Усилен firewall rollback lifecycle и безопасная запись конфигов/секретов

orchestrator/src/commands/install.ts

@@ -1,5 +1,5 @@
 import type { InstallContext, InstallOptions } from "../types/context";
-import { exists, readText, writeText } from "../lib/fs";
+import { exists, readText, writeText, writeTextAtomic } from "../lib/fs";
 import { runVisible } from "../lib/process";
 import { step } from "../lib/log";
 import { readPackageValue } from "../lib/packageMeta";
@@ -81,9 +81,11 @@ export async function install(options: InstallOptions): Promise<void> {
     await prepareFilesystem(context);
     step("write runtime env");
     await runVisible`mkdir -p /etc/hy2xs`;
-    await writeText(options.runtimeConfigPath, renderRuntimeEnv(config), 0o600);
-    await runVisible`chown root:root ${options.runtimeConfigPath}`;
-    await runVisible`chmod 0600 ${options.runtimeConfigPath}`;
+    await writeTextAtomic(options.runtimeConfigPath, renderRuntimeEnv(config), {
+      mode: 0o600,
+      owner: "root",
+      group: "root"
+    });
     step("bundled UI");
     await deployUi(context);
     step("Hysteria2 upstream install");
@@ -93,8 +95,8 @@ export async function install(options: InstallOptions): Promise<void> {
     step("systemd units");
     await deploySystemd(context);
     step("firewall");
-    await applyFirewall(context);
     state.firewallTouched = true;
+    await applyFirewall(context);
     step("post-install env");
     await writePostInstallEnv(context);
     step("bootstrap admin secret");

orchestrator/src/config/env.ts

@@ -112,6 +112,26 @@ function normalizeAcmeType(value: string): "http" | "tls" | "dns" {
   throw new Error(`invalid HY2XS_ACME_TYPE: ${value}`);
 }
 
+function normalizeSafeAbsolutePath(name: string, value: string, options?: { disallowTmp?: boolean }): string {
+  const v = value.trim();
+  if (!v.startsWith("/")) {
+    throw new Error(`${name} must be an absolute path`);
+  }
+  if (v === "/") {
+    throw new Error(`${name} must not be /`);
+  }
+  if (v.includes("\0") || /[\r\n]/.test(v)) {
+    throw new Error(`${name} contains forbidden control characters`);
+  }
+  if (/[;&|`$<>]/.test(v)) {
+    throw new Error(`${name} contains forbidden shell control characters`);
+  }
+  if (options?.disallowTmp && (v === "/tmp" || v.startsWith("/tmp/"))) {
+    throw new Error(`${name} must not be under /tmp`);
+  }
+  return v;
+}
+
 export function parseRuntimeEnv(content: string): RuntimeConfig {
   const env = parseEnv(content);
 
@@ -142,8 +162,8 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     tlsMode,
     acmeType,
     acmeEmail: env.HY2XS_ACME_EMAIL || "",
-    tlsCertPath: env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt",
-    tlsKeyPath: env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key",
+    tlsCertPath: normalizeSafeAbsolutePath("HY2XS_TLS_CERT_PATH", env.HY2XS_TLS_CERT_PATH || "/etc/hysteria/server.crt"),
+    tlsKeyPath: normalizeSafeAbsolutePath("HY2XS_TLS_KEY_PATH", env.HY2XS_TLS_KEY_PATH || "/etc/hysteria/server.key"),
     hysteriaBindHost: normalizeIpv4Host("HY2XS_HYSTERIA_BIND_HOST", env.HY2XS_HYSTERIA_BIND_HOST || "0.0.0.0"),
     hysteriaPort,
     hysteriaAuthMode: "http",
@@ -162,10 +182,10 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
       env.HY2XS_HYSTERIA_IGNORE_CLIENT_BANDWIDTH,
       false
     ),
-    hysteriaConfigPath: env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml",
-    installDir: env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin",
-    dataDir: env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin",
-    logDir: env.HY2XS_LOG_DIR || "/var/log/hy2xs",
+    hysteriaConfigPath: normalizeSafeAbsolutePath("HY2XS_HYSTERIA_CONFIG_PATH", env.HY2XS_HYSTERIA_CONFIG_PATH || "/etc/hysteria/config.yaml"),
+    installDir: normalizeSafeAbsolutePath("HY2XS_INSTALL_DIR", env.HY2XS_INSTALL_DIR || "/opt/hy2xs-admin", { disallowTmp: true }),
+    dataDir: normalizeSafeAbsolutePath("HY2XS_DATA_DIR", env.HY2XS_DATA_DIR || "/var/lib/hy2xs-admin", { disallowTmp: true }),
+    logDir: normalizeSafeAbsolutePath("HY2XS_LOG_DIR", env.HY2XS_LOG_DIR || "/var/log/hy2xs", { disallowTmp: true }),
     bootstrapAdminSecretPath: "/etc/hy2xs/bootstrap-admin.secret"
   };
 

