diff --git a/cmd/agent/main.go b/cmd/agent/main.go index 6070a3bd..49303854 100644 --- a/cmd/agent/main.go +++ b/cmd/agent/main.go @@ -16,6 +16,7 @@ import ( "github.com/Rain-kl/Wavelet/internal/apps/agent/httpclient" "github.com/Rain-kl/Wavelet/internal/apps/agent/logging" "github.com/Rain-kl/Wavelet/internal/apps/agent/nginx" + "github.com/Rain-kl/Wavelet/internal/apps/agent/runtimeuser" "github.com/Rain-kl/Wavelet/internal/apps/agent/state" syncservice "github.com/Rain-kl/Wavelet/internal/apps/agent/sync" "github.com/Rain-kl/Wavelet/internal/apps/agent/updater" @@ -33,6 +34,14 @@ func main() { slog.Error("load agent config failed", "error", err) os.Exit(1) } + if err = runtimeuser.EnsureProcessUser(); err != nil { + slog.Error("ensure runtime user failed", "error", err) + os.Exit(1) + } + if err = runtimeuser.EnsurePathOwnership(cfg.DataDir, runtimeuser.DefaultDirPerm, runtimeuser.DefaultFilePerm); err != nil { + slog.Error("ensure data dir ownership failed", "error", err, "data_dir", cfg.DataDir) + os.Exit(1) + } cfg.ExtVersion = nginx.DetectVersion( context.Background(), nginx.ExecutorOptions{ diff --git a/docker/Dockerfile.agent b/docker/Dockerfile.agent index b9cb8669..b9d3cfd0 100644 --- a/docker/Dockerfile.agent +++ b/docker/Dockerfile.agent @@ -25,16 +25,22 @@ RUN --mount=type=cache,target=/go/pkg/mod \ FROM openresty/openresty:alpine -RUN apk add --no-cache ca-certificates tzdata perl libmaxminddb \ +RUN apk add --no-cache ca-certificates tzdata perl libmaxminddb su-exec libcap \ && ln -sf /usr/lib/libmaxminddb.so.0 /usr/lib/libmaxminddb.so \ && opm get anjia0532/lua-resty-maxminddb \ - && mkdir -p /etc/openflare /data + && addgroup -S openflare \ + && adduser -S -G openflare -H -h /data -s /sbin/nologin openflare \ + && mkdir -p /etc/openflare /data \ + && chown -R openflare:openflare /etc/openflare /data \ + && setcap 'cap_net_bind_service=+ep' /usr/local/openresty/nginx/sbin/nginx ENV OPENFLARE_OPENRESTY_PATH=openresty \ OPENFLARE_DATA_DIR=/data COPY --from=builder /build/bin/openflare-agent /usr/local/bin/openflare-agent +COPY docker/agent-entrypoint.sh /usr/local/bin/openflare-agent-entrypoint.sh +RUN chmod +x /usr/local/bin/openflare-agent-entrypoint.sh EXPOSE 80 443 18081 -ENTRYPOINT ["/usr/local/bin/openflare-agent"] -CMD ["-config", "/etc/openflare/agent.json"] +ENTRYPOINT ["/usr/local/bin/openflare-agent-entrypoint.sh"] +CMD ["-config", "/etc/openflare/agent.json"] \ No newline at end of file diff --git a/docker/agent-entrypoint.sh b/docker/agent-entrypoint.sh new file mode 100644 index 00000000..7a3cdeb7 --- /dev/null +++ b/docker/agent-entrypoint.sh @@ -0,0 +1,22 @@ +#!/bin/sh +set -eu + +RUNTIME_USER="openflare" +AGENT_BIN="/usr/local/bin/openflare-agent" +OPENRESTY_BIN="/usr/local/openresty/nginx/sbin/nginx" + +fix_runtime_ownership() { + for target in /data /etc/openflare; do + if [ -d "$target" ]; then + chown -R "${RUNTIME_USER}:${RUNTIME_USER}" "$target" 2>/dev/null || true + chmod -R u+rwX,g+rX "$target" 2>/dev/null || true + fi + done +} + +if [ "$(id -u)" -eq 0 ]; then + fix_runtime_ownership + exec su-exec "${RUNTIME_USER}" "${AGENT_BIN}" "$@" +fi + +exec "${AGENT_BIN}" "$@" \ No newline at end of file diff --git a/docs/changelog/index.md b/docs/changelog/index.md index 3154b23f..7908f944 100644 --- a/docs/changelog/index.md +++ b/docs/changelog/index.md @@ -22,6 +22,8 @@ sidebar: false ### 修复 +- 修复 Agent 与 OpenResty worker 权限不一致导致 Pages/WAF 等静态资源 Permission denied：引入共享运行时用户 `openflare`（Agent 进程、OpenResty worker、文件属主统一）；Docker 入口脚本在启动前修正 volume 属主并降权；本地 systemd 服务以 `openflare` 运行并授予 `CAP_NET_BIND_SERVICE`；`data_dir` 与 `pages_dir` 等路径在同步/Apply 时统一 `chown` 与 `0755/0644` 规范化。 + - 修复 Pages 站点根路径 `/` 访问异常：OpenResty 渲染增加 `location = /` 精确匹配；未启用 SPA Fallback 时直接提供入口文件（`index` 指令在 `try_files ... =404` 场景下不生效）；启用 SPA Fallback 时避免 `try_files $uri $uri/ /index.html` 因 `$uri/` 命中站点根目录触发内部重定向循环而返回 500。 - 修复代理路由详情认证配置 Tab：移除 PoW 配置（PoW 仅在 WAF 规则组中设置）；保留 Basic Auth 保存能力；移除页头重复的「保存当前分区」按钮。 diff --git a/internal/apps/agent/nginx/manager.go b/internal/apps/agent/nginx/manager.go index 559e2b3b..9779c4a0 100644 --- a/internal/apps/agent/nginx/manager.go +++ b/internal/apps/agent/nginx/manager.go @@ -25,6 +25,7 @@ import ( "github.com/Rain-kl/Wavelet/pkg/utils" "github.com/Rain-kl/Wavelet/internal/apps/agent/protocol" + "github.com/Rain-kl/Wavelet/internal/apps/agent/runtimeuser" ) // RuntimeConfigDirPlaceholder is substituted into generated configs at apply time. @@ -187,6 +188,7 @@ const ( ) const safeDefaultFallbackMainConfig = `# This file is generated by OpenFlare safe default fallback. +user ` + OpenFlareRuntimeUser + `; worker_processes auto; pid logs/nginx.pid; @@ -278,64 +280,32 @@ func (m *Manager) writeTargetFiles(mainConfig string, routeConfig string, suppor return m.ensureOpenRestyWorkerReadAccess() } -// ensureOpenRestyWorkerReadAccess makes runtime config and Lua paths traversable by the -// unprivileged OpenResty worker user (typically nobody). Volume mounts may create parent -// directories as 0700 root-owned; MkdirAll does not fix existing modes. +// ensureOpenRestyWorkerReadAccess assigns runtime ownership and normalized modes +// on agent-managed paths so the agent and OpenResty workers share access. func (m *Manager) ensureOpenRestyWorkerReadAccess() error { targets := []string{ m.RuntimeConfigDir, m.LuaDir, + m.PagesDir, filepath.Dir(m.MainConfigPath), filepath.Dir(m.RouteConfigPath), } if m.AccessLogPath != "" { targets = append(targets, filepath.Dir(m.AccessLogPath)) } + seen := make(map[string]struct{}, len(targets)) for _, target := range targets { - if err := ensureWorldTraversablePath(target); err != nil { - return err - } - } - if strings.TrimSpace(m.RuntimeConfigDir) == "" { - return nil - } - entries, err := os.ReadDir(m.RuntimeConfigDir) - if err != nil { - if os.IsNotExist(err) { - return nil - } - return err - } - for _, entry := range entries { - if entry.IsDir() { + cleaned := filepath.Clean(strings.TrimSpace(target)) + if cleaned == "" || cleaned == "." { continue } - path := filepath.Join(m.RuntimeConfigDir, entry.Name()) - if chmodErr := os.Chmod(path, nginxConfigFilePerm); chmodErr != nil && !os.IsNotExist(chmodErr) { - return chmodErr + if _, ok := seen[cleaned]; ok { + continue } - } - return nil -} - -func ensureWorldTraversablePath(targetDir string) error { - const maxDepth = 12 - current := filepath.Clean(strings.TrimSpace(targetDir)) - if current == "" || current == "." { - return nil - } - for depth := 0; depth < maxDepth; depth++ { - if err := os.Chmod(current, nginxDirPerm); err != nil { - if os.IsNotExist(err) || os.IsPermission(err) { - break - } - return fmt.Errorf("chmod %s: %w", current, err) + seen[cleaned] = struct{}{} + if