi(context); step("Hysteria2 upstream install"); @@ -93,8 +95,8 @@ export async function install(options: InstallOptions): Promise { step("systemd units"); await deploySystemd(context); step("firewall"); - await applyFirewall(context); state.firewallTouched = true; + await applyFirewall(context); step("post-install env"); await writePostInstallEnv(context); step("bootstrap admin secret"); diff --git a/orchestrator/src/config/env.ts b/orchestrator/src/config/env.ts index 1b2ba1c..5a0314a 100644 --- a/orchestrator/src/config/env.ts +++ b/orchestrator/src/config/env.ts @@ -112,6 +112,26 @@ function normalizeAcmeType(value: string): "http" | "tls" | "dns" { throw new Error(`invalid HY2XS_ACME_TYPE: ${value}`); } +function normalizeSafeAbsolutePath(name: string, value: string, options?: { disallowTmp?: boolean }): string { + const v = value.trim(); + if (!v.startsWith("/")) { + throw new Error(`${name} must be an absolute path`); + } + if (v === "/") { + throw new Error(`${name} must not be /`); + } + if (v.includes("\0") || /[\r\n]/.test(v)) { + throw new Error(`${name} contains forbidden control characters`); + } + if (/[;&|`$<>]/.test(v)) { + throw new Error(`${name} contains forbidden shell control characters`); + } + if (options?.disallowTmp && (v === "/tmp" || v.startsWith("/tmp/"))) { + throw new Error(`${name} must not be under /tmp`); + } + return v; +} + export function parseRuntimeEnv(content: string): RuntimeConfig { const env = parseEnv(content); @@ -142,8 +162,8 @@ export function parseRuntimeEnv(content: string): RuntimeConfig { tlsMode, acmeType, acmeEmail: env.HY2XS_ACME_EMAIL || "", - tlsCertPath: env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt", - tlsKeyPath: env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key", + tlsCertPath: normalizeSafeAbsolutePath("HY2XS_TLS_CERT_PATH", env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt"), + tlsKeyPath: normalizeSafeAbsolutePath("HY2XS_TLS_KEY_PATH", env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key"), hysteriaBindHost: normalizeIpv4Host("HY2XS_HYSTERIA_BIND_HOST", env.HY2XS_HYSTERIA_BIND_HOST || "0.0.0.0"), hysteriaPort, hysteriaAuthMode: "http", @@ -162,10 +182,10 @@ export function parseRuntimeEnv(content: string): RuntimeConfig { env.HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH, false ), - hysteriaConfigPath: env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml", - installDir: env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin", - dataDir: env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin", - logDir: env.HY2XS_LOG_DIR || "/var/log/hy2xs", + hysteriaConfigPath: normalizeSafeAbsolutePath("HY2XS_HYSTERIA_CONFIG_PATH", env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml"), + installDir: normalizeSafeAbsolutePath("HY2XS_INSTALL_DIR", env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin", { disallowTmp: true }), + dataDir: normalizeSafeAbsolutePath("HY2XS_DATA_DIR", env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin", { disallowTmp: true }), + logDir: normalizeSafeAbsolutePath("HY2XS_LOG_DIR", env.HY2XS_LOG_DIR || "/var/log/hy2xs", { disallowTmp: true }), bootstrapAdminSecretPath: "/etc/hy2xs/bootstrap-admin.secret" }; diff --git a/orchestrator/src/lib/fs.ts b/orchestrator/src/lib/fs.ts index c41944d..92c383b 100644 --- a/orchestrator/src/lib/fs.ts +++ b/orchestrator/src/lib/fs.ts @@ -19,6 +19,46 @@ export async function writeText(path: string, data: string, mode?: number): Prom } } +export async function writeTextAtomic( + path: string, + data: string, + options: { + mode: number; + owner: string; + group: string; + } +): Promise { + const dir = path.replace(/\/[^/]+$/, "") || "."; + const base = path.split("/").pop() || "tmp"; + const tmp = `${dir}/.