From f5eda6a31819e61d9c1d5756c3c1f4bdfbd13fa1 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 20 Jan 2024 10:34:29 -0500 Subject: [PATCH 1/4] Fix `HardLinkDmbProvider` using the minimum security level rather than the active one Fixes #1773 --- .../Deployment/HardLinkDmbProvider.cs | 23 +++++++++++++------ .../Components/Watchdog/PosixWatchdog.cs | 2 +- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/src/Tgstation.Server.Host/Components/Deployment/HardLinkDmbProvider.cs b/src/Tgstation.Server.Host/Components/Deployment/HardLinkDmbProvider.cs index 98a8361e34..09cdfb31d5 100644 --- a/src/Tgstation.Server.Host/Components/Deployment/HardLinkDmbProvider.cs +++ b/src/Tgstation.Server.Host/Components/Deployment/HardLinkDmbProvider.cs @@ -46,12 +46,14 @@ namespace Tgstation.Server.Host.Components.Deployment /// The for the . /// The value of . /// The for the . + /// The launch level. public HardLinkDmbProvider( IDmbProvider baseProvider, IIOManager ioManager, IFilesystemLinkFactory linkFactory, ILogger logger, - GeneralConfiguration generalConfiguration) + GeneralConfiguration generalConfiguration, + DreamDaemonSecurity securityLevel) : base( baseProvider, ioManager, @@ -61,7 +63,7 @@ namespace Tgstation.Server.Host.Components.Deployment cancellationTokenSource = new CancellationTokenSource(); try { - mirroringTask = MirrorSourceDirectory(generalConfiguration.GetCopyDirectoryTaskThrottle(), cancellationTokenSource.Token); + mirroringTask = MirrorSourceDirectory(generalConfiguration.GetCopyDirectoryTaskThrottle(), securityLevel, cancellationTokenSource.Token); } catch { @@ -143,9 +145,10 @@ namespace Tgstation.Server.Host.Components.Deployment /// Mirror the . /// /// The optional maximum number of simultaneous tasks allowed to execute. + /// The launch level. /// The for the operation. /// A resulting in the full path to the mirrored directory. - async Task MirrorSourceDirectory(int? taskThrottle, CancellationToken cancellationToken) + async Task MirrorSourceDirectory(int? taskThrottle, DreamDaemonSecurity securityLevel, CancellationToken cancellationToken) { var stopwatch = Stopwatch.StartNew(); var mirrorGuid = Guid.NewGuid(); @@ -157,7 +160,12 @@ namespace Tgstation.Server.Host.Components.Deployment var dest = IOManager.ResolvePath(mirrorGuid.ToString()); using var semaphore = taskThrottle.HasValue ? new SemaphoreSlim(taskThrottle.Value) : null; - await Task.WhenAll(MirrorDirectoryImpl(src, dest, semaphore, cancellationToken)); + await Task.WhenAll(MirrorDirectoryImpl( + src, + dest, + semaphore, + securityLevel, + cancellationToken)); stopwatch.Stop(); logger.LogDebug( @@ -175,14 +183,15 @@ namespace Tgstation.Server.Host.Components.Deployment /// The source directory path. /// The destination directory path. /// Optional used to limit degree of parallelism. + /// The launch level. /// The for the operation. /// A of s representing the running operations. The first returned is always the necessary call to . /// I genuinely don't know how this will work with symlinked files. Waiting for the issue report I guess. - IEnumerable MirrorDirectoryImpl(string src, string dest, SemaphoreSlim? semaphore, CancellationToken cancellationToken) + IEnumerable MirrorDirectoryImpl(string src, string dest, SemaphoreSlim? semaphore, DreamDaemonSecurity securityLevel, CancellationToken cancellationToken) { var dir = new DirectoryInfo(src); Task? subdirCreationTask = null; - var dreamDaemonWillAcceptOutOfDirectorySymlinks = CompileJob.MinimumSecurityLevel == DreamDaemonSecurity.Trusted; + var dreamDaemonWillAcceptOutOfDirectorySymlinks = securityLevel == DreamDaemonSecurity.Trusted; foreach (var subDirectory in dir.EnumerateDirectories()) { var mirroredName = Path.Combine(dest, subDirectory.Name); @@ -216,7 +225,7 @@ namespace Tgstation.Server.Host.Components.Deployment logger.LogDebug("Recreating symlinked directory {name} as hard links...", subDirectory.Name); var checkingSubdirCreationTask = true; - foreach (var copyTask in MirrorDirectoryImpl(subDirectory.FullName, mirroredName, semaphore, cancellationToken)) + foreach (var copyTask in MirrorDirectoryImpl(subDirectory.FullName, mirroredName, semaphore, securityLevel, cancellationToken)) { if (subdirCreationTask == null) { diff --git a/src/Tgstation.Server.Host/Components/Watchdog/PosixWatchdog.cs b/src/Tgstation.Server.Host/Components/Watchdog/PosixWatchdog.cs index 