@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_job_child_linux.go

@@ -0,0 +1,309 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"golang.org/x/sys/unix"
+	"io"
+	"net"
+	"os"
+	"runtime"
+	"strconv"
+	"time"
+)
+
+// S2's fixed child mode has NO RunLinux dispatch case. The VM builds a copy
+// with that one case added; S7 must perform the separately reviewed assembly.
+func sdkJobChildLinux(c Client) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+	parent, err := strconv.Atoi(os.Getenv("SYNOPKGLAND_PARENT"))
+	if err != nil {
+		return errTrust
+	}
+	if err = armParentDeath(parent, setParentDeath, os.Getppid); err != nil {
+		return err
+	}
+	if _, err = inspectSupervisor(parent, c.Expected); err != nil {
+		return err
+	}
+	if err = inheritLifetime(c); err != nil {
+		return err
+	}
+	f := os.NewFile(4, "sdk-job-control")
+	if f == nil {
+		return errTrust
+	}
+	defer f.Close()
+	control, err := operationSocket(f)
+	if err != nil {
+		return err
+	}
+	defer control.Close()
+	peer, err := peerCredentials(control)
+	if err != nil || int(peer.Pid) != parent || peer.Uid != 0 {
+		return errTrust
+	}
+	if err = enableCredentials(control); err != nil {
+		return err
+	}
+	var boot sdkJobBootstrap
+	cred, err := readSDKJobPacket(control, &boot, 300*time.Millisecond)
+	if err != nil || !sdkJobPeer(cred, parent, 0, peer.Gid) {
+		return errTrust
+	}
+	r, err := readRecord(c.StateDir, 0)
+	b := boot.Actor
+	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" || r.Lifecycle.Epoch != b.Binding.Epoch || b.Binding.Inventory != c.Expected || b.ReadOnly != nil || b.Write != nil || !allReferences(b.Token, b.SubjectRef, b.SessionRef) || b.UID == 0 || b.GID == 0 || b.Groups == nil || len(b.Groups) > 1024 {
+		return errTrust
+	}
+	if code := validateSDKJobPlan(sdkJobPlan{Request: boot.Request, Worker: boot.Worker}, b.Binding); code != "" {
+		return code
+	}
+	witness := os.NewFile(5, "sdk-job-root")
+	if witness == nil {
+		return errTrust
+	}
+	defer witness.Close()
+	pin := &pinnedReadOnlyRoot{path: boot.RootPath, file: witness}
+	for _, step := range boot.Request.Input.Steps {
+		if _, code := sdkJobWork(boot.RootPath, step); code != "" {
+			return code
+		}
+	}
+	if err = dropOperationCredentials(parent, b); err != nil {
+		return err
+	}
+	// Linux 4.4 does not expose NoNewPrivs in this fixture's /proc/status.
+	// Read back the kernel state before credential-ready on every kernel.
