nx_vault_acl_test.nx source

1// nx_vault_acl_test.nx -- ACLGATE: proves the path-based policy engine. Rules: secret/ -> READ; 2// secret/prod/ -> READ+WRITE; secret/prod/db -> EXPLICIT DENY; config/ -> READ+LIST. GREEN iff: 3// read on secret/dev allowed; write on secret/dev DENIED (not granted at that prefix); write on secret/prod 4// allowed (longest-prefix grant); secret/prod/db DENIED despite prod/ granting write (explicit-deny-wins); 5// unknown path DENIED (deny-by-default); list on config allowed; longest-prefix selection correct. 7/7. 6import "nx_vault_acl.nx" 7import "nx_syscalls.nx" 8 9func ag_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 10func ag_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 } 11 12func main() -> i64 { 13 ag_puts("=== SOVEREIGN ACL POLICY (deny-by-default, explicit-deny-wins, longest-prefix) ===\n" as *u8) 14 let n: i64 = 4 15 let paths: *i64 = sys_mmap(32) as *i64 16 let lens: *i64 = sys_mmap(32) as *i64 17 let deny: *i64 = sys_mmap(32) as *i64 18 let caps: *i64 = sys_mmap(32) as *i64 19 paths[0] = ("secret/" as *u8) as i64; lens[0] = 7; deny[0] = 0; caps[0] = CAP_READ 20 paths[1] = ("secret/prod/" as *u8) as i64; lens[1] = 12; deny[1] = 0; caps[1] = CAP_READ | CAP_WRITE 21 paths[2] = ("secret/prod/db" as *u8) as i64; lens[2] = 14; deny[2] = 1; caps[2] = 0 22 paths[3] = ("config/" as *u8) as i64; lens[3] = 7; deny[3] = 0; caps[3] = CAP_READ | CAP_LIST 23 24 let k1: i64 = acl_eval(paths, lens, deny, caps, n, "secret/dev/x" as *u8, 12, CAP_READ) 25 let k2: i64 = acl_eval(paths, lens, deny, caps, n, "secret/dev/x" as *u8, 12, CAP_WRITE) 26 let k3: i64 = acl_eval(paths, lens, deny, caps, n, "secret/prod/x" as *u8, 13, CAP_WRITE) 27 let k4: i64 = acl_eval(paths, lens, deny, caps, n, "secret/prod/db" as *u8, 14, CAP_READ) 28 let k5: i64 = acl_eval(paths, lens, deny, caps, n, "other/thing" as *u8, 11, CAP_READ) 29 let k6: i64 = acl_eval(paths, lens, deny, caps, n, "config/app" as *u8, 10, CAP_LIST) 30 let k7a: i64 = acl_eval(paths, lens, deny, caps, n, "secret/prod/x" as *u8, 13, CAP_WRITE) 31 let k7b: i64 = acl_eval(paths, lens, deny, caps, n, "secret/dev/x" as *u8, 12, CAP_WRITE) 32 33 ag_puts(" read@secret/dev=" as *u8); ag_num(k1); ag_puts(" write@secret/dev=" as *u8); ag_num(k2) 34 ag_puts(" write@secret/prod=" as *u8); ag_num(k3); ag_puts(" read@secret/prod/db(deny)=" as *u8); ag_num(k4) 35 ag_puts(" read@other(default)=" as *u8); ag_num(k5); ag_puts(" list@config=" as *u8); ag_num(k6); ag_puts("\n" as *u8) 36 37 let r: *i64 = sys_mmap(8*8) as *i64 38 r[0] = 0; if k1 == 1 { r[0] = 1 } // read allowed at secret/ 39 r[1] = 0; if k2 == 0 { r[1] = 1 } // write NOT granted at secret/ 40 r[2] = 0; if k3 == 1 { r[2] = 1 } // write allowed via longest-prefix secret/prod/ 41 r[3] = 0; if k4 == 0 { r[3] = 1 } // explicit deny wins over prod/ grant 42 r[4] = 0; if k5 == 0 { r[4] = 1 } // deny by default (no matching rule) 43 r[5] = 0; if k6 == 1 { r[5] = 1 } // list allowed at config/ 44 r[6] = 0; if k7a == 1 { if k7b == 0 { r[6] = 1 } } // longest-prefix selection is real 45 46 var pass: i64 = 0; var i: i64 = 0 47 while i < 7 { pass = pass + r[i]; i = i + 1 } 48 ag_puts("----\n passed " as *u8); ag_num(pass); ag_puts("/7\n" as *u8) 49 if pass == 7 { 50 ag_puts("ACLGATE deny_by_default=1 explicit_deny_wins=1 longest_prefix_grant=1 cap_bitmask=1 exceed[sovereign least-privilege path policy = HashiCorp policies-class; real string-prefix match, order-independent eval] verdict=GREEN\n" as *u8) 51 sys_exit(0); return 0 52 } 53 ag_puts("ACLGATE verdict=RED\n" as *u8); sys_exit(1); return 1 54}