@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/readonly_linux_test.go

@@ -1,378 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"golang.org/x/sys/unix"
-	"os"
-	"os/exec"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-	"unsafe"
-)
-
-// Linux syscall-only fixture adapter. NEVER installed in shipped helper builds;
-// DSM share gates and SynoACL masks require their own separately authorized proof.
-type fixtureReadOnlyACL struct {
-	deny bool
-	hook func()
-}
-
-func (a fixtureReadOnlyACL) Authorize(ctx context.Context, action Action, fd int) Code {
-	if ctx.Err() != nil {
-		return nativeContextCode(ctx)
-	}
-	if a.hook != nil {
-		a.hook()
-	}
-	if a.deny {
-		return ErrDenied
-	}
-	return ""
-}
-func readOnlyFixture(t *testing.T) (*pinnedReadOnlyRoot, string) {
-	t.Helper()
-	root := t.TempDir()
-	os.WriteFile(root+"/file", []byte("canary"), 0644)
-	os.Mkdir(root+"/sub", 0755)
-	os.WriteFile(root+"/sub/inside", []byte("inside"), 0644)
-	pin, code := pinReadOnlyRoot(root)
-	if code != "" {
-		t.Fatal(code)
-	}
-	t.Cleanup(func() { pin.Close() })
-	return pin, root
-}
-func readWork(pin *pinnedReadOnlyRoot, segments ...string) readOnlyWork {
-	return readOnlyWork{RootPath: pin.path, Action: ActionRead, Segments: segments, MaxBytes: MaxBoundedBytes}
-}
-func TestReadOnlyFixedOperationsAndSafeErrors(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "file"), fixtureReadOnlyACL{})
-	if result.Code != "" || string(data) != "canary" || result.Bytes != 6 {
-		t.Fatal(result, string(data))
-	}
-	result, data = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionStat, Segments: []string{"file"}}, fixtureReadOnlyACL{})
-	if result.Code != "" || result.Entry == nil || result.Entry.Kind != "regular" || result.Entry.Bytes != 6 || len(data) != 0 {
-		t.Fatal(result)
-	}
-	result, _ = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 10}, fixtureReadOnlyACL{})
-	if result.Code != "" || result.List == nil || len(result.List.Entries) != 2 {
-		t.Fatal(result)
-	}
-	for _, acl := range []readOnlyACL{nil, fixtureReadOnlyACL{deny: true}} {
-		result, data = executeReadOnly(context.Background(), pin, readWork(pin, "file"), acl)
-		if result.Code == "" || len(data) != 0 || result.Entry != nil || result.List != nil {
-			t.Fatal("ACL refusal leaked", result)
-		}
-	}
-	result, data = executeReadOnly(context.Background(), pin, readWork(pin, "missing-secret"), fixtureReadOnlyACL{})
-	b, _ := json.Marshal(result)
-	if result.Code == "" || len(data) != 0 || bytes.Contains(b, []byte("missing-secret")) || bytes.Contains(b, []byte(root)) {
-		t.Fatal(result)
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	result, _ = executeReadOnly(ctx, pin, readWork(pin, "file"), fixtureReadOnlyACL{})
-	if result.Code != ErrCanceled {
-		t.Fatal(result)
-	}
-}
-func TestReadOnlyTraversalSymlinksSpecialFilesAndHardlinks(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	os.Symlink("file", root+"/link")
-	os.Symlink("sub", root+"/dirlink")
-	os.Symlink("/etc/passwd", root+"/outside")
-	os.Link(root+"/file", root+"/alias")
-	unix.Mkfifo(root+"/fifo", 0600)
-	for _, segments := range [][]string{{"..", "file"}, {"/etc/passwd"}, {"link"}, {"dirlink", "inside"}, {"outside"}, {"file"}, {"alias"}, {"fifo"}, {"a\x00b"}} {
-		start := time.Now()
-		r, data := executeReadOnly(context.Background(), pin, readWork(pin, segments...), fixtureReadOnlyACL{})
-		if r.Code == "" || len(data) != 0 || time.Since(start) > time.Second {
-			t.Fatal(segments, r, "blocked or leaked")
-		}
-	}
-	// stat/list must not expose entries whose type or current actor ACL is refused.
