@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/dsm_acl_syscall_linux.go

@@ -0,0 +1,95 @@
+package helper
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"runtime"
+	"strconv"
+	"syscall"
+	"time"
+	"unsafe"
+)
+
+// Private trusted certification input; no environment/JSON/RPC can assert it.
+// Source layout alone is insufficient: actual target/build/masks must be proven.
+type dsmACLRuntimeProof struct {
+	Architecture, BuildRef, BootRef string
+	LayoutVerified, MasksVerified   bool
+	CheckedAt                       time.Time
+}
+type dsmACLSyscallBridge struct {
+	proof func(context.Context) (dsmACLRuntimeProof, Code)
+	now   func() time.Time
+	call  func(uintptr, uintptr, uintptr, uintptr) (uintptr, syscall.Errno)
+}
+
+func newDSMACLSyscallBridge(p func(context.Context) (dsmACLRuntimeProof, Code)) *dsmACLSyscallBridge {
+	return &dsmACLSyscallBridge{proof: p, now: time.Now, call: func(n, a, b, c uintptr) (uintptr, syscall.Errno) { r, _, e := syscall.Syscall(n, a, b, c); return r, e }}
+}
+
+// Source layout: DSM7-4 linux-4.4.x 29003c4, generic + x86-64 table.
+// The same numbers do not imply support on ordinary Linux or another DSM build.
+const dsmACLCheckSyscall = 812
+const dsmACLSupportSyscall = 813
+
+func (b *dsmACLSyscallBridge) Check(ctx context.Context, fd int, alias string, mask uint32) (nativeFDACLObservation, Code) {
+	empty := nativeFDACLObservation{}
+	if b == nil || b.proof == nil || b.call == nil || b.now == nil {
+		return empty, ErrUnsupported
+	}
+	if c := nativeContextCode(ctx); c != "" {
+		return empty, c
+	}
+	p, c := b.proof(ctx)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return empty, c
+	}
+	if (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") || p.Architecture != runtime.GOARCH || !p.LayoutVerified || !p.MasksVerified || !allReferences(p.BuildRef, p.BootRef) || !nativeFresh(p.CheckedAt, b.now()) {
+		return empty, ErrUnsupported
+	}
+	if fd < 0 || alias != "/proc/self/fd/"+strconv.Itoa(fd) || mask == 0 || mask & ^(nativeACLExec|nativeACLRead|nativeACLReadAttr) != 0 {
+		return empty, ErrInvalid
+	}
+	errorCode := func(e syscall.Errno) Code {
+		if e == unix.ENOSYS || e == unix.EOPNOTSUPP {
+			return ErrUnsupported
+		}
+		return ErrUnavailable
+	}
+	name, err := unix.BytePtrFromString(alias)
+	if err != nil {
+		return empty, ErrInvalid
+	}
+	defer runtime.KeepAlive(name)
+	// Positive FD support is mandatory. With WINACL compiled out this returns 0,
+	// which MUST refuse before the check syscall's misleading zero-success stub.
+	// Kernel fget excludes O_PATH: resolve the SAME fixed alias for support too.
+	// No original pathname, readable reopen, or POSIX fallback is introduced.
