@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/repair.go

@@ -0,0 +1,132 @@
+package helper
+
+import (
+	"errors"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+type RepairCompletion struct {
+	Inventory Inventory `json:"inventory"`
+	Boot      string    `json:"boot"`
+	Lease     Lease     `json:"lease"`
+}
+
+// repair is entered with control.lock held. It never calls Processes.Stop or
+// Start: the lifetime lock proves quiescence without observing/signalling PIDs.
+func (c Controller) repair(r Record) error {
+	if r.Inventory.Package != c.Expected.Package || r.Lifecycle == nil || r.Lifecycle.Lease == nil {
+		return errTrust
+	}
+	if r.Lifecycle.Completion != "" {
+		if _, err := completionRecord(c.Client, r); err != nil {
+			return err
+		}
+	}
+	lock, err := acquireLifetime(c.Client, r.Lifecycle)
+	if err != nil {
+		return err
+	}
+	defer lock.Close()
+	// Persist denial before any unlink; neither crash nor later active unit can
+	// clear this epoch's latch. Preserve Enabled and the old inventory.
+	if err = policyUpdate(c.Client, func(current *Record) error {
+		if !sameRepairEpoch(*current, r) {
+			return errTrust
+		}
+		current.Residual = true
+		current.Lifecycle.Phase = "fenced"
+		current.Lifecycle.Reason = "admin-repair"
+		current.Lifecycle.Completion = ""
+		return nil
+	}); err != nil {
+		return err
+	}
+	entries, err := repairEntries(c.Client, r)
+	if err != nil {
+		return err
+	}
+	for name, st := range entries {
+		path := filepath.Join(c.RunDir, name)
+		now, err := os.Lstat(path)
+		if err != nil || !os.SameFile(st, now) || now.Mode() != st.Mode() {
+			return errTrust
+		}
+		if err = os.Remove(path); err != nil {
+			return err
+		}
+	}
+	if err = syncDirectory(c.RunDir); err != nil {
+		return err
+	}
+	return policyUpdate(c.Client, func(current *Record) error {
+		if !sameRepairEpoch(*current, r) || current.Lifecycle.Phase != "fenced" || !runtimeAbsent(c.Client) {
+			return errTrust
+		}
+		if err := validateLifetime(c.Client, current.Lifecycle, lock); err != nil {
+			return err
+		}
+		current.Lifecycle.Phase = "stopped"
+		return storeCompletion(c.Client, current, Completion{Epoch: current.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: current.Inventory, Boot: current.Lifecycle.Binding.Boot, Lease: *current.Lifecycle.Lease}})
+	})
+}
+
+// Both repair policy transactions compare the same immutable epoch witness.
+func sameRepairEpoch(current, original Record) bool {
+	if current.Inventory != original.Inventory || current.Lifecycle == nil || original.Lifecycle == nil {
+		return false
+	}
+	got, want := current.Lifecycle, original.Lifecycle
+	return got.Epoch == want.Epoch && got.Lease != nil && want.Lease != nil && *got.Lease == *want.Lease
+}
+
+// Preflight every entry before deleting any, then recheck inode at unlink.
+// Missing entries permit retry after an interrupted repair, never proof alone.
