kobako 0.29.0 → 0.30.0

data/crates/kobako-runtime/src/lib.rs

@@ -2,7 +2,7 @@
 //!
 //! The surface where a wasm engine implementation and a host frontend
 //! meet: the `Runtime` trait, the isolation `Profile` a runtime
-//! declares, the Grants it presents to the guest and the `Filesystem` a
+//! declares, the Grants it presents to the guest and the Filesystem a
 //! Mount places, the neutral per-invocation value types, and the dispatch /
 //! yield re-entry traits a frontend supplies. The messages these carry
 //! are `kobako-transport`'s, which this crate takes as given.
@@ -13,27 +13,32 @@
 //! so the engine stays swappable.
 
 pub mod dispatch;
+pub mod endpoint;
 pub mod error;
 pub mod filesystem;
 pub mod grant;
+mod hashtable;
+mod locking;
 pub mod mount;
 pub mod profile;
 pub mod runtime;
+pub mod sched;
+pub mod security;
 pub mod snapshot;
+pub mod vfs;
 pub mod yielder;
 
 // Every name an engine implementation writes into its own signatures, at
 // the crate root: the module path repeats the crate name and adds nothing
 // a reader of `kobako_runtime::Runtime` was missing.
 pub use dispatch::DispatchHandler;
+pub use endpoint::{Calls, GuestInstance};
 pub use error::{InvokeError, SetupError, Trap};
-pub use filesystem::{
-    Access, Blocking, DirEntry, Directory, File, FileType, Filesystem, FilesystemError, Hold,
-    Memory, Metadata, OpenOptions, Overlay, Rename, SeedError, Temporary,
-};
+pub use filesystem::{Bind, DirEntry, FileType, FilesystemError, Kstat, Overlay, SeedError, Tmpfs};
 pub use grant::{Grant, GrantKind};
-pub use mount::{Denial, Mount, MountPathError, Policy};
+pub use mount::{Access, Mount, MountPathError, Policy};
 pub use profile::Profile;
 pub use runtime::{Entry, Runtime};
+pub use sched::Blocking;
 pub use snapshot::{Capture, Completion, Snapshot, Usage};
 pub use yielder::Yielder;

data/crates/kobako-runtime/src/locking/seqlock.rs

@@ -0,0 +1,66 @@
+//! A lock its readers never wait on, as Linux's `seqlock_t`: a writer
+//! counts each write, and a reader that a write overlapped reads again.
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Mutex, PoisonError};
+
+pub(crate) struct SeqLock {
+    /// Holds one writer at a time, as `write_seqlock` takes the lock's
+    /// spinlock.
+    writer: Mutex<()>,
+    /// How many times a write began or ended, odd while one is under way.
+    sequence: AtomicUsize,
+}
+
+impl SeqLock {
+    pub(crate) const fn new() -> Self {
+        Self {
+            writer: Mutex::new(()),
+            sequence: AtomicUsize::new(0),
+        }
+    }
+
+    /// Run `write` with every reader overlapping it told to read again, as
+    /// `write_seqlock` and `write_sequnlock` bracket a write.
+    pub(crate) fn write<T>(&self, write: impl FnOnce() -> T) -> T {
+        let _held = self.writer.lock().unwrap_or_else(PoisonError::into_inner);
+        self.sequence.fetch_add(1, Ordering::SeqCst);
+        let written = write();
+        self.sequence.fetch_add(1, Ordering::SeqCst);
+        written
+    }
+
+    /// Where the writes stand once none is under way, to ask `read_seqretry`
+    /// about later, as `__read_seqcount_begin` spins past an odd count. Holding
+    /// the writer's lock a moment waits out the one write it guards.
+    pub(crate) fn read_seqbegin(&self) -> usize {
+        loop {
+            let sequence = self.sequence.load(Ordering::SeqCst);
+            if sequence.is_multiple_of(2) {
+                return sequence;
+            }
+            drop(self.writer.lock().unwrap_or_else(PoisonError::into_inner));
+        }
+    }
+
+    /// Whether a write began since `read_seqbegin` answered `begun`.
+    pub(crate) fn read_seqretry(&self, begun: usize) -> bool {
+        self.sequence.load(Ordering::SeqCst) != begun
+    }
+
+    /// What `read` answers with no write overlapping it, as
+    /// `read_seqbegin_or_lock` reads: first without waiting, then, once a
+    /// write overlapped, holding writers off, so writes one after another
+    /// never keep a reader reading again.
+    pub(crate) fn read<T>(&self, mut read: impl FnMut() -> T) -> T {
+        let begun = self.sequence.load(Ordering::SeqCst);
+        if begun.is_multiple_of(2) {
+            let answer = read();
+            if self.sequence.load(Ordering::SeqCst) == begun {
+                return answer;
+            }
+        }
+        let _held = self.writer.lock().unwrap_or_else(PoisonError::into_inner);
+        read()
+    }
+}

