Repository navigation
test: recognize deferred SEP policy-window unlock - #1564
Closed
DjDeveloperr wants to merge 2 commits into
Closed
DjDeveloperr wants to merge 2 commits into
DjDeveloperr wants to merge 2 commits into
Conversation
The cached ref-key path defines its unlock closure before dispatching it through the real-root policy window. Validate that complete dispatch and reject an unwrapped or extra invocation instead of inspecting only the source preceding the call inside the closure. Preserve the existing initrd exception, call-site inventory and Touch ID assertions. Add negative controls for an unguarded real-root call and extra direct use. No production SEP, keybag or guard-policy changes. Assisted-by: LLM
DjDeveloperr
added a commit
to joske/linux
that referenced
this pull request
Nov 11, 2026
Backport the test-only correction from aurora-silicon#1564. The cached ref-key unlock closure is dispatched through the real-root policy window after its definition. Validate that complete dispatch and reject unwrapped or extra invocation; retain call-site inventory and initrd rules. No production SEP, keybag or guard-policy changes. Assisted-by: LLM
This was referenced Nov 11, 2026
Whitespace only; preserve every assertion and negative control. Assisted-by: LLM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Superseded by #1561, merged as ea10c4d with all four checks passing. Closing this duplicate implementation; its branch and local review/mutation evidence are retained. Pending backports are being aligned with the merged upstream test.
The policy-window source check falsely rejects
refkey_unseal_cached: it examines text before the call inside a deferred closure, while the real-rootpolicy_window(unlock)invocation follows the closure definition. Validate that complete dispatch, allow the direct call only in the existingkeystore_onlybranch, and reject any extra closure use. Existing call-site inventory and Touch ID checks remain intact. This changes only the regression test; production SEP and guard policy are unchanged.Validation: the original test reproduces its one failure on integration
125e6966; the repaired seven cases pass normally and with Python-Oagainst all 42 hash-verified top-level Rust sources. Negative controls reject an unwrapped real-root call and an extra direct invocation. Independent review also rejected reversed-initrd-condition, unconditional-dispatch and out-of-closure PREPARE mutants. The same inherited false positive blocks #1476's source job.