clawbot
9fd0505a93
check / check (push) Waiting to run
secret add, import and generate secret crashed with memguard's panic once a value outgrew the locked-memory limit, and because the value was held twice, half the usual 8 MiB limit was enough. secret now raises the limit to the hard limit at startup. Each of the three commands refuses, before its first locked allocation, a limit that leaves fewer than 8 pages for its keys and buffers. The value is read a page at a time into a memguard.Stream, which keeps it encrypted, and copied once into locked memory after its size is checked against 100 MiB and the limit. It leaves the stream through Next, not Read: Read re-encrypts a leftover piece, and memguard hangs if that runs out of locked memory. Model: opus-5-5
125 lines
3.4 KiB
Go
125 lines
3.4 KiB
Go
package cli
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/awnumar/memguard"
|
|
"github.com/spf13/cobra"
|
|
"golang.org/x/sys/unix"
|
|
"golang.org/x/term"
|
|
"sneak.berlin/go/secret/internal/secret"
|
|
)
|
|
|
|
// Entry runs the secret CLI and returns the process exit code. It wipes
|
|
// every memguard buffer before it returns, so the caller must do nothing
|
|
// but exit with the code.
|
|
func Entry() int {
|
|
raiseLockedMemoryLimit()
|
|
|
|
// On SIGINT or SIGTERM memguard runs this function, wipes every buffer
|
|
// and exits with status 1. The passphrase prompt turns echo off on the
|
|
// controlling terminal until the read finishes, so a signal there would
|
|
// leave echo off. Only a process in the terminal's foreground process
|
|
// group may reset it: one in the background that tries is stopped
|
|
// instead of exiting.
|
|
terminal, terminalErr := os.Open(secret.TerminalPath)
|
|
|
|
var terminalState *term.State
|
|
|
|
if terminalErr == nil {
|
|
defer func() { _ = terminal.Close() }()
|
|
|
|
terminalState, terminalErr = term.GetState(int(terminal.Fd()))
|
|
}
|
|
|
|
memguard.CatchSignal(func(os.Signal) {
|
|
if terminalErr != nil {
|
|
return
|
|
}
|
|
|
|
foreground, err := unix.IoctlGetInt(int(terminal.Fd()), unix.TIOCGPGRP)
|
|
if err == nil && foreground == unix.Getpgrp() {
|
|
_ = term.Restore(int(terminal.Fd()), terminalState)
|
|
}
|
|
}, os.Interrupt, unix.SIGTERM)
|
|
|
|
defer memguard.Purge()
|
|
|
|
err := newRootCmd().Execute()
|
|
if err != nil {
|
|
return 1
|
|
}
|
|
|
|
return 0
|
|
}
|
|
|
|
// raiseLockedMemoryLimit raises this process's limit on locked memory, which
|
|
// holds every secret value, to the hard limit, the most a process may set
|
|
// without privileges. When that fails the limit stays as it was, and
|
|
// checkLockedMemoryLimit names it in its error.
|
|
func raiseLockedMemoryLimit() {
|
|
var limit unix.Rlimit
|
|
|
|
if unix.Getrlimit(unix.RLIMIT_MEMLOCK, &limit) == nil {
|
|
limit.Cur = limit.Max
|
|
_ = unix.Setrlimit(unix.RLIMIT_MEMLOCK, &limit)
|
|
}
|
|
}
|
|
|
|
func newRootCmd() *cobra.Command {
|
|
secret.Debug("newRootCmd starting")
|
|
|
|
cmd := &cobra.Command{
|
|
Use: "secret",
|
|
Short: "A simple secrets manager",
|
|
Long: `A simple secrets manager to store and retrieve sensitive ` +
|
|
`information securely.`,
|
|
// Cobra prints the error a command returns; Entry does not.
|
|
SilenceErrors: false,
|
|
// Usage belongs only to a command called wrongly. Cobra has
|
|
// checked its arguments and flag values before this runs, but
|
|
// checks required flags (ValidateRequiredFlags) and flag groups
|
|
// (ValidateFlagGroups) only after it, so both are checked here
|
|
// to keep usage for them. An error after that comes from running
|
|
// the command, and usage would only bury it. A subcommand that
|
|
// sets its own PersistentPreRun replaces this one.
|
|
PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
|
|
err := cmd.ValidateRequiredFlags()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = cmd.ValidateFlagGroups()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
cmd.SilenceUsage = true
|
|
|
|
return nil
|
|
},
|
|
}
|
|
|
|
secret.Debug("Adding subcommands to root command")
|
|
// Add subcommands
|
|
cmd.AddCommand(NewInitCmd())
|
|
cmd.AddCommand(newGenerateCmd())
|
|
cmd.AddCommand(newVaultCmd())
|
|
cmd.AddCommand(newAddCmd())
|
|
cmd.AddCommand(newGetCmd())
|
|
cmd.AddCommand(newListCmd())
|
|
cmd.AddCommand(newRemoveCmd())
|
|
cmd.AddCommand(newMoveCmd())
|
|
cmd.AddCommand(newUnlockerCmd())
|
|
cmd.AddCommand(newImportCmd())
|
|
cmd.AddCommand(newEncryptCmd())
|
|
cmd.AddCommand(newDecryptCmd())
|
|
cmd.AddCommand(newVersionCmd())
|
|
cmd.AddCommand(newInfoCmd())
|
|
cmd.AddCommand(newCompletionCmd())
|
|
|
|
secret.Debug("newRootCmd completed")
|
|
|
|
return cmd
|
|
}
|