Repository navigation
[PLT.09, PLT.10, PLT.11, PRF.04] Completion follow-ups: wrong-user procedures, Linux and Windows reruns, PRF.04 macOS wording - #177
Merged
Merged
Conversation
… and same-account controls The second-Windows-account and second-Linux-uid denial checks cannot run inside one process tree, so the test assembly gains wrong-user-* helper modes reached only through the existing DOTNET_STARTUP_HOOKS + ARCFORGES_LOCALRPC_HELPER entry point: - wrong-user-serve|plain|launch|registration|named-pipe|unix-socket serves a PLT.09, PLT.10 or PLT.11 endpoint and prints SERVING|transport|address|owner|pid until STOP; - wrong-user-connect is a raw OS connect (no CurrentUserOnly, no library checks): REFUSED|access-denied only on UnauthorizedAccessException or EACCES; not-found, refused, busy and timeout are INCONCLUSIVE; a refusal expected by the owning account is INVALID|same-account and Linux root is INVALID|root; - wrong-user-squat-pipe and wrong-user-client: the PLT.09 foreign-pipe client check, REFUSED iff LocalRpcConnectException wraps UnauthorizedAccessException; - wrong-user-foreign-root-make and wrong-user-root-check: the PLT.10 launch-root ownership check, REFUSED only on the exact owner refusal message. Identity comes from WindowsIdentity and /proc/self/status, with no native binding. Offline tests (hosted CI) cover parsing, the classification tables, the exact owner message, the guards, the exit codes and the Windows foreign-root access list. Opt-in checks (ARCFORGES_LOCALRPC_OS_STREAMS=1) are same-account controls only and never wrong-user evidence. files.json gains the three new paths (ADP-07 inventory binding). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tests/wrong-user-procedure.md is the procedure for the checks that one account cannot run: W1 PLT.09 Named Pipe denial, W2 PLT.09 foreign-pipe client ownership, W3 PLT.10 launch-root ownership, W4 PLT.10 launch endpoint denial and W5 PLT.11 registration endpoint denial (Named Pipe and Unix socket), and U1 the Linux second-uid denial of the plain, launch and registration Unix sockets. Each section gives the account or uid set-up (a standard, non-elevated second Windows account; a non-root second uid in WSL Debian), staging (C:\ArcForgesWrongUser on the machine-wide runtime; a world-readable copy of the output and runtime on Linux), the exact runas/PowerShell and sudo -u commands, the expected lines and exit codes, controls before and after B's attempt, what is inconclusive, cleanup and the record block. On Linux each route is checked layered and isolated (helper directory opened to 0711) so the library's own modes decide. The README Validation section gains one factual paragraph linking the procedure; it has not been run, so wrong-user denial stays blocked on a second Windows account, not proven, and blocked on a second Linux uid, not proven. files.json gains the new path (ADP-07 inventory binding). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… (P2-023) S57(2) wording correction inside PRF.04's writes. The --verify-unix-peer-pid-backends PASS text and the probe's platform refusal text no longer state macOS support; the probe README and eng/verification/prf-04.md say macOS is not supported and never claimed (P2-023). The historical captured PASS line in prf-04.md stays verbatim with a dated correction note after it. The Unix backend dispatch and the RunProbeAsync platform condition are unchanged. No osx token is introduced (test_desktop_rids.py). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and the second-Linux-uid procedure The probe gains Linux-only modes; on any other OS they print INVALID and exit 2, and the two-process probe and its Windows named-pipe path are unchanged. - --wrong-uid-serve: a new owner-only 0700 /tmp/afprf04-wu-<hex> directory and the probe's own Kestrel CreateServer with the real generated LocalBootstrap service and no expected peer; prints WRONG-UID-ENDPOINT|socket|uid|pid and serves until STOP (COUNT reports Challenge dispatches). - --wrong-uid-control <socket>: the owner connect must succeed, SO_PEERCRED must name the same uid and the generated Challenge must be refused in-band. - --wrong-uid-connect <socket> <owner-uid>: a raw connect; EACCES is PASS (0), a connection is FAIL (1) with the in-band result, other errors are INCONCLUSIVE (3), the same uid or root is INVALID (2) before any connect. - --verify-wrong-uid-mode: an offline self-check of the classification, exit codes, argument and uid validation and guards; on Linux one real kernel EACCES from a chmod-000 directory, a missing socket and an SO_PEERCRED owner check. The uid comes from /proc/self/status; no LibraryImport is added. The README documents the modes, eng/verification/prf-04-second-linux-uid.md is the runnable procedure (blocked on a second Linux uid, not proven), prf-04.md links it and eng/provenance/files.json lists the new file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e summaries The LocalRpc README Validation section records the 2026-10-11 Windows opt-in re-run and the first WSL2 Debian offline and opt-in runs at 832ab2e, states wrong-user denial as blocked on a second Windows account and on a second Linux uid, not proven, discloses the AF_UNIX-on-Windows flake as run once with no repeat count, and makes no macOS claim. eng/verification/prf-04.md gains the win-x64 re-run and the linux-x64 Native AOT probe, self-check and single-uid procedure lines, and states the second-Linux-uid peer as not proven. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Independent review record: PLT.09, PLT.10, PLT.11, PRF.04 (completion follow-ups, epoch 1). Reviewer w-deku-20261011-rev-dp-transport (Opus 5.5), an independent session that authored nothing. Reviewed bba468a for [PLT.09] epoch 1, [PLT.10] epoch 1, [PLT.11] epoch 1, [PRF.04] epoch 1: approved.
Non-blocking:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DLV-41 completion follow-ups for four delivered DesktopPlatform transport tasks, in one bundle (DLV-38). These tasks stay delivered: the second-account and second-uid checks are deferred by the user (section 0e) and are "blocked on X, not proven", with runnable procedures committed here.
Claim: PLT.09 epoch 1 (w-deku-20261011-dp-transport)
Claim: PLT.10 epoch 1 (w-deku-20261011-dp-transport)
Claim: PLT.11 epoch 1 (w-deku-20261011-dp-transport)
Claim: PRF.04 epoch 1 (w-deku-20261011-dp-transport)
What this adds (coordinator rulings S57(1)-(2), S61(5))
src/BuildingBlocks/ArcForges.LocalRpc/Testsfiles and a one-arm switch inLaunchHelperProcess.cs). They drive the real PLT.09 LocalRpcServer, the PLT.10 launch endpoint and the PLT.11 RequireRegistration endpoint. Classification:Tests/wrong-user-procedure.md(W1-W5: the Named Pipe wrong-user denial, the foreign-pipe client check, the PLT.10 launch-root ownership; U1: the second Linux uid);eng/verification/prf-04-second-linux-uid.md.--verify-wrong-uid-mode). The macOS wording intests/LocalRpcAotTests/README.md,Program.csandeng/verification/prf-04.mdnow reads "not supported and never claimed (P2-023)". The historical PASS line is kept, with a dated correction note.eng/provenance/files.jsongains 5 path lines: the PRF.04 line is inside its writes, and the 4 LocalRpc lines are an ADP-07 inventory binding following the PLT.10 and PLT.11 precedent..gitleaks.tomlchange.Evidence (run once; reviewer-reproduced)
Notes
queuekey in publish-nuget.yml.🤖 Generated with Claude Code