@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/readonly_cohort_linux_test.go

@@ -0,0 +1,253 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func readOnlyVMFixture(t *testing.T) LinuxProcesses {
+	t.Helper()
+	source := os.Getenv("M2_S5_FIXTURE")
+	if source == "" {
+		t.Skip("NIC-free root VM fixture")
+	}
+	digest, err := executableDigest(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: digest, RegistryDigest: strings.Repeat("b", 64)}
+	c := NewClient(i)
+	for _, dir := range []string{c.StateDir, c.RunDir} {
+		if err := os.Mkdir(dir, 0700); err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { os.RemoveAll(dir) })
+	}
+	binary := c.StateDir + "/payload-" + digest
+	b, err := os.ReadFile(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(binary, b, 0700); err != nil {
+		t.Fatal(err)
+	}
+	root := "/tmp/m2-s5-operations"
+	if err := os.Mkdir(root, 0755); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(root) })
+	os.WriteFile(root+"/group", bytes.Repeat([]byte("group-only;"), 20000), 0640)
+	os.Chown(root+"/group", 0, 105)
+	os.WriteFile(root+"/denied", []byte("denied-canary"), 0600)
+	vmUnit(t, "start")
+	return LinuxProcesses{Client: c, Binary: binary}
+}
+func readOnlyVMRef(t *testing.T) string {
+	t.Helper()
+	var b [32]byte
+	if _, e := rand.Read(b[:]); e != nil {
+		t.Fatal(e)
+	}
+	return hex.EncodeToString(b[:])
+}
+func readOnlyVMRequest(t *testing.T, g Grant, act Action, args any) DataRequest {
+	b, _ := json.Marshal(args)
+	return DataRequest{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, Op: act, GrantID: g.ID, GrantRevision: g.Revision, OperationID: readOnlyVMRef(t), Nonce: readOnlyVMRef(t), Ticket: readOnlyVMRef(t), Args: b}
+}
+func grantVMMetadata(t *testing.T, p LinuxProcesses, r DataRequest) *readOnlyResult {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	var value *readOnlyResult
+	if err := waitHealthy(ctx, func(context.Context) bool {
+		r.Nonce = readOnlyVMRef(t)
+		r.Ticket = readOnlyVMRef(t)
+		res := grantVMCall(t, p, "operation.result", r)
+		if res.Code == ErrBusy {
+			return false
+		}
+		if res.Code != "" || res.Files == nil {
+			t.Fatalf("metadata refused: %+v", res)
+		}
+		value = res.Files
+		return true
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return value
+}
+func readOnlyVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead, ActionStat, ActionList}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, e := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
+	if e != nil {
+		t.Fatal(e)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func TestLinuxReadOnlyProtocol2ChildrenRelayAndReap(t *testing.T) {
+	p := readOnlyVMFixture(t)
+	proc := startVMHelper(t, p)
+	g := readOnlyVMCreate(t, p)
+	for _, kind := range []string{"stat", "list", "read", "deny"} {
+		os.Remove(p.RunDir + "/fixture-readonly-bytes")
+		act := ActionRead
+		var args any = ReadArgs{Segments: []string{"group"}, MaxBytes: MaxBoundedBytes}
+		switch kind {
+		case "stat":
+			act = ActionStat
+			args = StatArgs{Segments: []string{"group"}}
+		case "list":
+			act = ActionList
+			args = ListArgs{Segments: []string{}, Limit: 20}
+		case "deny":
+			args = ReadArgs{Segments: []string{"denied"}, MaxBytes: MaxBoundedBytes}
+		}
+		r := readOnlyVMRequest(t, g, act, args)
+		if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+			t.Fatal(res)
+		}
+		result := grantVMMetadata(t, p, r)
+		for sent := uint64(0); sent < result.Bytes; {
+			n := result.Bytes - sent
+			if n > MaxChunkBytes {
+				n = MaxChunkBytes
+			}
+			chunk := r
+			chunk.Nonce = readOnlyVMRef(t)
+			chunk.Ticket = readOnlyVMRef(t)
+			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"group"}, MaxBytes: n})
+			res := grantVMCall(t, p, "operation.chunk", chunk)
+			if res.Code == ErrBusy {
+				time.Sleep(10 * time.Millisecond)
