[FEATURE] Bind a local SEND revoker to its holder's process lifetime #7

New issue

Open

opened 2026-09-14 08:56:29 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-14 08:56:29 +02:00

Owner

Problem and motivation

Native realm routes need revocation custody that survives loss of their Procd owner. Holding a revoker only in that process does not establish independent terminal cleanup, and a second descriptive owner record is not another native guard. The kernel already owns process terminal transitions and the exact local SEND-branch lineage mechanism.

Provide an opt-in mechanism that transfers an existing local revoker into the caller's process lifetime. Compatibility admission and realm policy remain in userspace.

Proposed behavior and scope

Add one register-only x86_64 syscall, BIND_LOCAL_REVOCATION_LIFETIME at 0x4B, and a matching userspace shim. Like existing register-only local capability operations, the wrapper has no caller pointer or Rust memory-safety precondition; the internal assembly remains unsafe and the kernel validates all authority. rdi names a nonzero caller-local revocation-grant slot; every other argument is zero. Return the ordinary status in rax and zero in rdx.

The current Running process, nonzero native stage generation, admitted syscall window, actual exact MANAGE grant and caller-local SEND-derivation provenance must all validate. Successful binding consumes that unique local grant into kernel-owned lifetime custody. It returns no handle, authority or process identifier, and has no withdrawal operation. Failed admission preserves the actual local guard and existing lineage. An already-empty branch can retire immediately.

The original source, older siblings, receivers and independent setup masters remain outside this guard. Only descendants of its selected at-most-SEND branch are covered. A producer may keep a distinct nested revoker for ordinary retirement, establish the ancestor's lifetime custody before export, and explicitly dispose of unguarded setup authority. Normal copies continue to extend the existing lineage. When its last descendant disappears, a deposited lifetime record can be reclaimed without waiting for owner death.

Implement this across lib-ipc and kernel, then use it in the coordinated Procd/mediator setup contract. Update Posixd's ownership document and the technical manual as the mechanism and producer graph become concrete. No existing syscall is repurposed, no process-event queue is shared with another service, and no compatibility executable is added to boot.img.

Authority, security and reliability

Binding accepts no foreign process selector, CSpace selector, pointer, clock source, endpoint factory or process-control route. The actual current process and its nonwrapping stage generation determine lifetime. A reused numeric TCB identifier cannot inherit another generation's guard. Staged-install revokers and broader capability classes are outside this initial SEND-branch contract.

Serialize binding and terminal cleanup with the existing terminal/reply lifecycle boundary and BSP syscall execution. Keep the revocation table lock out of capability removal, which reenters lineage bookkeeping. Reuse the already allocated guard record; no lineage snapshot or separate guardian service is required. This does not establish concurrent userspace SMP support or a new scheduling fairness guarantee.

Before changing the owner to terminal, reserve the terminal event and validate the deposited branch bindings without removing authority. Refusal cancels that reservation and leaves the owner live and the actual guard retained. After the existing successful terminal-state transition, remove the prevalidated aliases locally before publishing the terminal event. This path performs no peer IPC or new allocation. A successful healthy transition therefore does not depend on Procd or another service making progress.

An unexpected internal removal failure after terminal commit must retain the remaining actual guard and first failure and enter kernel fail-stop before ordinary execution resumes. It must not publish a successful cleanup acknowledgment, discard the guard, or claim rollback of a partially removed branch. This is an explicit kernel-integrity failure policy, not a recoverable userspace error or a promise of arbitrary crash recovery. Test admission refusals separately from this post-commit invariant failure.

Alias absence, native process destruction, pending operation completion and provider-lease retirement remain distinct. This mechanism grants no cancellation acknowledgment or permission to release a retained IPC buffer. Kernel loss is outside the surviving-custodian model; an unresponsive process that has not undergone a terminal transition is not deemed dead.

