Enforce qualified pidfs host and process broker contracts

2026-07-14 00:05:23 +09:00 · 2026-07-14 00:05:23 +09:00 · f840a48376
commit f840a48376
parent 16defc768a
3 changed files with 1539 additions and 30 deletions
--- a/support/external-tools.toml
+++ b/support/external-tools.toml
@ -1,6 +1,57 @@
-schema = 1
+schema = 2
 levels = ["V1", "V2", "V3", "V4", "V5"]

+[pidfs_host_support]
+id = "pidfs-process-identity-v1"
+platform = "linux-x86_64"
+minimum_kernel = "6.9"
+probe = "pidfs-host-support-probe-v1"
+qualification_ids = ["upstream-linux-6.9.0-x86_64"]
+runtime_failure_policy = "fail-before-generation"
+verifier_unavailable_policy = "skip"
+bounded_claim = "current-boot-smoke-only"
+diagnostic_platform = "LZ-HOST-PIDFS-PLATFORM: PidfsProcessIdentityV1 requires Linux x86-64."
+diagnostic_kernel = "LZ-HOST-PIDFS-KERNEL: PidfsProcessIdentityV1 requires Linux x86-64 kernel 6.9 or newer; Linux 6.8 is unsupported even with a partial pidfs backport."
+diagnostic_qualification = "LZ-HOST-PIDFS-QUALIFICATION: the running kernel build has no exact qualified source/build record."
+diagnostic_smoke = "LZ-HOST-PIDFS-SMOKE: the bounded per-boot pidfs support smoke failed; no runtime resource or durable generation may be created."
+
+[[host_probe]]
+id = "pidfs-host-support-probe-v1"
+owner = "IP-03"
+cache_key = "boot_id"
+result_claim = "bounded-current-boot-observations"
+attempts_per_step = 1
+step_timeout_ms = 5000
+total_timeout_ms = 60000
+cleanup_timeout_ms = 5000
+steps = [
+    "linux-x86_64-kernel-floor",
+    "pidfd-operations",
+    "pidfs-magic",
+    "concurrent-same-process-identity",
+    "last-close-live-reopen-identity",
+    "simultaneous-process-distinct-inode",
+    "stale-handle-cannot-affect-live-peer",
+    "exit-reap-drop-all-later-process-non-reuse",
+]
+
+[[kernel_qualification]]
+id = "upstream-linux-6.9.0-x86_64"
+kind = "upstream"
+architecture = "x86_64"
+release = "6.9.0"
+source_ref = "v6.9"
+source_commit = "a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6"
+source_archive_sha256 = "24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149"
+source_signer_fingerprint = "647F28654894E3BD457199BE38DBBDC86092693E"
+build_config_sha256 = "7db4d48deb650052df60273c7f2c2d228c981db4d6f76b8eb929a9e120d7283a"
+build_image_sha256 = "e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc"
+probe_binary_sha256 = "040a84f2b06ae73671c262016c649fe21e3fb21fad89cea3d6d76f8d7436648f"
+reuse_result_sha256 = "b8491adc9c0fd4509ec94a99d03835842f7f92ca6d5baad8f6589a7f3c49517f"
+acquisition_result_sha256 = "867492f65ffd473733544626c032957143f40d040e1a4e8e1e82bf9e4bca6cc3"
+pidfs_inode_semantics = "boot-monotonic-u64"
+status = "qualified"
+
 [[command]]
 id = "python"
 program = "python3"
@ -83,6 +134,15 @@ policy = "skip"
 levels = ["V2", "V3", "V4", "V5"]
 diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."

+[[command]]
+id = "strace"
+program = "strace"
+args = ["--version"]
+version_pattern = '^strace -- version [6-9]\.|^strace -- version [1-9][0-9]\.'
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Install strace 6.x or newer to run the registered final-binary exercised-path syscall cases."
+
 [[feature]]
 id = "linux-x86_64"
 probe = "linux-x86_64"
@ -93,10 +153,18 @@ diagnostic = "Physical and composition suites currently support Linux x86_64."
 [[feature]]
 id = "kernel"
 probe = "kernel-at-least"
-minimum = "6.8"
+minimum = "6.9"
 policy = "skip"
 levels = ["V2", "V3", "V4", "V5"]
-diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."
+diagnostic = "Linux x86-64 kernel 6.9 or newer is required; Linux 6.8 is unsupported for pidfs process identity."
+
+[[feature]]
+id = "pidfs-host-support"
+probe = "registered-host-support"
+contract = "pidfs-process-identity-v1"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "PidfsHostSupportProbe execution is owned by IP-03; this scaffold cannot claim host support from a version string or manifest record."