+func repairEntries(c Client, r Record) (map[string]os.FileInfo, error) {
+	if err := protected(c.RunDir, c.Owner, true); err != nil {
+		return nil, err
+	}
+	entries := map[string]os.FileInfo{}
+	for _, name := range []string{"helper.sock", "supervisor.sock", "process.json"} {
+		path := filepath.Join(c.RunDir, name)
+		st, err := os.Lstat(path)
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		s, ok := st.Sys().(*syscall.Stat_t)
+		if !ok || s.Uid != c.Owner {
+			return nil, errTrust
+		}
+		if name == "process.json" {
+			p, err := readProcess(c.RunDir, c.Owner)
+			if err != nil || st.Mode().Perm() != 0600 || s.Nlink != 1 || p.Inventory != r.Inventory || p.Boot != r.Lifecycle.Binding.Boot {
+				return nil, errTrust
+			}
+		} else {
+			mode := fs.FileMode(0660)
+			if name == "supervisor.sock" {
+				mode = 0600
+			}
+			if st.Mode()&os.ModeSocket == 0 || st.Mode().Perm() != mode {
+				return nil, errTrust
+			}
+			conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
+			if err == nil {
+				conn.Close()
+				return nil, errTrust
+			}
+			if !errors.Is(err, syscall.ECONNREFUSED) {
+				return nil, errTrust
+			}
+		}
+		entries[name] = st
+	}
+	return entries, nil
+}

package/templates/native-go/backend/internal/helper/repair_test.go

@@ -0,0 +1,271 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+// Write the wire format independently of production constructors. This also
+// checks strict approval parsing and the pre-R2 parser's refusal of lease.
+func repairFixture(t *testing.T) (Controller, *fakeProcesses, string) {
+	t.Helper()
+	c, f := controlFixture(t)
+	f.stopErr = errTrust
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(c.StateDir, "lifetime-"+r.Lifecycle.Epoch+".lock")
+	if err := os.WriteFile(path, []byte(r.Lifecycle.Epoch), 0600); err != nil {
+		t.Fatal(err)
+	}
+	st, _ := os.Lstat(path)
+	stat := st.Sys().(*syscall.Stat_t)
+	b, _ := json.Marshal(r)
+	var wire map[string]any
+	json.Unmarshal(b, &wire)
+	wire["lifecycle"].(map[string]any)["lease"] = map[string]any{"device": uint64(stat.Dev), "inode": stat.Ino}
+	b, _ = json.Marshal(wire)
+	if err := os.WriteFile(filepath.Join(c.StateDir, "approval.json"), b, 0644); err != nil {
+		t.Fatal(err)
+	}
+	staleSocket(t, filepath.Join(c.RunDir, "helper.sock"))
+	staleSocket(t, filepath.Join(c.RunDir, "supervisor.sock"))
+	os.Chmod(filepath.Join(c.RunDir, "helper.sock"), 0660)
+	os.Chmod(filepath.Join(c.RunDir, "supervisor.sock"), 0600)
+	return c, f, path
+}
+
+func TestRepairCommitsQuiescenceWithoutSignalOrStart(t *testing.T) {
+	for _, disabled := range []bool{false, true} {
+		c, f, _ := repairFixture(t)
+		if disabled {
+			// Wire read will succeed only when the new lease field is implemented.
+			r, e := readRecord(c.StateDir, c.Owner)
+			if e != nil {
+				t.Fatal(e)
+			}
+			r.Enabled = false
+			record(t, c.Client, r)
+		}
+		if err := c.Control(context.Background(), "repair"); err != nil {
+			t.Fatal("repair refused valid lifetime evidence", err)
+		}
+		r, e := readRecord(c.StateDir, c.Owner)
+		if e != nil || r.Residual || r.Enabled == disabled || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" {
+			t.Fatalf("bad commit: %+v %v", r, e)
+		}
+		if _, e := completionRecord(c.Client, r); e != nil {
+			t.Fatal(e)
+		}
+		if !runtimeAbsent(c.Client) || f.stopped != 0 || f.started != 0 {
+			t.Fatal("repair signalled or started", f)
+		}