${base}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`; + + await Bun.write(tmp, data); + + const chmodResult = Bun.spawnSync(["chmod", options.mode.toString(8), tmp], { + stdout: "pipe", + stderr: "pipe" + }); + if (!chmodResult.success) { + throw new Error(`chmod failed for ${tmp}: ${chmodResult.stderr.toString()}`); + } + + const chownResult = Bun.spawnSync(["chown", `${options.owner}:${options.group}`, tmp], { + stdout: "pipe", + stderr: "pipe" + }); + if (!chownResult.success) { + throw new Error(`chown failed for ${tmp}: ${chownResult.stderr.toString()}`); + } + + const mvResult = Bun.spawnSync(["mv", "-f", tmp, path], { + stdout: "pipe", + stderr: "pipe" + }); + if (!mvResult.success) { + throw new Error(`atomic rename failed for ${path}: ${mvResult.stderr.toString()}`); + } +} + export function renderTemplate(template: string, values: Record): string { let rendered = template; for (const [key, value] of Object.entries(values)) { diff --git a/orchestrator/src/steps/env.ts b/orchestrator/src/steps/env.ts index c3d55b2..77da5cd 100644 --- a/orchestrator/src/steps/env.ts +++ b/orchestrator/src/steps/env.ts @@ -1,6 +1,5 @@ import type { RuntimeContext } from "../types/context"; -import { readText, renderTemplate, writeText } from "../lib/fs"; -import { runVisible } from "../lib/process"; +import { readText, renderTemplate, writeTextAtomic } from "../lib/fs"; export async function writePostInstallEnv(context: RuntimeContext): Promise { const rendered = renderTemplate(await readText(`${context.options.packageDir}/templates/env/post-install.env.tpl`), { @@ -30,21 +29,25 @@ export async function writePostInstallEnv(context: RuntimeContext): Promise { - await writeText( + await writeTextAtomic( context.config.bootstrapAdminSecretPath, [ `ADMIN_USER=${context.config.adminUser}`, `ADMIN_INITIAL_PASSWORD=${context.config.adminInitialPassword}`, `ADMIN_CON_PASS=${context.config.adminConPass}` ].join("\n") + "\n", - 0o600 + { + mode: 0o600, + owner: "root", + group: "root" + } ); - await runVisible`chown root:root ${context.config.bootstrapAdminSecretPath}`; - await runVisible`chmod 0600 ${context.config.bootstrapAdminSecretPath}`; } diff --git a/orchestrator/src/steps/filesystem.ts b/orchestrator/src/steps/filesystem.ts index 5a8bb7e..ce4e201 100644 --- a/orchestrator/src/steps/filesystem.ts +++ b/orchestrator/src/steps/filesystem.ts @@ -1,41 +1,62 @@ import type { InstallContext } from "../types/context"; -import { runRawVisible, runVisible } from "../lib/process"; +import { run } from "../lib/process"; + +async function userExists(user: string): Promise { + try { + await run`id -u ${user} >/dev/null 2>&1`; + return true; + } catch { + return false; + } +} + +async function getUserField(user: string, field: number): Promise { + return (await run`getent passwd ${user} | cut -d: -f${field}`).trim(); +} + +async function getPrimaryGroup(user: string): Promise { + return (await run`id -gn ${user}`).trim(); +} + +async function ensureDir(path: string, mode: string, ownerGroup: string): Promise { + await run`install -d -m ${mode} -o ${ownerGroup.split(":")[0]} -g ${ownerGroup.split(":")[1]} ${path}`; +} + +async function makeUser(user: string, expectedHome: string): Promise { + await run`useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}`; +} async function ensureRuntimeIdentity(user: string, expectedHome: string): Promise { - const checkCmd = ` -if id -u ${user} >/dev/null 2>&1; then - shell="$(getent passwd ${user} | cut -d: -f7)" - home="$(getent passwd ${user} | cut -d: -f6)" - group="$(id -gn ${user})" - if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then - echo "existing user '${user}' has unsupported shell: $shell" >&2 - exit 1 - fi - if [ "$group" != "${user}" ]; then - echo "existing user '${user}' must have primary group '${user}', got: $group" >&2 - exit 1 - fi - if [ "$home" != "${expectedHome}" ]; then - echo "existing user '${user}' has unexpected home: $home (expected ${expectedHome})" >&2 - exit 1 - fi -else - useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user} -fi -`; - await runRawVisible(checkCmd); + if (!(await userExists(user))) { + await makeUser(user, expectedHome); + return; + } + + const shell = await getUserField(user, 7); + const home = await getUserField(user, 6); + const group = await getPrimaryGroup(user); + + if (shell !== "/usr/sbin/nologin" && shell !