@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/data_protocol_test.go

@@ -0,0 +1,449 @@
+package helper
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func dataFixture(t testing.TB, name string) []byte {
+	t.Helper()
+	b, err := os.ReadFile("testdata/protocol2/" + name + ".json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestDataRequestFixtures(t *testing.T) {
+	for _, name := range []string{"list", "stat", "read", "create", "write-stream", "publish"} {
+		t.Run(name, func(t *testing.T) {
+			r, code := DecodeDataRequest(bytes.NewReader(dataFixture(t, name)))
+			want := Code("")
+			if name == "create" || name == "write-stream" || name == "publish" {
+				want = ErrUnsupported
+			}
+			if code != want {
+				t.Fatalf("got %q want %q", code, want)
+			}
+			if want == "" && (r.Inventory.Protocol != 2 || r.Op != Action("nas.files."+name)) {
+				t.Fatal("wrong decoded request")
+			}
+		})
+	}
+}
+
+func TestPortableControlFrames(t *testing.T) {
+	var cases []struct {
+		Name  string `json:"name"`
+		Frame string `json:"frame"`
+		Code  Code   `json:"code"`
+	}
+	if err := json.Unmarshal(dataFixture(t, "frames"), &cases); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			_, code := DecodeDataRequest(strings.NewReader(tc.Frame))
+			if code != tc.Code {
+				t.Fatalf("got %q want %q", code, tc.Code)
+			}
+		})
+	}
+}
+
+func TestTicketBindsArgumentsAndCurrentEpoch(t *testing.T) {
+	r, b, now := validRequestAndTicket(t)
+	w, _ := NewReplayWindow(r.Inventory, r.Epoch, b.SubjectRef, b.SessionRef)
+	changed := r
+	changed.Args = bytes.Replace(r.Args, []byte("note.txt"), []byte("other.txt"), 1)
+	if c := w.Consume(changed, b, now); c != ErrDenied {
+		t.Fatal("ticket substituted args", c)
+	}
+	changed = r
+	changed.Epoch = strings.Repeat("0", 64)
+	if c := w.Consume(changed, b, now); c != ErrStale {
+		t.Fatal("old/new epoch accepted", c)
+	}
+	changed = r
+	changed.Inventory.RegistryDigest = strings.Repeat("0", 64)
+	if c := w.Consume(changed, b, now); c != ErrIncompatible {
+		t.Fatal("inventory changed", c)
+	}
+	if c := w.Consume(r, b, now); c != "" {
+		t.Fatal("invalid request burned valid ticket", c)
+	}
+}
+
+func TestRequiredFieldsAndStagedWrites(t *testing.T) {
+	b := dataFixture(t, "create")
+	var fields map[string]json.RawMessage
+	if err := json.Unmarshal(b, &fields); err != nil {
+		t.Fatal(err)
+	}
+	var args map[string]json.RawMessage
+	if err := json.Unmarshal(fields["args"], &args); err != nil {
+		t.Fatal(err)
+	}
+	delete(args, "bytes")
+	fields["args"], _ = json.Marshal(args)
+	raw, _ := json.Marshal(fields)
+	if _, c := DecodeDataRequest(bytes.NewReader(raw)); c != ErrInvalid {
+		t.Fatal("missing zero-valued required field accepted", c)
+	}
+	for _, pair := range []struct{ from, to string }{
+		{`"exclusive": true`, `"exclusive": false`},
+		{`"bytes":`, `"data":"base64","bytes":`},
+	} {
+		if _, c := DecodeDataRequest(bytes.NewReader(bytes.Replace(b, []byte(pair.from), []byte(pair.to), 1))); c != ErrInvalid {
+			t.Fatal(pair, c)
+		}
+	}
+}
+
+func TestGrantStoreLimitsAndTombstones(t *testing.T) {
+	s, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+	if c != "" {
