code wiki / _hdl_build / nx_sov_tree_audit.nx
`nx_sov_tree_audit.nx` source

↩ module page · 190 lines · 10517 B
1// nx_sov_tree_audit.nx -- WHOLE-TREE sovereignty census. Recursively walks a directory root (getdents64 +
2// newfstatat, so it works even where d_type is DT_UNKNOWN on DrvFs), and:
3//   - every .nx file: scans for non-sovereign markers (exec-target string-literals "/bin/sh,"python,"qemu,... +
4//     non-.nx imports) -> counts sovereign vs FLAGGED, lists the flagged organs (the program-path worklist)
5//   - every non-.nx SOURCE file (.sh/.py/.java/.jar/.go/.js/.ts/.rb/.pl/.class/.c/.cpp): counts by extension
6//   - vendored trees (node_modules/.git/.alelane) are recorded but NOT descended (bounded + honest)
7// This turns "do we have hidden python/sh/java anywhere" into a repeatable mechanical census. It does NOT use
8// sys_read_file (that reserves ~4GB/call -> OOM over thousands of files); it reads into ONE reused buffer.
9//   nx_sov_tree_audit [root]    (default ".")
10// license_tier: ORIGINAL
11import "nx_syscalls.nx"
12const K_MAGIC_16384: i64 = 16384
13const K_MAGIC_65536: i64 = 65536
14const K_MAGIC_4194304: i64 = 4194304
15
16func ta_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
17func ta_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
18func ta_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
19func ta_eq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i]{return 0} i=i+1 } if b[i]!=(0 as u8){return 0} return 1 }
20// does path (len pl) end with ext (NUL-terminated)?
21func ta_ends(path: *u8, pl: i64, ext: *u8) -> i64 {
  let el: i64=ta_strlen(ext); if el>pl { return 0 }
  var i: i64=0; while i<el { if path[pl-el+i]!=ext[i] { return 0 } i=i+1 } return 1
24}
25func ta_find(buf: *u8, n: i64, pat: *u8, start: i64) -> i64 {
  let pl: i64=ta_strlen(pat); if pl==0 { return 0-1 }
  var i: i64=start
  while i+pl<=n { var j: i64=0; var ok: i64=1; while j<pl { if buf[i+j]!=pat[j]{ok=0;j=pl} else {j=j+1} } if ok==1 { return i } i=i+1 }
  return 0-1
30}
31// join dir + "/" + name into dst (NUL-terminated)
32func ta_join(dst: *u8, dir: *u8, name: *u8) -> i64 {
  var o: i64=0; var i: i64=0
  while dir[i]!=(0 as u8){ dst[o]=dir[i]; o=o+1; i=i+1 }
  dst[o]=47 as u8; o=o+1
  i=0; while name[i]!=(0 as u8){ dst[o]=name[i]; o=o+1; i=i+1 }
  dst[o]=0 as u8; return o
38}
39// bounded file read into a REUSED buffer (NOT sys_read_file -- avoids the 4GB-per-call reservation)
40func ta_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64=sys_openat_rd(path); if fd<0 { return 0-1 }
  var total: i64=0; var nrd: i64=sys_read(fd, buf, cap)
  while nrd>0 { total=total+nrd; if total>=cap { nrd=0 } else { nrd=sys_read(fd, ((buf as i64)+total) as *u8, cap-total) } }
  sys_close(fd); return total
45}
46func ta_getdents(fd: i64, buf: *u8, count: i64) -> i64 { return __syscall(217, fd, buf, count, 0, 0, 0) }
47// 1=dir, 0=not, -1=stat failed (newfstatat AT_FDCWD=-100; st_mode at byte offset 24; S_IFDIR=0x4000)
48func ta_isdir(path: *u8, st: *u8) -> i64 {
  let r: i64=__syscall(262, 0-100, path, st, 0, 0, 0)
  if r<0 { return 0-1 }
  let mode: i64=(st[24] as i64) | ((st[25] as i64)<<8) | ((st[26] as i64)<<16) | ((st[27] as i64)<<24)
  if (mode & 0xF000)==0x4000 { return 1 }
  return 0
54}
55// scan a .nx file (already read into buf[0..n)) for non-sovereign markers; print one FLAGGED line if any.
56// M/mc = exec-literal markers. returns 1 flagged, 0 clean.
