@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/readonly_linux_test.go

@@ -0,0 +1,378 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"golang.org/x/sys/unix"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+	"unsafe"
+)
+
+// Linux syscall-only fixture adapter. NEVER installed in shipped helper builds;
+// DSM share gates and SynoACL masks require their own separately authorized proof.
+type fixtureReadOnlyACL struct {
+	deny bool
+	hook func()
+}
+
+func (a fixtureReadOnlyACL) Authorize(ctx context.Context, action Action, fd int) Code {
+	if ctx.Err() != nil {
+		return nativeContextCode(ctx)
+	}
+	if a.hook != nil {
+		a.hook()
+	}
+	if a.deny {
+		return ErrDenied
+	}
+	return ""
+}
+func readOnlyFixture(t *testing.T) (*pinnedReadOnlyRoot, string) {
+	t.Helper()
+	root := t.TempDir()
+	os.WriteFile(root+"/file", []byte("canary"), 0644)
+	os.Mkdir(root+"/sub", 0755)
+	os.WriteFile(root+"/sub/inside", []byte("inside"), 0644)
+	pin, code := pinReadOnlyRoot(root)
+	if code != "" {
+		t.Fatal(code)
+	}
+	t.Cleanup(func() { pin.Close() })
+	return pin, root
+}
+func readWork(pin *pinnedReadOnlyRoot, segments ...string) readOnlyWork {
+	return readOnlyWork{RootPath: pin.path, Action: ActionRead, Segments: segments, MaxBytes: MaxBoundedBytes}
+}
+func TestReadOnlyFixedOperationsAndSafeErrors(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "file"), fixtureReadOnlyACL{})
+	if result.Code != "" || string(data) != "canary" || result.Bytes != 6 {
+		t.Fatal(result, string(data))
+	}
+	result, data = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionStat, Segments: []string{"file"}}, fixtureReadOnlyACL{})
+	if result.Code != "" || result.Entry == nil || result.Entry.Kind != "regular" || result.Entry.Bytes != 6 || len(data) != 0 {
+		t.Fatal(result)
+	}
+	result, _ = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 10}, fixtureReadOnlyACL{})
+	if result.Code != "" || result.List == nil || len(result.List.Entries) != 2 {
+		t.Fatal(result)
+	}
+	for _, acl := range []readOnlyACL{nil, fixtureReadOnlyACL{deny: true}} {
+		result, data = executeReadOnly(context.Background(), pin, readWork(pin, "file"), acl)
+		if result.Code == "" || len(data) != 0 || result.Entry != nil || result.List != nil {
+			t.Fatal("ACL refusal leaked", result)
+		}
+	}
+	result, data = executeReadOnly(context.Background(), pin, readWork(pin, "missing-secret"), fixtureReadOnlyACL{})
+	b, _ := json.Marshal(result)
+	if result.Code == "" || len(data) != 0 || bytes.Contains(b, []byte("missing-secret")) || bytes.Contains(b, []byte(root)) {
+		t.Fatal(result)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	result, _ = executeReadOnly(ctx, pin, readWork(pin, "file"), fixtureReadOnlyACL{})
+	if result.Code != ErrCanceled {
+		t.Fatal(result)
+	}
+}
+func TestReadOnlyTraversalSymlinksSpecialFilesAndHardlinks(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	os.Symlink("file", root+"/link")
+	os.Symlink("sub", root+"/dirlink")
+	os.Symlink("/etc/passwd", root+"/outside")
+	os.Link(root+"/file", root+"/alias")
+	unix.Mkfifo(root+"/fifo", 0600)
+	for _, segments := range [][]string{{"..", "file"}, {"/etc/passwd"}, {"link"}, {"dirlink", "inside"}, {"outside"}, {"file"}, {"alias"}, {"fifo"}, {"a\x00b"}} {
+		start := time.Now()
+		r, data := executeReadOnly(context.Background(), pin, readWork(pin, segments...), fixtureReadOnlyACL{})
+		if r.Code == "" || len(data) != 0 || time.Since(start) > time.Second {
+			t.Fatal(segments, r, "blocked or leaked")
+		}
+	}
+	// stat/list must not expose entries whose type or current actor ACL is refused.