== "/bin/false") { + throw new Error(`existing user '${user}' has unsupported shell: ${shell}`); + } + if (group !== user) { + throw new Error(`existing user '${user}' must have primary group '${user}', got: ${group}`); + } + if (home !== expectedHome) { + throw new Error(`existing user '${user}' has unexpected home: ${home} (expected ${expectedHome})`); + } } export async function prepareFilesystem(context: InstallContext): Promise { await ensureRuntimeIdentity("hysteria", "/var/lib/hysteria"); await ensureRuntimeIdentity("hy2xs-admin", context.config.dataDir); - await runVisible`install -d -m 0700 -o root -g root /etc/hy2xs`; - await runVisible`install -d -m 0755 -o root -g root /etc/hysteria`; - await runVisible`install -d -m 0750 -o hysteria -g hysteria /var/lib/hysteria`; - await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.dataDir}`; - await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.logDir}`; - await runVisible`install -d -m 0755 -o root -g root ${context.config.installDir}`; - await runVisible`install -d -m 0755 -o root -g root /usr/local/lib/hy2xs`; - await runVisible`install -d -m 0755 -o root -g root /etc/nftables.d`; - await runVisible`chmod -R go-w ${context.config.installDir}`; + await ensureDir("/etc/hy2xs", "0700", "root:root"); + await ensureDir("/etc/hysteria", "0755", "root:root"); + await ensureDir("/var/lib/hysteria", "0750", "hysteria:hysteria"); + await ensureDir(context.config.dataDir, "0750", "hy2xs-admin:hy2xs-admin"); + await ensureDir(context.config.logDir, "0750", "hy2xs-admin:hy2xs-admin"); + await ensureDir(context.config.installDir, "0755", "root:root"); + await ensureDir("/usr/local/lib/hy2xs", "0755", "root:root"); + await ensureDir("/etc/nftables.d", "0755", "root:root"); + await run`chmod -R go-w ${context.config.installDir}`; } diff --git a/orchestrator/src/steps/firewall.ts b/orchestrator/src/steps/firewall.ts index 1c70c76..c405676 100644 --- a/orchestrator/src/steps/firewall.ts +++ b/orchestrator/src/steps/firewall.ts @@ -10,8 +10,15 @@ const FW_BACKUP_FILES = [ "/etc/nftables.d/hy2xs.nft.candidate", "/etc/nftables.d/hy2xs.nft.existed", "/etc/nftables.d/hy2xs.nft.include.existed", - "/etc/nftables.d/nftables.conf.existed" -].join(" "); + "/etc/nftables.d/nftables.conf.existed", + "/etc/nftables.d/hy2xs.rollback.prepared" +]; + +async function cleanupFirewallBackupFiles(): Promise { + for (const file of FW_BACKUP_FILES) { + await runVisible`rm -f ${file}`; + } +} function stripNftComments(content: string): string { return content @@ -62,6 +69,7 @@ export async function applyFirewall(context: RuntimeContext): Promise { fail("existing non-HY2XS nftables.conf found; set HY2XS_FIREWALL_ALLOW_TAKEOVER=true or HY2XS_FIREWALL_ENABLED=false"); } + await runVisible`touch /etc/nftables.d/hy2xs.rollback.prepared`; await runVisible`cp -a /etc/nftables.conf /etc/nftables.conf.hy2xs.bak 2>/dev/null || true`; await runVisible`cp -a /etc/nftables.d/hy2xs.nft /etc/nftables.d/hy2xs.nft.bak 2>/dev/null || true`; await runVisible`test -f /etc/nftables.conf && echo 1 > /etc/nftables.d/nftables.conf.existed || rm -f /etc/nftables.d/nftables.conf.existed`; @@ -95,7 +103,7 @@ include "/etc/nftables.d/hy2xs.nft" await runVisible`nft -c -f /etc/nftables.conf`; if (context.config.firewallStagedApply) { - await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; nft -f /etc/nftables.conf >/dev/null 2>&1 || true'`; + await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/hy2xs.rollback.prepared ]; then if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi; fi'`; } await runVisible`nft -f /etc/nftables.conf`; @@ -116,7 +124,7 @@ export async function cancelFirewallRollback(context: RuntimeContext): Promise { @@ -124,7 +132,7 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise/dev/null || true; else rm -f /etc/nftables.conf; fi`; await runVisible`if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi`; await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi`; - await runVisible`rm -f ${FW_BACKUP_FILES}`; + await cleanupFirewallBackupFiles(); }