57func ta_check_nx(path: *u8, buf: *u8, n: i64, M: *i64, mc: i64) -> i64 {
  var flagged: i64=0
  let pl: i64=ta_strlen(path)
  // the audit tooling legitimately CONTAINS the marker strings as data -> don't scan those for exec-literals
  var is_tool: i64=0
  if ta_find(path, pl, "audit" as *u8, 0)>=0 { is_tool=1 }
  if is_tool==0 {
      var i: i64=0
      while i<mc {
          if ta_find(buf, n, M[i] as *u8, 0)>=0 { if flagged==0 { ta_puts("  FLAGGED " as *u8); ta_puts(path); ta_puts(" :" as *u8) } ta_puts(" " as *u8); ta_puts(M[i] as *u8); flagged=1 }
          i=i+1
      }
  }
  // imports: only a REAL top-of-line `import "..."` statement counts (skip comment/string mentions)
  var p: i64=0
  while 1==1 {
      let at: i64=ta_find(buf, n, "import \"" as *u8, p)
      if at<0 { break }
      p=at+8
      var b: i64=at-1; var atstart: i64=1
      while b>=0 { let cb: i64=buf[b] as i64; if cb==32 { b=b-1 } else { if cb==9 { b=b-1 } else { if cb==10 { b=0-1 } else { atstart=0; b=0-1 } } } }
      if atstart==1 {
          let s: i64=at+8; var e: i64=s
          while e<n { if buf[e]==(34 as u8) { break } e=e+1 }
          var nx_ok: i64=0
          if e-s>=3 { if buf[e-3]==(46 as u8) { if buf[e-2]==(110 as u8) { if buf[e-1]==(120 as u8) { nx_ok=1 } } } }
          if nx_ok==0 { if flagged==0 { ta_puts("  FLAGGED " as *u8); ta_puts(path); ta_puts(" :" as *u8) } ta_puts(" [non-nx-import]" as *u8); flagged=1 }
      }
  }
  if flagged==1 { ta_puts("\n" as *u8) }
  return flagged
88}
89
90func main(argc: i64, argv: *i64) -> i64 {
  var root: *u8 = "." as *u8
  if argc>=2 { root = argv[1] as *u8 }
  ta_puts("=== SOVEREIGNTY TREE AUDIT root=" as *u8); ta_puts(root); ta_puts(" ===\n" as *u8)
  ta_puts("(flagged .nx organs -- non-sovereign exec-literal or non-.nx import:)\n" as *u8)
95
  // exec-target string-literal markers
  let M: *i64=sys_mmap(8*32) as *i64; var mc: i64=0
  M[mc]="\"/bin/sh" as *u8 as i64; mc=mc+1
  M[mc]="\"/bin/bash" as *u8 as i64; mc=mc+1
  M[mc]="\"python" as *u8 as i64; mc=mc+1
  M[mc]="\"qemu" as *u8 as i64; mc=mc+1
  M[mc]="\"/usr/bin/qemu" as *u8 as i64; mc=mc+1
  M[mc]="\"perl" as *u8 as i64; mc=mc+1
  M[mc]="\"nodejs" as *u8 as i64; mc=mc+1
  M[mc]="\"/usr/bin/node" as *u8 as i64; mc=mc+1
  M[mc]="\"ruby" as *u8 as i64; mc=mc+1
  M[mc]="\"javac" as *u8 as i64; mc=mc+1
  M[mc]="\".jar" as *u8 as i64; mc=mc+1
  M[mc]="\"/usr/bin/env" as *u8 as i64; mc=mc+1
110
  // non-sovereign source extensions to tally
  let EX: *i64=sys_mmap(8*32) as *i64; let EC: *i64=sys_mmap(8*32) as *i64; var ec: i64=0
  EX[ec]=".sh" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".py" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".java" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".jar" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".class" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".go" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".js" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".ts" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".rb" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".pl" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".c" as *u8 as i64; EC[ec]=0; ec=ec+1
  EX[ec]=".cpp" as *u8 as i64; EC[ec]=0; ec=ec+1
125
  // reused buffers (no per-iteration mmap)
  let SLOT: i64=768; let QCAP: i64=K_MAGIC_16384
  let qbuf: *u8=sys_mmap(SLOT*QCAP)
  let gbuf: *u8=sys_mmap(K_MAGIC_65536)