orchestrator/src/lib/fs.ts

@@ -19,6 +19,46 @@ export async function writeText(path: string, data: string, mode?: number): Prom
   }
 }
 
+export async function writeTextAtomic(
+  path: string,
+  data: string,
+  options: {
+    mode: number;
+    owner: string;
+    group: string;
+  }
+): Promise<void> {
+  const dir = path.replace(/\/[^/]+$/, "") || ".";
+  const base = path.split("/").pop() || "tmp";
+  const tmp = `${dir}/.${base}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+
+  await Bun.write(tmp, data);
+
+  const chmodResult = Bun.spawnSync(["chmod", options.mode.toString(8), tmp], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (!chmodResult.success) {
+    throw new Error(`chmod failed for ${tmp}: ${chmodResult.stderr.toString()}`);
+  }
+
+  const chownResult = Bun.spawnSync(["chown", `${options.owner}:${options.group}`, tmp], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (!chownResult.success) {
+    throw new Error(`chown failed for ${tmp}: ${chownResult.stderr.toString()}`);
+  }
+
+  const mvResult = Bun.spawnSync(["mv", "-f", tmp, path], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (!mvResult.success) {
+    throw new Error(`atomic rename failed for ${path}: ${mvResult.stderr.toString()}`);
+  }
+}
+
 export function renderTemplate(template: string, values: Record<string, string | number>): string {
   let rendered = template;
   for (const [key, value] of Object.entries(values)) {

orchestrator/src/steps/env.ts

@@ -1,6 +1,5 @@
 import type { RuntimeContext } from "../types/context";
-import { readText, renderTemplate, writeText } from "../lib/fs";
-import { runVisible } from "../lib/process";
+import { readText, renderTemplate, writeTextAtomic } from "../lib/fs";
 
 export async function writePostInstallEnv(context: RuntimeContext): Promise<void> {
   const rendered = renderTemplate(await readText(`${context.options.packageDir}/templates/env/post-install.env.tpl`), {
@@ -30,21 +29,25 @@ export async function writePostInstallEnv(context: RuntimeContext): Promise<void
     LOG_DIR: context.config.logDir
   });
 
-  await writeText("/etc/hysteria/post-install.env", rendered, 0o600);
-  await runVisible`chown root:root /etc/hysteria/post-install.env`;
-  await runVisible`chmod 0600 /etc/hysteria/post-install.env`;
+  await writeTextAtomic("/etc/hysteria/post-install.env", rendered, {
+    mode: 0o600,
+    owner: "root",
+    group: "root"
+  });
 }
 
 export async function writeBootstrapAdminSecret(context: RuntimeContext): Promise<void> {
-  await writeText(
+  await writeTextAtomic(
     context.config.bootstrapAdminSecretPath,
     [
       `ADMIN_USER=${context.config.adminUser}`,
       `ADMIN_INITIAL_PASSWORD=${context.config.adminInitialPassword}`,
       `ADMIN_CON_PASS=${context.config.adminConPass}`
     ].join("\n") + "\n",
-    0o600
-  );
-  await runVisible`chown root:root ${context.config.bootstrapAdminSecretPath}`;
-  await runVisible`chmod 0600 ${context.config.bootstrapAdminSecretPath}`;
+    {
+      mode: 0o600,
+      owner: "root",
+      group: "root"
+    }
+  );
 }