+	r, _ := executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 10}, fixtureReadOnlyACL{})
+	if r.Code != "" || len(r.List.Entries) != 1 || r.List.Entries[0].Name != "sub" {
+		t.Fatal(r)
+	}
+}
+func TestReadOnlyObjectReplacementAndIntermediateRename(t *testing.T) {
+	for _, kind := range []string{"root", "middle", "file", "link-after-open"} {
+		t.Run(kind, func(t *testing.T) {
+			pin, root := readOnlyFixture(t)
+			work := readWork(pin, "sub", "inside")
+			mutated := false
+			acl := fixtureReadOnlyACL{hook: func() {
+				if mutated {
+					return
+				}
+				mutated = true
+				switch kind {
+				case "root":
+					os.Rename(root, root+"-old")
+					os.Mkdir(root, 0755)
+					t.Cleanup(func() { os.RemoveAll(root + "-old") })
+				case "middle":
+					os.Rename(root+"/sub", root+"/moved")
+					os.Mkdir(root+"/sub", 0755)
+					os.WriteFile(root+"/sub/inside", []byte("foreign"), 0644)
+				case "file":
+					os.Rename(root+"/sub/inside", root+"/sub/old")
+					os.WriteFile(root+"/sub/inside", []byte("foreign"), 0644)
+				case "link-after-open":
+					os.Link(root+"/sub/inside", root+"/alias")
+				}
+			}}
+			r, data := executeReadOnly(context.Background(), pin, work, acl)
+			if r.Code == "" || len(data) != 0 {
+				t.Fatal("mutation survived final check", r, string(data))
+			}
+		})
+	}
+}
+func TestReadOnlyBoundedReadAndList(t *testing.T) {
+	pin, root := readOnlyFixture(t)
+	os.WriteFile(root+"/large", bytes.Repeat([]byte{'x'}, MaxBoundedBytes+1), 0644)
+	r, b := executeReadOnly(context.Background(), pin, readWork(pin, "large"), fixtureReadOnlyACL{})
+	if r.Code != ErrLimit || len(b) != 0 {
+		t.Fatal(r)
+	}
+	w := readWork(pin, "file")
+	w.MaxBytes = 3
+	r, b = executeReadOnly(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if r.Code != ErrLimit || len(b) != 0 {
+		t.Fatal(r)
+	}
+	os.WriteFile(root+"/exact", bytes.Repeat([]byte{'x'}, MaxBoundedBytes), 0644)
+	r, b = executeReadOnly(context.Background(), pin, readWork(pin, "exact"), fixtureReadOnlyACL{})
+	if r.Code != "" || len(b) != MaxBoundedBytes {
+		t.Fatal(r)
+	}
+	w = readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 1}
+	r, _ = executeReadOnly(context.Background(), pin, w, fixtureReadOnlyACL{})
+	if r.Code != ErrLimit || r.List != nil {
+		t.Fatal("no unbound pagination", r)
+	}
+}
+func TestReadOnlySameDeviceBindMountRefused(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("root VM mount fixture")
+	}
+	pin, root := readOnlyFixture(t)
+	other := t.TempDir()
+	os.WriteFile(other+"/secret", []byte("outside"), 0644)
+	if err := unix.Mount(other, root+"/sub", "", unix.MS_BIND, ""); err != nil {
+		t.Fatal(err)
+	}
+	defer unix.Unmount(root+"/sub", 0)
+	var a, b unix.Stat_t
+	unix.Stat(root, &a)
+	unix.Stat(root+"/sub", &b)
+	if a.Dev != b.Dev {
+		t.Fatal("fixture must share st_dev")
+	}
+	r, data := executeReadOnly(context.Background(), pin, readWork(pin, "sub", "secret"), fixtureReadOnlyACL{})
+	if r.Code == "" || len(data) != 0 {
+		t.Fatal("bind mount escaped", r)
+	}
+}
+func TestReadOnlyActorCredentialsAndKernel44Fallback(t *testing.T) {
+	if os.Getenv("M2_S5_ACTOR_FIXTURE") == "1" {
+		return