err := runtimeuser.EnsurePathOwnership(cleaned, nginxDirPerm, nginxConfigFilePerm); err != nil { + return err } - parent := filepath.Dir(current) - if parent == current { - break - } - current = parent } return nil } diff --git a/internal/apps/agent/nginx/manager_test.go b/internal/apps/agent/nginx/manager_test.go index f349d0d9..342bc9ad 100644 --- a/internal/apps/agent/nginx/manager_test.go +++ b/internal/apps/agent/nginx/manager_test.go @@ -979,8 +979,8 @@ func TestEnsureWorldTraversableChainFixesRestrictedParentDirs(t *testing.T) { t.Fatalf("WriteFile failed: %v", err) } - if err := ensureWorldTraversablePath(runtimeDir); err != nil { - t.Fatalf("ensureWorldTraversablePath failed: %v", err) + if err := EnsureWorldTraversablePath(runtimeDir); err != nil { + t.Fatalf("EnsureWorldTraversablePath failed: %v", err) } info, err := os.Stat(filepath.Join(dataDir, "etc")) diff --git a/internal/apps/agent/nginx/runtime_access.go b/internal/apps/agent/nginx/runtime_access.go new file mode 100644 index 00000000..614221d1 --- /dev/null +++ b/internal/apps/agent/nginx/runtime_access.go @@ -0,0 +1,31 @@ +package nginx + +import ( + openrestyrender "github.com/Rain-kl/Wavelet/pkg/render/openresty" + + "github.com/Rain-kl/Wavelet/internal/apps/agent/runtimeuser" +) + +// OpenFlareRuntimeUser is the shared OS account for the agent process and +// OpenResty worker processes. +const OpenFlareRuntimeUser = openrestyrender.OpenFlareRuntimeUser + +// OpenRestyWorkerUser is an alias kept for internal call sites. +const OpenRestyWorkerUser = OpenFlareRuntimeUser + +// EnsureWorldTraversablePath makes targetDir and its ancestors world-traversable. +func EnsureWorldTraversablePath(targetDir string) error { + return runtimeuser.EnsurePathOwnership(targetDir, nginxDirPerm, nginxConfigFilePerm) +} + +// EnsureWorkerReadableTree normalizes ownership and modes under root for the +// shared runtime user. +func EnsureWorkerReadableTree(rootDir string) error { + return runtimeuser.EnsurePathOwnership(rootDir, nginxDirPerm, nginxConfigFilePerm) +} + +// EnsureWorkerReadAccess makes agent-managed runtime paths accessible to the +// shared runtime user. +func (m *Manager) EnsureWorkerReadAccess() error { + return m.ensureOpenRestyWorkerReadAccess() +} \ No newline at end of file diff --git a/internal/apps/agent/nginx/runtime_access_test.go b/internal/apps/agent/nginx/runtime_access_test.go new file mode 100644 index 00000000..38489b2b --- /dev/null +++ b/internal/apps/agent/nginx/runtime_access_test.go @@ -0,0 +1,75 @@ +package nginx + +import ( + "os" + "path/filepath" + "testing" +) + +func TestEnsureWorkerReadableTreeFixesRestrictedPagesFiles(t *testing.T) { + tempDir := t.TempDir() + pagesDir := filepath.Join(tempDir, "data", "var", "lib", "openflare", "pages") + releaseDir := filepath.Join(pagesDir, "deployments", "1", "releases", "abc123") + if err := os.MkdirAll(releaseDir, 0o700); err != nil { + t.Fatalf("MkdirAll failed: %v", err) + } + indexPath := filepath.Join(releaseDir, "index.html") + if err := os.WriteFile(indexPath, []byte(""), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + if err := EnsureWorldTraversablePath(pagesDir); err != nil { + t.Fatalf("EnsureWorldTraversablePath failed: %v", err) + } + if err := EnsureWorkerReadableTree(pagesDir); err != nil { + t.Fatalf("EnsureWorkerReadableTree failed: %v", err) + } + + info, err := os.Stat(indexPath) + if err != nil { + t.Fatalf("Stat failed: %v", err) + } + if info.Mode().Perm() != nginxConfigFilePerm { + t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, info.Mode().Perm()) + } + etcInfo, err := os.Stat(filepath.Join(tempDir, "data", "var")) + if err != nil { + t.Fatalf("Stat var failed: %v", err) + } + if etcInfo.Mode().Perm()&0o005 == 0 { + t.Fatalf("expected var directory to be world-traversable, got %o", etcInfo.Mode().Perm()) + } +} + +func TestManagerEnsureWorkerReadAccessIncludesPagesDir(t *testing.T) { + tempDir := t.TempDir() + dataDir := filepath.Join(tempDir, "data") + pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages") + releaseDir := filepath.Join(pagesRoot, "deployments", "1", "releases", "abc123") + if err := os.MkdirAll(releaseDir, 0o700); err != nil { + t.Fatalf("MkdirAll failed: %v", err) + } + if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + manager := &Manager{PagesDir: pagesRoot} + if err := manager.EnsureWorkerReadAccess(); err != nil { + t.Fatalf("EnsureWorkerReadAccess failed: %v", err) + } + + info, err := os.Stat(filepath.Join(tempDir, "data")) + if err != nil { + t.Fatalf("Stat data failed: %v", err) + } + if info.Mode().Perm()&0o005 == 0 { + t.Fatalf("expected data directory to be world-traversable, got %o", info.Mode().Perm()) + } + indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html")) + if err != nil { + t.Fatalf("Stat index failed: %v", err) + } + if indexInfo.Mode().Perm() != nginxConfigFilePerm { + t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, indexInfo.Mode().Perm()) + } +} \ No newline at end of file diff --git a/internal/apps/agent/runtimeuser/runtimeuser.go b/internal/apps/agent/runtimeuser/runtimeuser.go new file mode 100644 index 00000000..94260924 --- /dev/null +++ b/internal/apps/agent/runtimeuser/runtimeuser.go @@ -0,0 +1,111 @@ +// Package runtimeuser defines the shared OS account used by the agent process +// and OpenResty worker processes so file ownership stays aligned. +package runtimeuser + +import ( + "errors" + "fmt" + "log/slog" + "os" + "os/user" + "path/filepath" + "strconv" + "strings" + + openrestyrender "github.com/Rain-kl/Wavelet/pkg/render/openresty" +) + +// Name is the dedicated service account shared by the agent and OpenResty workers. +const Name = openrestyrender.OpenFlareRuntimeUser + +const ( + // DefaultDirPerm is the normalized permission for runtime directories. + DefaultDirPerm = 0o755 + // DefaultFilePerm is the normalized permission for runtime files. + DefaultFilePerm = 0o644 +) + +// Account holds the resolved UID/GID for Name on the current host. +type Account struct { + Name string + UID int + GID int +} + +// Lookup resolves the runtime account on the current host. +func Lookup() (*Account, error) { + record, err := user.Lookup(Name) + if err != nil { + return nil, fmt.Errorf("lookup %s: %w", Name, err) + } + uid, err := strconv.Atoi(record.Uid) + if err != nil { + return nil, fmt.Errorf("parse uid for %s: %w", Name, err) + } + gid, err := strconv.Atoi(record.Gid) + if err != nil { + return nil, fmt.Errorf("parse gid for %s: %w", Name, err) + } + return &Account{Name: Name, UID: uid, GID: gid}, nil +} + +// CurrentEUID returns the effective UID of the current process. +func CurrentEUID() int { + return os.Geteuid() +} + +// IsRuntimeUser