orchestrator/src/steps/filesystem.ts

@@ -1,41 +1,62 @@
 import type { InstallContext } from "../types/context";
-import { runRawVisible, runVisible } from "../lib/process";
+import { run } from "../lib/process";
+
+async function userExists(user: string): Promise<boolean> {
+  try {
+    await run`id -u ${user} >/dev/null 2>&1`;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function getUserField(user: string, field: number): Promise<string> {
+  return (await run`getent passwd ${user} | cut -d: -f${field}`).trim();
+}
+
+async function getPrimaryGroup(user: string): Promise<string> {
+  return (await run`id -gn ${user}`).trim();
+}
+
+async function ensureDir(path: string, mode: string, ownerGroup: string): Promise<void> {
+  await run`install -d -m ${mode} -o ${ownerGroup.split(":")[0]} -g ${ownerGroup.split(":")[1]} ${path}`;
+}
+
+async function makeUser(user: string, expectedHome: string): Promise<void> {
+  await run`useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}`;
+}
 
 async function ensureRuntimeIdentity(user: string, expectedHome: string): Promise<void> {
-  const checkCmd = `
-if id -u ${user} >/dev/null 2>&1; then
-  shell="$(getent passwd ${user} | cut -d: -f7)"
-  home="$(getent passwd ${user} | cut -d: -f6)"
-  group="$(id -gn ${user})"
-  if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then
-    echo "existing user '${user}' has unsupported shell: $shell" >&2
-    exit 1
-  fi
-  if [ "$group" != "${user}" ]; then
-    echo "existing user '${user}' must have primary group '${user}', got: $group" >&2
-    exit 1
-  fi
-  if [ "$home" != "${expectedHome}" ]; then
-    echo "existing user '${user}' has unexpected home: $home (expected ${expectedHome})" >&2
-    exit 1
-  fi
-else
-  useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}
-fi
-`;
-  await runRawVisible(checkCmd);
+  if (!(await userExists(user))) {
+    await makeUser(user, expectedHome);
+    return;
+  }
+
+  const shell = await getUserField(user, 7);
+  const home = await getUserField(user, 6);
+  const group = await getPrimaryGroup(user);
+
+  if (shell !== "/usr/sbin/nologin" && shell !== "/bin/false") {
+    throw new Error(`existing user '${user}' has unsupported shell: ${shell}`);
+  }
+  if (group !== user) {
+    throw new Error(`existing user '${user}' must have primary group '${user}', got: ${group}`);
+  }
+  if (home !== expectedHome) {
+    throw new Error(`existing user '${user}' has unexpected home: ${home} (expected ${expectedHome})`);
+  }
 }
 
 export async function prepareFilesystem(context: InstallContext): Promise<void> {
   await ensureRuntimeIdentity("hysteria", "/var/lib/hysteria");
   await ensureRuntimeIdentity("hy2xs-admin", context.config.dataDir);
-  await runVisible`install -d -m 0700 -o root -g root /etc/hy2xs`;
-  await runVisible`install -d -m 0755 -o root -g root /etc/hysteria`;
-  await runVisible`install -d -m 0750 -o hysteria -g hysteria /var/lib/hysteria`;
-  await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.dataDir}`;
-  await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.logDir}`;
-  await runVisible`install -d -m 0755 -o root -g root ${context.config.installDir}`;
-  await runVisible`install -d -m 0755 -o root -g root /usr/local/lib/hy2xs`;
-  await runVisible`install -d -m 0755 -o root -g root /etc/nftables.d`;
-  await runVisible`chmod -R go-w ${context.config.installDir}`;
+  await ensureDir("/etc/hy2xs", "0700", "root:root");
+  await ensureDir("/etc/hysteria", "0755", "root:root");
+  await ensureDir("/var/lib/hysteria", "0750", "hysteria:hysteria");
+  await ensureDir(context.config.dataDir, "0750", "hy2xs-admin:hy2xs-admin");
+  await ensureDir(context.config.logDir, "0750", "hy2xs-admin:hy2xs-admin");
+  await ensureDir(context.config.installDir, "0755", "root:root");
+  await ensureDir("/usr/local/lib/hy2xs", "0755", "root:root");
+  await ensureDir("/etc/nftables.d", "0755", "root:root");
+  await run`chmod -R go-w ${context.config.installDir}`;
 }