Acceptance criteria

Demonstrate actual local guard consumption and unchanged source/sibling authority, with no extra capability returned or minted.
Reject missing/currently nonrunning callers, zero/reserved/oversized arguments, out-of-window slots, wrong types/rights and staged-install provenance without effects.
Exercise descendants across CSpaces, nested guards, empty branches, slot reuse and nonwrapping process-generation reuse.
Show owner exit and kill remove the deposited branch before event observation or process destruction, without depending on a userspace guardian.
Preserve ordinary revoker move/drop behavior, staged-install restrictions and existing authority/error ordering.
Test terminal preflight refusal without a state transition, and partial internal removal failure with the actual remaining guard and first error retained. No silent successful cleanup is acceptable.
Validate allocation-free deposit/retirement bookkeeping over already admitted resources, without claiming a guest latency improvement or constant-time lineage scans.
Run formatting, strict Clippy, warning-denied builds/rustdoc and all affected host/unit/feature/profile checks; add bounded native VM integration evidence for the new mechanism and retain original regressions.
Publish signed coherent dependency selections, update affected documentation/API references, and observe each published revision's own CI. Full native realm and two-generation self-hosting acceptance remain required separately.

Alternatives and tradeoffs

A dedicated userspace holder needs its own surviving lifecycle, narrow notification or lease contract, bootstrap inventory and progress policy. The current process-event interface is a destructive queue with one wake target, not an independently provisioned subscription. A narrow clock route could support a conservative lease, but expiry would not establish process death and still needs an independent execution loop.

Kernel-owned lifetime custody is selected here as an opt-in object-lifetime mechanism. It avoids a service dependency while adding kernel state and a checked terminal-cleanup obligation. Preflight and explicit fail-stop are essential: one best-effort sweep followed by normal execution would not meet the contract. It covers only the already-held SEND lineage and does not solve operation completion or whole-process teardown.

Validation checkpoint — 14 September 2026: Signed feature e6bea362f9199230bf84269b1a8da6bd8da6470d carries original signed maintenance ancestor 2f85d8a0e2e502ff1126ba40263296bc72f4635a. The ordinary and lifetime graphs preserve their respective IPC/capability selections. All strict default/all development/release checks pass; the final fixture matrix passes 610/634 units plus one standalone on the feature graph and 586/610 units on the maintenance graph, with three pre-existing ignores. CI 532 and 533 pass with four complete logs, 624,386 bytes and zero warning candidates. Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c passes the actual native distinct-argument/lifetime VM in 20.204185 seconds and the unchanged ordinary Rootd IPC-framing VM in 45.264436 seconds, with empty stderr. These are host build/run durations, not guest performance results. Both signed images are byte-identical to the preceding accepted transition images. Realm producer adoption and full guest builds remain open.

Tracking and rollout

The isolated native mechanism is accepted at signed Kernel 03e13a784bde08914864267a4e2a6324a22d05c7, selected by signed Integration 4b65755f, with Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5, IPC de6892790de69f40f749c393d24078b287b36175 and capability ABI 984c9f7b0ca910488f8c5b035d2f0cb88f18d304.

Two private CPL3 owners execute actual syscall entry for refusal, consumed custody and repeated-slot denial. Ordinary exit and an independent observer's SEND-only Process endpoint exercise both terminal paths. Unchanged dispatch witnesses require exact generations and returns, cross-CSpace SEND/zero-right descendant absence, preserved independent aliases and exact terminal events. The fixture removes temporary CNode/TCB/VSpace handles before entry and retains its 16 owned code/stack/message pages until shutdown. It changes neither scheduler decisions nor production cleanup. Normal images exclude the fixture.

The native scenario passes the required debug exit, ordered and unique begin/complete markers and all forbidden-marker checks. QEMU stderr is empty. The full build-and-run command takes 19.202361 seconds under the unchanged 60-second VM hard and 45-second silence limits, with one CPU, 1 GiB RAM, TCG and no network; this duration is not a guest performance measurement. The signed 2,142,208-byte image has SHA256 4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797. The 1,552-byte serial log has SHA256 8cc7f9a7250881eddbc056834c46d7437ce944dd4b60c8b96e2c622bad2a85f9. The exact 15-repository graph and all 16 Cargo manifests are validated.