+		t.Fatal(c)
+	}
+	encode := func(s GrantStore) Code {
+		b, err := json.Marshal(s)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, c := DecodeGrantStore(bytes.NewReader(b))
+		return c
+	}
+	g := s.Grants[0]
+	g.State = GrantSuspended
+	g.Reason = ErrSuspended
+	s.Grants[0] = g
+	if c := encode(s); c != "" {
+		t.Fatal("suspension record", c)
+	}
+	g.State = GrantRevoked
+	g.Reason = ErrRevoked
+	g.RevokedAt = g.CreatedAt
+	s.Grants[0] = g
+	if c := encode(s); c != "" {
+		t.Fatal("tombstone record", c)
+	}
+	s.Grants = append(s.Grants, g)
+	if c := encode(s); c != ErrInvalid {
+		t.Fatal("duplicate ID accepted", c)
+	}
+	s.Grants = make([]Grant, MaxGrants)
+	for n := range s.Grants {
+		g.ID = strings.Repeat("0", 60) + hex4(n)
+		s.Grants[n] = g
+	}
+	if c := encode(s); c != "" {
+		t.Fatal("capacity boundary", c)
+	}
+	s.Grants = append(s.Grants, g)
+	if c := encode(s); c != ErrLimit {
+		t.Fatal("capacity including tombstones", c)
+	}
+	s.Grants = []Grant{g}
+	s.Grants[0].Issuer.SubjectRef = strings.Repeat("0", 64)
+	if c := encode(s); c != ErrDenied {
+		t.Fatal("admin cannot issue personal grant for another owner", c)
+	}
+}
+
+func TestStrictUnicodeAndDepth(t *testing.T) {
+	b := string(dataFixture(t, "read"))
+	for _, name := range []string{`\ud83d\ude00`, `\uFFFD`, `a\"b`, `a\\b`} {
+		_, c := DecodeDataRequest(strings.NewReader(strings.Replace(b, "note.txt", name, 1)))
+		// A literal backslash in a segment is outside this contract's subset.
+		want := Code("")
+		if name == `a\\b` {
+			want = ErrInvalid
+		}
+		if c != want {
+			t.Fatalf("%s: %q", name, c)
+		}
+	}
+	deep := strings.Repeat(`{"x":`, 65) + `0` + strings.Repeat(`}`, 65)
+	var value DataRequest
+	if c := decodeDataObject(strings.NewReader(strings.Replace(b, `"args": {`, `"args": `+deep+`,"removed": {`, 1)), &value, MaxControlBytes); c != ErrInvalid {
+		t.Fatal("depth accepted", c)
+	}
+}
+
+func TestDataStrictFrames(t *testing.T) {
+	b := string(dataFixture(t, "read"))
+	cases := []struct {
+		name, data string
+		code       Code
+	}{
+		{"unknown root", strings.Replace(b, `"args":`, `"uid":0,"args":`, 1), ErrInvalid},
+		{"unknown inventory", strings.Replace(b, `"package":`, `"admin":true,"package":`, 1), ErrInvalid},
+		{"unknown args", strings.Replace(b, `"maxBytes":`, `"offset":0,"maxBytes":`, 1), ErrInvalid},
+		{"case alias", strings.Replace(b, `"nonce":`, `"Nonce":`, 1), ErrInvalid},
+		{"duplicate root", strings.Replace(b, `"nonce":`, `"nonce":"x","nonce":`, 1), ErrInvalid},
+		{"duplicate nested", strings.Replace(b, `"segments":`, `"segments":[],"segments":`, 1), ErrInvalid},
+		{"trailing object", b + `{}`, ErrInvalid},
+		{"trailing junk", b + `x`, ErrInvalid},
+		{"oversized whitespace", b + strings.Repeat(" ", MaxControlBytes), ErrLimit},
+		{"missing ticket", strings.Replace(b, `"ticket":`, `"missingTicket":`, 1), ErrInvalid},
+		{"null args", strings.Replace(b, `"args": {`, `"args": null,"removed": {`, 1), ErrInvalid},
+		{"null segments", strings.Replace(b, "[\n      \"note.txt\"\n    ]", "null", 1), ErrInvalid},
+		{"wrong scalar", strings.Replace(b, `"grantRevision": 1`, `"grantRevision": "1"`, 1), ErrInvalid},