+		if err := c.Control(context.Background(), "repair"); err != nil {
+			t.Fatal("retry not idempotent", err)
+		}
+		if disabled {
+			if c.Control(context.Background(), "recover") == nil {
+				t.Fatal("disabled repair revived integration")
+			}
+		} else if err := c.Control(context.Background(), "recover"); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestRepairRefusesMissingLegacyBusyAndForeignEvidence(t *testing.T) {
+	for _, kind := range []string{"legacy", "pre-r2-m1g", "missing", "symlink", "replacement", "hardlink", "mode", "content", "busy", "foreign-process", "live", "foreign-socket"} {
+		t.Run(kind, func(t *testing.T) {
+			c, f, path := repairFixture(t)
+			switch kind {
+			case "legacy":
+				record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Residual: true})
+			case "pre-r2-m1g":
+				record(t, c.Client, Record{Inventory: c.Expected, Enabled: true, Residual: true, Lifecycle: testLifecycle("fenced")})
+			case "missing":
+				os.Remove(path)
+			case "symlink":
+				os.Remove(path)
+				os.Symlink("/etc/passwd", path)
+			case "replacement":
+				os.Rename(path, path+".old")
+				os.WriteFile(path, []byte(testLifecycle("running").Epoch), 0600)
+			case "hardlink":
+				os.Link(path, path+".alias")
+			case "mode":
+				os.Chmod(path, 0644)
+			case "content":
+				os.WriteFile(path, []byte("wrong epoch"), 0600)
+			case "busy":
+				h, e := os.OpenFile(path, os.O_RDWR, 0)
+				if e != nil {
+					t.Fatal(e)
+				}
+				defer h.Close()
+				if e = syscall.Flock(int(h.Fd()), syscall.LOCK_EX); e != nil {
+					t.Fatal(e)
+				}
+			case "foreign-process":
+				p := f.current
+				p.Inventory.Version = "9.0.0-9999"
+				writeProcess(c.RunDir, p)
+			case "live":
+				os.Remove(filepath.Join(c.RunDir, "helper.sock"))
+				live(t, c.Client, c.Expected, nil)
+			case "foreign-socket":
+				os.Remove(filepath.Join(c.RunDir, "supervisor.sock"))
+				os.WriteFile(filepath.Join(c.RunDir, "supervisor.sock"), []byte("foreign"), 0600)
+			}
+			if c.Control(context.Background(), "repair") == nil {
+				t.Fatal("unsafe repair accepted", kind)
+			}
+			if _, e := os.Lstat(filepath.Join(c.RunDir, "process.json")); e != nil {
+				t.Fatal("failure evidence removed", e)
+			}
+			if _, e := os.Lstat(filepath.Join(c.RunDir, "helper.sock")); e != nil {
+				t.Fatal("partial deletion before preflight", e)
+			}
+			if f.stopped != 0 || f.started != 0 {
+				t.Fatal("repair touched process", f)
+			}
+		})
+	}
+}
+
+func TestRepairRetriesInterruptedUnlinkAndOrphanProof(t *testing.T) {
+	for _, gap := range []string{"fence", "one-socket", "all-sockets", "all-runtime", "orphan-proof"} {
+		t.Run(gap, func(t *testing.T) {
+			c, f, _ := repairFixture(t)
+			r, e := readRecord(c.StateDir, c.Owner)
+			if e != nil {
+				t.Fatal(e)
+			}
+			r.Residual = true
+			r.Lifecycle.Phase = "fenced"
+			r.Lifecycle.Reason = "admin-repair"
+			record(t, c.Client, r)
+			if gap != "fence" {
+				os.Remove(filepath.Join(c.RunDir, "helper.sock"))
+			}
+			if gap == "all-sockets" || gap == "all-runtime" || gap == "orphan-proof" {
+				os.Remove(filepath.Join(c.RunDir, "supervisor.sock"))
+			}
+			if gap == "all-runtime" || gap == "orphan-proof" {
+				os.Remove(filepath.Join(c.RunDir, "process.json"))
+			}
+			if gap == "orphan-proof" {
+				// A correctly bound private artifact without the approval digest is
+				// still an uncommitted repair, not permission to recover.
+				proof := Completion{Epoch: r.Lifecycle.Epoch, Repair: &RepairCompletion{Inventory: r.Inventory, Boot: r.Lifecycle.Binding.Boot, Lease: *r.Lifecycle.Lease}}
+				if e := writeProtected(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json", proof); e != nil {
+					t.Fatal(e)
+				}
+			}
+			if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+				t.Fatal("crash gap recovered without repair")
+			}
+			if e := c.Control(context.Background(), "repair"); e != nil {
+				t.Fatal("retry failed", e)
+			}
+			r, e = readRecord(c.StateDir, c.Owner)
+			if e != nil || r.Residual {
+				t.Fatal("retry incomplete", e)
+			}
+		})
+	}
+}
+
+func TestRepairProofWriteFailureKeepsLatchAfterUnlink(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	r, e := readRecord(c.StateDir, c.Owner)
+	if e != nil {
+		t.Fatal(e)
+	}
+	proof := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+	os.Mkdir(proof, 0700) // deterministic failure after runtime unlink, before proof commit
+	if c.Control(context.Background(), "repair") == nil {
+		t.Fatal("proof failure committed")
+	}
+	r, e = readRecord(c.StateDir, c.Owner)
+	if e != nil || !r.Residual || r.Lifecycle.Phase != "fenced" || !runtimeAbsent(c.Client) {
+		t.Fatal("lost crash intent", e)
+	}
+	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+		t.Fatal("uncommitted repair revived")
+	}
+	os.Remove(proof)
+	if e := c.Control(context.Background(), "repair"); e != nil {
+		t.Fatal(e)
+	}
+	os.Remove(proof)
+	if c.Control(context.Background(), "recover") == nil {
+		t.Fatal("missing committed proof accepted")
+	}
+}
+
+func TestRepairAcrossPayloadRetainsOldApprovalAndRequiresEnable(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	c.Expected.Version = "2.0.0-0002"
+	if e := c.Control(context.Background(), "repair"); e != nil {
+		t.Fatal(e)
+	}
+	r, e := readRecord(c.StateDir, c.Owner)
+	if e != nil || r.Inventory.Version != "1.0.0-0001" {
+		t.Fatal("repair expanded approval", e)
+	}
+	if c.Control(context.Background(), "recover") == nil || f.started != 0 {
+		t.Fatal("old inventory recovered")
+	}
+	if e := c.Control(context.Background(), "enable"); e != nil {
+		t.Fatal(e)
+	}
+}
+
+func TestRepairCanceledBeforeMutation(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if e := c.Control(ctx, "repair"); !errors.Is(e, context.Canceled) {
+		t.Fatal(e)
+	}
+	if f.stopped != 0 || f.started != 0 {
+		t.Fatal(f)
+	}
+}
+
+func TestRepairAfterAutonomousCompletionKeepsLifetimeAuthority(t *testing.T) {
+	c, f, _ := repairFixture(t)
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := fenceRecord(c.Client, r.Lifecycle.Epoch, "admin-stop"); err != nil {
+		t.Fatal(err)
+	}
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, r.Lifecycle.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.Control(context.Background(), "repair"); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readRecord(c.StateDir, c.Owner)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(c.Client, got)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Residual || !got.Enabled || got.Lifecycle.Epoch != r.Lifecycle.Epoch || proof.Repair == nil || f.stopped != 0 || f.started != 0 {
+		t.Fatal("Repair lost lifetime authority or touched a PID")
+	}
+}

package/templates/native-go/backend/internal/helper/s1r_actor_acl_linux_test.go