+				continue
+			}
+			if res.Code != "" {
+				t.Fatal(res)
+			}
+			sent += n
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+		if waitHealthy(ctx, func(context.Context) bool {
+			_, err := os.Stat(p.RunDir + "/fixture-readonly-bytes")
+			return err == nil && len(processChildren(proc.PID)) == 1
+		}) != nil {
+			cancel()
+			t.Fatal(kind, "operation did not reap")
+		}
+		cancel()
+		data, err := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
+		if err != nil {
+			t.Fatal(err)
+		}
+		switch kind {
+		case "stat":
+			if result.Code != "" || result.Entry == nil || result.Entry.Bytes != 220000 || len(data) != 0 {
+				t.Fatal(result)
+			}
+		case "list":
+			if result.Code != "" || result.List == nil || len(result.List.Entries) != 1 || result.List.Entries[0].Name != "group" || len(data) != 0 {
+				t.Fatal(result)
+			}
+		case "read":
+			expected, _ := os.ReadFile("/tmp/m2-s5-operations/group")
+			if result.Code != "" || !bytes.Equal(data, expected) {
+				t.Fatal(result, len(data))
+			}
+		case "deny":
+			if result.Code != ErrDenied || len(data) != 0 || result.Entry != nil || result.List != nil {
+				t.Fatal("denied metadata escaped", result)
+			}
+		}
+	}
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped"
+	}) != nil {
+		t.Fatal("autonomous completion missing")
+	}
+	record, _ := readRecord(p.StateDir, 0)
+	proof, err := completionRecord(p.Client, record)
+	if err != nil || proof.Cohort == nil || proof.Cohort.Started != 4 || proof.Cohort.Reaped != 4 || !proof.Cohort.RelaysStopped {
+		t.Fatal(proof, err)
+	}
+}
+func TestLinuxReadOnlyBlockedRelayRevokeUsesExistingS3Quiescence(t *testing.T) {
+	p := readOnlyVMFixture(t)
+	proc := startVMHelper(t, p)
+	g := readOnlyVMCreate(t, p)
+	os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
+	r := readOnlyVMRequest(t, g, ActionRead, ReadArgs{Segments: []string{"group"}, MaxBytes: MaxBoundedBytes})
+	if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+		t.Fatal(res)
+	}
+	result := grantVMMetadata(t, p, r)
+	if result.Code != "" || result.Bytes == 0 {
+		t.Fatal(result)
+	}
+	chunk := r
+	chunk.Nonce = readOnlyVMRef(t)
+	chunk.Ticket = readOnlyVMRef(t)
+	chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"group"}, MaxBytes: MaxChunkBytes})
+	if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code != "" {
+		t.Fatal(res)
+	}
+	children := processChildren(proc.PID)
+	if len(children) != 2 {
+		t.Fatal("missing owned child", children)
+	}
+	b, _ := os.ReadFile(p.StateDir + "/grants.json")
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained {
+		t.Fatal(res)
+	}
+	b, err := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
+	var q GrantQuiescence
+	if err != nil || json.Unmarshal(b, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.Started != 1 || q.Cohort.Reaped != 1 || q.Cohort.AdmittedBytes != MaxChunkBytes {
+		t.Fatal(q, err)
+	}
+	if len(processChildren(proc.PID)) != 1 {
+		t.Fatal("Q before reap")
+	}
+	if res := grantVMCall(t, p, "operation.result", r); res.Code == "" || res.Files != nil {
+		t.Fatal("metadata after R", res)
+	}
+	if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code == "" {
+		t.Fatal("lease after R", res)
+	}
+	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	for _, pid := range children {
+		if _, e := os.Stat(fmt.Sprintf("/proc/%d", pid)); !os.IsNotExist(e) {
+			t.Fatal("child survived teardown", pid)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/readonly_linux_test.go

@@ -0,0 +1,378 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"golang.org/x/sys/unix"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+	"unsafe"
+)
+
+// Linux syscall-only fixture adapter. NEVER installed in shipped helper builds;
+// DSM share gates and SynoACL masks require their own separately authorized proof.
