[FEATURE] Load compatibility ELF, TLS, constructors and declared runtime modules safely #1
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/dynlinkd#1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
Imported runtimes emit TLS, constructors, exceptions and library features beyond the native abort-only artifact policy. Supporting them requires a distinct verified contract rather than removing native loader guards.
Proposed behavior and scope
Inventory the exact toolchain’s ELF features and implement bounded relocations, symbol rules, TLS/module lifecycle, constructor/finalizer order, declared runtime loading and compatibility-only unwind registration. Run actual C++/Rust runtime VMs alongside native-loader regressions.
This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.
Authority, security and reliability
Validate complete signed module identity and dependency closure before initialization. Confine library lookup to granted roots, preserve W^X/RELRO and exact mapped object identity, and retire mappings only after their users are gone. Unsupported dangerous binding modes require separate design and evidence.
Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.
Acceptance criteria
models, constructor/finalizer and exception metadata from exact selected compiler/runtime
packages.
abort-only/no-TLS/no-init-fini policy; preserve rejection of unsupported native artifacts
instead of simply deleting existing guards.
dependency closure, cycle/duplicate behavior and no ambient library search.
template/BSS alignment, unload rules and kernel#1 synchronization.
handling; no initializer executes before validation and final mappings.
plugins/proc macros; restrict dlopen-like search to granted library roots and retire
mappings/aliases only after their users are gone.
validate metadata and keep native/kernel abort policy intact.
for imported objects; reject text relocation/lazy binding/ IFUNC modes unless separately
required, designed, tested and approved.
ambiguity, plugin teardown and out-of-realm library lookup.
regression scenarios with strict warning-free component CI.
For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.
Alternatives and tradeoffs
A permissive generic ELF loader would silently weaken the native contract. Version compatibility artifacts separately and admit only emitted features justified by the selected packages.
Coherent realm image service prerequisites — 18 September 2026: Signed
ff2cb5f2b8059c26d8e3bff990d0dba60100113eselects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 6 default, all-feature and separate production development/release configurations pass 13 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. Original push/PR CI is under observation. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open.Original coherent realm source CI acceptance — 18 September 2026: Signed
ff2cb5f2b8059c26d8e3bff990d0dba60100113epasses CI 40 and CI 39. All four terminal logs are complete (65,476 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.Tracking and rollout
Runtime consumer dependency alignment — 15 September 2026
Signed
59092cf231fb26a74b3f4af2d062eecaeae85ce7aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 13 default / 13 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds:dynlinkd-runtime: 13 development / 13 release tests. There are 6 supported native builds in total. Push/review CI 37/38 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: #3.Dependencies: integration#1, lib-posixabi#1, kernel#1, lib-cstd#1
Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use
feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.
Coherent dependency checkpoint — 20 September 2026: signed/pushed commit 3d34f23a840be1f4978eb3d9a54b08be11ee05b8 aligns original shared dependency pins with the explicit installer-rights contract. Only the manifest and roadmap change; local implementation, APIs and authority policy are unchanged. Four strict 13-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting, private rustdoc and dependency checks pass without warnings. Original CI 41/42 passes with four complete hashed logs (65,470 bytes), zero warning candidates.
Full catalog equality and actual consumer-image validation remain required under Integration regression 68. The broader work remains tracked by phase completion, including native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations. This dependency checkpoint does not close full lifecycle, frame or self-hosting acceptance.
Acknowledged terminal service dependencies — 21 September 2026: signed a6b662ef5cc0165ae6512a164326cc39ff145f98 selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under Kernel design 20. Four strict 13-test development/release and default/all-feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI 43, 44 passes; complete hashed logs total 65,512 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in Phase 6 completion.
[FEATURE] [P11] Load compatibility ELF, TLS, constructors and declared runtime modules safelyto [FEATURE] Load compatibility ELF, TLS, constructors and declared runtime modules safely