Files
Triple-C/app/src-tauri/src/logging.rs
T
shadow-testandClaude Opus 5 00128f9b1a Make the scrub work off /usr/bin, and stop a log level deciding whether it runs
H3 — the pre-commit scrub was a silent no-op on any base image whose coreutils
are not under /usr/bin. Hardening against a PATH-planted `stat` shim by naming
every tool absolutely bought nothing the `PATH` reset on the first line had not
already bought — the shim lives in the persisted home volume, and uid 1000
cannot write /usr/bin or /bin — and it cost the whole feature on Alpine, which
Settings -> Docker -> Custom accepts. Measured on one seeded tree in a real
container: the absolute-path script printed `###TRIPLE-C-SCRUBBED 0` and left
every planted file in place; the PATH-resolved one reclaims 77824 bytes. The
default image is unchanged at 521038.

It was silent three times over, and all three are fixed:

* The script now probes for all six things it needs (`command -v` for the five
  tools, plus the root device id reading back as a number) and, if any is
  missing, prints `###TRIPLE-C-SCRUB-UNAVAILABLE <what>` and no total at all.
* `scrub_writable_layer` reads that marker first and returns a new
  `ScrubOutcome::Unavailable`, warning with what the image is missing; a
  genuine `Reclaimed(0)` now leaves a debug line rather than nothing.
* `commit_log_suffix` renders `Reclaimed(0)` as "ran and found nothing to drop"
  rather than "0.00 MB dropped", which is what a scrub that could not run used
  to look like.

Verified in real containers: the mount-at-the-match defence still holds with a
home-volume `stat` shim first on PATH (the volume survives; deleting the PATH
reset from the same script empties it, so the harness can tell the difference).

H2 — the pre-migration scrub had been folded into `log::info!`'s argument list
to satisfy `#[must_use]`. `log::info!` expands to `if Info <= max_level() { … }`,
so the awaited scrub lived inside the level check, and `logging::init`
tolerates `dispatch.apply()` failing — which returns before `set_max_level` and
leaves the process at `Off`. In that state the scrub never ran and the layer
was committed into the longest-lived snapshot the app takes. The outcome is
bound first now, `logging::init` restores the level on failure and says so on
stderr, and a test scans all four files for an `.await` inside any `log::*!`
argument list.

Also:

* `reconcile_migration` deferred a held project instead of dropping it. Its
  only caller fires once per "Docker became available", so a project held at
  that instant was never revisited for the session — phase un-normalised, no
  resume or rollback offered, pin left `Claimed`. It now waits for the holder
  to let go (20s x 90, one waiter per project) and reconciles then.
* The scrub's byte total counts what a partly failed `rm` removed, by
  re-measuring rather than dropping the whole subtree on a non-zero exit —
  which was exactly the `--one-file-system` case.
* The scrub exec blanks `LD_PRELOAD`, `LD_AUDIT` and `LD_LIBRARY_PATH`.
  `LD_PRELOAD` is in none of the reserved env families, so a project's custom
  env var reached a root exec and injected code into every tool the scrub runs,
  `PATH` reset or not. Verified against Engine 29.7 that `docker exec -e` wins.
* The device test is described honestly: it is a mount test under `overlay2`
  and not under `vfs`, where checks 1 and 2 are what still hold.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
2026-08-23 15:47:36 -07:00