+type fixtureReadOnlyACL struct {
+	deny bool
+	hook func()
+}
+
+func (a fixtureReadOnlyACL) Authorize(ctx context.Context, action Action, fd int) Code {
+	if ctx.Err() != nil {
+		return nativeContextCode(ctx)
+	}
+	if a.hook != nil {
+		a.hook()
+	}
+	if a.deny {
+		return ErrDenied
+	}
+	return ""
+}
+func readOnlyFixture(t *testing.T) (*pinnedReadOnlyRoot, string) {
+	t.Helper()
+	root := t.TempDir()
+	os.WriteFile(root+"/file", []byte("canary"), 0644)
+	os.Mkdir(root+"/sub", 0755)
+	os.WriteFile(root+"/sub/inside", []byte("inside"), 0644)
+	pin, code := pinReadOnlyRoot(root)
+	if code != "" {
+		t.Fatal(code)
+	}
+	t.Cleanup(func() { pin.Close() })
+	return pin, root
+}
+func readWork(pin *pinnedReadOnlyRoot, segments ...string) readOnlyWork {
+	return readOnlyWork{RootPath: pin.path, Action: ActionRead, Segments: segments, MaxBytes: MaxBoundedBytes}
+}
+func TestReadOnlyFixedOperationsAndSafeErrors(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "file"), fixtureReadOnlyACL{})
+	if result.Code != "" || string(data) != "canary" || result.Bytes != 6 {
+		t.Fatal(result, string(data))
+	}
+	result, data = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionStat, Segments: []string{"file"}}, fixtureReadOnlyACL{})
+	if result.Code != "" || result.Entry == nil || result.Entry.Kind != "regular" || result.Entry.Bytes != 6 || len(data) != 0 {
+		t.Fatal(result)
+	}
+	result, _ = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 10}, fixtureReadOnlyACL{})
+	if result.Code != "" || result.List == nil || len(result.List.Entries) != 2 {
+		t.Fatal(result)
+	}
+	for _, acl := range []readOnlyACL{nil, fixtureReadOnlyACL{deny: true}} {
+		result, data = executeReadOnly(context.Background(), pin, readWork(pin, "file"), acl)
+		if result.Code == "" || len(data) != 0 || result.Entry != nil || result.List != nil {
+			t.Fatal("ACL refusal leaked", result)
+		}
+	}
+	result, data = executeReadOnly(context.Background(), pin, readWork(pin, "missing-secret"), fixtureReadOnlyACL{})
+	b, _ := json.Marshal(result)
+	if result.Code == "" || len(data) != 0 || bytes.Contains(b, []byte("missing-secret")) || bytes.Contains(b, []byte(root)) {
+		t.Fatal(result)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	result, _ = executeReadOnly(ctx, pin, readWork(pin, "file"), fixtureReadOnlyACL{})
+	if result.Code != ErrCanceled {
+		t.Fatal(result)
+	}
+}
+func TestReadOnlyTraversalSymlinksSpecialFilesAndHardlinks(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	os.Symlink("file", root+"/link")
+	os.Symlink("sub", root+"/dirlink")
+	os.Symlink("/etc/passwd", root+"/outside")
+	os.Link(root+"/file", root+"/alias")
+	unix.Mkfifo(root+"/fifo", 0600)
+	for _, segments := range [][]string{{"..", "file"}, {"/etc/passwd"}, {"link"}, {"dirlink", "inside"}, {"outside"}, {"file"}, {"alias"}, {"fifo"}, {"a\x00b"}} {
+		start := time.Now()
+		r, data := executeReadOnly(context.Background(), pin, readWork(pin, segments...), fixtureReadOnlyACL{})
+		if r.Code == "" || len(data) != 0 || time.Since(start) > time.Second {
+			t.Fatal(segments, r, "blocked or leaked")
+		}
+	}
+	// stat/list must not expose entries whose type or current actor ACL is refused.