+	for _, tag := range []uintptr{1, 2} {
+		supported, e := b.call(dsmACLSupportSyscall, uintptr(unsafe.Pointer(name)), uintptr(fd), tag)
+		if e != 0 {
+			return empty, errorCode(e)
+		}
+		if supported != 1 {
+			return empty, ErrUnsupported
+		}
+		if c := nativeContextCode(ctx); c != "" {
+			return empty, c
+		}
+	}
+	result, e := b.call(dsmACLCheckSyscall, uintptr(unsafe.Pointer(name)), uintptr(mask), 0)
+	runtime.KeepAlive(name)
+	if c := nativeContextCode(ctx); c != "" {
+		return empty, c
+	}
+	if e != 0 && e != unix.EACCES && e != unix.EPERM {
+		return empty, errorCode(e)
+	}
+	if e == 0 && result != 0 {
+		return empty, ErrUnavailable
+	}
+	if !nativeFresh(p.CheckedAt, b.now()) {
+		return empty, ErrStale
+	}
+	return nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: e == 0, CheckedAt: p.CheckedAt}, ""
+}

package/dist/templates/native-go/backend/internal/helper/dsm_acl_syscall_linux_test.go

@@ -0,0 +1,56 @@
+package helper
+
+import (
+	"context"
+	"runtime"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestDSMNativeSyscallsRequirePositiveProofAndSupport(t *testing.T) {
+	now := time.Now()
+	calls := 0
+	b := newDSMACLSyscallBridge(func(context.Context) (dsmACLRuntimeProof, Code) { return dsmACLRuntimeProof{}, "" })
+	b.call = func(uintptr, uintptr, uintptr, uintptr) (uintptr, syscall.Errno) { calls++; return 0, 0 }
+	if _, c := b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead); c != ErrUnsupported || calls != 0 {
+		t.Fatal("unknown target invoked custom syscall", c, calls)
+	}
+	b.proof = func(context.Context) (dsmACLRuntimeProof, Code) {
+		return dsmACLRuntimeProof{Architecture: runtime.GOARCH, BuildRef: grantRef('a'), BootRef: grantRef('b'), LayoutVerified: true, MasksVerified: true, CheckedAt: now}, ""
+	}
+	b.now = func() time.Time { return now }
+	if _, c := b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead); c != ErrUnsupported || calls != 1 {
+		t.Fatal("no-WINACL zero treated as Allow", c, calls)
+	}
+	b.call = func(n, a1, a2, a3 uintptr) (uintptr, syscall.Errno) {
+		calls++
+		if n == 813 {
+			if a1 == 0 || (a3 != 1 && a3 != 2) {
+				t.Fatal("O_PATH support must resolve the pinned alias, not fget")
+			}
+			return 1, 0
+		}
+		if n != 812 {
+			t.Fatal(n)
+		}
+		return 0, 0
+	}
+	o, c := b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead|nativeACLReadAttr)
+	if c != "" || !o.Allowed || !o.ObjectSupported {
+		t.Fatal(c, o)
+	}
+	if _, c = b.Check(context.Background(), 5, "/proc/self/fd/6", nativeACLRead); c == "" {
+		t.Fatal("alias substitution")
+	}
+	b.call = func(n, a1, a2, a3 uintptr) (uintptr, syscall.Errno) {
+		if n == 813 {
+			return 1, 0
+		}
+		return 0, syscall.EACCES
+	}
+	o, c = b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead)
+	if c != "" || o.Allowed {
+		t.Fatal("native deny", c, o)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/dsm_bridge_linux.go

@@ -0,0 +1,144 @@
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/dsmprobe"
+	"runtime"
+	"slices"
+	"time"
+)
+
+// Certificates are private root-side audit input, never probe/browser flags.
+// No certificate or bridge is installed in shipped supervisor adapters.