data/crates/kobako-runtime/src/locking.rs

@@ -0,0 +1,218 @@
+//! The lock a directory's calls run under, as Linux's `rw_semaphore` in
+//! `kernel/locking`: shared while a name in it is looked up, exclusive while
+//! one is made, removed, or moved. The other locks beneath the VFS sit
+//! beside it.
+
+pub(crate) mod seqlock;
+
+use std::sync::{Arc, Condvar, Mutex, MutexGuard, PoisonError};
+use std::thread::ThreadId;
+
+use crate::sched;
+
+/// Why a hold was not taken.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum DownError {
+    /// A wait no release could ever end, since the thread asking holds what it
+    /// asks for. A thread must never hang on itself, so it is answered, as
+    /// Linux's `rt_mutex` answers `-EDEADLK`.
+    Deadlock,
+    /// The wait's run was to stop, past its deadline or interrupted, as
+    /// `down_read_killable` answers `-EINTR` on a fatal signal.
+    Interrupted,
+}
+
+/// Held shared by any number of threads or exclusive by one. A thread
+/// asking again for a hold it could only get once it let go of its own is
+/// refused as a Deadlock; a thread already holding it shared may hold it
+/// shared again, even past a waiting writer, which waits for that thread.
+/// Every wait for it ends once its run is to stop, as each wait of Linux's
+/// is `_killable`.
+#[derive(Default)]
+pub(crate) struct RwSemaphore {
+    holders: Mutex<Holders>,
+    freed: Condvar,
+}
+
+#[derive(Default)]
+struct Holders {
+    writer: Option<ThreadId>,
+    /// One entry for each shared hold, a thread holding it shared twice
+    /// standing twice.
+    readers: Vec<ThreadId>,
+    /// How many threads wait for a release, so one nobody waits for wakes
+    /// no one.
+    waiting: usize,
+    /// How many threads wait to hold it exclusive, which a thread arriving to hold
+    /// it shared goes behind, as `rwsem_down_read_slowpath` queues behind a waiting
+    /// writer, so readers one after another never keep a writer out.
+    writers_waiting: usize,
+}
+
+/// The semaphore while one call holds it, freed as the call returns. It keeps
+/// the semaphore alive itself, so whatever a lock was reached through may go
+/// first.
+pub(crate) struct RwSemaphoreGuard {
+    semaphore: Arc<RwSemaphore>,
+    holder: ThreadId,
+    exclusive: bool,
+}
+
+impl RwSemaphore {
+    fn holders(&self) -> MutexGuard<'_, Holders> {
+        self.holders.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    /// Hold it shared, waiting while a writer holds it.
+    pub(crate) fn down_read(self: &Arc<Self>) -> Result<RwSemaphoreGuard, DownError> {
+        let current = sched::current();
+        self.down(current, false, |holders| match holders.writer {
+            Some(writer) if writer == current => Err(DownError::Deadlock),
+            Some(_) => Ok(false),
+            None if holders.writers_waiting > 0 && !holders.readers.contains(&current) => Ok(false),
+            None => {
+                holders.readers.push(current);
+                Ok(true)
+            }
+        })
+    }
+
+    /// Hold it exclusive, waiting while anyone holds it.
+    pub(crate) fn down_write(self: &Arc<Self>) -> Result<RwSemaphoreGuard, DownError> {
+        let current = sched::current();
+        self.down(current, true, |holders| {
+            if holders.writer == Some(current) || holders.readers.contains(&current) {
+                return Err(DownError::Deadlock);
+            }
+            if holders.writer.is_some() || !holders.readers.is_empty() {
+                return Ok(false);
+            }
+            holders.writer = Some(current);
+            Ok(true)
+        })
+    }
+
+    /// Hold it shared where nobody holds or waits to hold it exclusive, without
+    /// waiting, as `down_read_trylock` fails on a writer or a waiter.
+    pub(crate) fn down_read_trylock(self: &Arc<Self>) -> Option<RwSemaphoreGuard> {
+        let current = sched::current();
+        let mut holders = self.holders();
+        if holders.writer.is_some() || holders.writers_waiting > 0 {
+            return None;
+        }
+        holders.readers.push(current);
+        Some(self.guard(current, false))
+    }
+
+    /// Hold it exclusive where nobody holds it, without waiting, as
+    /// `down_write_trylock`.
+    pub(crate) fn down_write_trylock(self: &Arc<Self>) -> Option<RwSemaphoreGuard> {
