Install SQLite Link control policy

2026-07-16 21:59:58 +07:00 · 2026-07-16 21:59:58 +07:00 · ae1c0741e5
commit ae1c0741e5
parent 7b11ce9da2
3 changed files with 76 additions and 8 deletions
--- a/README.md
+++ b/README.md
@ -130,6 +130,7 @@ Install the Control service after the WireGuard Hub:
 ```bash
 sudo ./ochenstarik-server-monitor-manager.sh install-control-hub
 sudo ./ochenstarik-server-monitor-manager.sh control-code home
+sudo ./ochenstarik-server-monitor-manager.sh control-device-code windows-pc
 ```

 Copy the resulting `SMMCTL1-...` code and install the Agent on the matching Node:
@ -140,6 +141,8 @@ sudo ./ochenstarik-server-monitor-manager.sh install-control-agent

 Create a new code for every Node. The code contains the public Control CA certificate but never its private key. Release archives are verified against their published SHA-256 checksums before installation. The Hub listens on TCP `7443`; allow this port at the hosting provider firewall if an external firewall is used.

+`control-device-code` creates a separate operator identity for the Windows application. Agent certificates cannot list all servers, change Links, or subscribe to the operator event stream. The Control service can invoke only the dedicated `link-connect` and `link-disconnect` policy wrapper through sudo; other Hub administration commands are not granted to it.
+
 ## Installation flow

 1. Select the wizard dialog language.
--- a/ochenstarik-server-monitor-manager.sh
+++ b/ochenstarik-server-monitor-manager.sh
@ -13,6 +13,7 @@ readonly HUB_CONFIG="${MESH_DIR}/hub.conf"
 readonly HUB_PRIVATE_KEY="${MESH_DIR}/hub.key"
 readonly LINKS_FILE="${MESH_DIR}/links"
 readonly HUB_HELPER="/usr/local/libexec/ochenstarik-smm-hub"
+readonly CONTROL_POLICY_HELPER="/usr/local/libexec/ochenstarik-smm-policy-apply"
 readonly HUB_CLI="/usr/local/sbin/ochenstarik-smm"
 readonly WG_INTERFACE="smm0"
 readonly WG_CONFIG="/etc/wireguard/${WG_INTERFACE}.conf"
@ -31,7 +32,7 @@ readonly AGENT_ENV="${MESH_DIR}/agent.env"
 readonly CONTROL_CA_CERT="${MESH_DIR}/control-ca.crt"
 readonly CONTROL_SERVICE="/etc/systemd/system/ochenstarik-smm-control.service"
 readonly AGENT_SERVICE="/etc/systemd/system/ochenstarik-smm-agent.service"
-readonly SMM_RELEASE_VERSION="${SMM_RELEASE_VERSION:-v0.1.0-alpha.1}"
+readonly SMM_RELEASE_VERSION="${SMM_RELEASE_VERSION:-v0.1.0-alpha.2}"
 readonly SMM_RELEASE_BASE_URL="${SMM_RELEASE_BASE_URL:-https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/${SMM_RELEASE_VERSION}}"

 log() { printf '[+] %s\n' "$*"; }
@ -659,14 +660,48 @@ EOF
 }

 configure_hub_sudo() {
-  cat > /etc/sudoers.d/ochenstarik-smm-hub <<EOF
-${MONITOR_USER} ALL=(root) NOPASSWD: ${HUB_HELPER} *
-EOF
+  {
+    printf '%s ALL=(root) NOPASSWD: %s *\n' "$MONITOR_USER" "$HUB_HELPER"
+    if getent passwd "$CONTROL_USER" >/dev/null; then
+      printf '%s ALL=(root) NOPASSWD: %s *\n' "$CONTROL_USER" "$CONTROL_POLICY_HELPER"
+    fi
+  } > /etc/sudoers.d/ochenstarik-smm-hub
  chmod 0440 /etc/sudoers.d/ochenstarik-smm-hub
  visudo -cf /etc/sudoers.d/ochenstarik-smm-hub >/dev/null \
    || die "Некорректный sudoers-файл Mesh Hub"
 }