 [[feature]]
 id = "user-namespaces"
--- a/support/integration-tests.toml
+++ b/support/integration-tests.toml
@ -1,3 +1,8 @@
 schema = 1
 levels = ["V2", "V3", "V4", "V5"]
-scenarios = []
+
+[[scenarios]]
+name = "process-safety-baseline-exercised-paths"
+level = "V2"
+command = ["tools/dev", "process-audit", "--dynamic"]
+capabilities = ["linux-x86_64", "strace"]
--- a/support/process-safety.toml
+++ b/support/process-safety.toml
@ -0,0 +1,184 @@
+schema = 2
+
+[policy]
+id = "causal-child-acquisition-v1"
+broker_crate = "lazaret-process-broker"
+broker_state = "unimplemented"
+production_roots = ["crates"]
+lint_config = ".clippy.toml"
+lint_allow_paths = []
+dynamic_scenario = "process-safety-baseline-exercised-paths"
+dynamic_coverage = "registered-exercised-paths-only"
+completion_owner = "IP-03"
+trace_expression = "process,wait4,waitid,rt_sigaction"
+forbidden_syscall_patterns = [
+    '^clone3?\(',
+    '^execveat\(',
+    '^fork\(',
+    '^vfork\(',
+    '^wait4\(',
+    '^waitid\(',
+    '^rt_sigaction\(SIGCHLD,',
+]
+disallowed_types = [
+    "std::process::Child",
+    "std::process::Command",
+    "tokio::process::Child",
+    "tokio::process::Command",
+]
+disallowed_methods = [
+    "libc::clone",
+    "libc::execve",
+    "libc::execveat",
+    "libc::fork",
+    "libc::posix_spawn",
+    "libc::sigaction",
+    "libc::signal",
+    "libc::vfork",
+    "libc::wait",
+    "libc::wait4",
+    "libc::waitid",
+    "libc::waitpid",
+    "nix::sys::signal::sigaction",
+    "nix::sys::wait::wait",
+    "nix::sys::wait::waitid",
+    "nix::sys::wait::waitpid",
+    "nix::unistd::execve",
+    "nix::unistd::execveat",
+    "nix::unistd::fork",
+    "nix::unistd::vfork",
+    "rustix::process::kill_process",
+    "rustix::process::kill_process_group",
+    "rustix::process::pidfd_open",
+    "rustix::process::pidfd_send_signal",
+    "rustix::process::waitid",
+    "rustix::process::waitpid",
+    "std::process::Child::kill",
+    "std::process::Child::try_wait",
+    "std::process::Child::wait",
+    "std::process::Child::wait_with_output",
+    "std::process::Command::output",
+    "std::process::Command::spawn",
+    "std::process::Command::status",
+]
+
+[[trace_case]]
+binary = "lazaret"
+args = []
+expected_exit_code = 0
+initial_execve_count = 1
+
+[[trace_case]]
+binary = "lazaret-escalation-client"
+args = []
+expected_exit_code = 0
+initial_execve_count = 1
+
+[[trace_case]]
+binary = "lazaret-host-coordinator"
+args = []
+expected_exit_code = 0
+initial_execve_count = 1
+
+[[trace_case]]
+binary = "lazaret-network-sidecar"
+args = []
+expected_exit_code = 0
+initial_execve_count = 1
+
+[[trace_case]]
+binary = "lazaret-runtime-supervisor"
+args = []
+expected_exit_code = 0
+initial_execve_count = 1
+
+[[runtime_dependency]]
+name = "cobs"
+version = "0.3.0"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+features = []
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "embedded-io"
+version = "0.4.0"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+features = ["alloc"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "embedded-io"
+version = "0.6.1"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+features = ["alloc"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "postcard"
+version = "1.1.3"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+features = ["alloc", "use-std"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "proc-macro2"
+version = "1.0.106"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+features = ["default", "proc-macro"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "quote"
+version = "1.0.46"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+features = ["default", "proc-macro"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "serde"
+version = "1.0.228"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+features = ["alloc", "default", "derive", "serde_derive", "std"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "serde_core"
+version = "1.0.228"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+features = ["alloc", "result", "std"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "serde_derive"
+version = "1.0.228"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+features = ["default"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "syn"
+version = "2.0.118"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+features = ["clone-impls", "default", "derive", "parsing", "printing", "proc-macro"]
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "thiserror"
+version = "2.0.18"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+features = []
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "thiserror-impl"
+version = "2.0.18"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+features = []
+reviewed_process_apis = []
+
+[[runtime_dependency]]
+name = "unicode-ident"
+version = "1.0.24"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+features = []
+reviewed_process_apis = []