-	r, _ := executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 10}, fixtureReadOnlyACL{})
-	if r.Code != "" || len(r.List.Entries) != 1 || r.List.Entries[0].Name != "sub" {
-		t.Fatal(r)
-	}
-}
-func TestReadOnlyObjectReplacementAndIntermediateRename(t *testing.T) {
-	for _, kind := range []string{"root", "middle", "file", "link-after-open"} {
-		t.Run(kind, func(t *testing.T) {
-			pin, root := readOnlyFixture(t)
-			work := readWork(pin, "sub", "inside")
-			mutated := false
-			acl := fixtureReadOnlyACL{hook: func() {
-				if mutated {
-					return
-				}
-				mutated = true
-				switch kind {
-				case "root":
-					os.Rename(root, root+"-old")
-					os.Mkdir(root, 0755)
-					t.Cleanup(func() { os.RemoveAll(root + "-old") })
-				case "middle":
-					os.Rename(root+"/sub", root+"/moved")
-					os.Mkdir(root+"/sub", 0755)
-					os.WriteFile(root+"/sub/inside", []byte("foreign"), 0644)
-				case "file":
-					os.Rename(root+"/sub/inside", root+"/sub/old")
-					os.WriteFile(root+"/sub/inside", []byte("foreign"), 0644)
-				case "link-after-open":
-					os.Link(root+"/sub/inside", root+"/alias")
-				}
-			}}
-			r, data := executeReadOnly(context.Background(), pin, work, acl)
-			if r.Code == "" || len(data) != 0 {
-				t.Fatal("mutation survived final check", r, string(data))
-			}
-		})
-	}
-}
-func TestReadOnlyBoundedReadAndList(t *testing.T) {
-	pin, root := readOnlyFixture(t)
-	os.WriteFile(root+"/large", bytes.Repeat([]byte{'x'}, MaxBoundedBytes+1), 0644)
-	r, b := executeReadOnly(context.Background(), pin, readWork(pin, "large"), fixtureReadOnlyACL{})
-	if r.Code != ErrLimit || len(b) != 0 {
-		t.Fatal(r)
-	}
-	w := readWork(pin, "file")
-	w.MaxBytes = 3
-	r, b = executeReadOnly(context.Background(), pin, w, fixtureReadOnlyACL{})
-	if r.Code != ErrLimit || len(b) != 0 {
-		t.Fatal(r)
-	}
-	os.WriteFile(root+"/exact", bytes.Repeat([]byte{'x'}, MaxBoundedBytes), 0644)
-	r, b = executeReadOnly(context.Background(), pin, readWork(pin, "exact"), fixtureReadOnlyACL{})
-	if r.Code != "" || len(b) != MaxBoundedBytes {
-		t.Fatal(r)
-	}
-	w = readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 1}
-	r, _ = executeReadOnly(context.Background(), pin, w, fixtureReadOnlyACL{})
-	if r.Code != ErrLimit || r.List != nil {
-		t.Fatal("no unbound pagination", r)
-	}
-}
-func TestReadOnlySameDeviceBindMountRefused(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("root VM mount fixture")
-	}
-	pin, root := readOnlyFixture(t)
-	other := t.TempDir()
-	os.WriteFile(other+"/secret", []byte("outside"), 0644)
-	if err := unix.Mount(other, root+"/sub", "", unix.MS_BIND, ""); err != nil {
-		t.Fatal(err)
-	}
-	defer unix.Unmount(root+"/sub", 0)
-	var a, b unix.Stat_t
-	unix.Stat(root, &a)
-	unix.Stat(root+"/sub", &b)
-	if a.Dev != b.Dev {
-		t.Fatal("fixture must share st_dev")
-	}
-	r, data := executeReadOnly(context.Background(), pin, readWork(pin, "sub", "secret"), fixtureReadOnlyACL{})
-	if r.Code == "" || len(data) != 0 {
-		t.Fatal("bind mount escaped", r)
-	}
-}
-func TestReadOnlyActorCredentialsAndKernel44Fallback(t *testing.T) {
-	if os.Getenv("M2_S5_ACTOR_FIXTURE") == "1" {
-		return
-	}
-	if os.Geteuid() != 0 {
