code wiki / (root) / nx_ownership_gate.nx
`nx_ownership_gate.nx` source

↩ module page · 229 lines · 15186 B
1// nx_ownership_gate.nx -- GATE for LN4 ownership moves (own_check_move) and LN5 use-after-free
2// (own_check_uaf).  ONE gate for both rungs because there is ONE checker: a move and a release are
3// the same event -- the name stops naming a live buffer -- and two gates over one state machine would
4// be two rulers for one invariant.
5//
6// THE RUNGS' DONE-RULES: a use after `__move(p)` is a compile error naming the local; a use after
7// `sys_munmap(p, n)` is a compile error naming the local; the existing corpus builds unchanged under
8// the default mode.
9//
10// SUBJECT IS argv[1] AND THERE IS NO DEFAULT.  A gate that forks a compiler it was not given measures
11// whatever happens to be installed and prints a fully-formed verdict about it -- the sibling compiler
12// gates default to the live builder, and that default is exactly how a stale binary earns a green.
13// Refusing costs one argument and removes the whole failure class, so this gate exits 3 (UNKNOWN --
14// "I could not look", never an acquittal) rather than guess.
15//
16// THE BITE IS TWO REAL COMPILERS, not a synthesised mutant: GREEN on a challenger built from a tree
17// carrying the rung, RED on _offc/nx_cc_sovereign.elf (the live builder, which has no --ownership).
18//
19// Data captures in /tmp/nxown/, RUNNABLES under _build/ -- the NAS mounts /tmp noexec, so a runnable
20// staged there passes every compile tooth and fails every run tooth with no diagnostic at all.
21// Usage: nx_ownership_gate <compiler_elf>          (CWD = the tree root)
22// license_tier: ORIGINAL   No hw writes (Rule 26).
23import "nx_syscalls.nx"
24import "nx_gate_verdict.nx"
25import "nx_ccgate_lib.nx"
26import "nx_ccbuild_lib.nx"
27import "nx_lineconf_lib.nx"
28
29const OWNG_USAGE_EXIT: i64 = 3
30const OWNG_CONF: *u8 = "knowledge/ownership_gate.conf\x00"
31
32func main(argc: i64, argv: *i64) -> i64 {
  // SUBJECT RESOLUTION, THREE WAYS, AND IT SAYS WHICH ONE IT USED.  argv[1] wins; else the DECLARED
  // row in knowledge/ownership_gate.conf (read line-anchored by the one conf reader, lcf_str_of);
  // else exit 3 UNKNOWN.  A baked-in default is the failure class -- the gate would measure whatever
  // binary happens to be installed and print a confident verdict about it.  A bare refusal was the
  // opposite failure: MEASURED here, nx_gate_bite reported UNCONTROLLED and the gate roster forks
  // its rows BARE, so the gate was unrunnable by every harness in the estate.  A declaration answers
  // both, and printing the provenance is what stops the declaration becoming the silent default.
  // Path buffer is CCG_PATH_CAP -- the estate's existing per-run path cap, not a fresh guess.
  ccg_anchor_root()
  var cc: *u8 = 0 as *u8
  var how: *u8 = "argv\x00"
  if argc >= 2 { cc = argv[1] as *u8 }
  if argc < 2 {
      let cbuf: *u8 = sys_mmap(CCG_PATH_CAP)
      // KEY WITHOUT THE '=' -- lcf_find appends it itself (nx_lineconf_lib.nx:32 requires buf[i+k]
      // to be '=' AFTER the key matches).  Passing "subject=" searched for `subject==` and missed,
      // and the miss surfaced as a confident "no subject declared" REFUSAL rather than an error:
      // a format mismatch fails as a wrong answer, never as a diagnostic.  Read the parser's
      // contract before choosing the producer's format.