+	r, _ := executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 10}, fixtureReadOnlyACL{})
+	if r.Code != "" || len(r.List.Entries) != 1 || r.List.Entries[0].Name != "sub" {
+		t.Fatal(r)
+	}
+}
+func TestReadOnlyObjectReplacementAndIntermediateRename(t *testing.T) {
+	for _, kind := range []string{"root", "middle", "file", "link-after-open"} {
+		t.Run(kind, func(t *testing.T) {
+			pin, root := readOnlyFixture(t)
+			work := readWork(pin, "sub", "inside")
+			mutated := false
+			acl := fixtureReadOnlyACL{hook: func() {
+				if mutated {
+					return
+				}
+				mutated = true
+				switch kind {
+				case "root":
+					os.Rename(root, root+"-old")
+					os.Mkdir(root, 0755)
+					t.Cleanup(func() { os.RemoveAll(root + "-old") })
+				case "middle":
+					os.Rename(root+"/sub", root+"/moved")
+					os.Mkdir(root+"/sub", 0755)
+					os.WriteFile(root+"/sub/inside", []byte("foreign"), 0644)
+				case "file":
+					os.Rename(root+"/sub/inside", root+"/sub/old")
+					os.WriteFile(root+"/sub/inside", []byte("foreign"), 0644)
+				case "link-after-open":
+					os.Link(root+"/sub/inside", root+"/alias")
+				}
+			}}
+			r, data := executeReadOnly(context.Background(), pin, work, acl)
+			if r.Code == "" || len(data) != 0 {
+				t.Fatal("mutation survived final check", r, string(data))
+			}
+		})
+	}
+}
+func TestReadOnlyBoundedReadAndList(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	os.WriteFile(root+"/large", bytes.Repeat([]byte{'x'}, MaxBoundedBytes+1), 0644)
+	r, b := executeReadOnly(context.Background(), pin, readWork(pin, "large"), fixtureReadOnlyACL{})
+	if r.Code != ErrLimit || len(b) != 0 {
+		t.Fatal(r)
+	}
+	w := readWork(pin, "file")
+	w.MaxBytes = 3
+	r, b = executeReadOnly(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if r.Code != ErrLimit || len(b) != 0 {
+		t.Fatal(r)
+	}
+	os.WriteFile(root+"/exact", bytes.Repeat([]byte{'x'}, MaxBoundedBytes), 0644)
+	r, b = executeReadOnly(context.Background(), pin, readWork(pin, "exact"), fixtureReadOnlyACL{})
+	if r.Code != "" || len(b) != MaxBoundedBytes {
+		t.Fatal(r)
+	}
+	w = readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 1}
+	r, _ = executeReadOnly(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if r.Code != ErrLimit || r.List != nil {
+		t.Fatal("no unbound pagination", r)
+	}
+}
+func TestReadOnlySameDeviceBindMountRefused(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("root VM mount fixture")
+	}
+	pin, root := readOnlyFixture(t)
+	other := t.TempDir()
+	os.WriteFile(other+"/secret", []byte("outside"), 0644)
+	if err := unix.Mount(other, root+"/sub", "", unix.MS_BIND, ""); err != nil {
+		t.Fatal(err)
+	}
+	defer unix.Unmount(root+"/sub", 0)
+	var a, b unix.Stat_t
+	unix.Stat(root, &a)
+	unix.Stat(root+"/sub", &b)
+	if a.Dev != b.Dev {
+		t.Fatal("fixture must share st_dev")
+	}
+	r, data := executeReadOnly(context.Background(), pin, readWork(pin, "sub", "secret"), fixtureReadOnlyACL{})
+	if r.Code == "" || len(data) != 0 {
+		t.Fatal("bind mount escaped", r)
+	}
+}