-		t.Skip("root VM credentials fixture")
-	}
-	root, err := os.MkdirTemp("/tmp", "m2-s5-actor-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(root) })
-	os.Chmod(root, 0755)
-	os.WriteFile(root+"/group", []byte("group-only"), 0640)
-	os.Chown(root+"/group", 0, 105)
-	os.WriteFile(root+"/denied", []byte("denied-canary"), 0600)
-	os.Mkdir(root+"/no-traverse", 0700)
-	os.WriteFile(root+"/no-traverse/secret", []byte("secret"), 0644)
-	for _, groups := range [][]uint32{{101, 105}, {101}} {
-		exe, _ := os.Executable()
-		cmd := exec.Command(exe, "-test.run=^TestReadOnlyActorProcess$", "-test.v")
-		cmd.Env = append(os.Environ(), "M2_S5_ACTOR_FIXTURE=1", "M2_S5_ROOT="+root, "M2_S5_GROUP_ALLOW="+fmt.Sprint(len(groups) == 2))
-		cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 1001, Gid: 100, Groups: groups}}
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatal(err, string(out))
-		}
-		t.Log(string(out))
-	}
-}
-func TestReadOnlyActorProcess(t *testing.T) {
-	if os.Getenv("M2_S5_ACTOR_FIXTURE") != "1" {
-		t.Skip("subprocess only")
-	}
-	// All Go threads deny post-4.4 primitives; prove ENOSYS before using resolver.
-	filter := []unix.SockFilter{{Code: unix.BPF_LD | unix.BPF_W | unix.BPF_ABS, K: 0}, {Code: unix.BPF_JMP | unix.BPF_JEQ | unix.BPF_K, Jt: 1, K: unix.SYS_OPENAT2}, {Code: unix.BPF_JMP | unix.BPF_JEQ | unix.BPF_K, Jf: 1, K: unix.SYS_STATX}, {Code: unix.BPF_RET | unix.BPF_K, K: unix.SECCOMP_RET_ERRNO | uint32(unix.ENOSYS)}, {Code: unix.BPF_RET | unix.BPF_K, K: unix.SECCOMP_RET_ALLOW}}
-	program := unix.SockFprog{Len: uint16(len(filter)), Filter: &filter[0]}
-	if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
-		t.Fatal(err)
-	}
-	_, _, errno := unix.Syscall(unix.SYS_SECCOMP, unix.SECCOMP_SET_MODE_FILTER, unix.SECCOMP_FILTER_FLAG_TSYNC, uintptr(unsafe.Pointer(&program)))
-	if errno != 0 {
-		t.Fatal(errno)
-	}
-	fd, err := unix.Openat2(unix.AT_FDCWD, "/", &unix.OpenHow{Flags: unix.O_PATH})
-	if fd >= 0 {
-		unix.Close(fd)
-	}
-	if err != unix.ENOSYS {
-		t.Fatal("compatibility fixture ineffective", err)
-	}
-	root := os.Getenv("M2_S5_ROOT")
-	pin, c := pinReadOnlyRoot(root)
-	if c != "" {
-		t.Fatal(c)
-	}
-	defer pin.Close()
-	r, b := executeReadOnly(context.Background(), pin, readWork(pin, "group"), fixtureReadOnlyACL{})
-	allow := os.Getenv("M2_S5_GROUP_ALLOW") == "true"
-	if allow && (r.Code != "" || string(b) != "group-only") || !allow && (r.Code == "" || len(b) != 0) {
-		t.Fatal("supplementary group", r, string(b))
-	}
-	for _, s := range [][]string{{"denied"}, {"no-traverse", "secret"}} {
-		r, b = executeReadOnly(context.Background(), pin, readWork(pin, s...), fixtureReadOnlyACL{})
-		if r.Code == "" || len(b) != 0 {
-			t.Fatal("actor permission bypass", r)
-		}
-	}
-	r, _ = executeReadOnly(context.Background(), pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 20}, fixtureReadOnlyACL{})
-	if r.Code != "" {
-		t.Fatal(r)
-	}
-	for _, e := range r.List.Entries {
-		if e.Name == "denied" || e.Name == "no-traverse" || e.Name == "group" && !allow {
-			t.Fatal("denied metadata leaked", e)
-		}
-	}
-	t.Log("uid/gid/groups and openat2/statx ENOSYS compatibility profile passed")
-}
-