+type dsmBridgeCertificate struct {
+	Architecture, DSMBuild, Kernel, Fingerprint, BootRef string
+	NativeGettersAudited, LayoutAudited, MasksAudited    bool
+}
+type dsmProbeTransport interface {
+	Observe(context.Context, dsmprobe.Request) (dsmprobe.Response, Code)
+}
+type dsmNativeBridge struct {
+	transport   dsmProbeTransport
+	certificate *dsmBridgeCertificate
+	now         func() time.Time
+}
+type dsmShareObservation struct {
+	Principal                            Principal
+	SessionRef, Name, Path               string
+	Available, VolumeProven, ReadAllowed bool
+	CheckedAt                            time.Time
+}
+
+func newDSMNativeBridge(t dsmProbeTransport, c *dsmBridgeCertificate) *dsmNativeBridge {
+	b := &dsmNativeBridge{transport: t, now: time.Now}
+	if c != nil {
+		copy := *c
+		b.certificate = &copy
+	}
+	return b
+}
+func (b *dsmNativeBridge) observe(ctx context.Context, actor *NativeActor) (dsmprobe.Response, time.Time, Code) {
+	var zero dsmprobe.Response
+	if b == nil || b.transport == nil || b.certificate == nil || b.now == nil {
+		return zero, time.Time{}, ErrUnsupported
+	}
+	cert := *b.certificate
+	if !allReferences(cert.Fingerprint, cert.BootRef) || cert.Architecture == "" || cert.DSMBuild == "" || cert.Kernel == "" {
+		return zero, time.Time{}, ErrUnsupported
+	}
+	started := b.now()
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	nonce, c := randomGrantID()
+	if c != "" {
+		return zero, started, c
+	}
+	request := dsmprobe.Request{Version: dsmprobe.Protocol, Nonce: nonce, Kind: "runtime", Groups: []uint32{}}
+	if actor != nil {
+		if !actor.valid || actor.Principal().Kind != "local" || !actor.account.Enabled || !nativeFresh(actor.account.CheckedAt, started) {
+			return zero, started, ErrDenied
+		}
+		request.Kind = "metadata"
+		request.Username = actor.Username()
+		request.UID = actor.UID()
+		request.GID = actor.GID()
+		request.Groups = actor.Groups()
+	}
+	out, c := b.transport.Observe(ctx, request)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return zero, started, c
+	}
+	if !nativeFresh(started, b.now()) {
+		return zero, started, ErrStale
+	}
+	if out.Version != dsmprobe.Protocol || out.Nonce != nonce || out.Status != "ok" || out.Runtime.Architecture != cert.Architecture || out.Runtime.DSMBuild != cert.DSMBuild || out.Runtime.Kernel != cert.Kernel || out.Runtime.Fingerprint != cert.Fingerprint || out.Runtime.BootRef != cert.BootRef {
+		return zero, started, ErrUnsupported
+	}
+	if actor != nil {
+		a := out.Account
+		identity := out.Identity
+		if !cert.NativeGettersAudited || !a.NativeKnown || !a.Local || !a.Enabled || !a.GroupsKnown || a.Username != actor.Username() || a.UID != actor.UID() || a.GID != actor.GID() || !slices.Equal(a.Groups, actor.Groups()) || identity.UID != actor.UID() || identity.GID != actor.GID() || !slices.Equal(identity.Groups, actor.Groups()) || !identity.NoNewPrivs || !identity.NonDumpable {
+			return zero, started, ErrDenied
+		}
+		if !nativeFresh(actor.account.CheckedAt, b.now()) {
+			return zero, started, ErrStale
+		}
+	}
+	return out, started, ""
+}
+func nativeShareFacts(s dsmprobe.Share) Code {
+	if !s.NativeKnown || !s.VolumeKnown || !s.PermissionKnown {
+		return ErrUnsupported
+	}
+	if !s.Available || !s.ReadAllowed {
+		return ErrDenied
+	}
+	if ValidateRelativeSegments([]string{s.Name}, false) != "" {
+		return ErrInvalid
+	}
+	return (readOnlyWork{RootPath: s.Path, Action: ActionStat, Segments: []string{}}).validate()
+}
+func (b *dsmNativeBridge) ObserveOwnHome(ctx context.Context, a NativeActor) (ownHomeObservation, Code) {
+	out, at, c := b.observe(ctx, &a)
+	if c != "" {
+		return ownHomeObservation{}, c
+	}
+	if c = nativeShareFacts(out.Share); c != "" {
+		return ownHomeObservation{}, c
+	}
+	if !out.Home.StatusKnown {
+		return ownHomeObservation{}, ErrUnsupported
+	}
+	if !out.Home.Enabled || out.Share.Name != "homes" || out.Share.Path != out.Home.HomesPath || out.Account.Home != "/var/services/homes/"+a.Username() {
+		return ownHomeObservation{}, ErrDenied
+	}
+	return ownHomeObservation{Principal: a.Principal(), SessionRef: a.SessionRef(), Home: out.Account.Home, HomesPath: out.Home.HomesPath, Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: at}, ""
+}
+func (b *dsmNativeBridge) ObserveShare(ctx context.Context, a NativeActor, name string) (dsmShareObservation, Code) {
+	if name != "homes" {
+		return dsmShareObservation{}, ErrUnsupported
+	} // This slice certifies only the own-home native homes share.