+	nnp, err := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
+	if err != nil || nnp != 1 {
+		return errTrust
+	}
+	if err = writeOperationPacketBound(control, boot, MaxControlBytes); err != nil {
+		return err
+	}
+	x := &sdkJobChild{control: control, boot: boot, parent: parent, parentGID: peer.Gid}
+	if _, err = x.receive(0, false); err != nil {
+		return err
+	}
+	operationMountIDFallback = x.mount
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(boot.Worker.Limits.TotalMS)*time.Millisecond)
+	defer cancel()
+	return x.run(ctx, pin)
+}
+
+type sdkJobChild struct {
+	control                    *net.UnixConn
+	boot                       sdkJobBootstrap
+	parent                     int
+	parentGID                  uint32
+	sequence, progressSequence uint64
+	lastProgress               time.Time
+}
+
+func (x *sdkJobChild) receive(seq uint64, mount bool) (sdkJobWire, error) {
+	var p sdkJobWire
+	cred, err := readSDKJobPacket(x.control, &p, time.Duration(x.boot.Worker.Limits.IdleMS)*time.Millisecond)
+	if err != nil || !sdkJobPeer(cred, x.parent, 0, x.parentGID) || !sdkJobWireBound(p, x.boot, seq) || p.Event != nil || p.MountFD != nil {
+		return sdkJobWire{}, errTrust
+	}
+	if mount {
+		if p.Reply != nil || p.Mount == 0 {
+			return sdkJobWire{}, errTrust
+		}
+	} else if p.Reply == nil || p.Mount != 0 {
+		return sdkJobWire{}, errTrust
+	}
+	return p, nil
+}
+func (x *sdkJobChild) event(e sdkJobEvent) (sdkJobReply, error) {
+	x.sequence++
+	if err := writeOperationPacketBound(x.control, sdkJobWire{Binding: x.boot.Request.Control.Binding, Token: x.boot.Actor.Token, Sequence: x.sequence, Event: &e}, MaxControlBytes); err != nil {
+		return sdkJobReply{}, err
+	}
+	p, err := x.receive(x.sequence, false)
+	if err != nil {
+		return sdkJobReply{}, err
+	}
+	return *p.Reply, nil
+}
+func (x *sdkJobChild) mount(fd int) (uint64, Code) {
+	if fd < 0 || fd > 1<<20 {
+		return 0, ErrInvalid
+	}
+	x.sequence++
+	number := uint32(fd)
+	if err := writeOperationPacketBound(x.control, sdkJobWire{Binding: x.boot.Request.Control.Binding, Token: x.boot.Actor.Token, Sequence: x.sequence, MountFD: &number}, MaxControlBytes); err != nil {
+		return 0, ErrUnavailable
+	}
+	p, err := x.receive(x.sequence, true)
+	if err != nil {
+		return 0, ErrUnavailable
+	}
+	return p.Mount, ""
+}
+func sdkJobWork(root string, s jobcontract.Step) (readOnlyWork, Code) {
+	w := readOnlyWork{RootPath: root, Action: Action(s.Action), Segments: append([]string{}, s.Segments...)}
+	if s.Limit != nil {
+		if *s.Limit > MaxPageEntries {
+			return w, ErrLimit
+		}
+		w.Limit = uint32(*s.Limit)
+	}
+	if s.MaxBytes != nil {
+		w.MaxBytes = *s.MaxBytes
+	}
+	return w, w.validate()
+}
+func (x *sdkJobChild) checkpoint(ctx context.Context, phase string, step uint64, n uint32) (context.Context, context.CancelFunc, error) {
+	r, err := x.event(sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: phase, Step: step, Bytes: n}})
+	if err != nil {
+		return nil, nil, err
+	}
+	deadline := time.Unix(0, r.Deadline)
+	if r.Deadline == 0 || !time.Now().Before(deadline) || time.Until(deadline) > NativeProofFreshness {
+		return nil, nil, ErrStale
+	}
+	proof, cancel := context.WithDeadline(ctx, deadline)
+	return proof, cancel, nil
+}
+func (x *sdkJobChild) progress(r jobcontract.Result, phase string) error {
+	if !x.lastProgress.IsZero() && time.Since(x.lastProgress) < time.Second {
+		return nil
+	}
+	if x.progressSequence >= jobcontract.MaxProgressPackets {
+		return nil
+	}
+	x.progressSequence++
+	x.lastProgress = time.Now()
+	n := uint64(len(x.boot.Request.Input.Steps))
+	_, err := x.event(sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: x.progressSequence, Phase: phase, CompletedUnits: r.CompletedSteps, TotalUnits: &n, BytesRead: r.BytesRead}})
+	return err
+}
+func (x *sdkJobChild) run(ctx context.Context, pin *pinnedReadOnlyRoot) error {
+	total := jobcontract.Result{ResultSchema: 1}
+	for index, step := range x.boot.Request.Input.Steps {
+		stepNumber := uint64(index)
+		proof, cancel, err := x.checkpoint(ctx, "before-step", stepNumber, 0)
+		if err != nil {
+			return err
+		}
+		work, code := sdkJobWork(pin.path, step)
+		result := jobcontract.Result{ResultSchema: 1}
+		if code == "" {
+			if work.Action == ActionRead || work.Action == ActionReadStream {
+				result.BytesRead, code = x.read(ctx, proof, pin, work, stepNumber, total)
+			} else {
+				bounded, done := context.WithTimeout(proof, time.Duration(x.boot.Worker.Limits.MetadataMS)*time.Millisecond)
+				metadata, _ := executeReadOnly(bounded, pin, work, operationReadOnlyACL)
+				code = metadata.Code
+				if code == "" {
+					code = nativeContextCode(bounded)
+				}
+				done()
+				if metadata.Entry != nil {
+					result.Entries = 1
+				}
+				if metadata.List != nil {
+					result.Entries = uint64(len(metadata.List.Entries))
+				}
+			}
+		}
+		cancel()
+		if code != "" {
+			// Fixed safe refusal only; no metadata/path/raw errors cross the socket.
