code wiki / _hdl_build / nx_security_status.nx
nx_security_status.nx source
↩ module page · 104 lines · 5785 B
1// nx_security_status.nx -- the operator's SECURITY POSTURE at a glance (own-cybersecurity
2// observability). Composes the working pieces into one durable report:
3// (1) AUDIT CHAIN integrity -- runs _offc/nx_audit_log.elf verify (tamper-evident history intact?)
4// (2) SECRET INVENTORY -- counts ~/.nishi/secrets/*.nv (how many named secrets are vaulted)
5// (3) PROOF LEDGER verdict -- the last line of knowledge/status/proof_ledger.log (ALL-CLAIMS-HOLD?)
6// Emits a SECSTATUS line to knowledge/status/security_status.log (durable trend) + stdout summary.
7// Sovereign-buildable (syscalls + fork/exec; no crypto import). license_tier: ORIGINAL
8import "nx_syscalls.nx"
9const K_MAGIC_65536: i64 = 65536
10const K_MAGIC_1048592: i64 = 1048592
11const K_MAGIC_1048576: i64 = 1048576
12func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
13func _pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
14func _fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
15func _fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
16func ss_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
17func ss_run(path: *u8, a1: *u8) -> i64 {
18 let pid: i64 = sys_fork()
19 if pid == 0 {
20 let argv: *i64 = sys_mmap(64) as *i64
21 argv[0] = path as i64; var i: i64 = 1
22 if (a1 as i64) != 0 { argv[i] = a1 as i64; i = i + 1 }
23 argv[i] = 0
24 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
25 // mute child stdout so the report stays clean
26 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
27 if dn >= 0 { sys_dup3(dn, 1, 0) }
28 sys_execve(path, argv, envp)
29 sys_exit(127)
30 }
31 let st: *i64 = sys_mmap(16) as *i64
32 sys_wait4(pid, st, 0)
33 return (st[0] >> 8) & 0xff
34}
35// count *.nv entries in ~/.nishi/secrets via getdents
36func ss_count_secrets() -> i64 {
37 let fd: i64 = sys_openat_rd("/home/elderwesto/.nishi/secrets" as *u8)
38 if fd < 0 { return 0 }
39 let dirbuf: *u8 = sys_mmap(K_MAGIC_65536)
40 var cnt: i64 = 0
41 var done: i64 = 0
42 while done == 0 {
43 let nb: i64 = sys_getdents64(fd, dirbuf, K_MAGIC_65536)
44 if nb <= 0 { done = 1 }
45 else {
46 var off: i64 = 0
47 while off < nb {
48 let dbase: i64 = dirbuf as i64
49 let rec: *u8 = (dbase + off) as *u8
50 let rl: i64 = dirent_reclen(rec)
51 if rl <= 0 { off = nb }
52 else {
53 let name: *u8 = dirent_name(rec)
54 let nl: i64 = ss_slen(name)
55 if nl > 3 { if name[nl-3]==(46 as u8) { if name[nl-2]==(110 as u8) { if name[nl-1]==(118 as u8) { cnt = cnt + 1 } } } }
56 off = off + rl
57 }
58 }
59 }
60 }
61 sys_close(fd)
62 return cnt
63}
64// read last line containing pat into a small flag (1 if "ALL-CLAIMS-HOLD" present in the proof log)
65func ss_proof_ok() -> i64 {
66 let fd: i64 = sys_openat_rd("knowledge/status/proof_ledger.log" as *u8)
67 if fd < 0 { return 0 - 1 }
68 let buf: *u8 = sys_mmap(K_MAGIC_1048592)
69 var n: i64 = 0
70 var go: i64 = 1
71 while go == 1 { let base: i64 = buf as i64; let r: i64 = sys_read(fd, (base + n) as *u8, K_MAGIC_1048576 - n); if r <= 0 { go = 0 } else { n = n + r } if n >= K_MAGIC_1048576 { go = 0 } }
72 sys_close(fd)
73 // search for "verdict=ALL-CLAIMS-HOLD" anywhere (last write wins; presence => last run held)
74 let pat: *u8 = "ALL-CLAIMS-HOLD" as *u8
75 let pl: i64 = ss_slen(pat)
76 var found: i64 = 0
77 var i: i64 = 0
78 while i + pl <= n { var k: i64 = 0; var hit: i64 = 1; while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } } if hit == 1 { found = 1 } i = i + 1 }
79 return found
80}
81func main() -> i64 {
82 _p("=== SECURITY STATUS: audit-chain + secret-inventory + proof-ledger (your posture at a glance) ===\n" as *u8)
83 let audit: i64 = ss_run("_offc/nx_audit_log.elf" as *u8, "verify" as *u8) // 0 = intact
84 let nsecrets: i64 = ss_count_secrets()
85 let proof: i64 = ss_proof_ok()
86 _p(" audit-chain: " as *u8); if audit == 0 { _p("INTACT" as *u8) } else { _p("BROKEN/ABSENT" as *u8) }
87 _p(" secrets-vaulted: " as *u8); _pn(nsecrets)
88 _p(" proof-ledger: " as *u8); if proof == 1 { _p("ALL-CLAIMS-HOLD\n" as *u8) } else { _p("not-holding/absent\n" as *u8) }
89 let lfd: i64 = sys_openat_append("knowledge/status/security_status.log" as *u8, 0x1a4)
90 if lfd >= 0 {
91 _fp(lfd, "SECSTATUS epoch=" as *u8); _fn(lfd, sys_now_realtime_sec())
92 _fp(lfd, " audit_chain=" as *u8); if audit == 0 { _fp(lfd, "INTACT" as *u8) } else { _fp(lfd, "BROKEN" as *u8) }
93 _fp(lfd, " secrets=" as *u8); _fn(lfd, nsecrets)
94 _fp(lfd, " proof=" as *u8); if proof == 1 { _fp(lfd, "HOLD" as *u8) } else { _fp(lfd, "NOHOLD" as *u8) }
95 _fp(lfd, "\n" as *u8)
96 sys_close(lfd)
97 }
98 _p(" durable: knowledge/status/security_status.log\n" as *u8)
99 // overall: green only if audit intact AND proof holds AND at least one secret vaulted
100 if audit == 0 { if proof == 1 { if nsecrets >= 1 { _p(" SECURITY POSTURE: GREEN\n" as *u8); sys_exit(0); return 0 } } }
101 _p(" SECURITY POSTURE: ATTENTION (see fields above)\n" as *u8)
102 sys_exit(1)
103 return 1
104}