+        let current = sched::current();
+        let mut holders = self.holders();
+        if holders.writer.is_some() || !holders.readers.is_empty() {
+            return None;
+        }
+        holders.writer = Some(current);
+        Some(self.guard(current, true))
+    }
+
+    fn guard(self: &Arc<Self>, holder: ThreadId, exclusive: bool) -> RwSemaphoreGuard {
+        RwSemaphoreGuard {
+            semaphore: self.clone(),
+            holder,
+            exclusive,
+        }
+    }
+
+    /// Whether a thread waits to hold it exclusive, for a test to see one queued.
+    #[cfg(test)]
+    pub(crate) fn writer_waits(&self) -> bool {
+        self.holders().writers_waiting > 0
+    }
+
+    /// Take the hold `take` grants, or wait for it.
+    fn down(
+        self: &Arc<Self>,
+        holder: ThreadId,
+        exclusive: bool,
+        mut take: impl FnMut(&mut Holders) -> Result<bool, DownError>,
+    ) -> Result<RwSemaphoreGuard, DownError> {
+        let mut holders = self.holders();
+        if !take(&mut holders)? {
+            drop(holders);
+            self.down_slowpath(exclusive, &mut take)?;
+        }
+        Ok(self.guard(holder, exclusive))
+    }
+
+    /// Wait for a release and ask again, as `rwsem_down_read_slowpath` and
+    /// `rwsem_down_write_slowpath` call `schedule`, until the run is to stop, as
+    /// a killable wait looks at `fatal_signal_pending` each time it wakes.
+    fn down_slowpath(
+        &self,
+        exclusive: bool,
+        take: &mut impl FnMut(&mut Holders) -> Result<bool, DownError>,
+    ) -> Result<(), DownError> {
+        let mut taken = Ok(());
+        sched::schedule(&mut || {
+            let mut holders = self.holders();
+            holders.writers_waiting += usize::from(exclusive);
+            loop {
+                match take(&mut holders) {
+                    Ok(true) => break,
+                    Ok(false) if sched::fatal_signal_pending() => {
+                        taken = Err(DownError::Interrupted);
+                        break;
+                    }
+                    Ok(false) => {
+                        holders.waiting += 1;
+                        holders = self
+                            .freed
+                            .wait_timeout(holders, sched::sleep_slice())
+                            .unwrap_or_else(PoisonError::into_inner)
+                            .0;
+                        holders.waiting -= 1;
+                    }
+                    Err(err) => {
+                        taken = Err(err);
+                        break;
+                    }
+                }
+            }
+            holders.writers_waiting -= usize::from(exclusive);
+            // A reader may have stood behind this writer, which now takes it or
+            // gave up; one that took it wakes them again once it lets go.
+            if holders.waiting > 0 && taken.is_err() {
+                self.freed.notify_all();
+            }
+        });
+        taken
+    }
+}
+
+impl RwSemaphoreGuard {
+    /// Whether this holds `semaphore`.
+    pub(crate) fn holds(&self, semaphore: &Arc<RwSemaphore>) -> bool {
+        Arc::ptr_eq(&self.semaphore, semaphore)
+    }
+}
+
+impl Drop for RwSemaphoreGuard {
+    fn drop(&mut self) {
+        let mut holders = self.semaphore.holders();
+        if self.exclusive {
+            holders.writer = None;
+        } else if let Some(at) = holders
+            .readers
+            .iter()
+            .position(|reader| *reader == self.holder)
+        {
+            holders.readers.swap_remove(at);
+        }
+        let waiting = holders.waiting > 0;
+        drop(holders);
+        if waiting {
+            self.semaphore.freed.notify_all();
+        }
+    }
+}

data/crates/kobako-runtime/src/mount.rs

@@ -1,38 +1,37 @@
 //! A Mount: the Grant handing a Filesystem to the guest at an absolute
-//! guest path, with the access it allows there. The Mount decides each
-//! open and each change itself, so a runtime asks it rather than reading
-//! its access, and a Filesystem of a third party's checks nothing.
+//! guest path, with the access it allows there and the Policy that may refuse
+//! more, which the VFS asks through its Cred, so a Filesystem of a third
+//! party's checks nothing.
 