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("root VM credentials fixture")
+	}
+	root, err := os.MkdirTemp("/tmp", "m2-s5-actor-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(root) })
+	os.Chmod(root, 0755)
+	os.WriteFile(root+"/group", []byte("group-only"), 0640)
+	os.Chown(root+"/group", 0, 105)
+	os.WriteFile(root+"/denied", []byte("denied-canary"), 0600)
+	os.Mkdir(root+"/no-traverse", 0700)
+	os.WriteFile(root+"/no-traverse/secret", []byte("secret"), 0644)
+	for _, groups := range [][]uint32{{101, 105}, {101}} {
+		exe, _ := os.Executable()
+		cmd := exec.Command(exe, "-test.run=^TestReadOnlyActorProcess$", "-test.v")
+		cmd.Env = append(os.Environ(), "M2_S5_ACTOR_FIXTURE=1", "M2_S5_ROOT="+root, "M2_S5_GROUP_ALLOW="+fmt.Sprint(len(groups) == 2))
+		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 1001, Gid: 100, Groups: groups}}
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatal(err, string(out))
+		}
+		t.Log(string(out))
+	}
+}
+func TestReadOnlyActorProcess(t *testing.T) {
+	if os.Getenv("M2_S5_ACTOR_FIXTURE") != "1" {
+		t.Skip("subprocess only")
+	}
+	// All Go threads deny post-4.4 primitives; prove ENOSYS before using resolver.
+	filter := []unix.SockFilter{{Code: unix.BPF_LD | unix.BPF_W | unix.BPF_ABS, K: 0}, {Code: unix.BPF_JMP | unix.BPF_JEQ | unix.BPF_K, Jt: 1, K: unix.SYS_OPENAT2}, {Code: unix.BPF_JMP | unix.BPF_JEQ | unix.BPF_K, Jf: 1, K: unix.SYS_STATX}, {Code: unix.BPF_RET | unix.BPF_K, K: unix.SECCOMP_RET_ERRNO | uint32(unix.ENOSYS)}, {Code: unix.BPF_RET | unix.BPF_K, K: unix.SECCOMP_RET_ALLOW}}
+	program := unix.SockFprog{Len: uint16(len(filter)), Filter: &filter[0]}
+	if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
+		t.Fatal(err)
+	}
+	_, _, errno := unix.Syscall(unix.SYS_SECCOMP, unix.SECCOMP_SET_MODE_FILTER, unix.SECCOMP_FILTER_FLAG_TSYNC, uintptr(unsafe.Pointer(&program)))
+	if errno != 0 {
+		t.Fatal(errno)
+	}
+	fd, err := unix.Openat2(unix.AT_FDCWD, "/", &unix.OpenHow{Flags: unix.O_PATH})
+	if fd >= 0 {
+		unix.Close(fd)
+	}
+	if err != unix.ENOSYS {
+		t.Fatal("compatibility fixture ineffective", err)
+	}
+	root := os.Getenv("M2_S5_ROOT")
+	pin, c := pinReadOnlyRoot(root)
+	if c != "" {
+		t.Fatal(c)
+	}
+	defer pin.Close()
+	r, b := executeReadOnly(context.Background(), pin, readWork(pin, "group"), fixtureReadOnlyACL{})
+	allow := os.Getenv("M2_S5_GROUP_ALLOW") == "true"
+	if allow && (r.Code != "" || string(b) != "group-only") || !allow && (r.Code == "" || len(b) != 0) {
+		t.Fatal("supplementary group", r, string(b))
+	}
+	for _, s := range [][]string{{"denied"}, {"no-traverse", "secret"}} {
+		r, b = executeReadOnly(context.Background(), pin, readWork(pin, s...), fixtureReadOnlyACL{})
+		if r.Code == "" || len(b) != 0 {
+			t.Fatal("actor permission bypass", r)
+		}
+	}
+	r, _ = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 20}, fixtureReadOnlyACL{})
+	if r.Code != "" {
+		t.Fatal(r)
+	}
+	for _, e := range r.List.Entries {
+		if e.Name == "denied" || e.Name == "no-traverse" || e.Name == "group" && !allow {
+			t.Fatal("denied metadata leaked", e)
+		}
+	}
+	t.Log("uid/gid/groups and openat2/statx ENOSYS compatibility profile passed")
+}
+
