user: implement user factory

Co-Authored-By: Joshua M. Clulow <jmc@oxide.computer>

Author: emilyalbini

Cargo.lock

@@ -10,6 +10,7 @@ members = [
 	"download",
 	"factory/aws",
 	"factory/gimlet",
+	"factory/user",
 	"factory/lab",
 	"factory/propolis",
 	"github/client",
@@ -45,6 +46,7 @@ wrong_self_convention = "allow"
 [workspace.dependencies]
 ansi-to-html = { version = "0.2", features =  [ "lazy-init" ] }
 anyhow = "1"
+async-compression = { version = "0.4", features = ["gzip", "tokio"] }
 aws-config = "1"
 aws-credential-types = "1"
 aws-runtime = "1"

Cargo.toml

@@ -3,6 +3,7 @@
  */
 
 use anyhow::{anyhow, Result};
+use serde::{Deserialize, Serialize};
 use std::ffi::{CStr, CString};
 use std::io::{Error as IoError, ErrorKind};
 use std::path::PathBuf;
@@ -60,10 +61,16 @@ pub fn getuid() -> Uid {
     Uid(unsafe { libc::getuid() })
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize,
+)]
+#[serde(transparent)]
 pub struct Uid(pub u32);
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize,
+)]
+#[serde(transparent)]
 pub struct Gid(pub u32);
 
 fn catch_errno<T, F: Fn() -> T>(f: F) -> Result<T, IoError> {

common/src/unix.rs

@@ -0,0 +1,36 @@
+[package]
+name = "buildomat-factory-user"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+buildomat-common = { path = "../../common" }
+buildomat-database = { path = "../../database" }
+buildomat-client = { path = "../../client" }
+buildomat-types = { path = "../../types" }
+
+anyhow = { workspace = true }
+async-compression = { workspace = true }
+base64 = { workspace = true }
+chrono = { workspace = true }
+getopts = { workspace = true }
+libc = { workspace = true }
+rand = { workspace = true }
+reqwest = { workspace = true } 
+rusty_ulid = { workspace = true }
+schemars = { workspace = true }
+sea-query = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+slog = { workspace = true }
+slog-term = { workspace = true }
+smf = { workspace = true }
+strum = { workspace = true }
+tempfile = { workspace = true }
+tokio = { workspace = true }
+toml = { workspace = true }
+usdt = { workspace = true }

factory/user/Cargo.toml

@@ -0,0 +1,62 @@
+# User Factory
+
+The user factory creates unprivileged users on a shared illumos machine to run
+jobs.  The factory ensures each job runs in an ephemeral system user with no
+privileges and no ability to write files outside of allowlisted directories, and
+cleans up any leftover files at the end of the job.
+
+It currently only supports running on illumos, and requires that the factory
+runs with the `Primary Administrator` profile.
+
+## Slots 
+
+The factory configuration has to define one or more named "slots".  Each slot
+has a buildomat target it supports, plus optional configuration to define its
+execution environment.  When the a job comes in from the buildomat core server,
+the factory will only accept it if there is a free slot for that job's target.
+This means the number of slots is also the concurrency limit on that system.
+
+The minimal slot configuration requires only a slot name and the ID of the
+buildomat target the slot supports:
+
+```toml
+[slots.NAME]
+target = "TARGET_ID"
+```
+
+Additional configuration options are available:
+
+* **`add_to_groups = ["GROUP", "GROUP"]`**: add the ephemeral system user to
+  these groups in addition to the primary (ephemeral) group.  This can be useful
+  to allow jobs running in the slot to access system capabilities guarded by
+  group membership.
+
+* **`env.KEY = "VALUE"`**: set arbitrary environment variables in jobs executed
+  inside of this slot.
+
+An example of a full slot configuration:
+
+```toml
+[slots.hubris-1]
+target = "..."
+env.HUMILITY_ENVIRONMENT = "/opt/ci/humility/1.json"
+add_to_groups = ["usb"]
+```
+
+## Isolation
+
+Each job runs as an ephemeral user, with randomly generated UID and GID,
+guaranteed not to collide with any UID and GID currently in use on the system.
+The name of the user is the worker ID prefixed by `bmat-`.
+
+The whole filesystem is enforced to be read-only, except for a few allowlisted
+directories. All writeable directories are empty at the time the job starts, and
+are purged at the end of the job. The following directiories are writeable:
+
+* `/home/$USER`
+* `/input`
+* `/opt/buildomat` (used by the buildomat agent)
+* `/tmp`
+* `/var/run` (used by the buildomat agent)
+* `/var/tmp`
+* `/work`

factory/user/README.md

@@ -0,0 +1,11 @@
+-- v 1
+CREATE TABLE worker (
+    id              TEXT    NOT NULL    PRIMARY KEY,
+    slot            TEXT    NOT NULL,
+    state           TEXT    NOT NULL,
+    leased_job      TEXT    NOT NULL,
+    bootstrap       TEXT    NOT NULL
+);
+
+-- v 2
+CREATE INDEX worker_state ON worker (state);

factory/user/schema.sql

@@ -0,0 +1,8 @@
+<?xml version='1.0'?>
+<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
+<service_bundle name='buildomat-worker' type='manifest'>
+    <service name='site/buildomat/factory-user-worker' type='service' version='0'>
+        <exec_method name='start' type='method' timeout_seconds='60' exec='%EXEC%' />
+        <exec_method name='stop' type='method' timeout_seconds='60' exec=':kill' />
+    </service>
+</service_bundle>