+func TestReadOnlyActorCredentialsAndKernel44Fallback(t *testing.T) {
+	if os.Getenv("M2_S5_ACTOR_FIXTURE") == "1" {
+		return
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("root VM credentials fixture")
+	}
+	root, err := os.MkdirTemp("/tmp", "m2-s5-actor-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(root) })
+	os.Chmod(root, 0755)
+	os.WriteFile(root+"/group", []byte("group-only"), 0640)
+	os.Chown(root+"/group", 0, 105)
+	os.WriteFile(root+"/denied", []byte("denied-canary"), 0600)
+	os.Mkdir(root+"/no-traverse", 0700)
+	os.WriteFile(root+"/no-traverse/secret", []byte("secret"), 0644)
+	for _, groups := range [][]uint32{{101, 105}, {101}} {
+		exe, _ := os.Executable()
+		cmd := exec.Command(exe, "-test.run=^TestReadOnlyActorProcess$", "-test.v")
+		cmd.Env = append(os.Environ(), "M2_S5_ACTOR_FIXTURE=1", "M2_S5_ROOT="+root, "M2_S5_GROUP_ALLOW="+fmt.Sprint(len(groups) == 2))
+		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 1001, Gid: 100, Groups: groups}}
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatal(err, string(out))
+		}
+		t.Log(string(out))
+	}
+}
+func TestReadOnlyActorProcess(t *testing.T) {
+	if os.Getenv("M2_S5_ACTOR_FIXTURE") != "1" {
+		t.Skip("subprocess only")
+	}
+	// All Go threads deny post-4.4 primitives; prove ENOSYS before using resolver.
+	filter := []unix.SockFilter{{Code: unix.BPF_LD | unix.BPF_W | unix.BPF_ABS, K: 0}, {Code: unix.BPF_JMP | unix.BPF_JEQ | unix.BPF_K, Jt: 1, K: unix.SYS_OPENAT2}, {Code: unix.BPF_JMP | unix.BPF_JEQ | unix.BPF_K, Jf: 1, K: unix.SYS_STATX}, {Code: unix.BPF_RET | unix.BPF_K, K: unix.SECCOMP_RET_ERRNO | uint32(unix.ENOSYS)}, {Code: unix.BPF_RET | unix.BPF_K, K: unix.SECCOMP_RET_ALLOW}}
+	program := unix.SockFprog{Len: uint16(len(filter)), Filter: &filter[0]}
+	if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+		t.Fatal(err)
+	}
+	_, _, errno := unix.Syscall(unix.SYS_SECCOMP, unix.SECCOMP_SET_MODE_FILTER, unix.SECCOMP_FILTER_FLAG_TSYNC, uintptr(unsafe.Pointer(&program)))
+	if errno != 0 {
+		t.Fatal(errno)
+	}
+	fd, err := unix.Openat2(unix.AT_FDCWD, "/", &unix.OpenHow{Flags: unix.O_PATH})
+	if fd >= 0 {
+		unix.Close(fd)
+	}
+	if err != unix.ENOSYS {
+		t.Fatal("compatibility fixture ineffective", err)
+	}
+	root := os.Getenv("M2_S5_ROOT")
+	pin, c := pinReadOnlyRoot(root)
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer pin.Close()
+	r, b := executeReadOnly(context.Background(), pin, readWork(pin, "group"), fixtureReadOnlyACL{})
+	allow := os.Getenv("M2_S5_GROUP_ALLOW") == "true"
+	if allow && (r.Code != "" || string(b) != "group-only") || !allow && (r.Code == "" || len(b) != 0) {
+		t.Fatal("supplementary group", r, string(b))
+	}
+	for _, s := range [][]string{{"denied"}, {"no-traverse", "secret"}} {
+		r, b = executeReadOnly(context.Background(), pin, readWork(pin, s...), fixtureReadOnlyACL{})
+		if r.Code == "" || len(b) != 0 {
+			t.Fatal("actor permission bypass", r)
+		}
+	}
+	r, _ = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 20}, fixtureReadOnlyACL{})
+	if r.Code != "" {
+		t.Fatal(r)
+	}