+func TestReadOnlyChildRefusesMissingEpochRootBeforeSpawn(t *testing.T) {
+	w := readOnlyWork{RootPath: "/fixture", Action: ActionRead, Segments: []string{"file"}, MaxBytes: 10}
+	child, err := startLinuxReadOnlyOperation(Client{}, "", NativeActor{}, operationBinding{}, nil, w, nil)
+	if child != nil || err == nil {
+		t.Fatal("no grant authority admitted work")
+	}
+}
+func TestReadOnlyMountInfoParserAndPinnedProcessDirectory(t *testing.T) {
+	for _, input := range []string{"", "mnt_id: 0\n", "mnt_id: nope\n", "mnt_id: 2\nmnt_id: 3\n", strings.Repeat("x", 4097)} {
+		if _, code := parseReadOnlyMountID(strings.NewReader(input)); code == "" {
+			t.Fatal("malformed mount proof", input)
+		}
+	}
+	id, code := parseReadOnlyMountID(strings.NewReader("pos: 0\nflags: 010000000\nmnt_id: 25\n"))
+	if code != "" || id != 25 {
+		t.Fatal(id, code)
+	}
+	pin, _ := readOnlyFixture(t)
+	info, err := openOperationFDInfo(os.Getpid())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer info.Close()
+	local, c := readOnlyLocalMountID(int(pin.file.Fd()))
+	proxy, p := operationFDInfoMount(info, uint32(pin.file.Fd()))
+	if c != "" || p != "" || local != proxy {
+		t.Fatal("proxy disagrees", local, proxy, c, p)
+	}
+	if _, code := operationFDInfoMount(info, 1<<21); code == "" {
+		t.Fatal("unbounded FD number")
+	}
+}
+func TestReadOnlyRelayCompletionWaitsForMetadataReader(t *testing.T) {
+	p := newLinuxOperationRelay(nil, nil, nil, nil)
+	p.readOnly = true
+	p.resultPending = make(chan readOnlyPacketOutcome, 1)
+	p.stopRelay()
+	if p.relayStopped() {
+		t.Fatal("close falsely certified metadata goroutine stopped")
+	}
+	p.resultPending <- readOnlyPacketOutcome{err: ErrCanceled}
+	if !p.relayStopped() {
+		t.Fatal("metadata goroutine not observed")
+	}
+}
+
+func TestReadOnlyRejectsRootReadableDirectoryInsteadOfPathWitness(t *testing.T) {
+	_, root := readOnlyFixture(t)
+	readable, err := os.Open(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer readable.Close()
+	pin := &pinnedReadOnlyRoot{path: root, file: readable}
+	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "file"), fixtureReadOnlyACL{})
+	if result.Code != ErrDenied || len(data) != 0 {
+		t.Fatal("root-readable descriptor accepted", result)
+	}
+}
+func TestReadOnlyTwoProcessRenameBarrier(t *testing.T) {
+	if os.Getenv("M2_S5_RENAME_FIXTURE") == "1" {
+		root := os.Getenv("M2_S5_RENAME_ROOT")
+		if err := os.Rename(root+"/sub", root+"/moved"); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Mkdir(root+"/sub", 0755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(root+"/sub/inside", []byte("foreign-canary"), 0644); err != nil {
+			t.Fatal(err)
+		}
+		return
+	}
+	pin, root := readOnlyFixture(t)
+	mutated := false
+	acl := fixtureReadOnlyACL{hook: func() {
+		if mutated {
+			return
+		}
+		mutated = true
+		exe, _ := os.Executable()
+		cmd := exec.Command(exe, "-test.run=^TestReadOnlyTwoProcessRenameBarrier$", "-test.v")
+		cmd.Env = append(os.Environ(), "M2_S5_RENAME_FIXTURE=1", "M2_S5_RENAME_ROOT="+root)
+		if b, err := cmd.CombinedOutput(); err != nil {
+			t.Fatal(err, string(b))
+		}
+	}}
+	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "sub", "inside"), acl)