+		{"zero revision", strings.Replace(b, `"grantRevision": 1`, `"grantRevision": 0`, 1), ErrInvalid},
+		{"unknown op", strings.Replace(b, `nas.files.read`, `shell`, 1), ErrUnsupported},
+		{"protocol downgrade", strings.Replace(b, `"protocol": 2`, `"protocol": 1`, 1), ErrIncompatible},
+		{"future protocol", strings.Replace(b, `"protocol": 2`, `"protocol": 3`, 1), ErrIncompatible},
+		{"absolute path", strings.Replace(b, `note.txt`, `/etc/shadow`, 1), ErrInvalid},
+		{"parent traversal", strings.Replace(b, `note.txt`, `..`, 1), ErrInvalid},
+		{"surrogate", strings.Replace(b, `note.txt`, `\ud800`, 1), ErrInvalid},
+		{"invalid UTF8", strings.Replace(b, `note.txt`, string([]byte{0xff}), 1), ErrInvalid},
+		{"null envelope", `null`, ErrInvalid},
+		{"limit overflow", strings.Replace(b, `1048576`, `18446744073709551616`, 1), ErrInvalid},
+		{"over read limit", strings.Replace(b, `1048576`, `1048577`, 1), ErrLimit},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, got := DecodeDataRequest(strings.NewReader(tc.data))
+			if got != tc.code {
+				t.Fatalf("got %q want %q", got, tc.code)
+			}
+		})
+	}
+}
+
+func TestRelativeSegmentsContract(t *testing.T) {
+	for _, s := range [][]string{{".."}, {"."}, {""}, {"a/b"}, {"/x"}, {"x\x00y"}, {"a\\b"}, {strings.Repeat("a", 256)}, nil} {
+		if ValidateRelativeSegments(s, true) == "" {
+			t.Fatalf("accepted %q", s)
+		}
+	}
+	if ValidateRelativeSegments([]string{}, true) != "" || ValidateRelativeSegments([]string{}, false) != ErrInvalid {
+		t.Fatal("root rules")
+	}
+	if ValidateRelativeSegments([]string{"\u8cc7\u6599\u593e", "%2e%2e", "a%2fb", "é", "e\u0301"}, false) != "" {
+		t.Fatal("literal UTF8/percent must not be normalized or URL-decoded again")
+	}
+	if ValidateRelativeSegments(make([]string, MaxPathSegments+1), true) != ErrLimit {
+		t.Fatal("depth ceiling")
+	}
+	segments := make([]string, 17)
+	for i := range segments {
+		segments[i] = strings.Repeat("a", 255)
+	}
+	if ValidateRelativeSegments(segments, true) != ErrLimit {
+		t.Fatal("byte ceiling")
+	}
+}
+
+func TestProtocolNegotiationPinnedToApproval(t *testing.T) {
+	i := fixture(t).Expected
+	for _, tc := range []struct {
+		offered        []int
+		approved, want int
+		files          bool
+		code           Code
+	}{
+		{[]int{1, 2}, 1, 1, false, ""}, {[]int{1, 2}, 2, 2, true, ""},
+		{[]int{1}, 2, 0, false, ErrIncompatible}, {[]int{2}, 1, 0, false, ErrIncompatible},
+		{[]int{1, 2}, 1, 0, true, ErrIncompatible}, {[]int{1, 2, 3}, 2, 0, true, ErrInvalid},
+		{[]int{3}, 2, 0, true, ErrIncompatible},
+		{[]int{2, 2}, 2, 0, true, ErrInvalid}, {nil, 2, 0, true, ErrInvalid},
+	} {
+		i.Protocol = tc.approved
+		got, code := NegotiateProtocol(tc.offered, i, tc.files)
+		if got != tc.want || code != tc.code {
+			t.Fatalf("%+v: %d %q", tc, got, code)
+		}
+	}
+	i.Protocol = 1
+	if Respond(i, false, Request{i, "nas.files.read", strings.Repeat("a", 64)}).Error != "unsupported" {
+		t.Fatal("legacy must never serve files")
+	}
+}
+
+func validRequestAndTicket(t *testing.T) (DataRequest, TicketBinding, time.Time) {
+	t.Helper()
+	r, code := DecodeDataRequest(bytes.NewReader(dataFixture(t, "read")))
+	if code != "" {
+		t.Fatal(code)
+	}