+	for _, e := range r.List.Entries {
+		if e.Name == "denied" || e.Name == "no-traverse" || e.Name == "group" && !allow {
+			t.Fatal("denied metadata leaked", e)
+		}
+	}
+	t.Log("uid/gid/groups and openat2/statx ENOSYS compatibility profile passed")
+}
+
+func TestReadOnlyChildRefusesMissingEpochRootBeforeSpawn(t *testing.T) {
+	w := readOnlyWork{RootPath: "/fixture", Action: ActionRead, Segments: []string{"file"}, MaxBytes: 10}
+	child, err := startLinuxReadOnlyOperation(Client{}, "", NativeActor{}, operationBinding{}, nil, w, nil)
+	if child != nil || err == nil {
+		t.Fatal("no grant authority admitted work")
+	}
+}
+func TestReadOnlyMountInfoParserAndPinnedProcessDirectory(t *testing.T) {
+	for _, input := range []string{"", "mnt_id: 0\n", "mnt_id: nope\n", "mnt_id: 2\nmnt_id: 3\n", strings.Repeat("x", 4097)} {
+		if _, code := parseReadOnlyMountID(strings.NewReader(input)); code == "" {
+			t.Fatal("malformed mount proof", input)
+		}
+	}
+	id, code := parseReadOnlyMountID(strings.NewReader("pos: 0\nflags: 010000000\nmnt_id: 25\n"))
+	if code != "" || id != 25 {
+		t.Fatal(id, code)
+	}
+	pin, _ := readOnlyFixture(t)
+	info, err := openOperationFDInfo(os.Getpid())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer info.Close()
+	local, c := readOnlyLocalMountID(int(pin.file.Fd()))
+	proxy, p := operationFDInfoMount(info, uint32(pin.file.Fd()))
+	if c != "" || p != "" || local != proxy {
+		t.Fatal("proxy disagrees", local, proxy, c, p)
+	}
+	if _, code := operationFDInfoMount(info, 1<<21); code == "" {
+		t.Fatal("unbounded FD number")
+	}
+}
+func TestReadOnlyRelayCompletionWaitsForMetadataReader(t *testing.T) {
+	p := newLinuxOperationRelay(nil, nil, nil, nil)
+	p.readOnly = true
+	p.resultPending = make(chan readOnlyPacketOutcome, 1)
+	p.stopRelay()
+	if p.relayStopped() {
+		t.Fatal("close falsely certified metadata goroutine stopped")
+	}
+	p.resultPending <- readOnlyPacketOutcome{err: ErrCanceled}
+	if !p.relayStopped() {
+		t.Fatal("metadata goroutine not observed")
+	}
+}
+
+func TestReadOnlyRejectsRootReadableDirectoryInsteadOfPathWitness(t *testing.T) {
+	_, root := readOnlyFixture(t)
+	readable, err := os.Open(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer readable.Close()
+	pin := &pinnedReadOnlyRoot{path: root, file: readable}
+	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "file"), fixtureReadOnlyACL{})
+	if result.Code != ErrDenied || len(data) != 0 {
+		t.Fatal("root-readable descriptor accepted", result)
+	}
+}
+func TestReadOnlyTwoProcessRenameBarrier(t *testing.T) {
+	if os.Getenv("M2_S5_RENAME_FIXTURE") == "1" {
+		root := os.Getenv("M2_S5_RENAME_ROOT")
+		if err := os.Rename(root+"/sub", root+"/moved"); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Mkdir(root+"/sub", 0755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(root+"/sub/inside", []byte("foreign-canary"), 0644); err != nil {
+			t.Fatal(err)
+		}
+		return
+	}
+	pin, root := readOnlyFixture(t)
+	mutated := false
+	acl := fixtureReadOnlyACL{hook: func() {
+		if mutated {