Push CI 528 and PR CI 529 pass for that signed Kernel. Four complete logs total 623,648 bytes with no warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units plus the three standalone executions; three existing experiments remain ignored per unit suite. Local strict default/all-feature development/release host and freestanding checks, private rustdoc, four native/normal builds and symbol exclusion checks pass.

The failed pre-correction images remain retained: Bootloader issue 5 covers the runtime-name rejection; Kernel issue 9 covers markers suppressed by an unrelated Rootd smoke feature. The corrected entry point supplies a typed kernel-only begin/complete reporter without a new service route. Both defects now have exact-source CI and actual VM evidence.

The existing syscall and generated IPC manual is accepted at Docs 28b44183368c512da9c5b804f570ff497ae3b6fc with CI 839/840. The native diagnostic and runtime namespace manual is accepted at signed Docs 17b4d52a9a84e0803746e3a38eb34f070bfb28a4, with green CI 841/842 and zero final warnings. Integration CI 1603/1604 is running, including older VM regressions and the additional diagnostic. Realm producer migration, two-realms/two-clients actual byte I/O, pending-operation/provider completion, the complete authority audit and both full build generations inside EriX remain open.

Current signed 90fb945e291d1f8bb0b838d7ab8deccd1895600c passes push CI 524 and PR CI 525. Four complete logs total 622,018 bytes, with no compiler/lint warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units, plus the standalone allocation regression in all three selections. Three pre-existing experiments remain ignored per unit suite. The deterministic order regression and both originally failing allocator tests pass in all three selections; both Markdown jobs pass. Original CI523 and the deterministic pre-fix failure remain retained in #8. This closes the allocator fixture regression only; native VM, producer, audit and self-hosting gates remain open; the later manual checkpoint is recorded above.

The lifetime mechanism is implemented in signed 7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e; current signed 90fb945e291d1f8bb0b838d7ab8deccd1895600c corrects the allocator fixture order regression tracked in #8. The coherent IPC/capability library checkpoints have green CI. The strict lifetime matrix, ten new unit regressions and measured allocation-free deposit/prepared terminal removal pass. Original kernel CI 522 passes/CI 523 fails are retained; the corrected host matrix passes 609/633 units with ordinary concurrency, and its own CI now passes as recorded below. WIP PR #3 retains complete scope. Native VM, manual/API and producer acceptance, broader audit and two-generation guest self-hosting remain open.

Realm ownership: posixd #1.
Kernel audit/implementation: kernel #2 and kernel PR #3.
Shared ABI audit: lib-ipc #1.
Publish the ABI/shim contract first, pin that full signed commit in kernel, and implement/test the native custody mechanism before migrating realm producers. Keep existing component/image selections unchanged until a coherent new native proof is prepared. WIP status and pending gates must remain explicit.