+	out, at, c := b.observe(ctx, &a)
+	if c != "" {
+		return dsmShareObservation{}, c
+	}
+	if out.Share.Name != name {
+		return dsmShareObservation{}, ErrStale
+	}
+	if c = nativeShareFacts(out.Share); c != "" {
+		return dsmShareObservation{}, c
+	}
+	return dsmShareObservation{Principal: a.Principal(), SessionRef: a.SessionRef(), Name: name, Path: out.Share.Path, Available: true, VolumeProven: true, ReadAllowed: true, CheckedAt: at}, ""
+}
+func (b *dsmNativeBridge) ACLRuntimeProof(ctx context.Context) (dsmACLRuntimeProof, Code) {
+	out, at, c := b.observe(ctx, nil)
+	if c != "" {
+		return dsmACLRuntimeProof{}, c
+	}
+	cert := *b.certificate
+	if cert.Architecture != runtime.GOARCH || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") || !cert.LayoutAudited || !cert.MasksAudited {
+		return dsmACLRuntimeProof{}, ErrUnsupported
+	}
+	// An ACL sample's result/certified flag is never native action certification.
+	return dsmACLRuntimeProof{Architecture: out.Runtime.Architecture, BuildRef: cert.Fingerprint, BootRef: cert.BootRef, LayoutVerified: true, MasksVerified: true, CheckedAt: at}, ""
+}

package/dist/templates/native-go/backend/internal/helper/dsm_bridge_linux_test.go

@@ -0,0 +1,89 @@
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/dsmprobe"
+	"runtime"
+	"testing"
+	"time"
+)
+
+type nativeProbeFake struct {
+	response dsmprobe.Response
+	code     Code
+	change   func(*dsmprobe.Response)
+}
+
+func (f *nativeProbeFake) Observe(_ context.Context, r dsmprobe.Request) (dsmprobe.Response, Code) {
+	v := f.response
+	v.Nonce = r.Nonce
+	v.Version = 1
+	if f.change != nil {
+		f.change(&v)
+	}
+	return v, f.code
+}
+func bridgeFixture(t *testing.T) (*dsmNativeBridge, NativeActor, *nativeProbeFake) {
+	t.Helper()
+	p, _, _, carriers, now := nativeFixture()
+	actor, c := p.Resolve(context.Background(), carriers)
+	if c != "" {
+		t.Fatal(c)
+	}
+	actor.account.Username = "normal3"
+	f := &nativeProbeFake{response: dsmprobe.Response{Version: 1, Status: "ok", Runtime: dsmprobe.Runtime{Architecture: runtime.GOARCH, DSMBuild: "7.4-90069", Kernel: "4.4.302+", BootRef: grantRef('b'), Fingerprint: grantRef('f')}, Identity: dsmprobe.Identity{UID: actor.UID(), GID: actor.GID(), Groups: actor.Groups(), NoNewPrivs: true, NonDumpable: true}, Account: dsmprobe.Account{Username: actor.Username(), UID: actor.UID(), GID: actor.GID(), Groups: actor.Groups(), Home: "/var/services/homes/normal3", NativeKnown: true, Local: true, Enabled: true, GroupsKnown: true}, Home: dsmprobe.Home{HomesPath: "/volume1/homes", StatusKnown: true, Enabled: true}, Share: dsmprobe.Share{Name: "homes", Path: "/volume1/homes", NativeKnown: true, Available: true, VolumeKnown: true, PermissionKnown: true, ReadAllowed: true}}}