+			return
+		}
+		mutated = true
+		exe, _ := os.Executable()
+		cmd := exec.Command(exe, "-test.run=^TestReadOnlyTwoProcessRenameBarrier$", "-test.v")
+		cmd.Env = append(os.Environ(), "M2_S5_RENAME_FIXTURE=1", "M2_S5_RENAME_ROOT="+root)
+		if b, err := cmd.CombinedOutput(); err != nil {
+			t.Fatal(err, string(b))
+		}
+	}}
+	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "sub", "inside"), acl)
+	if result.Code == "" || len(data) != 0 {
+		t.Fatal("replacement/old data crossed rename barrier", result, string(data))
+	}
+}
+
+func TestReadOnlyMountReceiverClosesWitnessBeforeQuiescence(t *testing.T) {
+	pending := make(chan readOnlyPacketOutcome, 1)
+	p := &linuxOperation{closed: true, resultPending: pending}
+	closing := make(chan struct{})
+	release := make(chan struct{})
+	finished := make(chan struct{})
+	go func() {
+		runReadOnlyResultReceiver(pending, func() readOnlyPacketOutcome { return readOnlyPacketOutcome{result: &readOnlyResult{}} }, func() error { close(closing); <-release; return nil })
+		close(finished)
+	}()
+	<-closing
+	stopped := p.relayStopped()
+	close(release)
+	<-finished
+	if stopped {
+		t.Fatal("Q observed result while proc witness was still open")
+	}
+	if !p.relayStopped() {
+		t.Fatal("closed receiver prevented Q")
+	}
+}

package/templates/native-go/backend/internal/helper/readonly_mount_linux.go

@@ -0,0 +1,65 @@
+package helper
+
+import (
+	"golang.org/x/sys/unix"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// mnt_id in Linux fdinfo predates 4.4. st_dev alone misses same-device bind
+// mounts. This fixed proc alias reads ONLY kernel metadata for our own FD.
+var readOnlySelfMountID = readOnlyLocalMountID
+var operationMountIDFallback func(int) (uint64, Code)
+
+func readOnlyMountID(fd int) (uint64, Code) {
+	id, code := readOnlySelfMountID(fd)
+	if code == "" || operationMountIDFallback == nil {
+		return id, code
+	}
+	return operationMountIDFallback(fd)
+}
+func readOnlyLocalMountID(fd int) (uint64, Code) {
+	f, err := os.Open("/proc/self/fdinfo/" + strconv.Itoa(fd))
+	if err != nil {
+		return 0, ErrUnsupported
+	}
+	defer f.Close()
+	return parseReadOnlyMountID(f)
+}
+func parseReadOnlyMountID(f io.Reader) (uint64, Code) {
+	b, err := io.ReadAll(io.LimitReader(f, 4097))
+	if err != nil || len(b) > 4096 {
+		return 0, ErrUnsupported
+	}
+	var id uint64
+	for _, line := range strings.Split(string(b), "\n") {
+		if !strings.HasPrefix(line, "mnt_id:") {
+			continue
+		}
+		if id != 0 {
+			return 0, ErrUnsupported
+		}
+		id, err = strconv.ParseUint(strings.TrimSpace(strings.TrimPrefix(line, "mnt_id:")), 10, 64)
+		if err != nil || id == 0 {
+			return 0, ErrUnsupported
+		}
+	}
+	if id == 0 {
+		return 0, ErrUnsupported
+	}
+	return id, ""
+}
+
+func readOnlyLocalMount(fd int) Code {
+	var fs unix.Statfs_t
+	if unix.Fstatfs(fd, &fs) != nil {
+		return ErrUnsupported
+	}
+	switch uint64(fs.Type) {
+	case unix.EXT4_SUPER_MAGIC, unix.BTRFS_SUPER_MAGIC, unix.XFS_SUPER_MAGIC, unix.TMPFS_MAGIC:
+		return ""
+	}
+	return ErrUnsupported
+}