+create_control_policy_helper() {
+  cat > "$CONTROL_POLICY_HELPER" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+readonly HUB_HELPER="/usr/local/libexec/ochenstarik-smm-hub"
+action="${1:-}"
+
+valid_name() { [[ "$1" =~ ^[a-z0-9][a-z0-9-]{0,31}$ ]]; }
+valid_protocol() { [[ "$1" == tcp || "$1" == udp ]]; }
+valid_port() { [[ "$1" =~ ^[0-9]+$ ]] && (( $1 >= 1 && $1 <= 65535 )); }
+
+case "$action" in
+  link-connect)
+    [[ $# -eq 6 ]] || exit 2
+    valid_name "$2" && valid_name "$3" && valid_protocol "$4" && valid_port "$5" \
+      && [[ "$6" =~ ^[0-9]+$ ]] && (( $6 <= 525600 )) || exit 2
+    ;;
+  link-disconnect)
+    [[ $# -eq 5 ]] || exit 2
+    valid_name "$2" && valid_name "$3" && valid_protocol "$4" && valid_port "$5" || exit 2
+    ;;
+  *) exit 2 ;;
+esac
+
+exec "$HUB_HELPER" "$@"
+EOF
+  chown root:root "$CONTROL_POLICY_HELPER"
+  chmod 0750 "$CONTROL_POLICY_HELPER"
+}
+
 read_hub_endpoint() {
  local endpoint port
  if [[ -n "${SMM_HUB_ENDPOINT:-}" ]]; then
@ -778,6 +813,7 @@ ASPNETCORE_Kestrel__Certificates__Default__Path=${CONTROL_STATE}/server.pfx
 Control__DatabasePath=${CONTROL_STATE}/control.db
 Control__CertificateAuthorityPath=${CONTROL_STATE}/control-ca.pfx
 Control__HeartbeatSeconds=30
+Control__HubHelperPath=${CONTROL_POLICY_HELPER}
 EOF
  chmod 0600 "$CONTROL_ENV"
  cat > "$CONTROL_SERVICE" <<EOF
@ -794,7 +830,6 @@ EnvironmentFile=${CONTROL_ENV}
 ExecStart=${CONTROL_BINARY}
 Restart=on-failure
 RestartSec=10s
-NoNewPrivileges=true
 PrivateTmp=true
 PrivateDevices=true
 ProtectSystem=strict
@ -813,6 +848,7 @@ EOF
  chmod 0644 "$CONTROL_SERVICE"
  systemctl daemon-reload
  systemctl enable --now ochenstarik-smm-control.service
+  systemctl restart ochenstarik-smm-control.service
 }

 install_control_hub() {
@ -823,6 +859,8 @@ install_control_hub() {
  download_control_layer
  ensure_system_user "$CONTROL_USER" "$CONTROL_STATE"
  install -d -m 0700 -o root -g root "$MESH_DIR"
+  create_control_policy_helper
+  configure_hub_sudo
  create_control_certificates "$endpoint"
  configure_control_service
  if command -v ufw >/dev/null 2>&1 && ufw status | grep -q '^Status: active'; then
@ -917,6 +955,27 @@ create_control_join_code() {
  unset token payload ca
 }