+	if result.Code == "" || len(data) != 0 {
+		t.Fatal("replacement/old data crossed rename barrier", result, string(data))
+	}
+}
+
+func TestReadOnlyMountReceiverClosesWitnessBeforeQuiescence(t *testing.T) {
+	pending := make(chan readOnlyPacketOutcome, 1)
+	p := &linuxOperation{closed: true, resultPending: pending}
+	closing := make(chan struct{})
+	release := make(chan struct{})
+	finished := make(chan struct{})
+	go func() {
+		runReadOnlyResultReceiver(pending, func() readOnlyPacketOutcome { return readOnlyPacketOutcome{result: &readOnlyResult{}} }, func() error { close(closing); <-release; return nil })
+		close(finished)
+	}()
+	<-closing
+	stopped := p.relayStopped()
+	close(release)
+	<-finished
+	if stopped {
+		t.Fatal("Q observed result while proc witness was still open")
+	}
+	if !p.relayStopped() {
+		t.Fatal("closed receiver prevented Q")
+	}
+}

package/dist/templates/native-go/backend/internal/helper/readonly_mount_linux.go

@@ -0,0 +1,65 @@
+package helper
+
+import (
+	"golang.org/x/sys/unix"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// mnt_id in Linux fdinfo predates 4.4. st_dev alone misses same-device bind
+// mounts. This fixed proc alias reads ONLY kernel metadata for our own FD.
+var readOnlySelfMountID = readOnlyLocalMountID
+var operationMountIDFallback func(int) (uint64, Code)
+
+func readOnlyMountID(fd int) (uint64, Code) {
+	id, code := readOnlySelfMountID(fd)
+	if code == "" || operationMountIDFallback == nil {
+		return id, code
+	}
+	return operationMountIDFallback(fd)
+}
+func readOnlyLocalMountID(fd int) (uint64, Code) {
+	f, err := os.Open("/proc/self/fdinfo/" + strconv.Itoa(fd))
+	if err != nil {
+		return 0, ErrUnsupported
+	}
+	defer f.Close()
+	return parseReadOnlyMountID(f)
+}
+func parseReadOnlyMountID(f io.Reader) (uint64, Code) {
+	b, err := io.ReadAll(io.LimitReader(f, 4097))
+	if err != nil || len(b) > 4096 {
+		return 0, ErrUnsupported
+	}
+	var id uint64
+	for _, line := range strings.Split(string(b), "\n") {
+		if !strings.HasPrefix(line, "mnt_id:") {
+			continue
+		}
+		if id != 0 {
+			return 0, ErrUnsupported
+		}
+		id, err = strconv.ParseUint(strings.TrimSpace(strings.TrimPrefix(line, "mnt_id:")), 10, 64)
+		if err != nil || id == 0 {
+			return 0, ErrUnsupported
+		}
+	}
+	if id == 0 {
+		return 0, ErrUnsupported
+	}
+	return id, ""
+}
+
+func readOnlyLocalMount(fd int) Code {
+	var fs unix.Statfs_t
+	if unix.Fstatfs(fd, &fs) != nil {
+		return ErrUnsupported
+	}
+	switch uint64(fs.Type) {
+	case unix.EXT4_SUPER_MAGIC, unix.BTRFS_SUPER_MAGIC, unix.XFS_SUPER_MAGIC, unix.TMPFS_MAGIC:
+		return ""
+	}
+	return ErrUnsupported
+}

package/dist/templates/native-go/backend/internal/helper/readonly_mount_proxy_linux.go

@@ -0,0 +1,113 @@
+package helper
+
+import (
+	"golang.org/x/sys/unix"
+	"net"
+	"os"
+	"strconv"
+	"time"
+)
+
+const maxReadOnlyMountQueries = (MaxTransferBytes/MaxChunkBytes + 1) * (8*MaxPathSegments + 32)
+
+// Linux 4.4's non-dumpable actor may not read its own fdinfo. Keep it
+// non-dumpable: ask ONLY the exact root parent over the existing private socket.
+// The parent reads kernel mount metadata, never business data or ACL decisions.
