sysknife-daemon 0.11.0

Policy-enforced, audit-logged Linux action daemon for SysKnife
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//! apt package pinning (`/etc/apt/preferences.d/`). Debian-family only.
//!
//! `GetAptPins` is read-only (`apt-cache policy`). `SetAptPin`/`RemoveAptPin`
//! write/remove a pin drop-in via the root-owned helper
//! `/usr/lib/sysknife/apt-pin-edit`. Pinning steers which version/origin apt
//! prefers — reversible, so Dev/Medium rather than Admin.

use super::{command_mechanism, ActionSpec};
use sysknife_types::RiskLevel;

const HELPER: &str = "/usr/lib/sysknife/apt-pin-edit";

pub fn specs() -> Vec<ActionSpec> {
    vec![
        get_apt_pins(None),
        set_apt_pin("hold-nginx", "nginx", "version 1.24.*", 990),
        remove_apt_pin("hold-nginx"),
    ]
}

/// Show apt pin priorities (`apt-cache policy [pkg]`). Read-only.
pub fn get_apt_pins(package: Option<&str>) -> ActionSpec {
    let mut args = vec!["policy".to_string()];
    if let Some(pkg) = package {
        args.push(pkg.to_string());
    }
    ActionSpec {
        action_name: "GetAptPins",
        mechanism: command_mechanism("apt-cache", args),
        risk_level: RiskLevel::Low,
        reboot_required: false,
        rollback_available: false,
    }
}

/// Write a pin drop-in (`apt-pin-edit --op set …`).
pub fn set_apt_pin(name: &str, package: &str, pin: &str, priority: i64) -> ActionSpec {
    let prio = priority.to_string();
    ActionSpec {
        action_name: "SetAptPin",
        mechanism: command_mechanism(
            "sudo",
            [
                HELPER,
                "--op",
                "set",
                "--name",
                name,
                "--package",
                package,
                "--pin",
                pin,
                "--priority",
                &prio,
            ],
        ),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

/// Remove a pin drop-in (`apt-pin-edit --op remove …`).
pub fn remove_apt_pin(name: &str) -> ActionSpec {
    ActionSpec {
        action_name: "RemoveAptPin",
        mechanism: command_mechanism("sudo", [HELPER, "--op", "remove", "--name", name]),
        risk_level: RiskLevel::Medium,
        reboot_required: false,
        rollback_available: false,
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::actions::ActionMechanism;

    fn args_of(spec: &ActionSpec) -> (&'static str, Vec<String>) {
        match &spec.mechanism {
            ActionMechanism::Command { program, args } => (program, args.clone()),
            other => panic!("expected Command, got {other:?}"),
        }
    }

    #[test]
    fn get_pins_optional_package() {
        let (program, args) = args_of(&get_apt_pins(None));
        assert_eq!(program, "apt-cache");
        assert_eq!(args, vec!["policy"]);
        let (_, with_pkg) = args_of(&get_apt_pins(Some("nginx")));
        assert_eq!(with_pkg, vec!["policy", "nginx"]);
    }

    #[test]
    fn set_and_remove_shapes() {
        let (program, set) = args_of(&set_apt_pin("hold-nginx", "nginx", "version 1.24.*", 990));
        assert_eq!(program, "sudo");
        assert_eq!(
            set,
            vec![
                HELPER,
                "--op",
                "set",
                "--name",
                "hold-nginx",
                "--package",
                "nginx",
                "--pin",
                "version 1.24.*",
                "--priority",
                "990"
            ]
        );
        assert_eq!(set_apt_pin("a", "b", "c", 1).risk_level, RiskLevel::Medium);
        let (_, rm) = args_of(&remove_apt_pin("hold-nginx"));
        assert_eq!(rm, vec![HELPER, "--op", "remove", "--name", "hold-nginx"]);
    }
}