      let n: i64 = lcf_str_of(OWNG_CONF, "subject\x00" as *u8, cbuf, CCG_PATH_CAP)
      if n > 0 { cc = cbuf; how = "conf\x00" }
  }
  if (cc as i64) == 0 {
      gv_puts("nx_ownership_gate: REFUSED -- no compiler given and no subject declared.\n" as *u8)
      gv_puts("  usage: nx_ownership_gate <compiler_elf>   e.g. _build/nx_own_cc.elf (a challenger) or _offc/nx_cc_sovereign.elf (the live builder)\n" as *u8)
      gv_puts("  or declare one: a `subject=<path>` row in knowledge/ownership_gate.conf, which is what every harness that forks this gate BARE will read.\n" as *u8)
      gv_puts("  why refused rather than defaulted: a compiler gate that picks its own subject reports a confident verdict about whatever binary happens to be installed. That is how a stale artifact earns a green, and it is indistinguishable from a real measurement afterwards.\n" as *u8)
      gv_puts("verdict=UNKNOWN\n" as *u8)
      sys_exit(OWNG_USAGE_EXIT)
      return OWNG_USAGE_EXIT
  }
  let FLAG: *u8 = "--ownership\x00"
  sys_mkdir("/tmp/nxown\x00" as *u8, CCG_MODE_X)
  let pid: i64 = ccg_pid()
67
  // hazard (h) / positive control (c) / alias (a) / double-free (f)  x  default (d) / mode (m)
  let p_hds: *u8 = ccg_path("/tmp/nxown/hd_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_hde: *u8 = ccg_path("/tmp/nxown/hd_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_hdelf: *u8 = ccg_path("_build/nxown_hd_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_hms: *u8 = ccg_path("/tmp/nxown/hm_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_hme: *u8 = ccg_path("/tmp/nxown/hm_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_hmelf: *u8 = ccg_path("_build/nxown_hm_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_cds: *u8 = ccg_path("/tmp/nxown/cd_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_cde: *u8 = ccg_path("/tmp/nxown/cd_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_cdelf: *u8 = ccg_path("_build/nxown_cd_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_cms: *u8 = ccg_path("/tmp/nxown/cm_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_cme: *u8 = ccg_path("/tmp/nxown/cm_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_cmelf: *u8 = ccg_path("_build/nxown_cm_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_ads: *u8 = ccg_path("/tmp/nxown/ad_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_ade: *u8 = ccg_path("/tmp/nxown/ad_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_adelf: *u8 = ccg_path("_build/nxown_ad_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_ams: *u8 = ccg_path("/tmp/nxown/am_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_ame: *u8 = ccg_path("/tmp/nxown/am_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_amelf: *u8 = ccg_path("_build/nxown_am_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_fds: *u8 = ccg_path("/tmp/nxown/fd_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_fde: *u8 = ccg_path("/tmp/nxown/fd_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_fdelf: *u8 = ccg_path("_build/nxown_fd_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_fms: *u8 = ccg_path("/tmp/nxown/fm_\x00" as *u8, pid, ".s\x00" as *u8)
  let p_fme: *u8 = ccg_path("/tmp/nxown/fm_\x00" as *u8, pid, ".err\x00" as *u8)
  let p_fmelf: *u8 = ccg_path("_build/nxown_fm_\x00" as *u8, pid, ".elf\x00" as *u8)
  let p_asm: *u8 = ccg_path("_build/nxown_asm_\x00" as *u8, pid, ".elf\x00" as *u8)
94
  let hfx: *u8 = "runtime/nx_ownership.nx\x00"
  let cfx: *u8 = "runtime/nx_ownership_ok.nx\x00"
  let afx: *u8 = "runtime/nx_ownership_alias.nx\x00"
  let ffx: *u8 = "runtime/nx_ownership_dfree.nx\x00"
99