+	cert := &dsmBridgeCertificate{Architecture: runtime.GOARCH, DSMBuild: "7.4-90069", Kernel: "4.4.302+", Fingerprint: grantRef('f'), BootRef: grantRef('b'), NativeGettersAudited: true, LayoutAudited: true, MasksAudited: true}
+	b := &dsmNativeBridge{transport: f, certificate: cert, now: func() time.Time { return now }}
+	return b, actor, f
+}
+func TestDSMNativeBridgeRequiresIndependentNativeFacts(t *testing.T) {
+	b, a, f := bridgeFixture(t)
+	o, c := b.ObserveOwnHome(context.Background(), a)
+	if c != "" || o.Home != "/var/services/homes/normal3" || !o.ShareAllowed {
+		t.Fatal(c, o)
+	}
+	for _, change := range []func(*dsmprobe.Response){func(r *dsmprobe.Response) { r.Share.PermissionKnown = false }, func(r *dsmprobe.Response) { r.Account.GroupsKnown = false }, func(r *dsmprobe.Response) { r.Home.StatusKnown = false }, func(r *dsmprobe.Response) { r.Share.VolumeKnown = false }, func(r *dsmprobe.Response) { r.Account.UID++ }, func(r *dsmprobe.Response) { r.Runtime.Fingerprint = grantRef('e') }, func(r *dsmprobe.Response) { r.Identity.NoNewPrivs = false }} {
+		f.change = change
+		if _, c := b.ObserveOwnHome(context.Background(), a); c == "" {
+			t.Fatal("unknown proof accepted")
+		}
+	}
+	f.change = nil
+	b.certificate = nil
+	if _, c := b.ObserveOwnHome(context.Background(), a); c == "" {
+		t.Fatal("no audit certificate accepted")
+	}
+}
+func TestDSMNativeBridgeACLProofNeverUsesProbeAllowFlag(t *testing.T) {
+	b, _, f := bridgeFixture(t)
+	p, c := b.ACLRuntimeProof(context.Background())
+	if c != "" || !p.LayoutVerified || !p.MasksVerified {
+		t.Fatal(c, p)
+	}
+	f.response.ACL.Certified = true
+	f.response.ACL.CheckResult = 0
+	b.certificate.MasksAudited = false
+	if _, c = b.ACLRuntimeProof(context.Background()); c == "" {
+		t.Fatal("unknown masks accepted")
+	}
+	b.certificate.MasksAudited = true
+	f.change = func(r *dsmprobe.Response) { r.Runtime.BootRef = grantRef('d') }
+	if _, c = b.ACLRuntimeProof(context.Background()); c == "" {
+		t.Fatal("different boot accepted")
+	}
+}
+
+func TestDSMNativeShareBridgeIsOwnHomesOnlyAndProofBound(t *testing.T) {
+	b, a, f := bridgeFixture(t)
+	o, c := b.ObserveShare(context.Background(), a, "homes")
+	if c != "" || o.Path != "/volume1/homes" || o.Principal != a.Principal() || o.SessionRef != a.SessionRef() {
+		t.Fatal(c, o)
+	}
+	if _, c = b.ObserveShare(context.Background(), a, "public"); c != ErrUnsupported {
+		t.Fatal("unreviewed share", c)
+	}
+	f.change = func(r *dsmprobe.Response) { r.Share.ReadAllowed = false }
+	if _, c = b.ObserveShare(context.Background(), a, "homes"); c != ErrDenied {
+		t.Fatal(c)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/dsm_home_linux.go

@@ -0,0 +1,107 @@
+package helper
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"strings"
+	"time"
+)
+
+// This read-only observation must use fresh local pw_dir + home status + native
+// homes mapping; never HomePathGet/prepare-folder, NSS, or guessed volume paths.
