[BUG] VSpace mapping changes ignore attenuated MAP rights #25

New issue

Closed

opened 2026-09-22 02:20:14 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-22 02:20:14 +02:00

Owner

Summary

Caller-local VSpace map, protection and unmap operations resolved live object identity without checking the capability's current MAP right. The fixed Kernel requires MAP before any mapping mutation. Empty and MANAGE-only attenuations retain identity without regaining mapping authority.

Reproduction

Five owned-fixture host controls ran against original Kernel d0d9e25b71 with production source unchanged. Three negative controls failed: both empty and MANAGE-only aliases admitted a new mapping, changed an existing RW mapping to R, and removed an existing mapping. The independently held MAP alias cleaned up unexpected effects before assertions. MAP-only lifecycle and removed/reused-alias controls passed. The introducing revision and last known working revision are unknown.

Expected and actual behavior

Original map, protection and unmap results were Ok(()), where RootSlotPolicyViolation was expected. The correction preserves live identity and retirement error precedence, checks the actual local capability's MAP bit and retains independent frame checks. MAP alone suffices. Host controls now pass; actual CPL3 requests through both restricted aliases are denied, preserve the same RW/NX backing and user-visible fixture value, and finish with all five temporary grants dropped.

Environment and identity

Fixed Kernel and coordinated Integration catalog, on feature/posix-compat, with original signed commit-pinned dependencies.
Rust 1.97.1; x86_64 host controls in dev/release and default/all-feature configurations.
Native release diagnostic: one TCG CPU, original 60-second guest limit and unchanged caller slot window.
The fixture owns its backing and receives frame READ/WRITE/MAP, endpoint SEND, own-VSpace MAP, MANAGE-only and empty VSpace grants. No unrelated private memory is used.

Evidence and prior checks

Four strict configurations pass 750 default / 774 all-feature tests, with three pre-existing ignored cases. Formatting, strict host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Final Markdown checks found two overlong Kernel lines and one Integration line; wrapping them preserved every executable byte and all passing test evidence.

All 172 Integration helper commands pass. Unchanged orchestration and profiler Rust sources retain their prior strict matrices. Three exact-source native executions pass lifetime, invocation and mapping; both isolation and sparse contracts pass on the mapping capture with identical runtime settings. All fifteen native component signatures verify; each packaged Kernel equals exactly one retained original artifact after normal stripping. The original exec-successor service VM also passes against the complete 73-component graph and unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty.

The manual change passes all 45 tests and 2,431 pages; 450,550 word bounds and both changed pages are reviewed, with zero final warnings or overflow. Original failing host results remain retained. The unsafe original behavior was not executed natively; native acceptance proves the corrected boundary.

Tracking

Fixed in Kernel PR 3, coordinated through Integration PR 12 and Docs PR 4. Independent hardware roots remain in Kernel issue 22. Complete authority cleanup, measured performance improvement, external toolchain rebuilding and both full EriX guest-build generations remain open in the phase checklist.

Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.

## Summary Caller-local VSpace map, protection and unmap operations resolved live object identity without checking the capability's current MAP right. The [fixed Kernel](https://git.erikinkinen.fi/erix/kernel/commit/9fdf1a17acc9204719fee42d263dacfcd701d56c) requires MAP before any mapping mutation. Empty and MANAGE-only attenuations retain identity without regaining mapping authority. ## Reproduction Five owned-fixture host controls ran against original Kernel d0d9e25b71664126c29727265f285df2f5ae7fea with production source unchanged. Three negative controls failed: both empty and MANAGE-only aliases admitted a new mapping, changed an existing RW mapping to R, and removed an existing mapping. The independently held MAP alias cleaned up unexpected effects before assertions. MAP-only lifecycle and removed/reused-alias controls passed. The introducing revision and last known working revision are unknown. ## Expected and actual behavior Original map, protection and unmap results were Ok(()), where RootSlotPolicyViolation was expected. The correction preserves live identity and retirement error precedence, checks the actual local capability's MAP bit and retains independent frame checks. MAP alone suffices. Host controls now pass; actual CPL3 requests through both restricted aliases are denied, preserve the same RW/NX backing and user-visible fixture value, and finish with all five temporary grants dropped. ## Environment and identity - Fixed [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/9fdf1a17acc9204719fee42d263dacfcd701d56c) and coordinated [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/c62dbf9d7096d41b5d073bc497949e16f5f16e13), on feature/posix-compat, with original signed commit-pinned dependencies. - Rust 1.97.1; x86_64 host controls in dev/release and default/all-feature configurations. - Native release diagnostic: one TCG CPU, original 60-second guest limit and unchanged caller slot window. - The fixture owns its backing and receives frame READ/WRITE/MAP, endpoint SEND, own-VSpace MAP, MANAGE-only and empty VSpace grants. No unrelated private memory is used. ## Evidence and prior checks Four strict configurations pass 750 default / 774 all-feature tests, with three pre-existing ignored cases. Formatting, strict host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Final Markdown checks found two overlong Kernel lines and one Integration line; wrapping them preserved every executable byte and all passing test evidence. All 172 Integration helper commands pass. Unchanged orchestration and profiler Rust sources retain their prior strict matrices. Three exact-source native executions pass lifetime, invocation and mapping; both isolation and sparse contracts pass on the mapping capture with identical runtime settings. All fifteen native component signatures verify; each packaged Kernel equals exactly one retained original artifact after normal stripping. The original exec-successor service VM also passes against the complete 73-component graph and unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. The [manual change](https://git.erikinkinen.fi/erix/docs/commit/a96c994750ed10205e7bac17be6922a53070e2d6) passes all 45 tests and 2,431 pages; 450,550 word bounds and both changed pages are reviewed, with zero final warnings or overflow. Original failing host results remain retained. The unsafe original behavior was not executed natively; native acceptance proves the corrected boundary. ## Tracking Fixed in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), coordinated through [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) and [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). Independent hardware roots remain in [Kernel issue 22](https://git.erikinkinen.fi/erix/kernel/issues/22). Complete authority cleanup, measured performance improvement, external toolchain rebuilding and both full EriX guest-build generations remain open in [the phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65). Publication CI: Kernel [638](https://git.erikinkinen.fi/erix/kernel/actions/runs/638)/[639](https://git.erikinkinen.fi/erix/kernel/actions/runs/639) and Docs [1009](https://git.erikinkinen.fi/erix/docs/actions/runs/1009)/[1010](https://git.erikinkinen.fi/erix/docs/actions/runs/1010) pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1721](https://git.erikinkinen.fi/erix/integration/actions/runs/1721)/[1722](https://git.erikinkinen.fi/erix/integration/actions/runs/1722) remains queued; it receives no CI acceptance credit.

erikinkinen

2026-09-22 02:20:14 +02:00