  let ctr: *i64 = gv_ctr()
  gv_head("=== nx_ownership_gate -- LN4 own_check_move + LN5 own_check_uaf: --ownership refuses use-after-move and use-after-free naming the local and the line that ended its life, and every accept idiom still compiles and runs ===" as *u8)
  gv_puts("  compiler_under_test=" as *u8)
  gv_puts(cc)
  gv_puts("  subject_resolved_by=" as *u8)
  gv_puts(how)
  gv_puts("\n" as *u8)
107
  // ---- default mode: the record that all four hazards are LEGAL SOURCE TODAY ----
  let bhd: i64 = ccg_build(cc, 0 as *u8, hfx, p_hds, p_hdelf, p_hde, p_asm)
  let bcd: i64 = ccg_build(cc, 0 as *u8, cfx, p_cds, p_cdelf, p_cde, p_asm)
  let bad: i64 = ccg_build(cc, 0 as *u8, afx, p_ads, p_adelf, p_ade, p_asm)
  let bfd: i64 = ccg_build(cc, 0 as *u8, ffx, p_fds, p_fdelf, p_fde, p_asm)
  var hd_run: i64 = 0 - 1
  var cd_run: i64 = 0 - 1
  var ad_run: i64 = 0 - 1
  var fd_run: i64 = 0 - 1
  if bhd == 0 { hd_run = ccg_phase(p_hdelf, 0 as *u8) }
  if bcd == 0 { cd_run = ccg_phase(p_cdelf, 0 as *u8) }
  if bad == 0 { ad_run = ccg_phase(p_adelf, 0 as *u8) }
  if bfd == 0 { fd_run = ccg_phase(p_fdelf, 0 as *u8) }
  ccg_val("hazard_default_build_rc" as *u8, bhd)
  ccg_val("hazard_default_exit" as *u8, hd_run)
  ccg_val("control_default_build_rc" as *u8, bcd)
  ccg_val("control_default_exit" as *u8, cd_run)
  ccg_val("alias_default_build_rc" as *u8, bad)
  ccg_val("alias_default_exit" as *u8, ad_run)
  ccg_val("dfree_default_build_rc" as *u8, bfd)
  ccg_val("dfree_default_exit" as *u8, fd_run)
129
  var t1: i64 = 0
  if bhd == 0 { t1 = 1 }
  gv_check("T1 neg-control-use-after-move-and-use-after-free-COMPILE-under-the-default (they are legal source today -- the gap this rung closes)" as *u8, t1, ctr)
  var t2: i64 = 0
  if hd_run == 0 { t2 = 1 }
  gv_check("T2 neg-control-hazard-RUNS-exit0-under-the-default (right by an arena accident, not by correctness: 64 bytes is below NXA_SMALL_MAX so the release is a no-op)" as *u8, t2, ctr)
  var t3: i64 = 0
  if bcd == 0 { t3 = 1 }
  gv_check("T3 positive-control-compiles-under-the-default" as *u8, t3, ctr)
  var t4: i64 = 0
  if cd_run == 0 { t4 = 1 }
  gv_check("T4 positive-control-runs-exit0-under-the-default" as *u8, t4, ctr)
  var t5: i64 = 0
  if bad == 0 { if ad_run == 0 { t5 = 1 } }
  gv_check("T5 neg-control-alias-use-after-free-compiles-AND-runs-exit0-under-the-default" as *u8, t5, ctr)
  var t6: i64 = 0
  if bfd == 0 { if fd_run == 0 { t6 = 1 } }
  gv_check("T6 neg-control-double-free-compiles-AND-runs-exit0-under-the-default (a double free is completely invisible at runtime today)" as *u8, t6, ctr)
148
  // ---- ownership mode ----
  let bhm: i64 = ccg_build(cc, FLAG, hfx, p_hms, p_hmelf, p_hme, p_asm)
  let bcm: i64 = ccg_build(cc, FLAG, cfx, p_cms, p_cmelf, p_cme, p_asm)
  let bam: i64 = ccg_build(cc, FLAG, afx, p_ams, p_amelf, p_ame, p_asm)
  let bfm: i64 = ccg_build(cc, FLAG, ffx, p_fms, p_fmelf, p_fme, p_asm)
  var cm_run: i64 = 0 - 1
  if bcm == 0 { cm_run = ccg_phase(p_cmelf, 0 as *u8) }
  ccg_val("hazard_mode_build_rc" as *u8, bhm)
  ccg_val("control_mode_build_rc" as *u8, bcm)
  ccg_val("control_mode_exit" as *u8, cm_run)
  ccg_val("alias_mode_build_rc" as *u8, bam)
  ccg_val("dfree_mode_build_rc" as *u8, bfm)
161
  // BOUND TO ITS DENOMINATOR, and the baseline control is what found this: `bhm != 0` on its own
  // PASSES on any compiler that refuses this fixture for ANY reason -- MEASURED on the live builder,
  // which refuses it merely because `__move` is not a name it knows. A refusal the mode did not
  // cause is not evidence for the mode, so the claim is the PAIR: clean under the default, refused
  // under --ownership.
  var t7: i64 = 0
  if bhm != 0 { if bhd == 0 { t7 = 1 } }
  gv_check("T7 ownership-REFUSES-a-hazard-unit-THE-DEFAULT-ACCEPTED (the two rungs done-rule bound to its denominator: the MODE is what refuses, not broken source)" as *u8, t7, ctr)
  let t8: i64 = ccg_file_has(p_hme, "capability=own-check-move\x00" as *u8)
  gv_check("T8 move-refusal-stamps-capability-own-check-move (WHICH rule fired -- a refusal for some other reason is not evidence for this rung)" as *u8, t8, ctr)
  let t9: i64 = ccg_file_has(p_hme, "use of 'buf' after its ownership was moved away\x00" as *u8)
  gv_check("T9 move-refusal-names-the-dead-local-by-name" as *u8, t9, ctr)
  let t10a: i64 = ccg_file_has(p_hme, "moved away on line \x00" as *u8)
  let t10b: i64 = ccg_file_has(p_hme, "moved away on line 0\x00" as *u8)
  var t10: i64 = 0
  if t10a == 1 { if t10b == 0 { t10 = 1 } }
  ccg_val("move_line_clause_present" as *u8, t10a)
  ccg_val("move_line_is_zero" as *u8, t10b)
  gv_check("T10 move-refusal-names-a-REAL-move-line-not-zero (both ends of the defect: the use AND the statement that ended the local's life)" as *u8, t10, ctr)
  let t11: i64 = ccg_file_has(p_hme, "capability=own-check-uaf\x00" as *u8)
  gv_check("T11 release-refusal-stamps-capability-own-check-uaf-in-the-SAME-unit (the two halves are independently attributable, not one rule wearing two names)" as *u8, t11, ctr)
  let t12a: i64 = ccg_file_has(p_hme, "released on line \x00" as *u8)
  let t12b: i64 = ccg_file_has(p_hme, "released on line 0\x00" as *u8)
  var t12: i64 = 0
  if t12a == 1 { if t12b == 0 { t12 = 1 } }
  ccg_val("release_line_clause_present" as *u8, t12a)
  ccg_val("release_line_is_zero" as *u8, t12b)
  gv_check("T12 release-refusal-names-a-REAL-release-line-not-zero" as *u8, t12, ctr)
190
  var t13: i64 = 0
  if bcm == 0 { t13 = 1 }
  gv_check("T13 POSITIVE-CONTROL-COMPILES-under-ownership (move-then-silence, release-then-silence, re-init after both, untracked pointers -- AND the whole imported stdlib. A deny-everything checker dies HERE, and so does a broken fixture path or a noexec runnable dir)" as *u8, t13, ctr)
  var t14: i64 = 0
  if cm_run == 0 { t14 = 1 }
  gv_check("T14 POSITIVE-CONTROL-RUNS-exit0-under-ownership (the accepted program is still the right program)" as *u8, t14, ctr)
197
  // The mode emits NO IR: the positive control's asm under the flag is byte-identical to its asm
  // under the default.  This is what makes the default build byte-identical BY CONSTRUCTION rather
  // than by hope, and cb_files_equal is the estate's one byte-comparer -- no second copy here.
  // NON-EMPTY IS PART OF THE CLAIM.  cb_files_equal returns 1 for two UNREADABLE files, so when both
  // compiles fail this tooth compared nothing and reported equality -- MEASURED on the live builder:
  // control_asm_default_bytes=0, control_asm_mode_bytes=0, T15 PASS. Two failures agreeing read as an
  // equivalence -- the exact defect nx_ccbuild_lib's own header warns about -- sitting inside the one
  // tooth that certifies byte-neutrality. A tooth that passes on the empty set is not a tooth.
  let cds_n: i64 = cb_fsize(p_cds)
  let cms_n: i64 = cb_fsize(p_cms)
  var t15: i64 = 0
  if cds_n > 0 { if cms_n > 0 { t15 = cb_files_equal(p_cds, p_cms) } }
  ccg_val("control_asm_default_bytes" as *u8, cds_n)
  ccg_val("control_asm_mode_bytes" as *u8, cms_n)
  gv_check("T15 mode-emits-NO-IR (positive-control asm byte-identical default vs --ownership: this rung is compile-time only, so a default build cannot change)" as *u8, t15, ctr)
213
  var t16: i64 = 0
  if bam != 0 { if bad == 0 { t16 = 1 } }
  gv_check("T16 alias-sweep-REFUSES-a-use-through-a-SECOND-name-THE-DEFAULT-ACCEPTED (a checker that marked only the name inside the sys_munmap would report nothing at all here)" as *u8, t16, ctr)
  let t17: i64 = ccg_file_has(p_ame, "use of 'q'\x00" as *u8)
  gv_check("T17 alias-refusal-names-the-ALIAS-q-at-the-use-not-the-released-name-p" as *u8, t17, ctr)
219
  var t18: i64 = 0
  if bfm != 0 { if bfd == 0 { t18 = 1 } }
  gv_check("T18 double-free-REFUSED-WHERE-THE-DEFAULT-ACCEPTED-IT (CWE-415 falls out of the SAME use-after-release rule -- the second release must read the name to pass it)" as *u8, t18, ctr)
  let t19: i64 = ccg_file_has(p_fme, "capability=own-check-uaf\x00" as *u8)
  gv_check("T19 double-free-refusal-stamps-own-check-uaf-and-NOT-a-separate-rule" as *u8, t19, ctr)
225
  let rc: i64 = gv_verdict("OWNERSHIP-LN4-LN5" as *u8, ctr, "ownership declared mode" as *u8)
  sys_exit(rc)
  return rc
229}
nx_ownership_gate.nx source

`nx_ownership_gate.nx` source