-func TestReadOnlyChildRefusesMissingEpochRootBeforeSpawn(t *testing.T) {
-	w := readOnlyWork{RootPath: "/fixture", Action: ActionRead, Segments: []string{"file"}, MaxBytes: 10}
-	child, err := startLinuxReadOnlyOperation(Client{}, "", NativeActor{}, operationBinding{}, nil, w, nil)
-	if child != nil || err == nil {
-		t.Fatal("no grant authority admitted work")
-	}
-}
-func TestReadOnlyMountInfoParserAndPinnedProcessDirectory(t *testing.T) {
-	for _, input := range []string{"", "mnt_id: 0\n", "mnt_id: nope\n", "mnt_id: 2\nmnt_id: 3\n", strings.Repeat("x", 4097)} {
-		if _, code := parseReadOnlyMountID(strings.NewReader(input)); code == "" {
-			t.Fatal("malformed mount proof", input)
-		}
-	}
-	id, code := parseReadOnlyMountID(strings.NewReader("pos: 0\nflags: 010000000\nmnt_id: 25\n"))
-	if code != "" || id != 25 {
-		t.Fatal(id, code)
-	}
-	pin, _ := readOnlyFixture(t)
-	info, err := openOperationFDInfo(os.Getpid())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer info.Close()
-	local, c := readOnlyLocalMountID(int(pin.file.Fd()))
-	proxy, p := operationFDInfoMount(info, uint32(pin.file.Fd()))
-	if c != "" || p != "" || local != proxy {
-		t.Fatal("proxy disagrees", local, proxy, c, p)
-	}
-	if _, code := operationFDInfoMount(info, 1<<21); code == "" {
-		t.Fatal("unbounded FD number")
-	}
-}
-func TestReadOnlyRelayCompletionWaitsForMetadataReader(t *testing.T) {
-	p := newLinuxOperationRelay(nil, nil, nil, nil)
-	p.readOnly = true
-	p.resultPending = make(chan readOnlyPacketOutcome, 1)
-	p.stopRelay()
-	if p.relayStopped() {
-		t.Fatal("close falsely certified metadata goroutine stopped")
-	}
-	p.resultPending <- readOnlyPacketOutcome{err: ErrCanceled}
-	if !p.relayStopped() {
-		t.Fatal("metadata goroutine not observed")
-	}
-}
-
-func TestReadOnlyRejectsRootReadableDirectoryInsteadOfPathWitness(t *testing.T) {
-	_, root := readOnlyFixture(t)
-	readable, err := os.Open(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer readable.Close()
-	pin := &pinnedReadOnlyRoot{path: root, file: readable}
-	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "file"), fixtureReadOnlyACL{})
-	if result.Code != ErrDenied || len(data) != 0 {
-		t.Fatal("root-readable descriptor accepted", result)
-	}
-}
-func TestReadOnlyTwoProcessRenameBarrier(t *testing.T) {
-	if os.Getenv("M2_S5_RENAME_FIXTURE") == "1" {
-		root := os.Getenv("M2_S5_RENAME_ROOT")
-		if err := os.Rename(root+"/sub", root+"/moved"); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Mkdir(root+"/sub", 0755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(root+"/sub/inside", []byte("foreign-canary"), 0644); err != nil {
-			t.Fatal(err)
-		}
-		return
-	}
-	pin, root := readOnlyFixture(t)
-	mutated := false
-	acl := fixtureReadOnlyACL{hook: func() {
-		if mutated {
-			return
-		}
-		mutated = true
-		exe, _ := os.Executable()
-		cmd := exec.Command(exe, "-test.run=^TestReadOnlyTwoProcessRenameBarrier$", "-test.v")
-		cmd.Env = append(os.Environ(), "M2_S5_RENAME_FIXTURE=1", "M2_S5_RENAME_ROOT="+root)
-		if b, err := cmd.CombinedOutput(); err != nil {
-			t.Fatal(err, string(b))
-		}
-	}}
-	result, data := executeReadOnly(context.Background(), pin, readWork(pin, "sub", "inside"), acl)
