fix(security): harden diagnostics storage boundary

2026-09-07 19:52:11 +05:00
parent af9f476658
commit a3445f79c5
12 changed files with 562 additions and 37 deletions
@@ -1514,6 +1514,39 @@ run_single_owner_acceptance() {
    }
  ' || fail "acceptance: a diagnostics failure must never cancel the rollback"

+  log_step "Acceptance: diagnostics writes only into a trusted root namespace"
+  grep -qF 'export const DIAGNOSTICS_ROOT = `${INSTALL_STATE_DIR}/diagnostics`' \
+    orchestrator/src/lib/diagnosticsStorage.ts \
+    || fail "acceptance: diagnostics root must live below /var/lib/hy2xs"
+  ! grep -qF '/var/log/hy2xs/diagnostics' orchestrator/src/commands/diagnostics.ts \
+    || fail "acceptance: root diagnostics must not use the service-writable log namespace"
+  grep -q 'ensureDiagnosticsStorageRoot' orchestrator/src/steps/filesystem.ts \
+    || fail "acceptance: install must prepare the root-only diagnostics directory"
+  "$BUN_BIN" -e '
+    const fs = require("node:fs");
+    const storage = fs.readFileSync("orchestrator/src/lib/diagnosticsStorage.ts", "utf8");
+    const diagnostics = fs.readFileSync("orchestrator/src/commands/diagnostics.ts", "utf8");
+    for (const marker of ["lstat(", "isSymbolicLink()", "mkdtemp(", "open(archive, \"wx\"", "exactMode: DIAGNOSTICS_MODE"]) {
+      if (!storage.includes(marker)) throw new Error("missing diagnostics trust-boundary marker: " + marker);
+    }
+    if (!diagnostics.includes("createDiagnosticsWorkspace()")) {
+      throw new Error("diagnostics does not enter the trusted storage boundary");
+    }
+    if (!diagnostics.includes("runMutatingArgv([\"tar\"")) {
+      throw new Error("diagnostics archive creation must not use a shell string");
+    }
+  ' || fail "acceptance: diagnostics storage is not fail-closed against symlink substitution"
+
+  log_step "Acceptance: metadata fallback is ENOENT-only"
+  "$BUN_BIN" -e '
+    const fs = require("node:fs");
+    const source = fs.readFileSync("orchestrator/src/lib/packageMeta.ts", "utf8");
+    if (!source.includes(".code === \"ENOENT\"")) throw new Error("missing explicit ENOENT branch");
+    if (!source.includes("throw error")) throw new Error("non-ENOENT metadata errors are not rethrown");
+    const tests = fs.readFileSync("orchestrator/test/package-meta-utf8.test.ts", "utf8");
+    if (!tests.includes("каталог вместо metadata-файла")) throw new Error("missing non-ENOENT regression test");
+  ' || fail "acceptance: package metadata errors may still be masked by fallback"
+
  log_step "Acceptance: persisting the failure state never blocks the rollback"
  # Тот же класс, что и «диагностика не отменяет откат», но уровнем раньше.
  # Запись маркера отказа — это mkdir/write/chown в /var/lib/hy2xs, то есть она