v26.10.1 正式版

修复部分问题，优化性能，进一步推进类型系统

chusql-interface/test/sudo_native.py

@@ -0,0 +1,60 @@
+import ctypes
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+# 验证 Unix 本机凭据的所有权、权限及符号链接拒绝。
+
+# 执行本机凭据安全回归。
+def main():
+    library = ctypes.CDLL(sys.argv[1])
+    port = int(sys.argv[2])
+    library.chusql_sudo_create.argtypes = [ctypes.c_int, ctypes.c_char_p]
+    library.chusql_sudo_read.argtypes = [ctypes.c_int, ctypes.c_void_p]
+    secret = b'a' * 64
+    buffer = ctypes.create_string_buffer(64)
+    if len(sys.argv) > 3:
+        assert library.chusql_sudo_privileged() == 0
+        assert library.chusql_sudo_create(port, secret) != 0
+        assert library.chusql_sudo_read(port, buffer) != 0
+        print('non-root creation and reading refused')
+        return
+    assert library.chusql_sudo_privileged() == 1
+    assert library.chusql_sudo_create(port, secret) == 0
+    directory = Path(f'/var/run/chusql-sudo-{port}')
+    file = directory / 'credential'
+    try:
+        assert directory.stat().st_uid == 0
+        assert directory.stat().st_mode & 0o777 == 0o700
+        assert file.stat().st_mode & 0o777 == 0o600
+        assert library.chusql_sudo_read(port, buffer) == 0
+        assert buffer.raw == secret
+        assert library.chusql_sudo_create(port, secret) != 0
+        subprocess.run([sys.executable, __file__, sys.argv[1], str(port), '--deny'],
+                       user=65534, group=65534, check=True)
+        file.chmod(0o644)
+        assert library.chusql_sudo_read(port, buffer) != 0
+        file.chmod(0o600)
+        file.rename(directory / 'original')
+        file.symlink_to(directory / 'original')
+        assert library.chusql_sudo_read(port, buffer) != 0
+        file.unlink()
+        (directory / 'original').rename(file)
+        file.write_bytes(secret + b'extra')
+        assert library.chusql_sudo_read(port, buffer) != 0
+        file.write_bytes(secret)
+        os.chown(file, 65534, 65534)
+        assert library.chusql_sudo_read(port, buffer) != 0
+        os.chown(file, 0, 0)
+        directory.chmod(0o755)
+        assert library.chusql_sudo_read(port, buffer) != 0
+        directory.chmod(0o700)
+    finally:
+        assert library.chusql_sudo_remove(port) == 0
+    assert not directory.exists()
+    print('root round trip, duplicate, permissions, ownership, symlink and cleanup passed')
+
+
+if __name__ == '__main__':
+    main()