[BUG] Frame mappings add unrequested user read access #26

New issue

Closed

opened 2026-09-22 03:19:35 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-22 03:19:35 +02:00

Owner

Summary

The original ordinary mapping path admitted write-only and execute-only access and emitted user-accessible leaves for records with no requested user access. The fixed Kernel carries explicit READ through admission, activation and leaf encoding. No-access mappings retain backing with USER/WRITE clear and NX set; unsupported combinations fail without adding READ.

Reproduction

Four owned-fixture host controls ran once against original Kernel 841583c562. Changes were limited to tests, their module declaration and a test-only view of the unchanged production encoder. The command was cargo test --locked --no-default-features frame_access_ -- --nocapture, with strict warning flags. Three controls failed and one passed. The introducing revision and last known working revision are unknown.

Expected and actual behavior

Four write-only/execute-only attempts returned Ok(()) instead of RootSlotPolicyViolation, including restricted frame ceilings and readable grants whose requests omitted READ. No-access mappings requested as zero or MAP emitted USER bit 4 instead of zero. Removing final READ produced the same mismatch on activation. Supported R/RW/RX literal-bit checks passed.

The correction rejects WRITE or EXECUTE without requested READ and retains the W+X prohibition. Current rights determine both immediate mappings and later activation. No-access mappings remain present with USER/WRITE clear and NX set. Seven added host controls cover the original boundaries, preserved protection refusals, reactivation and managed allocation reclamation only after final unmap. Unreachable ordinary anonymous/fallback branches are removed. Existing protection-transition rules remain unchanged; general POSIX protection semantics are not established.

Environment and identity

Fixed Kernel and coordinated Integration catalog, on feature/posix-compat, with original signed commit-pinned dependencies.
Rust 1.97.1; x86_64 host controls in dev/release and default/all-feature configurations.
Native release diagnostic: one TCG CPU, original 60-second guest limit and unchanged caller slot window.
Owned managed frames in host controls; private fixture backing in the native image. Actual CPL3 calls use explicit frame, VSpace and endpoint grants. No unrelated private memory is used.

Evidence and prior checks

Four strict configurations pass 757 default / 781 all-feature tests, with three pre-existing ignored cases. Formatting, strict host/native Clippy, host/native private rustdoc and thirteen native builds pass without warnings. The original failing host evidence remains retained; the original unsafe behavior was not executed natively.

The corrected lifetime fixture executes 24 CPL3 calls and preserves every earlier domain and VSpace MAP witness. Further calls remove access, reject write-only access, derive a MAP-only frame alias after dropping the previous occupant, reject READ through that alias and unmap after both frame grants are dropped. Native leaf checks require exact backing, USER/WRITE clear and NX set in every inaccessible state, and exact original restoration after unmap. All original and derived grants are disposed. Execute-only admission is covered by managed-frame host controls; the native DeviceFrame fixture does not establish that case.

All 172 Integration helpers pass; unchanged orchestration and profiler Rust sources retain their strict matrices. Three exact-source native executions pass lifetime, invocation and mapping, with isolation and sparse contracts checked on the identical-runtime mapping capture. All fifteen selected signatures verify; each packaged Kernel equals one retained original artifact after normal stripping. The ordinary exec-successor service VM passes against the full 73-component graph and its original 120-second guest limit. Image builds emit no warnings and QEMU stderr is empty.

The manual change passes 45 tests and 2,433 pages; 450,702 word bounds and the changed rendered page are reviewed, with zero final warnings or overflow.

Tracking

Fixed in Kernel PR 3, coordinated through Integration PR 12 and Docs PR 4. VSpace MAP admission is separately recorded in report 25; independent hardware roots remain in Kernel issue 22. Full authority cleanup, measured performance improvement, external toolchain rebuilding and both complete EriX guest-build generations remain open in the phase checklist.

Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.