@@ -0,0 +1,303 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"slices"
+	"strings"
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func TestS1RKernelPermissionMatrix(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	for _, c := range []struct {
+		name, scenario string
+		uid, gid       uint32
+		groups         []uint32
+	}{
+		{"alice-own", "alice/allow", s1rAlice, s1rAliceGID, []uint32{}},
+		{"bob-own", "bob/allow", s1rBob, s1rBobGID, []uint32{}},
+		{"alice-denied-bob", "bob/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"bob-denied-alice", "alice/deny", s1rBob, s1rBobGID, []uint32{}},
+		{"supplementary-only", "supplementary/allow", s1rAlice, s1rAliceGID, []uint32{s1rExtra, s1rShared}},
+		{"supplementary-omitted", "supplementary/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"primary-group-only", "supplementary/allow", s1rAlice, s1rShared, []uint32{}},
+		{"acl-named-user", "acl-allow/allow", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-other-user", "acl-allow/deny", s1rBob, s1rBobGID, []uint32{}},
+		{"acl-directory-mask", "acl-mask/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-file-mask", "acl-file-mask/file-mask", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-named-group", "acl-group/allow", s1rAlice, s1rAliceGID, []uint32{s1rShared}},
+		{"acl-named-group-omitted", "acl-group/deny", s1rAlice, s1rAliceGID, []uint32{}},
+		{"acl-group-mask-read-only", "acl-group-mask/read-only", s1rAlice, s1rAliceGID, []uint32{s1rShared}},
+		{"default-acl-writer", "inherit/allow", s1rAlice, s1rAliceGID, []uint32{}},
+		{"default-acl-reader", "inherit/read-only", s1rBob, s1rBobGID, []uint32{}},
+		{"readonly-directory", "readonly/read-only", s1rAlice, s1rAliceGID, []uint32{}},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			s1rRunActor(t, s1rActorSpec{UID: c.uid, GID: c.gid, Groups: c.groups, Root: s1rFixture(t), Scenario: c.scenario})
+		})
+	}
+}
+
+func s1rAssertCredentials(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	u, e, s := unix.Getresuid()
+	g, eg, sg := unix.Getresgid()
+	if u != int(spec.UID) || e != u || s != u || g != int(spec.GID) || eg != g || sg != g {
+		t.Fatalf("UID/GID triplets: %d/%d/%d %d/%d/%d", u, e, s, g, eg, sg)
+	}
+	groups, err := syscall.Getgroups()
+	s1rMust(t, err)
+	want := make([]int, len(spec.Groups))
+	for i, v := range spec.Groups {
+		want[i] = int(v)
+	}
+	slices.Sort(groups)
+	slices.Sort(want)
+	if !slices.Equal(groups, want) {
+		t.Fatalf("setgroups got %v want %v", groups, want)
+	}
+	header := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	var caps [2]unix.CapUserData
+	s1rMust(t, unix.Capget(&header, &caps[0]))
+	if caps != ([2]unix.CapUserData{}) {
+		t.Fatalf("retained capabilities: %+v", caps)
+	}
+	nnp, err := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	s1rMust(t, err)
+	if nnp != 1 {
+		t.Fatal("no_new_privs", nnp)
+	}
+	keep, err := unix.PrctlRetInt(unix.PR_GET_KEEPCAPS, 0, 0, 0, 0)
+	s1rMust(t, err)
+	if keep != 0 {
+		t.Fatal("keepcaps", keep)
+	}
+	for _, attempt := range []struct {
+		name string
+		run  func() error
+	}{
+		{"setuid-root", func() error { return syscall.Setuid(0) }},
+		{"setresuid-root", func() error { return syscall.Setresuid(0, 0, 0) }},