 use std::fmt;
 use std::sync::Arc;
 
-use crate::filesystem::{Access, Filesystem};
+use crate::filesystem::Filesystem;
+use crate::vfs::VfsMount;
 
-/// The Host App's decision for one path a guest opens or changes, made in
-/// a Mount's access's place.
+/// What a Mount allows a guest beneath it, and what a Policy is asked to allow
+/// for one path.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Access {
+    Read,
+    ReadWrite,
+}
+
+/// The Host App's decision for one path a guest opens or changes, made after
+/// a Mount's access allows it, so it can only refuse more.
 pub trait Policy: Send + Sync {
     /// Whether the guest may reach `path`, the absolute guest path, with
     /// `access`.
     fn allows(&self, path: &str, access: Access) -> bool;
 }
 
-/// Why a Mount refused a call.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Denial {
-    /// A change beneath a Mount allowing only reads.
-    ReadOnly,
-    /// The Mount's Policy said no.
-    Refused,
-}
-
-/// A Filesystem at an absolute guest path. Its path bounds what a Policy
-/// can allow either way.
+/// A Filesystem instance at an absolute guest path. Its path bounds what a
+/// Policy can allow either way.
 #[derive(Clone)]
 pub struct Mount {
     at: String,
-    access: Access,
-    filesystem: Arc<dyn Filesystem>,
     policy: Option<Arc<dyn Policy>>,
+    mnt: Arc<VfsMount>,
 }
 
 /// A path no Mount can stand at: one that is not an absolute guest path.
@@ -66,7 +65,7 @@ impl Mount {
     /// guest path, which every path the Mount answers for is built on.
     pub fn new(
         at: impl Into<String>,
-        filesystem: Arc<dyn Filesystem>,
+        filesystem: Arc<Filesystem>,
         access: Access,
     ) -> Result<Self, MountPathError> {
         let at = at.into();
@@ -75,14 +74,13 @@ impl Mount {
         }
         Ok(Self {
             at,
-            access,
-            filesystem,
+            mnt: VfsMount::new(filesystem, access == Access::Read),
             policy: None,
         })
     }
 
-    /// This Mount with `policy` deciding each open and each change in its
-    /// access's place.
+    /// This Mount with `policy` also judging each open and each change its
+    /// access allows; it can only refuse more, as an LSM can.
     pub fn with_policy(self, policy: Arc<dyn Policy>) -> Self {
         Self {
             policy: Some(policy),
@@ -90,89 +88,18 @@ impl Mount {
         }
     }
 
-    /// The absolute guest path the Filesystem appears at.
-    pub fn at(&self) -> &str {
-        &self.at
-    }
-
-    /// The Filesystem an engine hands each call beneath this Mount.
-    pub fn filesystem(&self) -> &Arc<dyn Filesystem> {
-        &self.filesystem
-    }
-
-    /// Whether a change beneath this Mount may be allowed at all: it was made
-    /// to be written, or a Policy decides each change in its access's place.
-    /// The Policy itself is not asked.
-    pub fn allows_writes(&self) -> bool {
-        self.policy.is_some() || self.access == Access::ReadWrite
-    }
-
-    /// The absolute guest path `path`, relative to this Mount's root,
-    /// stands for.
-    pub fn guest_path(&self, path: &str) -> String {
-        match (self.at.as_str(), path) {
-            (at, "") => at.to_string(),
-            ("/", path) => format!("/{path}"),
-            (at, path) => format!("{at}/{path}"),
-        }
-    }
-
-    /// Whether the guest may reach `path`, relative to this Mount's root,
-    /// with `access`. A Policy judges the path as the Filesystem stores
-    /// its names, so a host folding case or Unicode form cannot hand it
-    /// one spelling of an entry it refuses by another; a Filesystem that
-    /// cannot spell it refuses.
-    pub fn check(&self, path: &str, access: Access) -> Result<(), Denial> {
-        match &self.policy {
-            Some(policy) => {
-                let stored = self
-                    .filesystem
-                    .stored_path(path)
-                    .map_err(|_| Denial::Refused)?;
-                if policy.allows(&self.guest_path(&stored), access) {
-                    Ok(())
-                } else {
-                    Err(Denial::Refused)
-                }
-            }
-            None if access == Access::ReadWrite && self.access == Access::Read => {
-                Err(Denial::ReadOnly)
-            }
-            None => Ok(()),
-        }
+    /// The Filesystem as the VFS walks it.
+    pub fn mnt(&self) -> &Arc<VfsMount> {
+        &self.mnt
     }
 
