vms-387: re-anchor register-continue-identity-dropped at the identity/privilege copy SITE - #1223
Merged
Merged
Conversation
…/privilege copy SITE (OPTION 1) The old anchor `shared_vms_pid = parent->vms_pid` drifted: the source refactored PID-sharing into `if (share_pid)` (12-space indent), so the 8-space sed no longer matched -- the defect was a selftest FAIL on origin/main, and even when it had matched it only stopped PID sharing (reddening test_kmod_exit's PID-share check) while the identity copy ran intact, leaving test_syssvc_identcont ORPHANED with no can-fail anchor. Re-anchor at the copy SITE itself per the never-orphan invariant (re-anchor > retire+refile > scope-out): zero the UNCONDITIONAL privilege copy `proc->cur_privs = parent->cur_privs` inside vms_proc_continue_identity(). The continued image (REGISTER_CONTINUE) and the $CREPRC subprocess (REGISTER_SUBPROCESS) both still register (CONTINUE_STATUS=1, username/UIC copied), but carry privs 0 instead of the mask the executive should have carried forward. That is a genuine, name-honest identity defect at the exact site, NOT the PID-sharing lie. Because the copy is shared by both entry points (share_pid is the only differing branch, forbidden as a re-anchor), the honest can-fail set is BOTH consumers: test_syssvc_identcont (SYSPRV/FIELD parent images lose their mask) AND test_syssvc_creprc_inherit (a non-root subprocess loses the SYS_PRIVS it should inherit from the executive). This also gives creprc_inherit a can-fail anchor it previously lacked. selftest: injects + no-op-reapply-has-teeth ok; every require_fail/ knock_on_fail label exists literally in a suite source. Runtime exact-red set proven separately via negctl-adhoc before flagging for reap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HMDFjHCqxDuXgbyxNU572h
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Re-anchors the
register-continue-identity-droppednegctl defect at the identity/privilege copy SITE invms_proc_continue_identity()(OPTION 1, the never-orphan invariant), replacing the driftedshared_vms_pidanchor.Why
On origin/main the old anchor
shared_vms_pid = parent->vms_pidno longer matched (source refactored PID-sharing intoif (share_pid), 12-space indent) → selftest FAIL. Even when it had matched, it only stopped PID sharing (reddeningtest_kmod_exit) while the identity copy ran intact — leavingtest_syssvc_identcontorphaned with no can-fail anchor (conductor FINDING 1).Change
Zero the unconditional privilege copy
proc->cur_privs = parent->cur_privsinside the parentmode_lock. The continued image and the$CREPRCsubprocess both still register (CONTINUE_STATUS=1, username/UIC copied) but carry privs 0 — a genuine, name-honest identity defect at the exact site, not the PID-sharing lie.Because the copy is shared by both entry points, the honest can-fail set is both consumers:
test_syssvc_identcont— SYSPRV/FIELD parent images lose their masktest_syssvc_creprc_inherit— a non-root subprocess loses the SYS_PRIVS it should inherit from the executive (previously had no anchor either)Proof
negctl-adhocbefore flagging for reap.🤖 Generated with Claude Code
https://claude.ai/code/session_01HMDFjHCqxDuXgbyxNU572h