## Summary The original ordinary mapping path admitted write-only and execute-only access and emitted user-accessible leaves for records with no requested user access. The [fixed Kernel](https://git.erikinkinen.fi/erix/kernel/commit/6671466a84cdc4994384e1b8391d6a01fa66fb09) carries explicit READ through admission, activation and leaf encoding. No-access mappings retain backing with USER/WRITE clear and NX set; unsupported combinations fail without adding READ. ## Reproduction Four owned-fixture host controls ran once against original Kernel 841583c562dea11068400be7751ac72becf5dd72. Changes were limited to tests, their module declaration and a test-only view of the unchanged production encoder. The command was `cargo test --locked --no-default-features frame_access_ -- --nocapture`, with strict warning flags. Three controls failed and one passed. The introducing revision and last known working revision are unknown. ## Expected and actual behavior Four write-only/execute-only attempts returned Ok(()) instead of RootSlotPolicyViolation, including restricted frame ceilings and readable grants whose requests omitted READ. No-access mappings requested as zero or MAP emitted USER bit 4 instead of zero. Removing final READ produced the same mismatch on activation. Supported R/RW/RX literal-bit checks passed. The correction rejects WRITE or EXECUTE without requested READ and retains the W+X prohibition. Current rights determine both immediate mappings and later activation. No-access mappings remain present with USER/WRITE clear and NX set. Seven added host controls cover the original boundaries, preserved protection refusals, reactivation and managed allocation reclamation only after final unmap. Unreachable ordinary anonymous/fallback branches are removed. Existing protection-transition rules remain unchanged; general POSIX protection semantics are not established. ## Environment and identity - Fixed [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/6671466a84cdc4994384e1b8391d6a01fa66fb09) and coordinated [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/b45edf143f599699f80e70a13827762d3e4da77e), on feature/posix-compat, with original signed commit-pinned dependencies. - Rust 1.97.1; x86_64 host controls in dev/release and default/all-feature configurations. - Native release diagnostic: one TCG CPU, original 60-second guest limit and unchanged caller slot window. - Owned managed frames in host controls; private fixture backing in the native image. Actual CPL3 calls use explicit frame, VSpace and endpoint grants. No unrelated private memory is used. ## Evidence and prior checks Four strict configurations pass 757 default / 781 all-feature tests, with three pre-existing ignored cases. Formatting, strict host/native Clippy, host/native private rustdoc and thirteen native builds pass without warnings. The original failing host evidence remains retained; the original unsafe behavior was not executed natively. The corrected lifetime fixture executes 24 CPL3 calls and preserves every earlier domain and VSpace MAP witness. Further calls remove access, reject write-only access, derive a MAP-only frame alias after dropping the previous occupant, reject READ through that alias and unmap after both frame grants are dropped. Native leaf checks require exact backing, USER/WRITE clear and NX set in every inaccessible state, and exact original restoration after unmap. All original and derived grants are disposed. Execute-only admission is covered by managed-frame host controls; the native DeviceFrame fixture does not establish that case. All 172 Integration helpers pass; unchanged orchestration and profiler Rust sources retain their strict matrices. Three exact-source native executions pass lifetime, invocation and mapping, with isolation and sparse contracts checked on the identical-runtime mapping capture. All fifteen selected signatures verify; each packaged Kernel equals one retained original artifact after normal stripping. The ordinary exec-successor service VM passes against the full 73-component graph and its original 120-second guest limit. Image builds emit no warnings and QEMU stderr is empty. The [manual change](https://git.erikinkinen.fi/erix/docs/commit/45dae3cee4116b9387c4f3d3d2687a87f0fa340b) passes 45 tests and 2,433 pages; 450,702 word bounds and the changed rendered page are reviewed, with zero final warnings or overflow. ## Tracking Fixed in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), coordinated through [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) and [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). VSpace MAP admission is separately recorded in [report 25](https://git.erikinkinen.fi/erix/kernel/issues/25); independent hardware roots remain in [Kernel issue 22](https://git.erikinkinen.fi/erix/kernel/issues/22). Full authority cleanup, measured performance improvement, external toolchain rebuilding and both complete EriX guest-build generations remain open in [the phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65). Publication CI: Kernel [640](https://git.erikinkinen.fi/erix/kernel/actions/runs/640)/[641](https://git.erikinkinen.fi/erix/kernel/actions/runs/641) and Docs [1011](https://git.erikinkinen.fi/erix/docs/actions/runs/1011)/[1012](https://git.erikinkinen.fi/erix/docs/actions/runs/1012) pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1723](https://git.erikinkinen.fi/erix/integration/actions/runs/1723)/[1724](https://git.erikinkinen.fi/erix/integration/actions/runs/1724) remains queued; it receives no CI acceptance credit.

erikinkinen

2026-09-22 03:19:35 +02:00