+type ownHomeObservation struct {
+	Principal                           Principal
+	SessionRef, Home, HomesPath         string
+	Enabled, ShareAllowed, VolumeProven bool
+	CheckedAt                           time.Time
+}
+type ownHomeBridge interface {
+	ObserveOwnHome(context.Context, NativeActor) (ownHomeObservation, Code)
+}
+type dsmOwnHomeResolver struct {
+	native ownHomeBridge
+	now    func() time.Time
+}
+
+func (r *dsmOwnHomeResolver) Resolve(ctx context.Context, actor NativeActor) (*pinnedReadOnlyRoot, Code) {
+	if r == nil || r.native == nil || r.now == nil {
+		return nil, ErrUnavailable
+	}
+	if !actor.valid || !nativeFresh(actor.account.CheckedAt, r.now()) {
+		return nil, ErrDenied
+	}
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	before, c := r.native.ObserveOwnHome(ctx, actor)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return nil, c
+	}
+	validate := func(o ownHomeObservation) Code {
+		if o.Principal != actor.Principal() || o.SessionRef != actor.SessionRef() || !o.Enabled || !o.ShareAllowed {
+			return ErrDenied
+		}
+		if !o.VolumeProven {
+			return ErrUnsupported
+		}
+		if !nativeFresh(o.CheckedAt, r.now()) || !nativeFresh(actor.account.CheckedAt, r.now()) {
+			return ErrStale
+		}
+		// Only the fixed native alias is recognized. No generic realpath or symlink
+		// exception enters S5; physical HomesPath comes from the trusted native map.
+		suffix, ok := strings.CutPrefix(o.Home, "/var/services/homes/")
+		if !ok || suffix != actor.Username() || ValidateRelativeSegments([]string{suffix}, false) != "" {
+			return ErrUnsupported
+		}
+		w := readOnlyWork{RootPath: o.HomesPath, Action: ActionStat, Segments: []string{}}
+		if c := w.validate(); c != "" {
+			return c
+		}
+		return ""
+	}
+	if c = validate(before); c != "" {
+		return nil, c
+	}
+	pin, c := pinReadOnlyRoot(before.HomesPath + "/" + actor.Username())
+	if c != "" {
+		return nil, c
+	}
+	after, c := r.native.ObserveOwnHome(ctx, actor)
+	if c = nativeObservationCode(ctx, c); c == "" {
+		c = validate(after)
+	}
+	copyBefore, copyAfter := before, after
+	copyBefore.CheckedAt = time.Time{}
+	copyAfter.CheckedAt = time.Time{}
+	if c != "" || copyBefore != copyAfter {
+		pin.Close()
+		if c != "" {
+			return nil, c
+		}
+		return nil, ErrStale
+	}
+	// Bracket path/object continuity as well as native mapping metadata.
