vms-29b+vms-65b: faithful SSH->DCL handoff via $CREPRC(LOGINOUT) + executive netlogin-trust conveyance - #1229
Merged
Merged
Conversation
baron-3dl
force-pushed
the
work/vms-29b-ssh-loginout-handoff
branch
8 times, most recently
from
September 14, 2026 19:43
3c69ba4 to
60e0245
Compare
…ecutive netlogin-trust conveyance
Retires the raw-execve DCL session shim (vms-16b) and lands the last layer
of the booted-distro SSH login: an inbound `ssh SYSTEM@` reaches an
authenticated DCL `$` through the SAME LOGINOUT/$CREPRC primitive console
login and DECnet SET HOST use, per design docs/design-ssh-loginout-handoff.md
(Option A: SSH authed in-protocol against SYSUAF/Purdy; LOGINOUT trusts it,
no re-challenge).
vms-65b -- the executive conveyance. Under PRC$M_LOGINOUT $CREPRC stamps no
identity and $SETIDENT is self-targeted, so a daemon cannot reach into the
LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed
user through the executive device table instead, modeled on the SETTERM
channel-not-name precedent:
- VMS_IOCTL_TERM_SETLOGIN (CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped
network daemon vouches the authed user onto the RTAn: it minted.
- VMS_IOCTL_TERM_GETLOGIN (ordinary read): the $CREPRC(LOGINOUT) child
bound to that terminal reads the note back for ITS OWN terminal; empty
is the honest "no network pre-auth" -> prompt (fail-closed, INV-6).
netlogin_user field on struct vms_device (both substrate copies); handlers
in the shared kernel-core; wired through all registration sites (Linux +
NetBSD dispatch, the ABI mirror + size/encoding asserts, libvmssys). The
note is a NAME, never a credential -- LOGINOUT still builds the persona
from the binary SYSUAF record and grants nothing beyond it.
vms-65b -- LOGINOUT network mode (tools/vms_login.c). On startup, read the
note off this session's own terminal (getjpi terminal -> GETLOGIN); if
present, SYSUAF lookup -> loginout_network_permit (the landed fail-closed
authorization floor) -> start_session() reused verbatim (identity stamp +
UIC drop + staged-DCL activation, no password re-read). Absent falls through
to the console prompt loop unchanged (console + DECnet re-challenge).
vms-29b -- the sshd seam. The handoff runs in the still-privileged pre-drop
window (__wrap_permanently_set_uid), the only point that still holds
CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that can establish
SYSTEM to read the World-denied SYSUAF: mint vterm -> stamp note ->
$CREPRC(LOGINOUT, vterm, PRC$M_INTER|PRC$M_LOGINOUT) -> pump the SSH channel
<-> vterm until the session ends -> _exit. pw_shell now names the staged
LOGINOUT.EXE (OpenSSH's shell-existence check targets the very image the
session becomes; never execve'd -- the handoff _exits first). No fork/exec/
openpty in the daemon: ovmx_vterm_create and $CREPRC are the sole homes.
Ground-source: test_kmod_devtab_terminal.c extended -- a real /dev/vms
round trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard,
and a cross-process B-writes/A-reads proof (the SSH-stamps/LOGINOUT-reads
path through the shared executive table, the vms-515 §7.5 anti-LARP bind).
The live `ssh SYSTEM@ -> DCL $` cold-boot e2e (vms-237) remains lab-gated
(vms-101); the ssh-boot-e2e transport rides #1128.
CI-completeness (registration + test coherence for the retired mechanism):
- libvmssys_shr.vec: append the two new kif universals (VMS-native LINK
resolves vms_kif_terminal_getlogin for LOGINOUT.EXE).
- vms_kif.h: OVMX-UNWIRED vms_kif_terminal_setlogin -- its only caller is the
wrapped OpenSSH sshd, built outside the caller-census CMake graph (dlm_xnode
precedent); the getlogin read half stays census-wired via LOGINOUT.
- test_syssvc_ssh_server.c: re-scope the vms-9cc in-process capstone. The
raw-execve-DCL mechanism it asserted is retired by vms-16b; a bare KE process
cannot activate LOGINOUT.EXE (needs PID 1 /run/ovmx-boot staging), so it now
proves transport + SYSUAF/Purdy auth (valid-user ACCEPTED vs unknown REFUSED,
the non-vacuity pair) + fail-closed handoff-initiation. The end-to-end
lands-in-DCL relocates to the booted ssh-boot-e2e (vms-843a, marker
OVMX_DCL_LANDED_843a) -- a more faithful home, nothing unproven.
