nx_os_introspect_gate.nx source
↩ module page · 79 lines · 4193 B
1// nx_os_introspect_gate.nx -- in-process referee for the OS-introspection lib (CAP-PORT-OWNER). Binds a REAL
2// listener, resolves it back through the sovereign /proc chain, and asserts the owner is THIS process (the mapping
3// is correct, not arbitrary) -- the honest self-test. Then, as a LIVE DIAGNOSTIC (not an assertion), it names
4// whatever holds :8456 (the docportal-admin bind conflict). GREEN iff T1..T6. license_tier: ORIGINAL expect_exit: 0
5import "nx_os_introspect.nx"
6
7func og_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
8func og_puti(v: i64) -> i64 {
9 var t: i64 = v; if t < 0 { sys_write(1, "-" as *u8, 1); t = 0 - t }
10 let tm: *u8 = sys_mmap(24); var k: i64 = 0; if t == 0 { tm[0]=48 as u8; k=1 }
11 while t > 0 { tm[k] = (48 + (t%10)) as u8; t = t/10; k = k+1 }
12 let b: *u8 = sys_mmap(24); var j: i64 = 0; while j < k { b[j] = tm[k-1-j]; j = j+1 }
13 sys_write(1, b, k); return 0
14}
15func og_row(name: *u8, ok: i64) -> i64 { if ok == 1 { og_w(" PASS " as *u8) } else { og_w(" FAIL " as *u8) } og_w(name); og_w("\n" as *u8); return ok }
16
17func main() -> i64 {
18 og_w("nx_os_introspect gate -- sovereign /proc perception: port->inode->pid->comm/cmdline (no ss/lsof/netstat)\n" as *u8)
19 let TESTPORT: i64 = 53991
20
21 let fd: i64 = sys_socket(2, 1, 0)
22 if fd < 0 { og_w("SOCKET FAIL\n" as *u8); sys_exit(1) }
23 let opt: *u8 = sys_mmap(4); opt[0]=1 as u8; sys_setsockopt(fd, 1, 2, opt, 4)
24 let addr: *u8 = sys_mmap(16)
25 addr[0]=2 as u8; addr[1]=0 as u8
26 addr[2]=((TESTPORT>>8)&0xff) as u8; addr[3]=(TESTPORT&0xff) as u8
27 addr[4]=127 as u8; addr[5]=0 as u8; addr[6]=0 as u8; addr[7]=1 as u8
28 var z: i64=8; while z<16 { addr[z]=0 as u8; z=z+1 }
29 if sys_bind(fd, addr, 16) < 0 { og_w("BIND FAIL\n" as *u8); sys_exit(1) }
30 if sys_listen(fd, 4) < 0 { og_w("LISTEN FAIL\n" as *u8); sys_exit(1) }
31
32 var pass: i64 = 0
33
34 let inode: i64 = pon_listener_inode(TESTPORT)
35 var t1: i64 = 0; if inode > 0 { t1 = 1 }
36 pass = pass + og_row("T1 LISTEN socket found in /proc/net/tcp (inode resolved)" as *u8, t1)
37
38 let pid: i64 = pon_inode_to_pid(inode)
39 var t2: i64 = 0; if pid > 0 { t2 = 1 }
40 pass = pass + og_row("T2 inode -> owning pid via /proc/*/fd readlinkat" as *u8, t2)
41
42 let selfl: *u8 = sys_mmap(64); pon_readlink("/proc/self" as *u8, selfl, 64)
43 let selfpid: i64 = pon_dec(selfl, 0, pon_strlen(selfl))
44 var t3: i64 = 0; if pid == selfpid { if selfpid > 0 { t3 = 1 } }
45 pass = pass + og_row("T3 owning pid == /proc/self (mapping found THIS process, not a wrong one)" as *u8, t3)
46
47 let comm: *u8 = sys_mmap(64); let cn: i64 = pon_pid_comm(pid, comm, 64)
48 var t4: i64 = 0; if cn > 0 { t4 = 1 }
49 pass = pass + og_row("T4 pid -> process name via /proc/<pid>/comm" as *u8, t4)
50
51 var t5: i64 = 0; if pon_listener_inode(TESTPORT + 1) == 0 { t5 = 1 }
52 pass = pass + og_row("T5 an unbound port -> inode 0 (no false positive)" as *u8, t5)
53
54 let cmdl: *u8 = sys_mmap(512); let cl: i64 = pon_pid_cmdline(pid, cmdl, 512)
55 var t6: i64 = 0; if cl > 0 { t6 = 1 }
56 pass = pass + og_row("T6 pid -> FULL cmdline via /proc/<pid>/cmdline (un-truncated identity)" as *u8, t6)
57
58 // ---- LIVE DIAGNOSTIC (informational; not scored): who holds :8456 (the docportal admin bind conflict)? ----
59 og_w("--- LIVE DIAGNOSTIC: who holds :8456? ---\n" as *u8)
60 let h: i64 = pon_port_owner_pid(8456)
61 if h > 0 {
62 og_w(" :8456 HELD by pid=" as *u8); og_puti(h)
63 let hc: *u8 = sys_mmap(64); pon_pid_comm(h, hc, 64); og_w(" comm=" as *u8); og_w(hc)
64 let hl: *u8 = sys_mmap(512); let hln: i64 = pon_pid_cmdline(h, hl, 512)
65 if hln > 0 { og_w("\n cmdline=" as *u8); og_w(hl) }
66 og_w("\n" as *u8)
67 } else {
68 og_w(" :8456 has NO LISTEN socket (free) -> the docportal FATAL is a code/perm path, NOT a port conflict\n" as *u8)
69 }
70 sys_close(fd)
71
72 if pass == 6 {
73 og_w("nx_os_introspect_gate GREEN 6/6 (sovereign port->inode->pid->comm+cmdline; the shared os-axis perception rung)\n" as *u8)
74 sys_exit(0)
75 }
76 og_w("nx_os_introspect_gate RED\n" as *u8)
77 sys_exit(1)
78 return 1
79}