+			_, _ = x.event(sdkJobEvent{Kind: "step-result", Result: &jobcontract.Result{ResultSchema: 1, SafeReason: jobcontract.SafeReason(safeGrantCode(code))}})
+			return code
+		}
+		result.CompletedSteps = 1
+		if _, err = x.event(sdkJobEvent{Kind: "step-result", Result: &result}); err != nil {
+			return err
+		}
+		total.CompletedSteps++
+		total.Entries += result.Entries
+		total.BytesRead += result.BytesRead
+		if err = x.progress(total, "metadata"); err != nil {
+			return err
+		}
+	}
+	proof, cancel, err := x.checkpoint(ctx, "before-result", uint64(len(x.boot.Request.Input.Steps)), 0)
+	if err != nil {
+		return err
+	}
+	defer cancel()
+	if code := nativeContextCode(proof); code != "" {
+		return code
+	}
+	_, err = x.event(sdkJobEvent{Kind: "result", Result: &total})
+	return err
+}
+
+// The fixed read handler opens data only after permanent drop. Unlike M2's
+// eager bounded buffer, even bounded SDK reads consume one freshly authorized
+// chunk at a time. Data stays in this actor process and is discarded, not relayed.
+func (x *sdkJobChild) read(ctx, proof context.Context, pin *pinnedReadOnlyRoot, w readOnlyWork, step uint64, total jobcontract.Result) (uint64, Code) {
+	o, code := resolveReadOnly(proof, pin, w)
+	if code != "" {
+		return 0, code
+	}
+	defer o.Close()
+	if code = authorizeReadOnly(proof, o, w, operationReadOnlyACL); code != "" {
+		return 0, code
+	}
+	if o.before.Mode&unix.S_IFMT != unix.S_IFREG {
+		return 0, ErrDenied
+	}
+	if o.before.Size < 0 || uint64(o.before.Size) > w.MaxBytes {
+		return 0, ErrLimit
+	}
+	if code = readOnlyUnchanged(int(o.data.Fd()), o.before); code != "" {
+		return 0, code
+	}
+	stepCtx := ctx
+	if w.Action == ActionRead {
+		var cancel context.CancelFunc
+		stepCtx, cancel = context.WithTimeout(ctx, time.Duration(x.boot.Worker.Limits.BoundedMS)*time.Millisecond)
+		defer cancel()
+	}
+	remaining := uint64(o.before.Size)
+	var read uint64
+	for remaining > 0 {
+		n := uint32(min(remaining, x.boot.Worker.Limits.ChunkBytes))
+		lease, cancel, err := x.checkpoint(stepCtx, "before-chunk", step, n)
+		if err != nil {
+			return read, ErrUnavailable
+		}
+		code = authorizeReadOnly(lease, o, w, operationReadOnlyACL)
+		if code == "" {
+			code = readOnlyUnchanged(int(o.data.Fd()), o.before)
+		}
+		buf := make([]byte, n)
+		if code == "" {
+			if _, err = io.ReadFull(o.data, buf); err != nil {
+				code = readOnlyError(err)
+			}
+		}
+		clear(buf)
+		if code == "" {
+			code = authorizeReadOnly(lease, o, w, operationReadOnlyACL)
+		}
+		if code == "" {
+			code = readOnlyUnchanged(int(o.data.Fd()), o.before)
+		}
+		cancel()
+		if code != "" {
+			return read, code
+		}
+		remaining -= uint64(n)
+		read += uint64(n)
+		p := total
+		p.BytesRead += read
+		if err = x.progress(p, "reading"); err != nil {
+			return read, ErrUnavailable
+		}
+	}
+	return read, ""
+}

package/templates/native-go/backend/internal/helper/sdk_job_contract.go

@@ -0,0 +1,122 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"time"
+)
+
+// S2 components only. Nothing registers these with RunLinux, the supervisor
+// loop, CGI, RPC, or the compiled registry consumer. S7 must explicitly assemble
+// ONE owner on the existing locked supervisor thread, after native proof gates.