+create_device_join_code() {
+  local device_id="$1" endpoint token ca payload
+  [[ -x "$CONTROL_BINARY" && -r "$CONTROL_ENV" && -r "$CONTROL_CA_CERT" ]] \
+    || die "Control Hub не установлен"
+  [[ "$device_id" =~ ^[a-z0-9][a-z0-9-]{0,62}$ ]] || die "Некорректное имя устройства"
+  endpoint="$(awk -F= '$1 == "HUB_ENDPOINT" { print $2; exit }' "$HUB_CONFIG")"
+  token="$(
+    set -a
+    # shellcheck disable=SC1090
+    . "$CONTROL_ENV"
+    set +a
+    runuser -u "$CONTROL_USER" -m -- "$CONTROL_BINARY" device-token-create "$device_id"
+  )"
+  [[ "$token" =~ ^[A-Za-z0-9_-]{43}$ ]] || die "Control Hub не создал device token"
+  ca="$(base64 -w0 "$CONTROL_CA_CERT")"
+  payload="$(printf 'VERSION=1\nDEVICE=%s\nURL=https://%s:%s\nTOKEN=%s\nCA=%s\n' \
+    "$device_id" "$endpoint" "$CONTROL_PORT" "$token" "$ca")"
+  printf 'SMMDEV1-%s\n' "$(printf '%s' "$payload" | base64url_encode)"
+  unset token payload ca
+}
+
 read_control_join_code() {
  if [[ -n "${SMM_CONTROL_CODE:-}" ]]; then
    CONTROL_JOIN_CODE="$SMM_CONTROL_CODE"
@ -1162,7 +1221,8 @@ backup_state() {
  timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
  backup_file="${backup_dir}/${timestamp}.tar.gz"
  for path in \
-    "$MESH_DIR" "$MONITOR_HOME" "$MONITOR_COMMAND" "$HUB_HELPER" "$HUB_CLI" "$WG_CONFIG" \
+    "$MESH_DIR" "$MONITOR_HOME" "$MONITOR_COMMAND" "$HUB_HELPER" "$HUB_CLI" \
+    "$CONTROL_POLICY_HELPER" "$WG_CONFIG" \
    /etc/systemd/system/ochenstarik-smm-firewall.service \
    /etc/systemd/system/ochenstarik-smm-firewall.timer \
    /etc/sudoers.d/ochenstarik-smm-hub \
@ -1270,7 +1330,8 @@ uninstall_hub() {
    /etc/systemd/system/ochenstarik-smm-firewall.timer \
    /etc/sudoers.d/ochenstarik-smm-hub \
    /etc/sysctl.d/90-ochenstarik-smm-forward.conf \
-    "$HUB_HELPER" "$HUB_CLI" "$WG_CONFIG" "$CONTROL_SERVICE" "$CONTROL_ENV" "$CONTROL_CA_CERT"
+    "$HUB_HELPER" "$HUB_CLI" "$CONTROL_POLICY_HELPER" "$WG_CONFIG" \
+    "$CONTROL_SERVICE" "$CONTROL_ENV" "$CONTROL_CA_CERT"
  rm -rf -- "$CONTROL_STATE" "$(dirname "$CONTROL_BINARY")"
  getent passwd "$CONTROL_USER" >/dev/null && userdel "$CONTROL_USER" 2>/dev/null || true
  rm -rf -- "$MESH_DIR"
@ -1290,6 +1351,7 @@ main() {
    install-control-hub) install_control_hub ;;
    install-control-agent) install_control_agent ;;
    control-code) [[ $# -eq 2 ]] || die "Использование: $0 control-code NAME"; create_control_join_code "$2" ;;
+    control-device-code) [[ $# -eq 2 ]] || die "Использование: $0 control-device-code DEVICE"; create_device_join_code "$2" ;;
    hub-code) [[ $# -eq 2 ]] || die "Использование: $0 hub-code NAME"; exec "$HUB_HELPER" node-code "$2" ;;
    status) show_status ;;
    update) update_installed ;;
@ -1298,7 +1360,7 @@ main() {
    uninstall-node) uninstall_node ;;
    uninstall-hub) uninstall_hub ;;
    uninstall) die "Укажите роль: uninstall-monitor, uninstall-node или uninstall-hub" ;;
-    *) die "Использование: $0 {install-monitor|install-hub|install-node|install-control-hub|install-control-agent|control-code NAME|hub-code NAME|status|update|rollback|uninstall-monitor|uninstall-node|uninstall-hub}" ;;
+    *) die "Использование: $0 {install-monitor|install-hub|install-node|install-control-hub|install-control-agent|control-code NAME|control-device-code DEVICE|hub-code NAME|status|update|rollback|uninstall-monitor|uninstall-node|uninstall-hub}" ;;
  esac
 }

--- a/tests/test-monitor-manager-control-layer.sh
+++ b/tests/test-monitor-manager-control-layer.sh
@ -9,9 +9,12 @@ grep -Fq 'readonly SMM_RELEASE_VERSION=' "$script"
 grep -Fq 'server-monitor-manager-${runtime}.tar.gz' "$script"
 grep -Fq 'sha256sum "$archive"' "$script"
 grep -Fq 'SMMCTL1-' "$script"
+grep -Fq 'SMMDEV1-' "$script"
 grep -Fq 'control-code)' "$script"
 grep -Fq 'install-control-hub)' "$script"
 grep -Fq 'install-control-agent)' "$script"
+grep -Fq 'control-device-code)' "$script"
+grep -Fq 'ochenstarik-smm-policy-apply' "$script"
 grep -Fq 'NoNewPrivileges=true' "$script"
 grep -Fq 'ProtectSystem=strict' "$script"
 grep -Fq 'SMM_EnrollToken=${token}' "$script"