+	now := time.Unix(1791000000, 0)
+	b := TicketBinding{Inventory: r.Inventory, Epoch: r.Epoch, SubjectRef: strings.Repeat("3", 64), SessionRef: strings.Repeat("4", 64), Action: r.Op, GrantID: r.GrantID, GrantRevision: r.GrantRevision, OperationID: r.OperationID, Nonce: r.Nonce, Ticket: r.Ticket, RequestDigest: r.Digest(), ExpiresAt: now.Add(time.Second)}
+	return r, b, now
+}
+
+func TestRequestReplayAndBinding(t *testing.T) {
+	r, b, now := validRequestAndTicket(t)
+	newWindow := func() *ReplayWindow {
+		w, c := NewReplayWindow(r.Inventory, r.Epoch, b.SubjectRef, b.SessionRef)
+		if c != "" {
+			t.Fatal(c)
+		}
+		return w
+	}
+	for _, change := range []string{"inventory", "epoch", "subject", "session", "action", "grant", "revision", "operation", "nonce", "ticket", "expiry"} {
+		t.Run(change, func(t *testing.T) {
+			bad := b
+			switch change {
+			case "inventory":
+				bad.Inventory.PayloadDigest = strings.Repeat("0", 64)
+			case "epoch":
+				bad.Epoch = strings.Repeat("0", 64)
+			case "subject":
+				bad.SubjectRef = strings.Repeat("0", 64)
+			case "session":
+				bad.SessionRef = strings.Repeat("0", 64)
+			case "action":
+				bad.Action = ActionStat
+			case "grant":
+				bad.GrantID = strings.Repeat("0", 64)
+			case "revision":
+				bad.GrantRevision++
+			case "operation":
+				bad.OperationID = strings.Repeat("0", 64)
+			case "nonce":
+				bad.Nonce = strings.Repeat("0", 64)
+			case "ticket":
+				bad.Ticket = strings.Repeat("0", 64)
+			case "expiry":
+				bad.ExpiresAt = now
+			}
+			w := newWindow()
+			if w.Consume(r, bad, now) == "" {
+				t.Fatal("binding accepted")
+			}
+			if c := w.Consume(r, b, now); c != "" {
+				t.Fatalf("failed binding consumed valid request: %q", c)
+			}
+		})
+	}
+	w := newWindow()
+	if c := w.Consume(r, b, now); c != "" {
+		t.Fatal(c)
+	}
+	if c := w.Consume(r, b, now); c != ErrReplay {
+		t.Fatal(c)
+	}
+	for _, duplicate := range []string{"nonce", "operation", "ticket"} {
+		r2, b2 := r, b
+		r2.Nonce = strings.Repeat("5", 64)
+		r2.OperationID = strings.Repeat("6", 64)
+		r2.Ticket = strings.Repeat("7", 64)
+		switch duplicate {
+		case "nonce":
+			r2.Nonce = r.Nonce
+		case "operation":
+			r2.OperationID = r.OperationID
+		case "ticket":
+			r2.Ticket = r.Ticket
+		}
+		b2.Nonce = r2.Nonce
+		b2.OperationID = r2.OperationID
+		b2.Ticket = r2.Ticket
+		b2.RequestDigest = r2.Digest()
+		if c := w.Consume(r2, b2, now); c != ErrReplay {
+			t.Fatalf("%s replay: %q", duplicate, c)
+		}
+	}
+}
+
+func TestReplayConcurrentAndFull(t *testing.T) {
+	r, b, now := validRequestAndTicket(t)
+	w, _ := NewReplayWindow(r.Inventory, r.Epoch, b.SubjectRef, b.SessionRef)
+	var accepted atomic.Int32
+	var wg sync.WaitGroup
+	for n := 0; n < 20; n++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if w.Consume(r, b, now) == "" {
+				accepted.Add(1)
+			}
+		}()
+	}
+	wg.Wait()
+	if accepted.Load() != 1 {
+		t.Fatal("single-use must be atomic")
+	}
+	for n := 1; n < MaxReplayEntries; n++ {
+		x := strings.Repeat("0", 60) + hex4(n)
+		r.Nonce = x
+		r.OperationID = x
+		r.Ticket = x
+		b.Nonce = x
+		b.OperationID = x
+		b.Ticket = x
+		b.RequestDigest = r.Digest()
