flyemoji
fe4c92c1c5
Give an owner a way to repair the one failure no other endpoint covers: a
server that will not boot because a single line of server.properties or a
plugin's YAML is wrong. Until now that needed a human with cluster access.
felis-api cannot touch a world in-process — the world PVC is ReadWriteOnce
and its lifecycle belongs to the operator's StatefulSet — so the work runs
as a one-shot Job, and the server must be stopped first because a running
one holds the volume. That is the same constraint that shapes restore and
backup, and the handlers enforce the stopped gate the same way.
What is different is that the caller wants the OUTPUT, not just the side
effect. The Job prints its result to stdout and felis-api reads it back
through the pods/log subresource, which needs no permission felis-api does
not already hold: jobs:create, pods:list, pods/log:get. No pods/exec, no
pods/portforward, not even pods:get. The price is latency — every operation
is a Pod schedule — which is why this is a repair tool and not a file
manager.
Containment is structural, not textual. Every filesystem access goes through
os.Root, the stdlib's escape-proof directory handle, which resolves each
component against the open root descriptor and refuses "..", absolute paths,
and symlinks leading outside. The string-prefix check used elsewhere is not
reused here: it validates a path as text and then opens it as a path, and a
world directory holds attacker-influenced content, so a symlink swapped in
between those two steps is a live threat rather than a theoretical one.
os.Root has no such window because the check and the open are one operation.
The Job's isolation is a strict subset of a restore Pod's: the weak
felis-restore SA with its token auto-mount disabled, exactly one volume (the
world PVC, mounted read-only for list and read so two of the three
operations cannot mutate anything), no Secret, no ConfigMap, no database
URL, non-root with an fsGroup matching the operator's so a written file is
readable by the server that later mounts it, and backoffLimit 0 so a failed
write is never silently retried as a second write.
Two limits on the surface are worth stating plainly, because the mount is
the server's whole working directory rather than a config subtree:
* A write accepts arbitrary bytes at any path, so an owner can place a
loadable plugin jar. This is deliberate — it is what a hosting panel's
file manager does, scoped to a server the caller already owns and
already drives through /command — but it is the one owner-tier route
that lands executable code in a backend pod, since images are
admin-only and modpack submissions need an admin verdict.
* config/paper-global.yml is refused on read. felis-lobby's entrypoint
writes FELIS_FORWARDING_SECRET into it on every boot, and that value is
identical on every backend, so reading it from a server you own would
hand you the handshake key for everyone else's. It is the only path in
the mount that is not the caller's own data, and therefore the only
denial. The comparison is on the cleaned path, or ./config/... would
walk straight through it.
Writing that file is still allowed: it leaks nothing, and the entrypoint
rewrites it whole on every boot regardless.
The write body's content field is a *[]byte rather than a []byte for the
reason permissionRequest.Value is a *bool — a plain slice makes absent,
null, and empty indistinguishable, so a body of {} would decode to nil and
truncate the target to zero bytes while answering 200, destroying the very
config the caller opened the editor to repair.
85 lines
3.4 KiB
Go
85 lines
3.4 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"flag"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
|
|
"felis.lolicon.best/internal/fileedit"
|
|
)
|
|
|
|
// cmdFiles is the in-Pod entrypoint the file-editor Job runs. internal/fileedit
|
|
// renders a Pod whose command is `/usr/local/bin/felis files`. It performs ONE
|
|
// file operation against the mounted world volume, prints the result as a single
|
|
// marked JSON line on stdout, and exits — it is NOT a user-facing command and is
|
|
// never invoked by hand.
|
|
//
|
|
// Like cmdRestore it deliberately holds NO database credentials and never calls
|
|
// config.Load: felis-api made the authorization decision (the caller owns this
|
|
// server, and the server is stopped so the RWO world volume is free); this process
|
|
// is the unprivileged hands that touch bytes. Its entire input is the three flags
|
|
// below plus, for a write, one environment variable. Every isolation guarantee
|
|
// lives in the Pod spec (internal/fileedit/jobspec.go), and the path-containment
|
|
// guarantee lives in fileedit.Execute, which resolves the path through os.Root and
|
|
// therefore cannot be walked out of the world mount.
|
|
//
|
|
// Exit status carries a specific meaning that felis-api depends on: a CALLER-fault
|
|
// outcome — a path that escapes the root, a file that is missing or too large — is
|
|
// a SUCCESSFUL run that prints a Result carrying an error code, so the API can map
|
|
// it to a precise 4xx. A non-zero exit means the operation could not be attempted
|
|
// at all (the world mount is unreadable, the result unprintable), which the API
|
|
// reports as a 500.
|
|
func cmdFiles(args []string, stdout, stderr io.Writer) int {
|
|
fs := flag.NewFlagSet("files", flag.ContinueOnError)
|
|
fs.SetOutput(stderr)
|
|
op := fs.String("op", "", "operation: list, read, or write")
|
|
path := fs.String("path", "", "path to operate on, relative to the world root (empty = the root itself)")
|
|
worldsRoot := fs.String("worlds-root", "/data", "mount path of the world PVC; every path resolves under it")
|
|
if err := fs.Parse(args); err != nil {
|
|
return 2
|
|
}
|
|
|
|
if *op == "" {
|
|
fmt.Fprintln(stderr, "felis files: --op is required (list, read, or write)")
|
|
return 2
|
|
}
|
|
|
|
// New content arrives base64-encoded in the environment rather than in argv:
|
|
// a process's arguments are world-readable on the node (/proc/<pid>/cmdline),
|
|
// whereas its environment is not, and a config file being written can carry
|
|
// secrets — an RCON password in server.properties is the obvious case. The
|
|
// encoding is what lets arbitrary bytes (CRLF endings, a BOM, a NUL) survive a
|
|
// channel that must be a valid string.
|
|
var content []byte
|
|
if *op == fileedit.OpWrite {
|
|
raw, ok := os.LookupEnv(fileedit.ContentEnv)
|
|
if !ok {
|
|
fmt.Fprintf(stderr, "felis files: a write needs %s in the environment\n", fileedit.ContentEnv)
|
|
return 2
|
|
}
|
|
decoded, err := base64.StdEncoding.DecodeString(raw)
|
|
if err != nil {
|
|
fmt.Fprintf(stderr, "felis files: %s is not valid base64: %v\n", fileedit.ContentEnv, err)
|
|
return 2
|
|
}
|
|
content = decoded
|
|
}
|
|
|
|
res, err := fileedit.Execute(*worldsRoot, *op, *path, content)
|
|
if err != nil {
|
|
// The operation could not be attempted — infrastructure, not caller fault.
|
|
fmt.Fprintf(stderr, "felis files: %v\n", err)
|
|
return 1
|
|
}
|
|
if err := fileedit.Print(stdout, res); err != nil {
|
|
// The result exists but could not be delivered. Exiting non-zero is the only
|
|
// honest signal left: felis-api would otherwise find no marked line and have
|
|
// to guess why.
|
|
fmt.Fprintf(stderr, "felis files: %v\n", err)
|
|
return 1
|
|
}
|
|
return 0
|
|
}
|