_sbr_install_gate.nx source

1// _sbr_install_gate.nx -- LOCK for the LM-026 ROOT FIX in nx_sov_build_run (install-on-success). NO mocks. 2// Forks the REAL runner (_offc/nx_sov_build_run.elf) on the throwaway fixture _sbrtest and proves the 3// runner now keeps _offc in sync with the fresh /tmp build, so gates can NEVER again fork a stale binary 4// (the trap that cost a full session on the MMU instruction-fetch rung). RED-on-regression: if a future 5// edit removes the auto-install or makes it pollute _offc with throwaway builds, this turns RED. 6// T1 no-spurious : build a module with NO pre-existing _offc/<name>.elf -> NO _offc entry created 7// (refresh-IF-PRESENT: gate/probe builds run from /tmp, must not pollute _offc) 8// T2 auto-refresh: a STALE _offc/<name>.elf -> after build, _offc/<name>.elf byte-equals /tmp/<name>.sov.elf 9// GREEN only if T1 && T2. Evidence -> knowledge/status/offc_install.log. license_tier: ORIGINAL 10import "nx_offc_install.nx" 11import "nx_syscalls.nx" 12 13const SG_LOG: *u8 = "knowledge/status/offc_install.log" 14const SG_RUNNER: *u8 = "_offc/nx_sov_build_run.elf" 15const SG_OFFC: *u8 = "_offc/_sbrtest.elf" 16const SG_TMP: *u8 = "/tmp/_sbrtest.sov.elf" 17 18func sg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 19func sg_p(s: *u8) -> i64 { sys_write(1, s, sg_len(s)); return 0 } 20func sg_fp(fd: i64, s: *u8) -> i64 { sys_write(fd, s, sg_len(s)); return 0 } 21 22func sg_write(path: *u8, content: *u8) -> i64 { 23 let fd: i64 = sys_openat_wr(path, 493) 24 if fd < 0 { return 0 } 25 sys_write(fd, content, sg_len(content)); sys_close(fd) 26 return 1 27} 28func sg_present(path: *u8) -> i64 { 29 let fd: i64 = sys_openat_rd(path) 30 if fd < 0 { return 0 } 31 sys_close(fd); return 1 32} 33// 1 if the two files byte-equal (both readable + same length + same bytes). 34func sg_file_eq(a: *u8, b: *u8) -> i64 { 35 let al: *i64 = sys_mmap(16) as *i64 36 let bl: *i64 = sys_mmap(16) as *i64 37 let ab: *u8 = sys_read_file(a, al) 38 if (ab as i64) == 0 { return 0 } 39 let bb: *u8 = sys_read_file(b, bl) 40 if (bb as i64) == 0 { return 0 } 41 if al[0] != bl[0] { return 0 } 42 var i: i64 = 0 43 while i < al[0] { if ab[i] != bb[i] { return 0 } i = i + 1 } 44 return 1 45} 46// fork + run the REAL runner on <name>, muting output; parent waits. The build+install side effect is 47// what we assert on (not the exit), so the run-exit of the fixture is irrelevant. 48func sg_build(name: *u8) -> i64 { 49 let pid: i64 = sys_fork() 50 if pid == 0 { 51 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4) 52 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 53 let argv: *i64 = sys_mmap(32) as *i64 54 argv[0] = SG_RUNNER as i64; argv[1] = name as i64; argv[2] = 0 55 let envp: *i64 = sys_mmap(16) as *i64 56 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 57 sys_execve(SG_RUNNER, argv, envp) 58 sys_exit(127) 59 } 60 let st: *i64 = sys_mmap(16) as *i64 61 sys_wait4(pid, st, 0) 62 return (st[0] >> 8) & 0xff 63} 64func sg_row(name: *u8, pass: i64) -> i64 { sg_p(" " as *u8); sg_p(name); if pass == 1 { sg_p(" PASS\n" as *u8) } else { sg_p(" FAIL\n" as *u8) } return 0 } 65 66func main() -> i64 { 67 // T1 no-spurious: with NO pre-existing _offc artifact, a build must NOT create one. 68 oi_fresh(SG_OFFC) // ensure absent (unlinkat) 69 sg_build("_sbrtest" as *u8) 70 var t1: i64 = 0 71 if sg_present(SG_OFFC) == 0 { t1 = 1 } 72 73 // T2 auto-refresh: a STALE installed artifact must be auto-refreshed to match the fresh build. 74 sg_write(SG_OFFC, "STALE-GARBAGE-v0-must-be-overwritten" as *u8) 75 sg_build("_sbrtest" as *u8) 76 var t2: i64 = 0 77 if sg_file_eq(SG_OFFC, SG_TMP) == 1 { t2 = 1 } 78 79 oi_fresh(SG_OFFC) // cleanup (no junk in _offc) 80 81 var ok: i64 = 0 82 if t1 == 1 { if t2 == 1 { ok = 1 } } 83 84 sg_p("SBR-INSTALL gate (LM-026 root fix: nx_sov_build_run installs-on-success)\n" as *u8) 85 sg_row("T1 no-spurious-entry " as *u8, t1) 86 sg_row("T2 auto-refresh-stale " as *u8, t2) 87 88 let lf: i64 = sys_openat_append(SG_LOG, 420) 89 if ok == 1 { 90 sg_p("SBRINSTALLGATE verdict=GREEN keystone=lm026-root-fix probe=sbr-install refresh-if-present=yes no-spurious=yes auto-refresh=yes\n" as *u8) 91 if lf >= 0 { sg_fp(lf, "SBRINSTALLGATE verdict=GREEN keystone=lm026-root-fix probe=sbr-install no-spurious+auto-refresh both-pass epoch=" as *u8); oi_wn(lf, sys_now_realtime_sec()); sg_fp(lf, "\n" as *u8); sys_close(lf) } 92 sys_exit(0); return 0 93 } 94 sg_p("SBRINSTALLGATE verdict=RED (root-fix not proven)\n" as *u8) 95 if lf >= 0 { sg_fp(lf, "SBRINSTALLGATE verdict=RED t1=" as *u8); oi_wn(lf, t1); sg_fp(lf, " t2=" as *u8); oi_wn(lf, t2); sg_fp(lf, "\n" as *u8); sys_close(lf) } 96 sys_exit(1) 97 return 1 98}