+	check, c := pinReadOnlyRoot(pin.path)
+	if c != "" {
+		pin.Close()
+		return nil, c
+	}
+	var first, second unix.Stat_t
+	same := unix.Fstat(int(pin.file.Fd()), &first) == nil && unix.Fstat(int(check.file.Fd()), &second) == nil && sameReadOnlyObject(first, second)
+	firstMount, mc := readOnlyMountID(int(pin.file.Fd()))
+	secondMount, nc := readOnlyMountID(int(check.file.Fd()))
+	same = same && mc == "" && nc == "" && firstMount == secondMount
+	check.Close()
+	if !same {
+		pin.Close()
+		return nil, ErrStale
+	}
+	if c := nativeContextCode(ctx); c != "" {
+		pin.Close()
+		return nil, c
+	}
+	if !nativeFresh(after.CheckedAt, r.now()) || !nativeFresh(actor.account.CheckedAt, r.now()) {
+		pin.Close()
+		return nil, ErrStale
+	}
+	return pin, ""
+}

package/dist/templates/native-go/backend/internal/helper/dsm_home_linux_test.go

@@ -0,0 +1,82 @@
+package helper
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+)
+
+type homeNativeFake struct {
+	value ownHomeObservation
+	code  Code
+	calls int
+	after func()
+}
+
+func (f *homeNativeFake) ObserveOwnHome(context.Context, NativeActor) (ownHomeObservation, Code) {
+	f.calls++
+	if f.after != nil {
+		f.after()
+	}
+	return f.value, f.code
+}
+func TestDSMHomeExistingOnlyAndBrackets(t *testing.T) {
+	p, _, _, c, now := nativeFixture()
+	actor, code := p.Resolve(context.Background(), c)
+	if code != "" {
+		t.Fatal(code)
+	}
+	root := t.TempDir()
+	if err := os.Mkdir(root+"/alice", 0700); err != nil {
+		t.Fatal(err)
+	}
+	native := &homeNativeFake{value: ownHomeObservation{Principal: actor.Principal(), SessionRef: actor.SessionRef(), Home: "/var/services/homes/alice", HomesPath: root, Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: now}}
+	resolver := &dsmOwnHomeResolver{native: native, now: func() time.Time { return now }}
+	pin, code := resolver.Resolve(context.Background(), actor)
+	if code != "" || native.calls != 2 {
+		t.Fatal(code, native.calls)
+	}
+	pin.Close()
+	for _, home := range []string{"/var/services/homes/bob", "/var/services/homes/../alice", "/volume1/arbitrary/alice"} {
+		native.value.Home = home
+		if pin, code = resolver.Resolve(context.Background(), actor); code == "" || pin != nil {
+			t.Fatal(home, code)
+		}
+	}
+	native.value.Home = "/var/services/homes/alice"
+	os.Remove(root + "/alice")
+	if pin, code = resolver.Resolve(context.Background(), actor); code == "" || pin != nil {
+		t.Fatal("missing home accepted")
+	}
+	if _, err := os.Stat(root + "/alice"); !os.IsNotExist(err) {
+		t.Fatal("created missing home")
+	}
+	os.Symlink(root, root+"/alice")
+	if pin, code = resolver.Resolve(context.Background(), actor); code == "" || pin != nil {
+		t.Fatal("symlink accepted")
+	}
+}
+func TestDSMHomeUnknownAndChangedMappingRefuse(t *testing.T) {
+	p, _, _, c, now := nativeFixture()
+	actor, _ := p.Resolve(context.Background(), c)
+	for _, change := range []func(*ownHomeObservation){func(o *ownHomeObservation) { o.Enabled = false }, func(o *ownHomeObservation) { o.ShareAllowed = false }, func(o *ownHomeObservation) { o.VolumeProven = false }, func(o *ownHomeObservation) { o.CheckedAt = time.Time{} }, func(o *ownHomeObservation) { o.SessionRef = grantRef('e') }} {
+		f := &homeNativeFake{value: ownHomeObservation{Principal: actor.Principal(), SessionRef: actor.SessionRef(), Home: "/var/services/homes/alice", HomesPath: t.TempDir(), Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: now}}
+		change(&f.value)
+		pin, code := (&dsmOwnHomeResolver{native: f, now: func() time.Time { return now }}).Resolve(context.Background(), actor)
+		if code == "" || pin != nil {
+			t.Fatal("unknown metadata accepted")
+		}
+	}
+	root := t.TempDir()
+	os.Mkdir(root+"/alice", 0700)
+	f := &homeNativeFake{value: ownHomeObservation{Principal: actor.Principal(), SessionRef: actor.SessionRef(), Home: "/var/services/homes/alice", HomesPath: root, Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: now}}
+	f.after = func() {
+		if f.calls == 2 {
+			f.value.ShareAllowed = false
+		}
+	}
+	if pin, code := (&dsmOwnHomeResolver{native: f, now: func() time.Time { return now }}).Resolve(context.Background(), actor); code == "" || pin != nil {
+		t.Fatal("changed observation leaked pin")
+	}
+}