27874178af..b4c7a74229 100644 --- a/src/Tgstation.Server.Host/Components/Watchdog/PosixWatchdog.cs +++ b/src/Tgstation.Server.Host/Components/Watchdog/PosixWatchdog.cs @@ -95,6 +95,6 @@ namespace Tgstation.Server.Host.Components.Watchdog /// protected override SwappableDmbProvider CreateSwappableDmbProvider(IDmbProvider dmbProvider) - => new HardLinkDmbProvider(dmbProvider, GameIOManager, LinkFactory, Logger, generalConfiguration); + => new HardLinkDmbProvider(dmbProvider, GameIOManager, LinkFactory, Logger, generalConfiguration, ActiveLaunchParameters.SecurityLevel!.Value); } } From 77306fd56b827a2c5abe52ad1c702740555a7f29 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 20 Jan 2024 10:40:47 -0500 Subject: [PATCH 2/4] Closes #1738 --- build/analyzers.ruleset | 6 +++--- src/Tgstation.Server.Host/Swarm/ISwarmService.cs | 2 +- src/Tgstation.Server.Host/Swarm/SwarmService.cs | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build/analyzers.ruleset b/build/analyzers.ruleset index e61e800d00..72be43fd43 100644 --- a/build/analyzers.ruleset +++ b/build/analyzers.ruleset @@ -1,4 +1,4 @@ - + @@ -6,7 +6,7 @@ - + @@ -1048,4 +1048,4 @@ - \ No newline at end of file + diff --git a/src/Tgstation.Server.Host/Swarm/ISwarmService.cs b/src/Tgstation.Server.Host/Swarm/ISwarmService.cs index 8e827eb131..a07a8478d4 100644 --- a/src/Tgstation.Server.Host/Swarm/ISwarmService.cs +++ b/src/Tgstation.Server.Host/Swarm/ISwarmService.cs @@ -38,6 +38,6 @@ namespace Tgstation.Server.Host.Swarm /// Gets the list of s in the swarm, including the current one. /// /// A of s in the swarm. If the server is not part of a swarm, will be returned. - ICollection? GetSwarmServers(); + List? GetSwarmServers(); } } diff --git a/src/Tgstation.Server.Host/Swarm/SwarmService.cs b/src/Tgstation.Server.Host/Swarm/SwarmService.cs index 0ff0131c72..3e9ac7d151 100644 --- a/src/Tgstation.Server.Host/Swarm/SwarmService.cs +++ b/src/Tgstation.Server.Host/Swarm/SwarmService.cs @@ -349,7 +349,7 @@ namespace Tgstation.Server.Host.Swarm } /// - public ICollection? GetSwarmServers() + public List? GetSwarmServers() { if (!SwarmMode) return null; From ff4cdb156cf143a67117aae478102deaa584be68 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 20 Jan 2024 10:44:26 -0500 Subject: [PATCH 3/4] Closes #1737 --- src/Tgstation.Server.Host/Security/WindowsSystemIdentity.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/Tgstation.Server.Host/Security/WindowsSystemIdentity.cs b/src/Tgstation.Server.Host/Security/WindowsSystemIdentity.cs index e15b51557d..136c3c24e7 100644 --- a/src/Tgstation.Server.Host/Security/WindowsSystemIdentity.cs +++ b/src/Tgstation.Server.Host/Security/WindowsSystemIdentity.cs @@ -47,7 +47,7 @@ namespace Tgstation.Server.Host.Security { this.identity = identity ?? throw new ArgumentNullException(nameof(identity)); if (identity.IsAnonymous) - throw new InvalidOperationException($"Cannot use anonymous {nameof(WindowsIdentity)} as a {nameof(WindowsSystemIdentity)}!"); + throw new ArgumentException($"Cannot use anonymous {nameof(WindowsIdentity)} as a {nameof(WindowsSystemIdentity)}!", nameof(identity)); canCreateSymlinks = new WindowsPrincipal(identity).IsInRole(WindowsBuiltInRole.Administrator); } @@ -86,7 +86,7 @@ namespace Tgstation.Server.Host.Security } // can't clone a UP, shouldn't be trying to anyway, cloning is for impersonation - throw new InvalidOperationException("Cannot clone a UserPrincipal based WindowsSystemIdentity!"); + throw new NotSupportedException("Cannot clone a UserPrincipal based WindowsSystemIdentity!"); } /// @@ -95,7 +95,7 @@ namespace Tgstation.Server.Host.Security { ArgumentNullException.ThrowIfNull(action); if (identity == null) - throw new InvalidOperationException("Impersonate using a UserPrincipal based WindowsSystemIdentity!"); + throw new NotSupportedException("Impersonate using a UserPrincipal based WindowsSystemIdentity!"); WindowsIdentity.RunImpersonated(identity.AccessToken, action); }, cancellationToken, From c667d2365d54cd895d22dc37d5ae15f8b873edb1 Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 20 Jan 2024 10:45:42 -0500 Subject: [PATCH 4/4] Version bump to 6.1.3 --- build/Version.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Version.props b/build/Version.props index da62ceb40a..f281ec3d80 100644 --- a/build/Version.props +++ b/build/Version.props @@ -3,7 +3,7 @@ - 6.1.2 + 6.1.3 5.0.0 10.0.0 7.0.0