  let stbuf: *u8=sys_mmap(256)
  let fbuf: *u8=sys_mmap(K_MAGIC_4194304)
  let child: *u8=sys_mmap(SLOT)
  var qhead: i64=0; var qtail: i64=0
  // seed queue with root
  var ri: i64=0; while root[ri]!=(0 as u8){ qbuf[ri]=root[ri]; ri=ri+1 } qbuf[ri]=0 as u8; qtail=1
136
  var dirs: i64=0; var nxT: i64=0; var nxS: i64=0; var nxF: i64=0; var vend: i64=0; var trunc: i64=0
  while qhead<qtail {
      let dir: *u8=((qbuf as i64)+qhead*SLOT) as *u8; qhead=qhead+1
      let fd: i64=sys_openat_rd(dir)
      if fd<0 { continue }
      dirs=dirs+1
      var nread: i64=ta_getdents(fd, gbuf, K_MAGIC_65536)
      while nread>0 {
          var off: i64=0
          while off<nread {
              let reclen: i64=(gbuf[off+16] as i64) | ((gbuf[off+17] as i64)<<8)
              if reclen<=0 { off=nread } else {
                  let name: *u8=((gbuf as i64)+off+19) as *u8
                  var skip: i64=0
                  if ta_eq(name, "." as *u8)==1 { skip=1 }
                  if ta_eq(name, ".." as *u8)==1 { skip=1 }
                  if skip==0 {
                      ta_join(child, dir, name)
                      let isd: i64=ta_isdir(child, stbuf)
                      if isd==1 {
                          var vendored: i64=0
                          if ta_eq(name, "node_modules" as *u8)==1 { vendored=1 }
                          if ta_eq(name, ".git" as *u8)==1 { vendored=1 }
                          if ta_eq(name, ".alelane" as *u8)==1 { vendored=1 }
                          if vendored==1 { vend=vend+1; ta_puts("  [vendored, not descended] " as *u8); ta_puts(child); ta_puts("\n" as *u8) }
                          else { if qtail<QCAP { let dst: *u8=((qbuf as i64)+qtail*SLOT) as *u8; var c: i64=0; while child[c]!=(0 as u8){ dst[c]=child[c]; c=c+1 } dst[c]=0 as u8; qtail=qtail+1 } else { trunc=1 } }
                      } else { if isd==0 {
                          let pl: i64=ta_strlen(child)
                          if ta_ends(child, pl, ".nx" as *u8)==1 {
                              let fn: i64=ta_read(child, fbuf, K_MAGIC_4194304)
                              if fn>0 { nxT=nxT+1; if ta_check_nx(child, fbuf, fn, M, mc)==1 { nxF=nxF+1 } else { nxS=nxS+1 } }
                          } else {
                              var k: i64=0
                              while k<ec { if ta_ends(child, pl, EX[k] as *u8)==1 { EC[k]=EC[k]+1; k=ec } else { k=k+1 } }
                          }
                      } }
                  }
                  off=off+reclen
              }
          }
          nread=ta_getdents(fd, gbuf, K_MAGIC_65536)
      }
      sys_close(fd)
  }
181
  ta_puts("(non-sovereign source files by extension:)\n " as *u8)
  var k: i64=0; var nonsov: i64=0
  while k<ec { ta_puts(" " as *u8); ta_puts(EX[k] as *u8); ta_puts("=" as *u8); ta_num(EC[k]); nonsov=nonsov+EC[k]; k=k+1 }
  ta_puts("\n" as *u8)
  if trunc==1 { ta_puts("(WARNING: directory queue capacity hit -- census TRUNCATED)\n" as *u8) }
  ta_puts("TOTALS: dirs=" as *u8); ta_num(dirs); ta_puts(" nx_files=" as *u8); ta_num(nxT); ta_puts(" nx_sovereign=" as *u8); ta_num(nxS); ta_puts(" nx_flagged=" as *u8); ta_num(nxF); ta_puts(" vendored_dirs=" as *u8); ta_num(vend); ta_puts(" nonsov_source_files=" as *u8); ta_num(nonsov); ta_puts("\n" as *u8)
  ta_puts("SOV-TREE-DONE\n" as *u8)
  sys_exit(0); return 0
190}
nx_sov_tree_audit.nx source

`nx_sov_tree_audit.nx` source