reports whether the current process runs as Name. +func IsRuntimeUser() bool { + account, err := Lookup() + if err != nil { + return false + } + return os.Geteuid() == account.UID +} + +// EnsureProcessUser drops from root to Name when possible so the agent writes +// files with the same ownership OpenResty workers read. +func EnsureProcessUser() error { + account, err := Lookup() + if err != nil { + slog.Warn("runtime user unavailable, agent continues as current user", "user", Name, "euid", os.Geteuid(), "error", err) + return nil + } + if os.Geteuid() == account.UID { + slog.Info("agent running as runtime user", "user", Name, "uid", account.UID) + return nil + } + if os.Geteuid() != 0 { + slog.Warn("agent is not running as runtime user", "expected", Name, "euid", os.Geteuid()) + return nil + } + if dropErr := dropTo(account); dropErr != nil { + return dropErr + } + slog.Info("agent dropped privileges to runtime user", "user", Name, "uid", account.UID) + return nil +} + +// EnsurePathOwnership makes root and its ancestors traversable, assigns runtime +// ownership when running as root, and normalizes directory/file modes. +func EnsurePathOwnership(root string, dirPerm os.FileMode, filePerm os.FileMode) error { + root = filepath.Clean(strings.TrimSpace(root)) + if root == "" || root == "." { + return nil + } + if err := ensureWorldTraversablePath(root); err != nil { + return err + } + if _, statErr := os.Stat(root); os.IsNotExist(statErr) { + return nil + } + account, lookupErr := Lookup() + if lookupErr != nil { + var unknown user.UnknownUserError + if errors.As(lookupErr, &unknown) { + return ensureModesOnly(root, dirPerm, filePerm) + } + return lookupErr + } + return applyOwnershipAndModes(root, account, dirPerm, filePerm) +} \ No newline at end of file diff --git a/internal/apps/agent/runtimeuser/runtimeuser_test.go b/internal/apps/agent/runtimeuser/runtimeuser_test.go new file mode 100644 index 00000000..54973904 --- /dev/null +++ b/internal/apps/agent/runtimeuser/runtimeuser_test.go @@ -0,0 +1,39 @@ +package runtimeuser + +import ( + "os" + "path/filepath" + "testing" +) + +func TestEnsurePathOwnershipNormalizesModes(t *testing.T) { + tempDir := t.TempDir() + dataDir := filepath.Join(tempDir, "data") + releaseDir := filepath.Join(dataDir, "var", "lib", "openflare", "pages", "releases", "abc") + if err := os.MkdirAll(releaseDir, 0o700); err != nil { + t.Fatalf("MkdirAll failed: %v", err) + } + if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages") + if err := EnsurePathOwnership(pagesRoot, 0o755, 0o644); err != nil { + t.Fatalf("EnsurePathOwnership failed: %v", err) + } + + dataInfo, err := os.Stat(dataDir) + if err != nil { + t.Fatalf("Stat dataDir failed: %v", err) + } + if dataInfo.Mode().Perm()&0o005 == 0 { + t.Fatalf("expected dataDir to be world-traversable, got %o", dataInfo.Mode().Perm()) + } + indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html")) + if err != nil { + t.Fatalf("Stat index failed: %v", err) + } + if indexInfo.Mode().Perm() != 0o644 { + t.Fatalf("expected mode 0644, got %o", indexInfo.Mode().Perm()) + } +} \ No newline at end of file diff --git a/internal/apps/agent/runtimeuser/runtimeuser_unix.go b/internal/apps/agent/runtimeuser/runtimeuser_unix.go new file mode 100644 index 00000000..6bac9c89 --- /dev/null +++ b/internal/apps/agent/runtimeuser/runtimeuser_unix.go @@ -0,0 +1,99 @@ +//go:build unix + +package runtimeuser + +import ( + "fmt" + "os" + "path/filepath" + "strings" + "syscall" +) + +func dropTo(account *Account) error { + if err := syscall.Setgid(account.GID); err != nil { + return fmt.Errorf("setgid %d: %w", account.GID, err) + } + if err := syscall.Setuid(account.UID); err != nil { + return fmt.Errorf("setuid %d: %w", account.UID, err) + } + return nil +} + +func ensureWorldTraversablePath(targetDir string) error { + const maxDepth = 12 + current := filepath.Clean(strings.TrimSpace(targetDir)) + if current == "" || current == "." { + return nil + } + for depth := 0; depth < maxDepth; depth++ { + if err := os.Chmod(current, DefaultDirPerm); err != nil { //nolint:gosec // parent dirs must be traversable by the runtime user + if os.IsNotExist(err) || os.IsPermission(err) { + break + } + return fmt.Errorf("chmod %s: %w", current, err) + } + parent := filepath.Dir(current) + if parent == current { + break + } + current = parent + } + return nil +} + +func applyOwnershipAndModes(root string, account *Account, dirPerm os.FileMode, filePerm os.FileMode) error { + return filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error { + if walkErr != nil { + return walkErr + } + info, err := entry.Info() + if err != nil { + return err + } + if os.Geteuid() == 0 { + if chownErr := os.Chown(path, account.UID, account.GID); chownErr != nil && !os.IsNotExist(chownErr) { //nolint:gosec // path is under managed root walk + return fmt.Errorf("chown %s: %w", path, chownErr) + } + } + if entry.IsDir() { + if chmodErr := os.Chmod(path, dirPerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk + return fmt.Errorf("chmod dir %s: %w", path, chmodErr) + } + return nil + } + if !info.Mode().IsRegular() { + return nil + } + mode := filePerm + if chmodErr := os.Chmod(path, mode); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk + return fmt.Errorf("chmod file %s: %w", path, chmodErr) + } + return nil + }) +} + +func ensureModesOnly(root string, dirPerm os.FileMode, filePerm os.FileMode) error { + return filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error { + if walkErr != nil { + return walkErr + } + info, err := entry.Info() + if err != nil { + return err + } + if entry.IsDir() { + if chmodErr := os.Chmod(path, dirPerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk + return fmt.Errorf("chmod dir %s: %w", path, chmodErr) + } + return nil + } + if !info.Mode().IsRegular() { + return nil + } + if chmodErr := os.Chmod(path, filePerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk + return fmt.Errorf("chmod file %s: %w", path, chmodErr) + } + return nil + }) +} \ No newline at end of file diff --git a/internal/apps/agent/sync/pages.go b/internal/apps/agent/sync/pages.go index eca3b9bb..e4867df0 100644 --- a/internal/apps/agent/sync/pages.go +++ b/internal/apps/agent/sync/pages.go @@ -24,6 +24,7 @@ import ( const ( pagesMaxExtractedFileBytes = 100 * 1024 * 1024 pagesDirPerm = 0o755 + pagesFilePerm = 0o644 pagesManifestFilePerm = 0o644 ) @@ -137,6 +138,11 @@ func (s *Service) syncPagesDeployments(ctx context.Context, snapshot *state.Snap return err } } + if s.nginxManager != nil { + if err := s.nginxManager.EnsureWorkerReadAccess(); err != nil { + return fmt.Errorf("ensure openresty worker read access: %w", err) + } + } return nil } @@ -333,7 +339,7 @@ func extractPagesFile(item *zip.File, targetPath string) error { return err } defer func() { _ = source.Close() }() - target, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, item.FileInfo().Mode().Perm()) //nolint:gosec // targetPath is under managed PagesDir from validated zip entry + target, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir from validated zip entry if err != nil { return err } @@ -416,10 +422,6 @@ func copyPagesDir(sourceDir string, targetDir string) error { if entry.IsDir() { return os.MkdirAll(targetPath, pagesDirPerm) } - info, err := entry.Info() - if err != nil { - return err - } input, err := os.Open(sourcePath) //nolint:gosec // sourcePath is under managed PagesDir walk root if err != nil { return err @@ -428,7 +430,7 @@ func copyPagesDir(sourceDir string, targetDir string) error { if err := os.MkdirAll(filepath.Dir(targetPath), pagesDirPerm); err != nil { return err } - output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode().Perm()) //nolint:gosec // targetPath is under managed PagesDir walk root + output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir walk root if err != nil { return err } diff --git a/internal/apps/agent/sync/service.go b/internal/apps/agent/sync/service.go index e57c29b8..67e5b254 100644 --- a/internal/apps/agent/sync/service.go +++ b/internal/apps/agent/sync/service.go @@ -43,6 +43,7 @@ type NginxManager interface { CurrentChecksum() (string, error) WAFIPGroupChecksums() (map[string]string, error) SyncWAFIPGroups(groups []protocol.WAFIPGroup) error + EnsureWorkerReadAccess() error } // Service orchestrates configuration synchronisation between the server and the local OpenResty instance. diff --git a/internal/apps/agent/sync/service_test.go b/internal/apps/agent/sync/service_test.go index d7f014fb..3846c050 100644 --- a/internal/apps/agent/sync/service_test.go +++ b/internal/apps/agent/sync/service_test.go @@ -141,6 +141,10 @@ func (m *fakeManager) SyncWAFIPGroups(groups []protocol.WAFIPGroup) error { return nil } +func (m *fakeManager) EnsureWorkerReadAccess() error { + return nil +} + func TestSyncOnceSuccess(t *testing.T) { client := &fakeClient{ config: protocol.ActiveConfigResponse{ @@ -254,6 +258,54 @@ func TestSyncOnceDownloadsPagesDeploymentBeforeApply(t *testing.T) { } } +func TestSyncPagesDeploymentEnsuresWorkerReadAccess(t *testing.T) { + tempDir := t.TempDir() + dataDir := filepath.Join(tempDir, "data") + if err := os.MkdirAll(dataDir, 0o700); err != nil { + t.Fatalf("MkdirAll failed: %v", err) + } + pagesDir := filepath.Join(dataDir, "var", "lib", "openflare", "pages") + + packageBytes := testPagesPackage(t, map[string]string{"index.html": "hello"}) + checksum := testBytesChecksum(packageBytes) + config := protocol.ActiveConfigResponse{ + Version: "20260309-106", + Checksum: "pages-config-checksum", + SourceConfigJSON: testPagesSourceConfigJSON(7, checksum), + CreatedAt: time.Now().Format(time.RFC3339), + } + client := &fakeClient{ + config: config, + pagesPackages: map[uint][]byte{7: packageBytes}, + } + stateStore := state.NewStore(filepath.Join(tempDir, "state.json")) + snapshot, _ := stateStore.Load() + + runtimeManager := &nginx.Manager{PagesDir: pagesDir} + service := New(client, runtimeManager, stateStore) + service.SetPagesDir(pagesDir) + + if err := service.syncPagesDeployments(context.Background(), snapshot, &config); err != nil { + t.Fatalf("syncPagesDeployments failed: %v", err) + } + + dataInfo, err := os.Stat(dataDir) + if err != nil { + t.Fatalf("Stat dataDir failed: %v", err) + } + if dataInfo.Mode().Perm()&0o005 == 0 { + t.Fatalf("expected dataDir to be world-traversable, got %o", dataInfo.Mode().Perm()) + } + indexPath := filepath.Join(pagesDir, "deployments", "7", "current", "index.html") + indexInfo, err := os.Stat(indexPath) + if err != nil { + t.Fatalf("expected Pages file to be extracted: %v", err) + } + if indexInfo.Mode().Perm() != 0o644 { + t.Fatalf("expected index.html mode 0644, got %o", indexInfo.Mode().Perm()) + } +} + func TestSyncOnceExtractsPagesPackageWithZeroByteFiles(t *testing.T) { packageBytes := testPagesPackage(t, map[string]string{ "index.html": "hello", diff --git a/internal/model/openflare_option.go b/internal/model/openflare_option.go index c91c2097..311eac2a 100644 --- a/internal/model/openflare_option.go +++ b/internal/model/openflare_option.go @@ -106,6 +106,7 @@ var ( ) const defaultOpenRestyMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually. +user openflare; worker_processes {{OpenRestyWorkerProcesses}}; worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}}; pid logs/nginx.pid; diff --git a/pkg/render/openresty/types.go b/pkg/render/openresty/types.go index 3bcda857..52731d80 100644 --- a/pkg/render/openresty/types.go +++ b/pkg/render/openresty/types.go @@ -25,7 +25,15 @@ const ( anubisAPIPrefix = "/.within.website/x/cmd/anubis/api/" ) +// OpenFlareRuntimeUser is the dedicated service account shared by the agent +// process and OpenResty worker processes. +const OpenFlareRuntimeUser = "openflare" + +// OpenRestyWorkerUser is kept as an alias for existing call sites. +const OpenRestyWorkerUser = OpenFlareRuntimeUser + const defaultMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually. +user ` + OpenFlareRuntimeUser + `; worker_processes {{OpenRestyWorkerProcesses}}; worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}}; pid logs/nginx.pid; diff --git a/scripts/install-agent.sh b/scripts/install-agent.sh index 1500ebdd..981c5858 100755 --- a/scripts/install-agent.sh +++ b/scripts/install-agent.sh @@ -478,8 +478,21 @@ if [[ -d "$INSTALL_DIR" ]]; then rm -rf "$INSTALL_DIR" fi +ensure_runtime_user() { + if [[ "$OS" != "linux" ]]; then + return + fi + if id openflare >/dev/null 2>&1; then + return + fi + if command -v useradd >/dev/null 2>&1; then + useradd --system --home-dir "${INSTALL_DIR}/data" --shell /usr/sbin/nologin openflare + fi +} + echo "Installing to ${INSTALL_DIR}..." mkdir -p "${INSTALL_DIR}/data" +ensure_runtime_user mv -f "$TMP_BINARY" "${INSTALL_DIR}/openflare-agent" trap - EXIT @@ -511,6 +524,10 @@ else CFGEOF fi +if id openflare >/dev/null 2>&1; then + chown -R openflare:openflare "${INSTALL_DIR}" +fi + # Create systemd service if [[ "$CREATE_SERVICE" == "true" && "$OS" == "linux" && -d /etc/systemd/system && "$SYSTEMCTL_AVAILABLE" == "true" ]]; then echo "Creating systemd service..." @@ -521,6 +538,11 @@ After=network.target [Service] Type=simple +User=openflare +Group=openflare +AmbientCapabilities=CAP_NET_BIND_SERVICE +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +NoNewPrivileges=true ExecStart=${INSTALL_DIR}/openflare-agent -config ${CONFIG_FILE} WorkingDirectory=${INSTALL_DIR} Restart=always