nx_sovereign_deps_gate.nx source
↩ module page · 93 lines · 4972 B
1// nx_sovereign_deps_gate.nx -- SOVEREIGN replacement for bench/gate_nx_sovereign_deps.sh (which uses
2// grep + file + readelf under /bin/bash). Enforces the operator's sovereignty cardinal by construction:
3// (1) SOURCE: the primary netscope module must contain NO C-FFI / external-library reference
4// (dlopen / #include / __attribute__ / openssl / libpcap / .so), scanned in-organ (no grep).
5// (2) ARTIFACT: build nx_netscope_heal_test through the sovereign lane and prove the shipped ELF is
6// STATIC with 0 dynamic dependencies -- via nx_elf_inspect (no file/readelf). This is the
7// machine-enforced core: any smuggled C-lib that produced a runtime dep shows up as DT_NEEDED > 0.
8// Composes _offc/nx_sov_build_run.elf (--build-only) + _offc/nx_elf_inspect.elf. Sovereign (syscalls only).
9// Run from the nxc2 root. license_tier: ORIGINAL expect_exit: 0
10import "nx_syscalls.nx"
11
12const SD_NETSCOPE_SRC: *u8 = "runtime/nx_netscope_heal_test.nx\x00"
13const SD_ORGAN: *u8 = "nx_netscope_heal_test\x00"
14const SD_ELF: *u8 = "/tmp/nx_netscope_heal_test.sov.elf\x00"
15
16func sd_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
17
18func sd_read_file(path: *u8, buf: *u8, cap: i64) -> i64 {
19 let fd: i64 = sys_openat_rd(path)
20 if fd < 0 { return 0 }
21 var total: i64 = 0
22 var go: i64 = 1
23 while go == 1 {
24 let r: i64 = sys_read(fd, ((buf as i64) + total) as *u8, cap - total)
25 if r <= 0 { go = 0 } else { total = total + r; if total >= cap { go = 0 } }
26 }
27 sys_close(fd)
28 return total
29}
30
31// substring search (the banned patterns are passed as needles; they live in THIS organ only as string
32// literals, so scanning THIS organ would not itself see them as code -- the check targets the netscope src).
33func sd_contains(buf: *u8, n: i64, pat: *u8) -> i64 {
34 var pl: i64 = 0; while pat[pl] != (0 as u8) { pl = pl + 1 }
35 if pl == 0 { return 0 }
36 var i: i64 = 0
37 while i + pl <= n {
38 var m: i64 = 0; var hit: i64 = 1
39 while m < pl { if buf[i + m] != pat[m] { hit = 0; m = pl } else { m = m + 1 } }
40 if hit == 1 { return 1 }
41 i = i + 1
42 }
43 return 0
44}
45
46// fork+exec elf [a1] [a2] with a PATH env (child that shells to as/ld resolves them); stdout muted; return WEXITSTATUS
47func sd_run(path: *u8, a1: *u8, a2: *u8) -> i64 {
48 let pid: i64 = sys_fork()
49 if pid == 0 {
50 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 0x1a4)
51 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
52 let av: *i64 = sys_mmap(32) as *i64
53 av[0] = path as i64; var ai: i64 = 1
54 if (a1 as i64) != 0 { av[ai] = a1 as i64; ai = ai + 1 }
55 if (a2 as i64) != 0 { av[ai] = a2 as i64; ai = ai + 1 }
56 av[ai] = 0
57 let envp: *i64 = sys_mmap(16) as *i64
58 envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0
59 sys_execve(path, av, envp)
60 sys_exit(127)
61 }
62 let st: *i64 = sys_mmap(16) as *i64
63 sys_wait4(pid, st, 0)
64 if (st[0] % 128) != 0 { return 0 - 1 }
65 return (st[0] >> 8) & 0xff
66}
67
68func main() -> i64 {
69 sd_puts("=== nx_sovereign_deps_gate (sovereign, no grep/file/readelf/shell) ===\n" as *u8)
70
71 // (1) SOURCE: no C-FFI / external-library reference in the netscope module.
72 let buf: *u8 = sys_mmap(1048576)
73 let n: i64 = sd_read_file(SD_NETSCOPE_SRC, buf, 1048576)
74 if n <= 0 { sd_puts(" [1] SOURCE: cannot read " as *u8); sd_puts(SD_NETSCOPE_SRC); sd_puts(" -- FAIL\n" as *u8); sys_exit(1); return 1 }
75 var ffi: i64 = 0
76 ffi = ffi + sd_contains(buf, n, "dlopen\x00" as *u8)
77 ffi = ffi + sd_contains(buf, n, "#include\x00" as *u8)
78 ffi = ffi + sd_contains(buf, n, "__attribute__\x00" as *u8)
79 ffi = ffi + sd_contains(buf, n, "openssl\x00" as *u8)
80 ffi = ffi + sd_contains(buf, n, "libpcap\x00" as *u8)
81 if ffi > 0 { sd_puts(" [1] SOURCE: C-FFI / external-lib reference found -- FAIL (borrow concepts, never code/licenses)\n" as *u8); sys_exit(1); return 1 }
82 sd_puts(" [1] SOURCE: 0 C-FFI / external-library references (concepts only)\n" as *u8)
83
84 // (2) ARTIFACT: build through the sovereign lane, then prove the ELF is STATIC (0 dynamic deps).
85 let bexit: i64 = sd_run("_offc/nx_sov_build_run.elf\x00" as *u8, SD_ORGAN, "--build-only\x00" as *u8)
86 if bexit != 0 { sd_puts(" [2] ARTIFACT: sovereign build FAILED (exit " as *u8); sys_exit(1); return 1 }
87 let iexit: i64 = sd_run("_offc/nx_elf_inspect.elf\x00" as *u8, SD_ELF, 0 as *u8)
88 if iexit != 0 { sd_puts(" [2] ARTIFACT: shipped ELF is DYNAMIC (has interpreter or DT_NEEDED) -- FAIL\n" as *u8); sys_exit(1); return 1 }
89 sd_puts(" [2] ARTIFACT: shipped ELF is STATIC, 0 dynamic dependencies (raw-syscall bits-up)\n" as *u8)
90
91 sd_puts("NX-SOVEREIGN-DEPS-GATE PASS: NX-NETSCOPE is NishiLang bits-up -- no libs, no licenses, concepts only (sovereign: no grep/file/readelf)\n" as *u8)
92 sys_exit(0); return 0
93}