137 lines
5.4 KiB
Rust

use std::fs;
use std::path::PathBuf;
/// The level the dispatch is built with, and the level restored by hand if
/// installing it fails — see the failure branch in [`init`] for why that
/// matters more than it looks.
const LOG_LEVEL: log::LevelFilter = log::LevelFilter::Info;
/// Returns the log directory path: `<data_dir>/triple-c/logs/`
fn log_dir() -> Option<PathBuf> {
dirs::data_dir().map(|d| d.join("triple-c").join("logs"))
}
/// Initialise logging to both stderr and a log file in the app data directory.
///
/// Logs are written to `<data_dir>/triple-c/logs/triple-c.log`.
/// A panic hook is also installed so that unexpected crashes are captured in the
/// same log file before the process exits.
pub fn init() {
let log_file_path = log_dir().and_then(|dir| {
fs::create_dir_all(&dir).ok()?;
let path = dir.join("triple-c.log");
fs::OpenOptions::new()
.create(true)
.append(true)
.open(&path)
.ok()
.map(|file| (path, file))
});
let mut dispatch = fern::Dispatch::new()
.format(|out, message, record| {
out.finish(format_args!(
"[{} {} {}] {}",
chrono::Local::now().format("%Y-%m-%d %H:%M:%S"),
record.level(),
record.target(),
message
))
})
.level(LOG_LEVEL)
.chain(std::io::stderr());
if let Some((_path, file)) = &log_file_path {
dispatch = dispatch.chain(fern::Dispatch::new().chain(file.try_clone().unwrap()));
}
if let Err(e) = dispatch.apply() {
// H2's other half. `fern::Dispatch::apply` calls `log::set_boxed_logger`
// and only then `log::set_max_level`, so a failure returns with the
// global filter still at its default, `LevelFilter::Off`. That is not
// merely "no log output": every `log::info!(…)` expands to
// `if Info <= max_level() { … }`, so at `Off` the macro never evaluates
// its own arguments. Anything a call site put in an argument list —
// a function call, an `await`, a side effect — silently stops
// happening, app-wide, because a logger could not be installed.
//
// Call sites must not put effects in log arguments (see the
// pre-migration scrub in `migration_commands.rs`), but "the whole
// program's log macros are dead and nothing said so" is its own
// hazard, so the level this dispatch was configured with is restored
// by hand. Nothing is listening — `log`'s default logger is a no-op —
// but the macros evaluate, and the one thing that *is* guaranteed to
// reach the user, the stderr line below, says what happened.
eprintln!(
"Failed to initialise logger: {}. Log output is disabled for this run; \
log macros still evaluate their arguments.",
e
);
log::set_max_level(LOG_LEVEL);
}
// Install a panic hook that writes to the log file so crashes are captured.
let crash_log_dir = log_dir();
std::panic::set_hook(Box::new(move |info| {
let msg = format!(
"[{} PANIC] {}\nBacktrace:\n{:?}",
chrono::Local::now().format("%Y-%m-%d %H:%M:%S"),
info,
std::backtrace::Backtrace::force_capture(),
);
eprintln!("{}", msg);
if let Some(ref dir) = crash_log_dir {
let crash_path = dir.join("triple-c.log");
let _ = fs::OpenOptions::new()
.create(true)
.append(true)
.open(&crash_path)
.and_then(|mut f| {
use std::io::Write;
writeln!(f, "{}", msg)
});
}
}));
if let Some((ref path, _)) = log_file_path {
log::info!("Logging to {}", path.display());
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn a_logger_that_could_not_be_installed_still_leaves_the_macros_evaluating() {
// H2: `log::info!(…)` expands to `if Info <= max_level() { … }`, so at
// `LevelFilter::Off` the arguments are never evaluated. `fern` returns
// before `set_max_level` when `apply()` fails, which leaves exactly
// that state — and a call site that folded an effect into an argument
// list then stops performing it, app-wide, because a log file could not
// be opened. The failure branch restores the level for that reason.
//
// Asserted on the level itself rather than by driving `init`, which
// installs a process-global logger and a panic hook and can only run
// once per process.
assert_ne!(LOG_LEVEL, log::LevelFilter::Off);
// The property that makes the above worth asserting, demonstrated
// against the macro itself: a side effect in an argument list runs only
// while the level admits the record.
let mut ran = false;
let effect = |v: &mut bool| {
*v = true;
0
};
let previous = log::max_level();
log::set_max_level(log::LevelFilter::Off);
log::info!("{}", effect(&mut ran));
assert!(!ran, "the premise is wrong: arguments evaluated at LevelFilter::Off");
log::set_max_level(LOG_LEVEL);
log::info!("{}", effect(&mut ran));
assert!(ran, "arguments did not evaluate at the level this module configures");
log::set_max_level(previous);
}
}