-    /// Whether a directory may move beneath this Mount. Under a Policy it
-    /// may not: everything beneath it would take paths the Policy never
-    /// judged, so a move is refused as one across devices and the guest
-    /// copies entry by entry instead, as Landlock refuses such a move.
-    pub fn moves_directories(&self) -> bool {
-        self.policy.is_none()
+    /// The Policy deciding beneath this Mount, once one was given.
+    pub(crate) fn policy(&self) -> Option<&Arc<dyn Policy>> {
+        self.policy.as_ref()
     }
 
-    /// Whether a path beneath this Mount may pass through a link the
-    /// Filesystem holds. Under a Policy it may not: the link leads to a
-    /// path the Policy never judged, so the call is refused as one past
-    /// too many links.
-    pub fn follows_links(&self) -> bool {
-        self.policy.is_none()
-    }
-
-    /// This Mount as a new Invocation starts from it, over the Filesystem
-    /// that Invocation receives; beneath a Policy, the one that follows no
-    /// link, so each call reaches the path the Policy judged.
-    pub fn for_invocation(&self) -> Self {
-        let filesystem = self
-            .filesystem
-            .for_invocation()
-            .unwrap_or_else(|| self.filesystem.clone());
-        let filesystem = match self.policy {
-            Some(_) => filesystem.for_policy().unwrap_or(filesystem),
-            None => filesystem,
-        };
-        Self {
-            filesystem,
-            ..self.clone()
-        }
+    /// The absolute guest path the Filesystem appears at.
+    pub fn at(&self) -> &str {
+        &self.at
     }
 }

data/crates/kobako-runtime/src/profile.rs

@@ -6,13 +6,20 @@
 //! actually built, and the frontend refuses a declaration below the
 //! request — so the request is also the floor.
 
+use std::hash::{BuildHasher, RandomState};
+use std::sync::LazyLock;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::vfs::{FileType, Identity, Kstat};
+
 /// The ordered isolation ladder a runtime builds one rung of.
 ///
 /// `Hermetic` is the full ambient-denial posture: ambient time and
 /// entropy denied at the WASI boundary, no ambient filesystem /
 /// environment / network reachability, and no host import beyond the wire ABI's
 /// `__kobako_upcall`. `Permissive` differs only in the ambient
-/// authority it grants — live time and entropy at the WASI boundary. Ordering
+/// authority it grants — live time and entropy at the WASI boundary — and in
+/// the times and inode numbers it shows of an entry. Ordering
 /// follows strength (`Permissive < Hermetic`), so a floor check is a
 /// plain comparison.
 ///
@@ -29,10 +36,139 @@ pub enum Profile {
     Hermetic,
 }
 