+		if c := w.Consume(r, b, now); c != "" {
+			t.Fatal(c)
+		}
+	}
+	r.Nonce = strings.Repeat("9", 64)
+	r.OperationID = r.Nonce
+	r.Ticket = r.Nonce
+	b.Nonce = r.Nonce
+	b.OperationID = r.Nonce
+	b.Ticket = r.Nonce
+	b.RequestDigest = r.Digest()
+	if c := w.Consume(r, b, now); c != ErrBusy {
+		t.Fatal("full must not evict", c)
+	}
+}
+
+func hex4(n int) string {
+	const chars = "0123456789abcdef"
+	return string([]byte{chars[(n>>12)&15], chars[(n>>8)&15], chars[(n>>4)&15], chars[n&15]})
+}
+
+func TestGrantAndIntentStrictRecords(t *testing.T) {
+	g := dataFixture(t, "grant-store")
+	if s, c := DecodeGrantStore(bytes.NewReader(g)); c != "" || len(s.Grants) != 1 {
+		t.Fatal(c)
+	}
+	i := dataFixture(t, "intent")
+	if _, c := DecodeIntent(bytes.NewReader(i)); c != "" {
+		t.Fatal(c)
+	}
+	for _, change := range []struct{ from, to string }{
+		{`"grantSchema": 1`, `"grantSchema": 2`}, {`"kind": "local"`, `"kind": "ldap"`},
+		{`"targetKind": "directory"`, `"targetKind": "file"`}, {`"state": "active"`, `"state": "unknown"`},
+		{`"mountRef":`, `"path":"/secret","mountRef":`}, {`nas.files.read`, `shell`},
+		{`"segments":`, `"Segments":`}, {`"grantRevision": 1`, `"grantRevision": 0`},
+	} {
+		if _, c := DecodeGrantStore(bytes.NewReader(bytes.Replace(g, []byte(change.from), []byte(change.to), 1))); c == "" {
+			t.Fatalf("accepted %+v", change)
+		}
+	}
+	if _, c := DecodeIntent(bytes.NewReader(bytes.Replace(i, []byte(`"summaryDigest":`), []byte(`"admin":true,"summaryDigest":`), 1))); c != ErrInvalid {
+		t.Fatal(c)
+	}
+	if _, c := DecodeGrantStore(strings.NewReader(string(g) + strings.Repeat(" ", MaxGrantStoreBytes))); c != ErrLimit {
+		t.Fatal(c)
+	}
+}
+
+func TestSafeErrorCannotLeakUnknownCode(t *testing.T) {
+	b, err := json.Marshal(SafeError{Code: Code("/secret/path credential=oops"), OperationID: "/secret"})
+	if err != nil || strings.Contains(string(b), "secret") || !strings.Contains(string(b), "internal") {
+		t.Fatalf("%s %v", b, err)
+	}
+}
+
+func FuzzDataDecoder(f *testing.F) {
+	for _, name := range []string{"list", "stat", "read", "create"} {
+		f.Add(dataFixture(f, name))
+	}
+	f.Add([]byte(`{"args":{"x":{"x":{"x":null}}}}`))
+	f.Fuzz(func(t *testing.T, b []byte) {
+		_, c := DecodeDataRequest(bytes.NewReader(b))
+		if c != "" && !c.Valid() {
+			t.Fatalf("unsafe code %q", c)
+		}
+	})
+}

package/templates/native-go/backend/internal/helper/dsm_acl_linux.go

@@ -0,0 +1,139 @@
+package helper
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"os"
+	"runtime"
+	"slices"
+	"strconv"
+	"time"
+)
+
+// EA masks from DSM7-4 libsynoacl and syno_acl_xattr_ds.h. A bridge must prove
+// target support and action semantics; unsupported never falls back to POSIX.
+const (
+	nativeACLExec     uint32 = 0x0001
+	nativeACLRead     uint32 = 0x0004
+	nativeACLReadAttr uint32 = 0x0100
+)
+
+type nativeFDACLObservation struct {
+	FilesystemSupported, ObjectSupported, MasksVerified, Allowed bool
+	CheckedAt                                                    time.Time
+}
+
+// Check runs IN the permanently dropped operation process, not a CLI subprocess.
+// fd/alias are generated by this adapter, never received from caller controls.