+// The ordinary build excludes every sdk_job*.go production source file.
+type sdkJobRequest struct {
+	Control jobcontract.Control `json:"control"`
+	Input   jobcontract.Input   `json:"input"`
+}
+
+// Trusted root-side proof, never decoded from a caller or persisted as authority.
+// ValidateJob must observe the exact input/scope/action, App permission and root
+// continuity at every checkpoint. GrantAuthority independently checks the parent
+// under its existing admission order; this seam cannot replace that authority.
+type sdkJobProof struct {
+	Intent                    jobcontract.RevisionRef
+	Binding                   jobcontract.Binding
+	Principal                 Principal
+	SessionRef, Nonce, Ticket string
+	ExpiresAt, CheckedAt      time.Time
+	Continuity                ContinuityBinding
+	Continuous                bool
+	Root                      readOnlyRootWitness
+}
+type sdkJobValidator interface {
+	ValidateJob(context.Context, NativeActor, sdkJobRequest, Grant, sdkJobCheckpoint) (sdkJobProof, Code)
+}
+
+// A root-owned bounded journal must retain execution keys across owner restarts.
+// Reserve is immutable, exclusive and durable before admission/spawn, capped at
+// 256 lifetime intents. Cancel/Finish acknowledge only fsynced records. An error
+// is not a receipt, and uncertain writes never permit retry/redispatch. S2 has no
+// production journal assembly; the VM supplies a real fsync-backed fixture.
+type sdkJobJournal interface {
+	Reserve(sdkJobIntent) Code
+	Cancel(jobcontract.Binding) Code
+	Finish(sdkJobReceipt) Code
+}
+type sdkJobIntent struct {
+	Request    sdkJobRequest         `json:"request"`
+	Actor      jobcontract.Principal `json:"actor"`
+	SessionRef string                `json:"sessionRef,omitempty"`
+}
+type sdkJobReceipt struct {
+	Job    jobcontract.Job     `json:"job"`
+	Result *jobcontract.Result `json:"result,omitempty"`
+}
+type sdkJobCheckpoint struct {
+	Phase string `json:"phase"`
+	Step  uint64 `json:"step"`
+	Bytes uint32 `json:"bytes"`
+}
+type sdkJobEvent struct {
+	Kind       string                `json:"kind"`
+	Checkpoint sdkJobCheckpoint      `json:"checkpoint"`
+	Progress   *jobcontract.Progress `json:"progress,omitempty"`
+	Result     *jobcontract.Result   `json:"result,omitempty"`
+}
+type sdkJobReply struct {
+	Deadline int64 `json:"deadline"`
+}
+type sdkJobPlan struct {
+	Request sdkJobRequest
+	Worker  jobcontract.Worker
+	Root    readOnlyRootWitness
+}
+
+// Sole owner/reaper calls this interface. Its private receiver authenticates
+// SCM_CREDENTIALS, token, full binding and packet sequence before returning an
+// event. next/idle/reply must not wait for child I/O; stopRelay closes gates but
+// relayStopped is true only after the receiver and all FD users have returned.