## Problem and motivation Native realm routes need revocation custody that survives loss of their Procd owner. Holding a revoker only in that process does not establish independent terminal cleanup, and a second descriptive owner record is not another native guard. The kernel already owns process terminal transitions and the exact local SEND-branch lineage mechanism. Provide an opt-in mechanism that transfers an existing local revoker into the caller's process lifetime. Compatibility admission and realm policy remain in userspace. ## Proposed behavior and scope Add one register-only x86_64 syscall, `BIND_LOCAL_REVOCATION_LIFETIME` at `0x4B`, and a matching userspace shim. Like existing register-only local capability operations, the wrapper has no caller pointer or Rust memory-safety precondition; the internal assembly remains unsafe and the kernel validates all authority. `rdi` names a nonzero caller-local revocation-grant slot; every other argument is zero. Return the ordinary status in `rax` and zero in `rdx`. The current Running process, nonzero native stage generation, admitted syscall window, actual exact MANAGE grant and caller-local SEND-derivation provenance must all validate. Successful binding consumes that unique local grant into kernel-owned lifetime custody. It returns no handle, authority or process identifier, and has no withdrawal operation. Failed admission preserves the actual local guard and existing lineage. An already-empty branch can retire immediately. The original source, older siblings, receivers and independent setup masters remain outside this guard. Only descendants of its selected at-most-SEND branch are covered. A producer may keep a distinct nested revoker for ordinary retirement, establish the ancestor's lifetime custody before export, and explicitly dispose of unguarded setup authority. Normal copies continue to extend the existing lineage. When its last descendant disappears, a deposited lifetime record can be reclaimed without waiting for owner death. Implement this across lib-ipc and kernel, then use it in the coordinated Procd/mediator setup contract. Update Posixd's ownership document and the technical manual as the mechanism and producer graph become concrete. No existing syscall is repurposed, no process-event queue is shared with another service, and no compatibility executable is added to boot.img. ## Authority, security and reliability Binding accepts no foreign process selector, CSpace selector, pointer, clock source, endpoint factory or process-control route. The actual current process and its nonwrapping stage generation determine lifetime. A reused numeric TCB identifier cannot inherit another generation's guard. Staged-install revokers and broader capability classes are outside this initial SEND-branch contract. Serialize binding and terminal cleanup with the existing terminal/reply lifecycle boundary and BSP syscall execution. Keep the revocation table lock out of capability removal, which reenters lineage bookkeeping. Reuse the already allocated guard record; no lineage snapshot or separate guardian service is required. This does not establish concurrent userspace SMP support or a new scheduling fairness guarantee. Before changing the owner to terminal, reserve the terminal event and validate the deposited branch bindings without removing authority. Refusal cancels that reservation and leaves the owner live and the actual guard retained. After the existing successful terminal-state transition, remove the prevalidated aliases locally before publishing the terminal event. This path performs no peer IPC or new allocation. A successful healthy transition therefore does not depend on Procd or another service making progress. An unexpected internal removal failure after terminal commit must retain the remaining actual guard and first failure and enter kernel fail-stop before ordinary execution resumes. It must not publish a successful cleanup acknowledgment, discard the guard, or claim rollback of a partially removed branch. This is an explicit kernel-integrity failure policy, not a recoverable userspace error or a promise of arbitrary crash recovery. Test admission refusals separately from this post-commit invariant failure. Alias absence, native process destruction, pending operation completion and provider-lease retirement remain distinct. This mechanism grants no cancellation acknowledgment or permission to release a retained IPC buffer. Kernel loss is outside the surviving-custodian model; an unresponsive process that has not undergone a terminal transition is not deemed dead. ## Acceptance criteria - Demonstrate actual local guard consumption and unchanged source/sibling authority, with no extra capability returned or minted. - Reject missing/currently nonrunning callers, zero/reserved/oversized arguments, out-of-window slots, wrong types/rights and staged-install provenance without effects. - Exercise descendants across CSpaces, nested guards, empty branches, slot reuse and nonwrapping process-generation reuse. - Show owner exit and kill remove the deposited branch before event observation or process destruction, without depending on a userspace guardian. - Preserve ordinary revoker move/drop behavior, staged-install restrictions and existing authority/error ordering. - Test terminal preflight refusal without a state transition, and partial internal removal failure with the actual remaining guard and first error retained. No silent