+impl Profile {
+    /// The inode number a guest on this posture sees for `identity`. A
+    /// hermetic guest sees none, as a Filesystem's device number depends on
+    /// how many were made before it in the process. Any other sees a hash of
+    /// it under a key the process draws once, so it can tell entries apart
+    /// and cannot work back to a host's inode number.
+    pub fn guest_ino(self, identity: Option<Identity>) -> u64 {
+        static KEY: LazyLock<RandomState> = LazyLock::new(RandomState::new);
+        match (self, identity) {
+            (Self::Hermetic, _) | (_, None) => 0,
+            (Self::Permissive, Some(identity)) => KEY.hash_one(identity),
+        }
+    }
+
+    /// `stat` as a guest on this posture sees it, whichever ABI a Wasm
+    /// Driver encodes it into. A Filesystem records the host's real time whatever
+    /// the invocation writing to it runs under, so one shared across
+    /// invocations keeps one record; a hermetic guest sees every time at the
+    /// Unix epoch, where its wall clock stands, so a time a write left behind
+    /// is no clock it can read. A link reports no size, so nothing of where it
+    /// points reaches the guest, and an entry is told apart only by what
+    /// `guest_ino` answers.
+    pub fn guest_kstat(self, stat: Kstat) -> Kstat {
+        let ino = self.guest_ino(Identity::of(&stat));
+        let masked = match self {
+            Self::Permissive => stat,
+            Self::Hermetic => {
+                let epoch = |time: Option<SystemTime>| time.map(|_| UNIX_EPOCH);
+                stat.with_times(epoch(stat.atime), epoch(stat.mtime), epoch(stat.ctime))
+            }
+        };
+        Kstat {
+            size: match masked.file_type {
+                FileType::Symlink => 0,
+                _ => masked.size,
+            },
+            ..masked.with_identity(0, ino)
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    // The Wasm Driver only encodes this, so another one shows the same, and a
+    // guest reads a link's size and a time here or nowhere.
+    // @behavior RT-173 RT-183
+    #[test]
+    fn a_guest_sees_no_size_for_a_link_and_only_what_its_posture_allows() {
+        let reported = Kstat::new(FileType::Symlink, 42)
+            .with_identity(7, 9)
+            .with_times(Some(SystemTime::now()), None, None);
+        let (hermetic, permissive) = (
+            Profile::Hermetic.guest_kstat(reported),
+            Profile::Permissive.guest_kstat(reported),
+        );
+        assert_eq!(
+            (hermetic.size, permissive.size, hermetic.ino, hermetic.atime),
+            (0, 0, 0, Some(UNIX_EPOCH)),
+            "Profile::guest_kstat of a link must report no size on any posture, and at the \
+             hermetic rung no inode number and every time at the Unix epoch"
+        );
+        assert!(
+            permissive.ino != 0 && permissive.ino != 9 && permissive.atime == reported.atime,
+            "Profile::guest_kstat at the permissive rung must hash the inode number and keep \
+             the time"
+        );
+    }
+
+    // A device number depends on how many Filesystems the process made before,
+    // so the inode number a guest reads folds it in and the device stays out.
+    // @behavior RT-283
+    #[test]
+    fn a_guest_sees_one_device_for_every_entry() {
+        let reported = Kstat::new(FileType::RegFile, 1).with_identity(7, 9);
+        assert_eq!(
+            [Profile::Hermetic, Profile::Permissive]
+                .map(|profile| profile.guest_kstat(reported).dev),
+            [0, 0],
+            "Profile::guest_kstat of an entry a Filesystem reports on device 7 must report \
+             device 0 on either posture"
+        );
+    }
+
+    // An unkeyed hash answers what anyone can compute from a host's numbers,
+    // so the hash a guest reads must differ from it.
+    // @behavior RT-194
+    #[test]
+    fn a_guest_cannot_compute_the_inode_number_it_reads() {
+        use std::collections::hash_map::DefaultHasher;
+        use std::hash::{Hash, Hasher};
+
+        let reported = Kstat::new(FileType::RegFile, 0).with_identity(7, 9);
+        let identity = Identity::of(&reported);
+        let mut unkeyed = DefaultHasher::new();
+        identity
+            .expect("an inode number names an identity")
+            .hash(&mut unkeyed);
+        let seen = Profile::Permissive.guest_ino(identity);
+        assert_eq!(
+            seen,
+            Profile::Permissive.guest_ino(identity),
+            "Profile::guest_ino of one identity must answer one number within a process"
+        );
+        assert_ne!(
+            seen,
+            unkeyed.finish(),
+            "Profile::guest_ino at the permissive rung must not answer a hash anyone can compute \
+             from the device and inode numbers"
+        );
+    }
+
+    // A guest reads the count on any ABI, so the count starts in the runtime
+    // rather than in what a Wasm Driver encodes.
+    // @behavior RT-193
+    #[test]
+    fn an_entry_whose_filesystem_keeps_no_count_is_named_once() {
+        let reported = Kstat::new(FileType::RegFile, 0);
+        assert_eq!(
+            (
+                Profile::Hermetic.guest_kstat(reported).nlink,
+                Profile::Permissive.guest_kstat(reported).nlink,
+                Profile::Permissive
+                    .guest_kstat(reported.with_nlink(3))
+                    .nlink,
+            ),
+            (1, 1, 3),
+            "Profile::guest_kstat of an entry reporting no count must show one name on each \
+             posture, and of one reporting three must show three"
+        );
+    }
+
     // @behavior RT-014
     #[test]
     fn a_declaration_satisfies_any_floor_at_or_below_it() {