+type fixedFDACLBridge interface {
+	Check(context.Context, int, string, uint32) (nativeFDACLObservation, Code)
+}
+type fixedFDNativeACL struct {
+	actor       NativeActor
+	native      fixedFDACLBridge
+	boundary    readOnlyACL
+	now         func() time.Time
+	credentials func(NativeActor) Code
+}
+
+func newFixedFDNativeACL(a NativeActor, n fixedFDACLBridge, b readOnlyACL) *fixedFDNativeACL {
+	return &fixedFDNativeACL{actor: a, native: n, boundary: b, now: time.Now, credentials: fixedFDActorCredentials}
+}
+func fixedFDActorCredentials(a NativeActor) Code {
+	if !a.valid || a.UID() == 0 {
+		return ErrDenied
+	}
+	ru, eu, su := unix.Getresuid()
+	rg, eg, sg := unix.Getresgid()
+	groups, err := os.Getgroups()
+	want := []int{}
+	for _, g := range a.Groups() {
+		want = append(want, int(g))
+	}
+	slices.Sort(groups)
+	slices.Sort(want)
+	if err != nil || ru != int(a.UID()) || eu != ru || su != ru || rg != int(a.GID()) || eg != rg || sg != rg || !slices.Equal(groups, want) {
+		return ErrDenied
+	}
+	var caps [2]unix.CapUserData
+	h := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
+	if unix.Capget(&h, &caps[0]) != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
+		return ErrDenied
+	}
+	dump, e := unix.PrctlRetInt(unix.PR_GET_DUMPABLE, 0, 0, 0, 0)
+	if e != nil || dump != 0 {
+		return ErrDenied
+	}
+	priv, e := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	if e != nil || priv != 1 {
+		return ErrDenied
+	}
+	return ""
+}
+func (a *fixedFDNativeACL) Authorize(ctx context.Context, action Action, fd int) Code {
+	if a == nil || a.native == nil || a.boundary == nil || a.now == nil || a.credentials == nil {
+		return ErrUnsupported
+	}
+	if !action.ReadOnly() {
+		return ErrUnsupported
+	}
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	if !a.actor.valid || !nativeFresh(a.actor.account.CheckedAt, a.now()) {
+		return ErrStale
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	if c := nativeContextCode(ctx); c != "" {
+		return c
+	}
+	if c := a.credentials(a.actor); c != "" {
+		return safeGrantCode(c)
+	}
+	duplicate, err := unix.FcntlInt(uintptr(fd), unix.F_DUPFD_CLOEXEC, 3)
+	if err != nil {
+		return ErrUnavailable
+	}
+	defer unix.Close(duplicate)
+	var st unix.Stat_t
+	if c := readOnlyInspect(duplicate, &st); c != "" {
+		return c
+	}
+	if c := nativeObservationCode(ctx, a.boundary.Authorize(ctx, action, duplicate)); c != "" {
+		return c
+	}
+	mask := nativeACLRead | nativeACLReadAttr
+	if st.Mode&unix.S_IFMT == unix.S_IFDIR {
+		mask |= nativeACLExec
+	}
+	o, c := a.native.Check(ctx, duplicate, "/proc/self/fd/"+strconv.Itoa(duplicate), mask)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return c
+	}
+	if !o.FilesystemSupported || !o.ObjectSupported || !o.MasksVerified {
+		return ErrUnsupported
+	}
+	if !o.Allowed {
+		return ErrDenied
+	}
+	if !nativeFresh(o.CheckedAt, a.now()) {
+		return ErrStale
+	}
+	if c = a.credentials(a.actor); c != "" {
+		return safeGrantCode(c)
+	}
+	var after unix.Stat_t
+	if c = readOnlyInspect(duplicate, &after); c != "" {
+		return c
+	}
+	if !sameReadOnlyObject(st, after) {
+		return ErrStale
+	}
+	if c = nativeObservationCode(ctx, a.boundary.Authorize(ctx, action, duplicate)); c != "" {
+		return c
+	}
+	if !nativeFresh(o.CheckedAt, a.now()) || !nativeFresh(a.actor.account.CheckedAt, a.now()) {
+		return ErrStale
+	}
+	return ""
+}

package/templates/native-go/backend/internal/helper/dsm_acl_linux_test.go

@@ -0,0 +1,121 @@
+package helper
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+)
+
+type aclNativeFake struct {
+	value    nativeFDACLObservation
+	code     Code
+	calls    int
+	alias    string
+	mask     uint32
+	expected uint64
+	rename   func()
+}
+
+func (f *aclNativeFake) Check(ctx context.Context, fd int, alias string, mask uint32) (nativeFDACLObservation, Code) {
+	f.calls++
+	f.alias = alias