- tests/qemu/Dockerfile: stage LOGINOUT.EXE into the KE initramfs (build
vms_login + cp to /vms/.../SYSEXE/loginout.exe). pw_shell now names
LOGINOUT.EXE, and OpenSSH's allowed_user() stat()s pw_shell at auth time, so
test_syssvc_ssh_server's valid-user (SYSTEM) accept half was rejected before
the SYSUAF read ("shell .../loginout.exe does not exist") in the bare KE env
that stages DCL.EXE but not LOGINOUT. Test-env fix (the booted distro stages
LOGINOUT via PID 1), the faithful analogue of the existing DCL.EXE staging.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
baron-3dl
force-pushed
the
work/vms-29b-ssh-loginout-handoff
branch
from
September 14, 2026 20:23
60e0245 to
4072092
Compare
baron-3dl
added a commit
that referenced
this pull request
Sep 14, 2026
…ded handoff engineering (#1229) The 11 transport files for the booted-distro `ssh SYSTEM@ -> DCL $` proof, rebased onto post-#1229 main. The vms-29b/65b handoff engineering is now landed on main, so this carries ONLY the transport -- no engineering, no cherry-pick: - distro/Dockerfile.bootable: OVMX_TEST_ENABLE_SSH overlay build (wrapped OpenSSH sshd + privsep + hostkey/config), SSH-off by default (layered-product posture). - distro/rootfs-test-ssh/ + TCPIP$SSH_STARTUP.COM: SSH-enabled overlay that RUN/DETACHEDs the wrapped sshd (-D; __wrap_main injects -D -e -f). - tests/qemu/{run_,}ssh_boot_e2e.sh + ci.yml ssh-boot-e2e job: boot the distro, ssh SYSTEM@ (pw MANAGER), assert OVMX_DCL_LANDED_843a; wrong-pw negative. - third-party/openssh/ovmx/ovmx_ssh_wrap.c: __wrap_main -D injection. - tools/parity/image_parity.py + tests/integration/test_tcpip_posture_guard.sh: overlay-arg parity + shipped-SSH-off posture guard. Carry-forwards verified against post-#1229 main: (1) pw_shell resolves via ovmx_sshd_loginout_path -> ovmx_boot_stage_exec_path -> /run/ovmx-boot/LOGINOUT.EXE, which PID 1 stages (ovmx_init.c mandatory boot set, uppercase-matched by ovmx_boot_stage_exec_path) -> OpenSSH's shell- existence stat passes on the booted distro (unlike the bare-KE env); (2) the e2e asserts on the ssh CLIENT stdout marker (whole-file grep -qF), not a truncatable sshd-log head read -- no analog of the KE log-scan fix needed. The live ssh->DCL cold-boot e2e (vms-237) is the "verified" bracket. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last-layer engineering for the booted-distro SSH login (vms-843a): an inbound
ssh SYSTEM@reaches an authenticated DCL$through the SAME LOGINOUT/$CREPRC primitive console login and DECnet SET HOST use. Retires the raw-execve DCL session shim (vms-16b). Design:docs/design-ssh-loginout-handoff.mdOption A (SSH authed in-protocol; LOGINOUT trusts it, no re-challenge).Why standalone (not on #1128): #1128's transport (Dockerfile SSH overlay,
ssh_boot_e2e, ci.yml job) is untouched by this — the changed files (kernel,vms_login.c, the sshd seam) don't overlap it. This validates the hard executive/LOGINOUT/seam work green-by-SHA on current main, independent of the 104-commit transport branch (same posture as the #1199 floor). Fold target: the livessh SYSTEM@ -> DCL $proof (ssh-boot-e2e) runs once this rides #1128's transport — conductor's fold-vs-rebase call.vms-65b — executive conveyance
Under
PRC$M_LOGINOUT$CREPRC stamps no identity and $SETIDENT is self-targeted, so a daemon can't reach into the LOGINOUT child it creates. New terminal-scoped ioctls convey the pre-authed user through the executive device table (the SETTERM channel-not-name precedent):VMS_IOCTL_TERM_SETLOGIN(CAP_SYS_ADMIN/SETPRV-gated): a not-yet-dropped daemon vouches the authed user onto the RTAn: it minted.VMS_IOCTL_TERM_GETLOGIN(ordinary read): the$CREPRC(LOGINOUT)child bound to that terminal reads it back for its OWN terminal; empty = honest "no pre-auth" -> prompt (fail-closed).netlogin_useronstruct vms_device(both substrate copies); shared kernel-core handlers; wired through every registration site (Linux + NetBSD dispatch, ABI mirror + size/encoding asserts, libvmssys). The note is a NAME, never a credential — LOGINOUT builds the persona from binary SYSUAF and grants nothing beyond it.vms-65b — LOGINOUT network mode (
tools/vms_login.c)Read the note off this session's own terminal (getjpi terminal -> GETLOGIN); if present, SYSUAF lookup ->
loginout_network_permit(landed floor) ->start_session()reused verbatim (identity stamp + UIC drop + staged-DCL activation, no password re-read). Absent falls through to the console prompt loop unchanged.vms-29b — sshd seam
The handoff runs in the still-privileged pre-drop window (
__wrap_permanently_set_uid) — the only point still holding CAP_SYS_ADMIN to stamp the note and create a LOGINOUT that canestablish_systemto read the World-denied SYSUAF: mint vterm -> stamp note ->$CREPRC(LOGINOUT, vterm, PRC\$M_INTER|PRC\$M_LOGINOUT)-> pump SSH channel <-> vterm ->_exit.pw_shellnow names the staged LOGINOUT.EXE (OpenSSH's shell-existence check targets the image the session becomes; never execve'd). No fork/exec/openpty in the daemon.Ground-source
test_kmod_devtab_terminal.cextended: a real/dev/vmsround trip of SETLOGIN/GETLOGIN, the honest-omission floor, the OPA0: guard, and a cross-process B-writes/A-reads proof (SSH-stamps/LOGINOUT-reads through the shared executive table — the vms-515 §7.5 anti-LARP bind).Host-verified: ABI asserts on both substrates, libvmssys wrappers, LOGINOUT + both sshd TUs, and the extended kmod test all compile. The live e2e (vms-237) remains lab-gated (vms-101).
🤖 Generated with Claude Code
https://claude.ai/code/session_016PErgRQp9P1SegPxZyus3S