nx_media_path_gate.nx source

1// nx_media_path_gate.nx -- proves the /media (everyone/family) file allowlist: SFW library paths are served, 2// but the OWNER-ONLY recordings/NSFW (/mnt/nas_logging, served only by /gallery) are DENIED even by direct path. 3// Operator 2026-06-17: /media live for everyone, /gallery (owner-only) is the other thread. license_tier: ORIGINAL 4import "nx_galx_authz.nx" 5import "nx_syscalls.nx" 6 7func mpw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 8func mpslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 9func mprow(id: i64, ok: i64, what: *u8) -> i64 { mpw("MPROW " as *u8); let b: *u8=sys_mmap(8); b[0]=(48+id) as u8; sys_write(1,b,1); mpw(" " as *u8); if ok==1 { mpw("PASS " as *u8) } else { mpw("FAIL " as *u8) } mpw(what); mpw("\n" as *u8); return ok } 10func mpok(p: *u8) -> i64 { return galx_media_path_ok(p, mpslen(p)) } 11 12func main() -> i64 { 13 mpw("media path allowlist gate: /media serves SFW library, DENIES owner-only nas_logging\n" as *u8) 14 var rows: i64=0 15 var pass: i64=0 16 var ok: i64=0 17 18 // R0: SFW movie library is allowed (Zatoichi) 19 ok=0; if mpok("/mnt/nas_movies/Zatoichi_01_1962.mkv" as *u8)==1 { ok=1 } 20 rows=rows+1; pass=pass+mprow(0, ok, "/mnt/nas_movies (SFW: Zatoichi) ALLOWED on /media" as *u8) 21 22 // R1: owner-only cam recording is DENIED 23 ok=0; if mpok("/mnt/nas_logging/beanco_/beanco__2025-10-20_22-51-12_681.ts" as *u8)==0 { ok=1 } 24 rows=rows+1; pass=pass+mprow(1, ok, "/mnt/nas_logging (cam recording) DENIED on /media (owner-only)" as *u8) 25 26 // R2: owner-only NSFW is DENIED 27 ok=0; if mpok("/mnt/nas_logging/Redgifs/duke/GiantFlashyJumpingbean.mp4" as *u8)==0 { ok=1 } 28 rows=rows+1; pass=pass+mprow(2, ok, "/mnt/nas_logging/Redgifs (NSFW) DENIED on /media (owner-only)" as *u8) 29 30 // R3: a /volume1 path under a logging share is DENIED (covers the raw-Synology form) 31 ok=0; if mpok("/volume1/homes/elderwesto/logging/cam_2025.ts" as *u8)==0 { ok=1 } 32 rows=rows+1; pass=pass+mprow(3, ok, "/volume1/.../logging/ DENIED on /media (owner-only, raw form)" as *u8) 33 34 // R4: a non-NAS path is DENIED (no traversal/escape) 35 ok=0; if mpok("/etc/passwd" as *u8)==0 { ok=1 } 36 rows=rows+1; pass=pass+mprow(4, ok, "non-NAS path (/etc/passwd) DENIED (no escape)" as *u8) 37 38 // R5: another SFW library item + a /volume1 non-logging item are allowed 39 ok=0; if mpok("/mnt/nas_movies/MrBean/ep1.mkv" as *u8)==1 { if mpok("/volume1/media/film.mkv" as *u8)==1 { ok=1 } } 40 rows=rows+1; pass=pass+mprow(5, ok, "SFW (Mr Bean) + /volume1 non-logging ALLOWED on /media" as *u8) 41 42 mpw("NX-MEDIA-PATH-GATE rows=" as *u8); let rb: *u8=sys_mmap(8); rb[0]=(48+rows) as u8; sys_write(1,rb,1); mpw(" pass=" as *u8); let pb: *u8=sys_mmap(8); pb[0]=(48+pass) as u8; sys_write(1,pb,1); mpw("\n" as *u8) 43 if pass==rows { 44 let line: *u8 = "CMSGATE row=nx_media_path media-sfw-allow-deny-nas_logging rows=6 pass=6 verdict=PASS\n" as *u8 45 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 46 if gf >= 0 { sys_write(gf, line, mpslen(line)); sys_close(gf) } 47 mpw("NX-MEDIA-PATH-GATE GREEN 6/6 (/media serves SFW, denies owner-only nas_logging even by direct path)\n" as *u8) 48 sys_exit(0); return 0 49 } 50 mpw("NX-MEDIA-PATH-GATE RED\n" as *u8) 51 sys_exit(1); return 1 52}