filed

Job queue using FUSE

git clone git://mccd.space/filed

main.go (6169B)

 package main
 
 import (
 	"context"
 	"flag"
 	"fmt"
 	"git.sr.ht/~marcc/filed/store"
 	"log"
 	"log/slog"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"syscall"
 
 	"bazil.org/fuse"
 	"bazil.org/fuse/fs"
 	_ "bazil.org/fuse/fs/fstestutil"
 	"github.com/landlock-lsm/go-landlock/landlock"
 )
 
 func usage() {
 	fmt.Fprintf(os.Stderr, "Usage: %s MOUNTPOINT\n", os.Args[0])
 	flag.PrintDefaults()
 }
 
 type Restrictions struct {
 	rwFiles []string
 	roFiles []string
 	rwDir   []string
 	roDir   []string
 }
 
 func main() {
 	flag.Usage = usage
 	restrictions := Restrictions{}
 	shouldLandlock := false
 	flag.Func("ro", "Read-only path", func(s string) error {
 		restrictions.roDir = append(restrictions.roDir, s)
 		shouldLandlock = true
 		return nil
 	})
 
 	flag.Func("rof", "Read-only file", func(s string) error {
 		restrictions.roFiles = append(restrictions.roFiles, s)
 		shouldLandlock = true
 		return nil
 	})
 
 	flag.Func("rwf", "Read-write file", func(s string) error {
 		restrictions.rwFiles = append(restrictions.rwFiles, s)
 
 		shouldLandlock = true
 		return nil
 	})
 
 	flag.Func("rw", "Read-write path", func(s string) error {
 		restrictions.rwDir = append(restrictions.rwDir, s)
 
 		shouldLandlock = true
 		return nil
 	})
 	flag.Parse()
 	if flag.NArg() != 1 {
 		usage()
 		os.Exit(2)
 	}
 
 	filedLaunchExecutable, err := exec.LookPath("filed-launch")
 	if err != nil {
 		log.Fatalf("filed-launch needs to be available in $PATH: %v", err)
 	}
 	fusermountExecutable, err := exec.LookPath("fusermount")
 	if err != nil {
 		log.Fatalf("fusermount needs to be available in $PATH: %v", err)
 	}
 
 	userUid := uint32(os.Getuid())
 	if userUid == 0 {
 		warning := fmt.Sprintf("Running %s as root is highly not recommended. Be careful", os.Args[0])
 		slog.Warn(warning)
 	}
 
 	dbPath := getDbPath()
 	mountpoint := flag.Arg(0)
 
 	if err := Unmount(mountpoint); err != nil {
 		slog.Debug("FUSE: Pre-start unmount failed (this is usually okay)", "error", err)
 	}
 
 	store, err := store.NewStore(dbPath)
 	if err != nil {
 		panic(err)
 	}
 	slog.Info("Mounting filesystem", "mountpoint", mountpoint)
 	c, err := fuse.Mount(
 		mountpoint,
 		fuse.FSName("filed"),
 		fuse.AllowOther(),
 		fuse.DefaultPermissions(),
 	)
 	if err != nil {
 		panic(err)
 	}
 	defer c.Close()
 
 	if shouldLandlock {
 		var rules []landlock.Rule
 
 		// For the filed daemon we need to append extra files and directories needed to operate.
 		// Later on, filed-launch will further landlock each process to make sure they can't
 		// access these files.
 
 		// fusermount and and filed-launcher are needed to launch applications
 		rwFilePathsForFiled := append(restrictions.rwFiles, dbPath)
 		rules = append(rules, landlock.RWFiles(rwFilePathsForFiled...))
 
 		// filed-launch are needed to launch applications
 		// fusermount for unmounting
 		roFilePathsForFiled := append(restrictions.roFiles, "/dev/fuse", "/dev/null", fusermountExecutable, filedLaunchExecutable)
 		rules = append(rules, landlock.ROFiles(roFilePathsForFiled...))
 