+		{"setgid-root", func() error { return syscall.Setgid(0) }},
+		{"setresgid-root", func() error { return syscall.Setresgid(0, 0, 0) }},
+		{"setgroups-root", func() error { return syscall.Setgroups([]int{0}) }},
+		{"cap-dac-override", func() error {
+			c := [2]unix.CapUserData{{Effective: 2, Permitted: 2}}
+			return unix.Capset(&header, &c[0])
+		}},
+	} {
+		if err := attempt.run(); err != unix.EPERM {
+			t.Fatalf("privilege regain %s: %v", attempt.name, err)
+		}
+	}
+	u, e, s = unix.Getresuid()
+	g, eg, sg = unix.Getresgid()
+	if u != int(spec.UID) || e != u || s != u || g != int(spec.GID) || eg != g || sg != g {
+		t.Fatal("regain changed credentials")
+	}
+	t.Logf("credentials UID=%d/%d/%d GID=%d/%d/%d groups=%v caps=0 NNP=1; six regain attempts=EPERM", u, e, s, g, eg, sg, groups)
+}
+
+func s1rActorMatrix(t *testing.T, spec s1rActorSpec) {
+	parts := strings.Split(spec.Scenario, "/")
+	if parts[0] == "races" {
+		s1rActorRaces(t, spec, parts[1])
+		return
+	}
+	if parts[0] == "inherited" {
+		s1rCheckInherited(t, spec)
+		return
+	}
+	root := spec.Root + "/" + parts[0]
+	mode := parts[1]
+	for _, op := range []string{"stat", "list", "read", "stream", "create", "write", "publish"} {
+		t.Run(op, func(t *testing.T) {
+			allow := mode == "allow" || (mode == "read-only" && slices.Contains([]string{"stat", "list", "read", "stream"}, op)) || (mode == "file-mask" && slices.Contains([]string{"list", "create", "write", "publish"}, op))
+			pin, code := pinReadOnlyRoot(root)
+			if code != "" {
+				if allow || code != ErrDenied {
+					t.Fatal("root search", code, "allow", allow)
+				}
+				t.Log("kernel denies root search")
+				return
+			}
+			defer pin.Close()
+			ctx := context.Background()
+			var result readOnlyResult
+			var data []byte
+			switch op {
+			case "stat", "list", "read":
+				work := readWork(pin, "file")
+				if op == "stat" {
+					work.Action = ActionStat
+					work.MaxBytes = 0
+				}
+				if op == "list" {
+					work.Action = ActionList
+					work.Segments = []string{}
+					work.MaxBytes = 0
+					work.Limit = 20
+				}
+				result, data = executeReadOnly(ctx, pin, work, fixtureReadOnlyACL{})
+				code = result.Code
+				if allow {
+					if op == "read" && string(data) != "canary:"+parts[0] {
+						t.Fatal("read canary", string(data))
+					}
+					if op == "stat" && result.Entry == nil {
+						t.Fatal("missing stat")
+					}
+					if op == "list" {
+						found := false
+						if result.List != nil {
+							for _, e := range result.List.Entries {
+								if e.Name == "file" {
+									found = true
+								}
+							}
+						}
+						if found != (mode != "file-mask") {
+							t.Fatal("list filtered file", result)
+						}
+					}
+				} else if len(data) > 0 || result.Entry != nil || result.List != nil {
+					t.Fatal("denial leaked bytes/metadata", result)
+				}
+			case "stream":
+				work := readWork(pin, "file")
+				work.Action = ActionReadStream
+				x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+				code = r.Code
+				if x != nil {
+					defer x.Close()
+					for x.remaining > 0 {
+						n := uint32(3)
+						if uint64(n) > x.remaining {
+							n = uint32(x.remaining)
+						}
+						b, c := x.ReadChunk(ctx, n)
+						if c != "" {
+							code = c
+							break
+						}
+						data = append(data, b...)