-	if result.Code == "" || len(data) != 0 {
-		t.Fatal("replacement/old data crossed rename barrier", result, string(data))
-	}
-}
-
-func TestReadOnlyMountReceiverClosesWitnessBeforeQuiescence(t *testing.T) {
-	pending := make(chan readOnlyPacketOutcome, 1)
-	p := &linuxOperation{closed: true, resultPending: pending}
-	closing := make(chan struct{})
-	release := make(chan struct{})
-	finished := make(chan struct{})
-	go func() {
-		runReadOnlyResultReceiver(pending, func() readOnlyPacketOutcome { return readOnlyPacketOutcome{result: &readOnlyResult{}} }, func() error { close(closing); <-release; return nil })
-		close(finished)
-	}()
-	<-closing
-	stopped := p.relayStopped()
-	close(release)
-	<-finished
-	if stopped {
-		t.Fatal("Q observed result while proc witness was still open")
-	}
-	if !p.relayStopped() {
-		t.Fatal("closed receiver prevented Q")
-	}
-}

package/templates/native-go/backend/internal/helper/readonly_mount_linux.go

@@ -1,65 +0,0 @@
-package helper
-
-import (
-	"golang.org/x/sys/unix"
-	"io"
-	"os"
-	"strconv"
-	"strings"
-)
-
-// mnt_id in Linux fdinfo predates 4.4. st_dev alone misses same-device bind
-// mounts. This fixed proc alias reads ONLY kernel metadata for our own FD.
-var readOnlySelfMountID = readOnlyLocalMountID
-var operationMountIDFallback func(int) (uint64, Code)
-
-func readOnlyMountID(fd int) (uint64, Code) {
-	id, code := readOnlySelfMountID(fd)
-	if code == "" || operationMountIDFallback == nil {
-		return id, code
-	}
-	return operationMountIDFallback(fd)
-}
-func readOnlyLocalMountID(fd int) (uint64, Code) {
-	f, err := os.Open("/proc/self/fdinfo/" + strconv.Itoa(fd))
-	if err != nil {
-		return 0, ErrUnsupported
-	}
-	defer f.Close()
-	return parseReadOnlyMountID(f)
-}
-func parseReadOnlyMountID(f io.Reader) (uint64, Code) {
-	b, err := io.ReadAll(io.LimitReader(f, 4097))
-	if err != nil || len(b) > 4096 {
-		return 0, ErrUnsupported
-	}
-	var id uint64
-	for _, line := range strings.Split(string(b), "\n") {
-		if !strings.HasPrefix(line, "mnt_id:") {
-			continue
-		}
-		if id != 0 {
-			return 0, ErrUnsupported
-		}
-		id, err = strconv.ParseUint(strings.TrimSpace(strings.TrimPrefix(line, "mnt_id:")), 10, 64)
-		if err != nil || id == 0 {
-			return 0, ErrUnsupported
-		}
-	}
-	if id == 0 {
-		return 0, ErrUnsupported
-	}
-	return id, ""
-}
-
-func readOnlyLocalMount(fd int) Code {
-	var fs unix.Statfs_t
-	if unix.Fstatfs(fd, &fs) != nil {
-		return ErrUnsupported
-	}
-	switch uint64(fs.Type) {
-	case unix.EXT4_SUPER_MAGIC, unix.BTRFS_SUPER_MAGIC, unix.XFS_SUPER_MAGIC, unix.TMPFS_MAGIC:
-		return ""
-	}
-	return ErrUnsupported
-}

package/templates/native-go/backend/internal/helper/readonly_mount_proxy_linux.go

@@ -1,113 +0,0 @@
-package helper
-
-import (
-	"golang.org/x/sys/unix"
-	"net"
-	"os"
-	"strconv"
-	"time"
-)
-
-const maxReadOnlyMountQueries = (MaxTransferBytes/MaxChunkBytes + 1) * (8*MaxPathSegments + 32)
-
-// Linux 4.4's non-dumpable actor may not read its own fdinfo. Keep it
-// non-dumpable: ask ONLY the exact root parent over the existing private socket.
-// The parent reads kernel mount metadata, never business data or ACL decisions.