orchestrator/src/steps/firewall.ts

@@ -10,8 +10,15 @@ const FW_BACKUP_FILES = [
   "/etc/nftables.d/hy2xs.nft.candidate",
   "/etc/nftables.d/hy2xs.nft.existed",
   "/etc/nftables.d/hy2xs.nft.include.existed",
-  "/etc/nftables.d/nftables.conf.existed"
-].join(" ");
+  "/etc/nftables.d/nftables.conf.existed",
+  "/etc/nftables.d/hy2xs.rollback.prepared"
+];
+
+async function cleanupFirewallBackupFiles(): Promise<void> {
+  for (const file of FW_BACKUP_FILES) {
+    await runVisible`rm -f ${file}`;
+  }
+}
 
 function stripNftComments(content: string): string {
   return content
@@ -62,6 +69,7 @@ export async function applyFirewall(context: RuntimeContext): Promise<void> {
     fail("existing non-HY2XS nftables.conf found; set HY2XS_FIREWALL_ALLOW_TAKEOVER=true or HY2XS_FIREWALL_ENABLED=false");
   }
 
+  await runVisible`touch /etc/nftables.d/hy2xs.rollback.prepared`;
   await runVisible`cp -a /etc/nftables.conf /etc/nftables.conf.hy2xs.bak 2>/dev/null || true`;
   await runVisible`cp -a /etc/nftables.d/hy2xs.nft /etc/nftables.d/hy2xs.nft.bak 2>/dev/null || true`;
   await runVisible`test -f /etc/nftables.conf && echo 1 > /etc/nftables.d/nftables.conf.existed || rm -f /etc/nftables.d/nftables.conf.existed`;
@@ -95,7 +103,7 @@ include "/etc/nftables.d/hy2xs.nft"
   await runVisible`nft -c -f /etc/nftables.conf`;
 
   if (context.config.firewallStagedApply) {
-    await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; nft -f /etc/nftables.conf >/dev/null 2>&1 || true'`;
+    await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/hy2xs.rollback.prepared ]; then if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi; fi'`;
   }
 
   await runVisible`nft -f /etc/nftables.conf`;
@@ -116,7 +124,7 @@ export async function cancelFirewallRollback(context: RuntimeContext): Promise<v
     await runVisible`systemctl reset-failed hy2xs-fw-rollback || true`;
   }
 
-  await runVisible`rm -f ${FW_BACKUP_FILES}`;
+  await cleanupFirewallBackupFiles();
 }
 
 export async function rollbackFirewallNow(context: RuntimeContext): Promise<void> {
@@ -124,7 +132,7 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise<void
     return;
   }
 
-  if (!(await exists("/etc/nftables.d/nftables.conf.existed")) && !(await exists("/etc/nftables.d/hy2xs.nft.existed"))) {
+  if (!(await exists("/etc/nftables.d/hy2xs.rollback.prepared"))) {
     info("firewall rollback skipped: no HY2XS rollback markers found");
     return;
   }
@@ -137,5 +145,5 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise<void
   await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi`;
   await runVisible`if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi`;
   await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi`;
-  await runVisible`rm -f ${FW_BACKUP_FILES}`;
+  await cleanupFirewallBackupFiles();
 }