+type sdkJobProcess interface {
+	operationProcess
+	next() (sdkJobEvent, bool)
+	reply(sdkJobReply) error
+	exitSuccess() bool
+}
+type sdkJobServices struct {
+	Validator sdkJobValidator
+	Journal   sdkJobJournal
+	Start     func(NativeActor, operationBinding, sdkJobPlan) (sdkJobProcess, error)
+}
+type sdkJob struct {
+	attach                                            *sdkAttachLease
+	background                                        *sdkBackgroundRuntime
+	journalUncertain                                  bool
+	request                                           sdkJobRequest
+	worker                                            jobcontract.Worker
+	actor                                             NativeActor
+	carriers                                          SessionCarriers // transient only; clear at terminal or canceled
+	root                                              readOnlyRootWitness
+	op                                                *cohortOperation
+	process                                           sdkJobProcess
+	receipt                                           sdkJobReceipt
+	step, admitted, stepAdmitted                      uint64
+	stepOpen, resultAllowed, resultReceived, terminal bool
+	lastCheckpoint, lastProgress                      time.Time
+	lastSeenProgress                                  *jobcontract.Progress
+	progress                                          []jobcontract.Progress
+	progressPackets                                   uint64
+	counters                                          jobcontract.Result
+	failure                                           Code
+}
+type sdkJobOwner struct {
+	session   *sdkSessionJobs      // opt-in session/File Station mode; no native authority fabrication
+	attachNow func() time.Duration // elapsed monotonic time; never restored from disk
+	views     *sdkJobViews         // one status budget/cursor owner, installed only by S5/S7 fixtures
+	grants    *supervisorGrants
+	services  sdkJobServices
+	workers   map[string]jobcontract.Worker
+	jobs      map[string]*sdkJob
+	controls  map[string]bool
+}

package/templates/native-go/backend/internal/helper/sdk_job_linux_test.go

@@ -0,0 +1,159 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"encoding/json"
+	"net"
+	"os"
+	"os/exec"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func sdkSocketPair(t *testing.T) (*net.UnixConn, *net.UnixConn) {
+	t.Helper()
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	open := func(fd int) *net.UnixConn {
+		f := os.NewFile(uintptr(fd), "sdk-test")
+		c, e := operationSocket(f)
+		f.Close()
+		if e != nil {
+			t.Fatal(e)
+		}
+		if e = enableCredentials(c); e != nil {
+			t.Fatal(e)
+		}
+		t.Cleanup(func() { c.Close() })
+		return c
+	}
+	return open(pair[0]), open(pair[1])
+}
+
+func TestSDKJobPrivatePacketClosesUnexpectedRights(t *testing.T) {
+	a, b := sdkSocketPair(t)
+	f, err := os.Open("/dev/null")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	before, err := os.ReadDir("/proc/self/fd")
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(sdkJobWire{Token: grantRef('a'), Sequence: 1, Event: &sdkJobEvent{Kind: "ready"}})
+	if _, _, err = a.WriteMsgUnix(raw, syscall.UnixRights(int(f.Fd())), nil); err != nil {
+		t.Fatal(err)
+	}
+	var packet sdkJobWire
+	if _, err = readSDKJobPacket(b, &packet, time.Second); err == nil {
+		t.Fatal("unexpected fd accepted")
+	}
+	after, err := os.ReadDir("/proc/self/fd")
+	if err != nil || len(after) != len(before) {
+		t.Fatal("received rights leaked", len(before), len(after), err)