-func operationMountIDProxy(control *net.UnixConn, boot operationBootstrap) func(int) (uint64, Code) {
-	var sequence uint64
-	return func(fd int) (uint64, Code) {
-		if fd < 0 || fd > 1<<20 || sequence >= maxReadOnlyMountQueries {
-			return 0, ErrLimit
-		}
-		sequence++
-		number := uint32(fd)
-		packet := readOnlyPacket{Binding: boot.Binding, Token: boot.Token, MountFD: &number, MountSequence: sequence}
-		if writeOperationPacketBound(control, packet, MaxControlBytes) != nil {
-			return 0, ErrUnavailable
-		}
-		var reply readOnlyMountReply
-		if _, err := readOperationPacketBound(control, &reply, MaxHealthBytes, ControlTimeout); err != nil || reply.Token != boot.Token || reply.Sequence != sequence {
-			return 0, ErrUnavailable
-		}
-		if reply.Code != "" {
-			if reply.Code.Valid() {
-				return 0, reply.Code
-			}
-			return 0, ErrUnavailable
-		}
-		if reply.Mount == 0 {
-			return 0, ErrUnsupported
-		}
-		return reply.Mount, ""
-	}
-}
-func openOperationFDInfo(pid int) (*os.File, error) {
-	fd, err := unix.Open("/proc/"+strconv.Itoa(pid)+"/fdinfo", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	return os.NewFile(uintptr(fd), "owned-operation-fdinfo"), nil
-}
-func operationFDInfoMount(info *os.File, number uint32) (uint64, Code) {
-	if number > 1<<20 {
-		return 0, ErrInvalid
-	}
-	// Pinned proc directory belongs to this child instance; after reap, numeric PID
-	// reuse cannot redirect this openat to another process's fdinfo directory.
-	fd, err := unix.Openat(int(info.Fd()), strconv.FormatUint(uint64(number), 10), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return 0, ErrUnsupported
-	}
-	f := os.NewFile(uintptr(fd), "owned-operation-mount")
-	defer f.Close()
-	return parseReadOnlyMountID(f)
-}
-func receiveReadOnlyResult(control *net.UnixConn, info *os.File, boot operationBootstrap, w readOnlyWork, pid int) readOnlyPacketOutcome {
-	return receiveReadOnlyProof(control, info, boot, w, pid, 0, 0, 0, BoundedTimeout)
-}
-
-func receiveReadOnlyProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w readOnlyWork, pid int, sequence, chunkSequence uint64, chunkBytes uint32, timeout time.Duration) readOnlyPacketOutcome {
-	deadline := time.Now().Add(timeout)
-	for {
-		var packet readOnlyPacket
-		remaining := time.Until(deadline)
-		if remaining <= 0 {
-			return readOnlyPacketOutcome{err: ErrTimeout}
-		}
-		cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, remaining)
-		if err != nil {
-			return readOnlyPacketOutcome{err: err}
-		}
-		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
-			return readOnlyPacketOutcome{err: errTrust}
-		}
-		if packet.Result != nil {
-			valid := packet.Result.validFor(w)
-			if chunkSequence > 0 {
-				valid = packet.Result.Entry == nil && packet.Result.List == nil && ((packet.Result.Code == "" && packet.Result.Bytes == uint64(chunkBytes)) || (packet.Result.Code.Valid() && packet.Result.Bytes == 0))
-			}
-			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != chunkSequence || !valid {
-				return readOnlyPacketOutcome{err: errTrust}
-			}
-			return readOnlyPacketOutcome{result: packet.Result, mountSequence: sequence}
-		}
-		if packet.ChunkSequence != 0 || packet.MountFD == nil || sequence >= maxReadOnlyMountQueries || packet.MountSequence != sequence+1 {
-			return readOnlyPacketOutcome{err: errTrust}
-		}
-		sequence++
-		id, code := operationFDInfoMount(info, *packet.MountFD)
-		if err := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
-			return readOnlyPacketOutcome{err: err}
-		}
-	}
-}
-
-func runReadOnlyResultReceiver(done chan<- readOnlyPacketOutcome, receive func() readOnlyPacketOutcome, closeInfo func() error) {
-	// Publish the observation only AFTER closing the proc witness. A buffered
-	// send followed by deferred Close would let the owner certify Q too early.
-	outcome := receive()
-	if err := closeInfo(); err != nil && outcome.err == nil {
-		outcome.err = err
-	}
-	done <- outcome
-}