 		// /proc and /dev are needed to oversee the process and kill it
 		roDirPathsForFiled := append(restrictions.roDir, "/proc")
 		rules = append(rules, landlock.RODirs(roDirPathsForFiled...))
 
 		rwPathsForFiled := append(restrictions.rwFiles, mountpoint)
 		rules = append(rules, landlock.RWDirs(rwPathsForFiled...))
 
 		err := landlock.V5.BestEffort().RestrictPaths(
 			rules...,
 		)
 		if err != nil {
 			log.Fatalf("Failed to landlock: %v", err)
 		}
 	}
 
 	jobManager := NewJobManager(store, filedLaunchExecutable, &restrictions)
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	jobManager.StartWorker(ctx)
 
 	err = fs.Serve(c, FS{jobManager})
 	if err != nil {
 		panic(err)
 	}
 
 }
 
 type FS struct {
 	manager *JobManager
 }
 
 func (fs FS) Root() (fs.Node, error) {
 	return RootDir{fs.manager}, nil
 }
 
 type RootDir struct {
 	manager *JobManager
 }
 
 func (RootDir) Attr(ctx context.Context, a *fuse.Attr) error {
 	a.Mode = os.ModeDir | 0o555
 	return nil
 }
 
 func (rd RootDir) Lookup(ctx context.Context, name string) (fs.Node, error) {
 	slog.Debug("FUSE: Lookup", "name", name)
 	switch name {
 	case store.StatePending:
 		return &PendingDir{manager: rd.manager, inode: 2}, nil
 	case store.StateCompleted:
 		return &JobDir{state: name, manager: rd.manager, inode: 3}, nil
 	case store.StateFailed:
 		return &JobDir{state: name, manager: rd.manager, inode: 4}, nil
 	case store.StateRunning:
 		return &JobDir{state: name, manager: rd.manager, inode: 5}, nil
 	case NewIdName:
 		return &NewIdFile{manager: rd.manager, inode: 6}, nil
 	case ConfigName:
 		return &ConfigFile{manager: rd.manager, inode: 7}, nil
 	default:
 		return nil, syscall.ENOENT
 	}
 }
 
 var rootEntries = []fuse.Dirent{
 	{Name: store.StatePending, Type: fuse.DT_Dir},
 	{Name: store.StateCompleted, Type: fuse.DT_Dir},
 	{Name: store.StateFailed, Type: fuse.DT_Dir},
 	{Name: store.StateRunning, Type: fuse.DT_Dir},
 	{Name: NewIdName, Type: fuse.DT_File},
 	{Name: ConfigName, Type: fuse.DT_File},
 }
 
 func (RootDir) ReadDirAll(ctx context.Context) ([]fuse.Dirent, error) {
 	return rootEntries, nil
 }
 func getDbPath() string {
 	dbPath := os.Getenv("FILED_STATE_FILE")
 	if dbPath == "" {
 		xdg_home := os.Getenv("XDG_DATA_HOME")
 		if xdg_home == "" {
 			fmt.Fprintf(os.Stderr, "FILED_STATE_FILE environment variable needs to be set.\n")
 			fmt.Fprintf(os.Stderr, "For example: export FILED_STATE_FILE=$HOME/.local/share/filed.db")
 			usage()
 			os.Exit(1)
 		}
 		dbPath = filepath.Join(xdg_home, "filed.db")
 	}
 	return dbPath
 }
 
 // XXX Should be struct
 func getLandlockOptions() ([]string, []string, []string, []string, bool) {
 	var roPaths, roFilePaths, rwFilePaths, rwPaths []string
 	isSet := false
 	flag.Func("ro", "Read-only path", func(s string) error {
 		roPaths = append(roPaths, s)
 		isSet = true
 		return nil
 	})
 
 	flag.Func("rof", "Read-only file", func(s string) error {
 		roFilePaths = append(roFilePaths, s)
 		isSet = true
 		return nil
 	})
 
 	flag.Func("rwf", "Read-write file", func(s string) error {
 		rwFilePaths = append(rwFilePaths, s)
 
 		isSet = true
 		return nil
 	})
 
 	flag.Func("rw", "Read-write path", func(s string) error {
 		rwPaths = append(rwPaths, s)
 
 		isSet = true
 		return nil
 	})
 
 	return roPaths, roFilePaths, rwFilePaths, rwPaths, isSet
 }