[BUG] Endpoint transfer fixtures inherit a previous non-root process #13

New issue

Closed

opened 2026-09-15 05:18:38 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-15 05:18:38 +02:00

Owner

Summary

Kernel CI fails an existing endpoint-transfer test during capability setup after another test leaves a non-root process selected. Four transfer fixtures reset the CSpace table without resetting current-process attribution, making their behavior depend on test order. This is a host-test isolation defect; no production or security-boundary failure is established.

Reproduction

At signed Kernel b1b632446ff5762761b5aee3fbdba320f5efff42, run cargo test --all-targets with ordinary test-runner concurrency. Both push and PR CI reproduce the same failure. Local full matrices passed before CI, so a passing random schedule is insufficient.

A deterministic control explicitly creates and selects a real non-root staged process before each of the four affected fixtures resets CSpaces and constructs its endpoint. With the original reset sequence, all four controls fail at capability installation with CspaceSlotMissing. No privileged IPC instruction is required to expose the fixture failure.

Expected and actual behavior

Each serialized host test must establish the process attribution its own fixture needs before using current-CSpace operations. Expected: bootstrap endpoint setup succeeds and the existing message, conflict and backpressure assertions execute independently of the previous test.

Actual: call_rejects_redundant_empty_cap_transfer_table panics during setup, and both CI runs exit 101 with 630 passed, one failed and three existing ignored tests. Source review finds the same missing process reset in the occupied-destination, unpaired-notify and stale-call-context controls. Their deterministic predecessor controls all fail before correction.

Environment and identity

Repository/revision: Kernel b1b632446ff5762761b5aee3fbdba320f5efff42, feature/posix-compat.
Host configuration: Forgejo CI on x86_64 with the repository's Rust container and pinned original dependency graph; local controls use Rust 1.97.1.
Runtime identity: actual current non-root TCB refers to a CSpace discarded by the next fixture's reset. Tests hold the existing shared object-state guard.
Image: no guest-image failure is attributed; the failure occurs in host fixture setup.
Last known working schedule: predecessor CI 544/545 passed; this does not prove those older fixtures were order-independent.

Evidence and prior checks

Push CI 546 and PR CI 547 fail only the same fixture. Both Markdown jobs pass. The four complete logs total 237,473 bytes and contain zero warning candidates.

The deterministic original control fails all four affected fixtures with the same missing-space error. The proposed correction resets the TCB subsystem before replacing CSpaces, preserves every existing behavioral assertion and runs each control after an explicitly selected foreign process. Full corrected strict validation and same-head CI acceptance remain pending.

Corrected checkpoint: signed Kernel 2e4deb7351184d3fe4517ce8d5d59eb9960f28ad passes all four deterministic controls and the full 631/655 strict unit matrices, two standalone tests and eight freestanding builds. Corrected signed-head Kernel CI 548/549 and Docs 859/860 pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified.

Tracking

Related owning issues #1 and #2, invocation design #11, and WIP PR #3. Keep this issue open until the deterministic controls, full strict checks and corrected signed-head CI pass. Preserve the original failure; do not reduce test concurrency or change production authority rules as a workaround.

## Summary Kernel CI fails an existing endpoint-transfer test during capability setup after another test leaves a non-root process selected. Four transfer fixtures reset the CSpace table without resetting current-process attribution, making their behavior depend on test order. This is a host-test isolation defect; no production or security-boundary failure is established. ## Reproduction At signed Kernel `b1b632446ff5762761b5aee3fbdba320f5efff42`, run `cargo test --all-targets` with ordinary test-runner concurrency. Both push and PR CI reproduce the same failure. Local full matrices passed before CI, so a passing random schedule is insufficient. A deterministic control explicitly creates and selects a real non-root staged process before each of the four affected fixtures resets CSpaces and constructs its endpoint. With the original reset sequence, all four controls fail at capability installation with `CspaceSlotMissing`. No privileged IPC instruction is required to expose the fixture failure. ## Expected and actual behavior Each serialized host test must establish the process attribution its own fixture needs before using current-CSpace operations. Expected: bootstrap endpoint setup succeeds and the existing message, conflict and backpressure assertions execute independently of the previous test. Actual: `call_rejects_redundant_empty_cap_transfer_table` panics during setup, and both CI runs exit 101 with 630 passed, one failed and three existing ignored tests. Source review finds the same missing process reset in the occupied-destination, unpaired-notify and stale-call-context controls. Their deterministic predecessor controls all fail before correction. ## Environment and identity - Repository/revision: Kernel `b1b632446ff5762761b5aee3fbdba320f5efff42`, feature/posix-compat. - Host configuration: Forgejo CI on x86_64 with the repository's Rust container and pinned original dependency graph; local controls use Rust 1.97.1. - Runtime identity: actual current non-root TCB refers to a CSpace discarded by the next fixture's reset. Tests hold the existing shared object-state guard. - Image: no guest-image failure is attributed; the failure occurs in host fixture setup. - Last known working schedule: predecessor CI 544/545 passed; this does not prove those older fixtures were order-independent. ## Evidence and prior checks [Push CI 546](https://git.erikinkinen.fi/erix/kernel/actions/runs/546) and [PR CI 547](https://git.erikinkinen.fi/erix/kernel/actions/runs/547) fail only the same fixture. Both Markdown jobs pass. The four complete logs total 237,473 bytes and contain zero warning candidates. The deterministic original control fails all four affected fixtures with the same missing-space error. The proposed correction resets the TCB subsystem before replacing CSpaces, preserves every existing behavioral assertion and runs each control after an explicitly selected foreign process. Full corrected strict validation and same-head CI acceptance remain pending. Corrected checkpoint: signed Kernel `2e4deb7351184d3fe4517ce8d5d59eb9960f28ad` passes all four deterministic controls and the full 631/655 strict unit matrices, two standalone tests and eight freestanding builds. Corrected signed-head Kernel CI [548](https://git.erikinkinen.fi/erix/kernel/actions/runs/548)/[549](https://git.erikinkinen.fi/erix/kernel/actions/runs/549) and Docs [859](https://git.erikinkinen.fi/erix/docs/actions/runs/859)/[860](https://git.erikinkinen.fi/erix/docs/actions/runs/860) pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. ## Tracking Related owning issues #1 and #2, invocation design #11, and WIP PR #3. Keep this issue open until the deterministic controls, full strict checks and corrected signed-head CI pass. Preserve the original failure; do not reduce test concurrency or change production authority rules as a workaround.

erikinkinen added the

bug

phase-6

labels

2026-09-15 05:18:38 +02:00

erikinkinen referenced this issue from a commit

2026-09-15 05:23:07 +02:00

fix: Reset process attribution before transfer fixture setup

erikinkinen referenced this issue

2026-09-15 05:31:18 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue