nx_tools_denial_observation_gate_t316.nx source
↩ module page · 38 lines · 3139 B
1import "nx_tools_denial_observation_candidate_t316.nx"
2import "nx_gatekit_lib.nx"
3import "nx_gate_verdict.nx"
4func dg_same(a:*u8,an:i64,b:*u8,bn:i64)->i64{if an!=bn{return 0};var i:i64=0;while i<an{if a[i]!=b[i]{return 0};i=i+1};return 1}
5func main(argc:i64,argv:*i64)->i64{
6 if argc!=2{return 3};let path:*u8=argv[1] as *u8
7 if gk_len(path)<6{return 3};let prefix:*u8="/tmp/";var p:i64=0;while p<5{if path[p]!=prefix[p]{return 3};p=p+1}
8 while path[p]!=(0 as u8){if path[p]<(32 as u8)||path[p]==(47 as u8)||path[p]==(92 as u8){return 3};p=p+1}
9 let c:*i64=gv_ctr();gv_head("Denied capability attempts use existing journal and timing owner")
10 let fd:i64=sys_openat_exclusive(path,384);gv_check("fresh-exclusive-fixture",fd>=0,c);if fd<0{return 3};sys_close(fd)
11 ta_timing_begin();ta_timing_handle_begin();tt_request_pid=777
12 let start:i64=ta_timing_now_us();let end:i64=ta_timing_now_us()
13 gv_check("no-cap-original-negative-decision-written",ta_denial_observe_to(path,"nx_txtscan",10,-9,start,end)==0,c)
14 gv_check("denied-tool-bound-for-response-phases",tt_tool_n==10,c)
15 gv_check("scope-denial-original-negative-decision-written",ta_denial_observe_to(path,"nx_txtscan",10,-4,start,end)==0,c)
16 let len:*i64=sys_mmap(8) as *i64;let before:*u8=sys_read_file(path,len)
17 if (before as i64)<=0{return 1}
18 gv_check("denial-is-not-runner-success",gk_has(before,"\tcall\tdenied\ttools/call lane=authorization exit=-9 bytes=0"),c)
19 gv_check("original-scope-code-retained",gk_has(before,"exit=-4 bytes=0"),c)
20 gv_check("dispatch-explicitly-false",gk_has(before,"dispatched=false decision_domain=capability"),c)
21 gv_check("named-authorization-phase",gk_has(before,"\tobserve\tauthorization_denied\t"),c)
22 gv_check("request-pid-retained",gk_has(before,"request_pid=777 request_begin_us="),c)
23 gv_check("no-job-invented",gk_has(before,"job=-1 request_pid=777"),c)
24 gv_check("timing-decision-not-flipped",gk_has(before,"code=-9 bytes=0"),c)
25 gv_check("no-credential-fields",gk_has(before,"_cap=")==0&&gk_has(before,"Authorization:")==0,c)
26 gv_check("no-arguments-or-prompts",gk_has(before,"argv=")==0&&gk_has(before,"prompt=")==0,c)
27 gv_check("success-refused-as-denial",ta_denial_observe_to(path,"nx_txtscan",10,0,start,end)<0,c)
28 gv_check("injected-row-refused",ta_denial_observe_to(path,"bad\nname",8,-4,start,end)<0,c)
29 gv_check("empty-name-refused",ta_denial_observe_to(path,"",0,-4,start,end)<0,c)
30 let afterlen:*i64=sys_mmap(8) as *i64;let after:*u8=sys_read_file(path,afterlen)
31 gv_check("refusals-did-not-append",dg_same(before,len[0],after,afterlen[0]),c)
32 gv_check("actual-writer-failure-returned",ta_denial_observe_to("/tmp","nx_txtscan",10,-4,start,end)<0,c)
33 gv_check("unknown-clock-recorded",ta_denial_observe_to(path,"nx_txtscan",10,-4,TT_UNKNOWN,TT_UNKNOWN)==0,c)
34 let unknownlen:*i64=sys_mmap(8) as *i64;let unknown:*u8=sys_read_file(path,unknownlen)
35 gv_check("unknown-duration-not-zero",gk_has(unknown,"dur_ms=-1 dispatched=false"),c)
36 gv_puts("retained_fixture=");gv_puts(path);gv_puts("\n")
37 return gv_verdict("NX-TOOLS-DENIAL-OBSERVATION",c,"isolated helper only; canonical endpoint integration and operation join not proven")
38}