+func operationMountIDProxy(control *net.UnixConn, boot operationBootstrap) func(int) (uint64, Code) {
+	var sequence uint64
+	return func(fd int) (uint64, Code) {
+		if fd < 0 || fd > 1<<20 || sequence >= maxReadOnlyMountQueries {
+			return 0, ErrLimit
+		}
+		sequence++
+		number := uint32(fd)
+		packet := readOnlyPacket{Binding: boot.Binding, Token: boot.Token, MountFD: &number, MountSequence: sequence}
+		if writeOperationPacketBound(control, packet, MaxControlBytes) != nil {
+			return 0, ErrUnavailable
+		}
+		var reply readOnlyMountReply
+		if _, err := readOperationPacketBound(control, &reply, MaxHealthBytes, ControlTimeout); err != nil || reply.Token != boot.Token || reply.Sequence != sequence {
+			return 0, ErrUnavailable
+		}
+		if reply.Code != "" {
+			if reply.Code.Valid() {
+				return 0, reply.Code
+			}
+			return 0, ErrUnavailable
+		}
+		if reply.Mount == 0 {
+			return 0, ErrUnsupported
+		}
+		return reply.Mount, ""
+	}
+}
+func openOperationFDInfo(pid int) (*os.File, error) {
+	fd, err := unix.Open("/proc/"+strconv.Itoa(pid)+"/fdinfo", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	return os.NewFile(uintptr(fd), "owned-operation-fdinfo"), nil
+}
+func operationFDInfoMount(info *os.File, number uint32) (uint64, Code) {
+	if number > 1<<20 {
+		return 0, ErrInvalid
+	}
+	// Pinned proc directory belongs to this child instance; after reap, numeric PID
+	// reuse cannot redirect this openat to another process's fdinfo directory.
+	fd, err := unix.Openat(int(info.Fd()), strconv.FormatUint(uint64(number), 10), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return 0, ErrUnsupported
+	}
+	f := os.NewFile(uintptr(fd), "owned-operation-mount")
+	defer f.Close()
+	return parseReadOnlyMountID(f)
+}
+func receiveReadOnlyResult(control *net.UnixConn, info *os.File, boot operationBootstrap, w readOnlyWork, pid int) readOnlyPacketOutcome {
+	return receiveReadOnlyProof(control, info, boot, w, pid, 0, 0, 0, BoundedTimeout)
+}
+
+func receiveReadOnlyProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w readOnlyWork, pid int, sequence, chunkSequence uint64, chunkBytes uint32, timeout time.Duration) readOnlyPacketOutcome {
+	deadline := time.Now().Add(timeout)
+	for {
+		var packet readOnlyPacket
+		remaining := time.Until(deadline)
+		if remaining <= 0 {
+			return readOnlyPacketOutcome{err: ErrTimeout}
+		}
+		cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, remaining)
+		if err != nil {
+			return readOnlyPacketOutcome{err: err}
+		}
+		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		if packet.Result != nil {
+			valid := packet.Result.validFor(w)
+			if chunkSequence > 0 {
+				valid = packet.Result.Entry == nil && packet.Result.List == nil && ((packet.Result.Code == "" && packet.Result.Bytes == uint64(chunkBytes)) || (packet.Result.Code.Valid() && packet.Result.Bytes == 0))
+			}
+			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != chunkSequence || !valid {
+				return readOnlyPacketOutcome{err: errTrust}
+			}
+			return readOnlyPacketOutcome{result: packet.Result, mountSequence: sequence}
+		}
+		if packet.ChunkSequence != 0 || packet.MountFD == nil || sequence >= maxReadOnlyMountQueries || packet.MountSequence != sequence+1 {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		sequence++
+		id, code := operationFDInfoMount(info, *packet.MountFD)
+		if err := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
+			return readOnlyPacketOutcome{err: err}
+		}
+	}
+}
+
+func runReadOnlyResultReceiver(done chan<- readOnlyPacketOutcome, receive func() readOnlyPacketOutcome, closeInfo func() error) {
+	// Publish the observation only AFTER closing the proc witness. A buffered
+	// send followed by deferred Close would let the owner certify Q too early.
+	outcome := receive()
+	if err := closeInfo(); err != nil && outcome.err == nil {
+		outcome.err = err
+	}
+	done <- outcome
+}