+	f.mask = mask
+	var st unix.Stat_t
+	if unix.Fstat(fd, &st) != nil || st.Ino != f.expected {
+		return nativeFDACLObservation{}, ErrDenied
+	}
+	if alias != "/proc/self/fd/"+strconv.Itoa(fd) {
+		return nativeFDACLObservation{}, ErrDenied
+	}
+	if f.rename != nil {
+		f.rename()
+	}
+	return f.value, f.code
+}
+func TestDSMFixedFDACLUsesPinnedObjectAndNativeSupport(t *testing.T) {
+	p, _, _, c, now := nativeFixture()
+	actor, _ := p.Resolve(context.Background(), c)
+	root := t.TempDir()
+	os.WriteFile(root+"/file", []byte("private"), 0600)
+	file, err := os.Open(root + "/file")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	var st unix.Stat_t
+	unix.Fstat(int(file.Fd()), &st)
+	f := &aclNativeFake{expected: st.Ino, value: nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: true, CheckedAt: now}}
+	a := newFixedFDNativeACL(actor, f, fixtureReadOnlyACL{})
+	a.now = func() time.Time { return now }
+	a.credentials = func(NativeActor) Code { return "" }
+	f.rename = func() {
+		f.rename = nil
+		os.Rename(root+"/file", root+"/old")
+		os.WriteFile(root+"/file", []byte("replacement"), 0600)
+	}
+	if code := a.Authorize(context.Background(), ActionRead, int(file.Fd())); code != "" || f.calls != 1 || f.mask != nativeACLRead|nativeACLReadAttr {
+		t.Fatal(code, f.mask)
+	}
+	for _, change := range []func(*nativeFDACLObservation){func(o *nativeFDACLObservation) { o.FilesystemSupported = false }, func(o *nativeFDACLObservation) { o.ObjectSupported = false }, func(o *nativeFDACLObservation) { o.MasksVerified = false }, func(o *nativeFDACLObservation) { o.Allowed = false }, func(o *nativeFDACLObservation) { o.CheckedAt = time.Time{} }} {
+		f.value = nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: true, CheckedAt: now}
+		change(&f.value)
+		if code := a.Authorize(context.Background(), ActionRead, int(file.Fd())); code == "" {
+			t.Fatal("unproved native Allow")
+		}
+	}
+	a.credentials = func(NativeActor) Code { return ErrDenied }
+	before := f.calls
+	if code := a.Authorize(context.Background(), ActionRead, int(file.Fd())); code != ErrDenied || f.calls != before {
+		t.Fatal("root/stale credential reached ACL", code)
+	}
+}
+func TestDSMFixedFDACLNoNativeOrBoundaryFallback(t *testing.T) {
+	p, _, _, c, _ := nativeFixture()
+	actor, _ := p.Resolve(context.Background(), c)
+	for _, a := range []*fixedFDNativeACL{newFixedFDNativeACL(actor, nil, fixtureReadOnlyACL{}), newFixedFDNativeACL(actor, &aclNativeFake{}, nil)} {
+		if code := a.Authorize(context.Background(), ActionStat, 0); code == "" {
+			t.Fatal("missing gate allowed")
+		}
+	}
+}
+
+// A successful final boundary check must not publish expired native/actor proof.
+type agingACLBoundary struct {
+	calls   int
+	advance func()
+}
+
+func (b *agingACLBoundary) Authorize(context.Context, Action, int) Code {
+	b.calls++
+	if b.calls == 2 {
+		b.advance()
+	}
+	return ""
+}
+func TestDSMFixedFDACLFinalBoundaryCannotPublishExpiredProof(t *testing.T) {
+	p, _, _, carriers, now := nativeFixture()
+	actor, code := p.Resolve(context.Background(), carriers)
+	if code != "" {
+		t.Fatal(code)
+	}
+	file, err := os.CreateTemp(t.TempDir(), "pinned")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	var st unix.Stat_t
+	if err := unix.Fstat(int(file.Fd()), &st); err != nil {
+		t.Fatal(err)
+	}
+	native := &aclNativeFake{expected: st.Ino, value: nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: true, CheckedAt: now}}
+	boundary := &agingACLBoundary{advance: func() { now = now.Add(NativeProofFreshness + time.Nanosecond) }}
+	acl := newFixedFDNativeACL(actor, native, boundary)
+	acl.now = func() time.Time { return now }
+	acl.credentials = func(NativeActor) Code { return "" }
+	if code := acl.Authorize(context.Background(), ActionStat, int(file.Fd())); code != ErrStale {
+		t.Fatalf("expired proof published: %s", code)
+	}
+}