+					}
+				}
+				if allow && string(data) != "canary:"+parts[0] {
+					t.Fatal("stream canary", string(data))
+				}
+				if !allow && (x != nil || len(data) > 0 || r.Bytes != 0) {
+					t.Fatal("denied stream", r)
+				}
+			default:
+				staged := op == "publish"
+				work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new-" + op}, MaxBytes: 3}
+				if staged {
+					work.Action = ActionWriteStream
+					work.Staged = true
+				}
+				x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+				code = c
+				if x != nil {
+					defer x.Close()
+				}
+				if code == "" {
+					if op == "create" {
+						if !x.Receipt().Created || x.Receipt().BytesWritten != 0 {
+							t.Fatal(x.Receipt())
+						}
+					} else {
+						r, c := x.WriteChunk(ctx, []byte("abc"))
+						code = c
+						if c == "" {
+							r, code = x.Commit(ctx)
+						}
+						if allow && (!r.Committed || !r.Published || r.BytesWritten != 3) {
+							t.Fatal("write receipt", r, code)
+						}
+					}
+				}
+				if !allow {
+					if _, err := os.Stat(root + "/new-" + op); err == nil {
+						t.Fatal("denied write created destination")
+					}
+				}
+			}
+			if allow && code != "" || !allow && code != ErrDenied {
+				t.Fatalf("%s mode=%s expected allow=%v got=%s", op, mode, allow, code)
+			}
+			t.Logf("%s allow=%v code=%q", op, allow, code)
+		})
+	}
+}
+
+func s1rCheckInherited(t *testing.T, spec s1rActorSpec) {
+	root := spec.Root + "/inherit"
+	pin, code := pinReadOnlyRoot(root)
+	if code != "" {
+		t.Fatal(code)
+	}
+	defer pin.Close()
+	for _, name := range []string{"new-create", "new-write", "new-publish"} {
+		result, data := executeReadOnly(context.Background(), pin, readWork(pin, name), fixtureReadOnlyACL{})
+		want := "abc"
+		if name == "new-create" {
+			want = ""
+		}
+		if result.Code != "" || string(data) != want {
+			t.Fatal("inherited read", name, result, string(data))
+		}
+	}
+	if _, code := openActorWriteTransfer(context.Background(), pin, writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"bob-must-not-create"}, MaxBytes: 1}, fixtureReadOnlyACL{}); code != ErrDenied {
+		t.Fatal("inherited directory write", code)
+	}
+	t.Log("Bob reads Alice's created/written/published files via inherited ACL; cannot create")
+}
+
+func TestS1RDefaultACLInheritance(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	root := s1rFixture(t)
+	s1rRunActor(t, s1rActorSpec{UID: s1rAlice, GID: s1rAliceGID, Groups: []uint32{}, Root: root, Scenario: "inherit/allow"})
+	for _, name := range []string{"new-create", "new-write", "new-publish"} {
+		b, err := exec.Command("/usr/bin/getfacl", "-cpn", root+"/inherit/"+name).CombinedOutput()
+		s1rMust(t, err)
+		if !strings.Contains(string(b), "user:23002:r-x") || !strings.Contains(string(b), "mask::rw-") {
+			t.Fatalf("missing inherited ACL: %s\n%s", name, b)
+		}
+		t.Logf("%s inherited ACL:\n%s", name, b)
+	}
+	s1rRunActor(t, s1rActorSpec{UID: s1rBob, GID: s1rBobGID, Groups: []uint32{}, Root: root, Scenario: "inherited/check"})
+}
+
+func TestS1RSymlinkAndRenameRaces(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	for _, kind := range []string{"symlink", "stat-rename", "list-rename", "read-rename", "stream-rename", "create-rename", "publish-rename", "publish-symlink", "publish-permission-loss", "open-fd-write-permission-loss"} {
+		t.Run(kind, func(t *testing.T) {
+			s1rRunActor(t, s1rActorSpec{UID: s1rAlice, GID: s1rAliceGID, Groups: []uint32{}, Root: s1rFixture(t), Scenario: "races/" + kind})
+		})
+	}
+}
+
+func TestS1RActorProcess(t *testing.T) {
+	raw := os.Getenv("S1R_ACTOR_SPEC")
+	if raw == "" {
+		t.Skip("isolated actor subprocess only")
+	}
+	var spec s1rActorSpec
+	s1rMust(t, json.Unmarshal([]byte(raw), &spec))
+	s1rDropActor(t, spec)
+	s1rAssertCredentials(t, spec)
+	s1rActorMatrix(t, spec)
+}