+	}
+}
+func TestSDKJobForeignPeerSender(t *testing.T) {
+	if os.Getenv("S2_FOREIGN_PEER") != "1" {
+		return
+	}
+	f := os.NewFile(3, "foreign-peer")
+	defer f.Close()
+	conn, err := operationSocket(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	if err = writeOperationPacketBound(conn, sdkJobWire{Token: grantRef('a'), Sequence: 1, Event: &sdkJobEvent{Kind: "ready"}}, MaxControlBytes); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestSDKJobSCMCredentialsRejectRealForeignProcess(t *testing.T) {
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	parent := os.NewFile(uintptr(pair[0]), "parent")
+	child := os.NewFile(uintptr(pair[1]), "child")
+	defer parent.Close()
+	defer child.Close()
+	conn, err := operationSocket(parent)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	if err = enableCredentials(conn); err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command(os.Args[0], "-test.run=^TestSDKJobForeignPeerSender$")
+	cmd.Env = append(os.Environ(), "S2_FOREIGN_PEER=1")
+	cmd.ExtraFiles = []*os.File{child}
+	if err = cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	var packet sdkJobWire
+	cred, readErr := readSDKJobPacket(conn, &packet, time.Second)
+	if err = cmd.Wait(); err != nil || readErr != nil {
+		t.Fatal(err, readErr)
+	}
+	if sdkJobPeer(cred, os.Getpid(), uint32(os.Geteuid()), uint32(os.Getegid())) || !sdkJobPeer(cred, cmd.Process.Pid, uint32(os.Geteuid()), uint32(os.Getegid())) {
+		t.Fatal("actual writer identity not enforced", cred)
+	}
+}
+func TestSDKJobPrivatePacketsAreCanonicalAndCredentialBound(t *testing.T) {
+	for _, kind := range []string{"valid", "unknown", "duplicate", "case", "null", "large"} {
+		t.Run(kind, func(t *testing.T) {
+			a, b := sdkSocketPair(t)
+			packet := sdkJobWire{Token: grantRef('a'), Sequence: 1, Event: &sdkJobEvent{Kind: "ready"}}
+			raw, _ := json.Marshal(packet)
+			switch kind {
+			case "unknown":
+				raw = append(raw[:len(raw)-1], []byte(`,"extra":1}`)...)
+			case "duplicate":
+				raw = append(raw[:len(raw)-1], []byte(`,"sequence":1}`)...)
+			case "case":
+				raw = []byte(`{"Token":"a","sequence":1}`)
+			case "null":
+				raw = []byte(`{"token":null,"sequence":1}`)
+			case "large":
+				raw = make([]byte, MaxControlBytes+1)
+			}
+			if _, e := a.Write(raw); e != nil {
+				t.Fatal(e)
+			}
+			var got sdkJobWire
+			cred, err := readSDKJobPacket(b, &got, time.Second)
+			if kind == "valid" {
+				if err != nil || cred == nil || int(cred.Pid) != os.Getpid() || cred.Uid != uint32(os.Geteuid()) {
+					t.Fatal(cred, err)
+				}
+			} else if err == nil {
+				t.Fatal("accepted noncanonical private frame")
+			}
+		})
+	}
+}
+func TestSDKJobLinuxFactoryRefusesNonSupervisor(t *testing.T) {
+	f := sdkJobFixture(t)
+	a := relaxedActor(t, f.s.services.native, f.carriers)
+	b := operationBinding{f.c.inventory, f.c.epoch, f.r.Control.Binding.Job.ID, f.r.Control.Nonce, f.g.ID, f.g.Revision}
+	if p, err := startLinuxSDKJob(NewClient(f.c.inventory), "/tmp/untrusted", a, b, sdkJobPlan{Request: f.r, Worker: f.o.workers["scan"], Root: f.validator.root}); err == nil || p != nil {
+		t.Fatal("non-supervisor spawned", p, err)
+	}
+}
+
+func TestSDKJobChildRefusesMissingParentBeforeCredentials(t *testing.T) {
+	t.Setenv("SYNOPKGLAND_PARENT", "")
+	before := os.Geteuid()
+	if err := sdkJobChildLinux(Client{}); err == nil {
+		t.Fatal("child entered without protected supervisor")
+	}
+	if os.Geteuid() != before {
+		t.Fatal("credentials changed before parent proof")
+	}
+}