successful cleanup is acceptable. - Validate allocation-free deposit/retirement bookkeeping over already admitted resources, without claiming a guest latency improvement or constant-time lineage scans. - Run formatting, strict Clippy, warning-denied builds/rustdoc and all affected host/unit/feature/profile checks; add bounded native VM integration evidence for the new mechanism and retain original regressions. - Publish signed coherent dependency selections, update affected documentation/API references, and observe each published revision's own CI. Full native realm and two-generation self-hosting acceptance remain required separately. ## Alternatives and tradeoffs A dedicated userspace holder needs its own surviving lifecycle, narrow notification or lease contract, bootstrap inventory and progress policy. The current process-event interface is a destructive queue with one wake target, not an independently provisioned subscription. A narrow clock route could support a conservative lease, but expiry would not establish process death and still needs an independent execution loop. Kernel-owned lifetime custody is selected here as an opt-in object-lifetime mechanism. It avoids a service dependency while adding kernel state and a checked terminal-cleanup obligation. Preflight and explicit fail-stop are essential: one best-effort sweep followed by normal execution would not meet the contract. It covers only the already-held SEND lineage and does not solve operation completion or whole-process teardown. Validation checkpoint — 14 September 2026: Signed feature `e6bea362f9199230bf84269b1a8da6bd8da6470d` carries original signed maintenance ancestor `2f85d8a0e2e502ff1126ba40263296bc72f4635a`. The ordinary and lifetime graphs preserve their respective IPC/capability selections. All strict default/all development/release checks pass; the final fixture matrix passes 610/634 units plus one standalone on the feature graph and 586/610 units on the maintenance graph, with three pre-existing ignores. CI [532](https://git.erikinkinen.fi/erix/kernel/actions/runs/532) and [533](https://git.erikinkinen.fi/erix/kernel/actions/runs/533) pass with four complete logs, 624,386 bytes and zero warning candidates. Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` passes the actual native distinct-argument/lifetime VM in 20.204185 seconds and the unchanged ordinary Rootd IPC-framing VM in 45.264436 seconds, with empty stderr. These are host build/run durations, not guest performance results. Both signed images are byte-identical to the preceding accepted transition images. Realm producer adoption and full guest builds remain open. ## Tracking and rollout The isolated native mechanism is accepted at signed Kernel `03e13a784bde08914864267a4e2a6324a22d05c7`, selected by signed [Integration `4b65755f`](https://git.erikinkinen.fi/erix/integration/commit/4b65755f1f2774798d4a909212db4e64c0349b86), with Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`, IPC `de6892790de69f40f749c393d24078b287b36175` and capability ABI `984c9f7b0ca910488f8c5b035d2f0cb88f18d304`. Two private CPL3 owners execute actual syscall entry for refusal, consumed custody and repeated-slot denial. Ordinary exit and an independent observer's SEND-only Process endpoint exercise both terminal paths. Unchanged dispatch witnesses require exact generations and returns, cross-CSpace SEND/zero-right descendant absence, preserved independent aliases and exact terminal events. The fixture removes temporary CNode/TCB/VSpace handles before entry and retains its 16 owned code/stack/message pages until shutdown. It changes neither scheduler decisions nor production cleanup. Normal images exclude the fixture. The native scenario passes the required debug exit, ordered and unique begin/complete markers and all forbidden-marker checks. QEMU stderr is empty. The full build-and-run command takes 19.202361 seconds under the unchanged 60-second VM hard and 45-second silence limits, with one CPU, 1 GiB RAM, TCG and no network; this duration is not a guest performance measurement. The signed 2,142,208-byte image has SHA256 `4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797`. The 1,552-byte serial log has SHA256 `8cc7f9a7250881eddbc056834c46d7437ce944dd4b60c8b96e2c622bad2a85f9`. The exact 15-repository graph and all 16 Cargo manifests are validated. [Push CI 528](https://git.erikinkinen.fi/erix/kernel/actions/runs/528) and [PR CI 529](https://git.erikinkinen.fi/erix/kernel/actions/runs/529) pass for that signed Kernel. Four complete logs total 623,648 bytes with no warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units plus the three standalone executions; three existing experiments remain ignored per unit suite. Local strict default/all-feature development/release host and freestanding checks, private rustdoc, four native/normal builds and symbol exclusion checks pass. The failed pre-correction images remain retained: Bootloader issue 5 covers the runtime-name rejection; Kernel issue 9 covers markers suppressed by an unrelated Rootd smoke feature. The corrected entry point supplies a typed kernel-only begin/complete reporter without a new service route. Both defects now have exact-source CI and actual VM evidence. The existing syscall and generated IPC manual is accepted at Docs `28b44183368c512da9c5b804f570ff497ae3b6fc` with CI 839/840. The native diagnostic and runtime namespace manual is accepted at signed Docs `17b4d52a9a84e0803746e3a38eb34f070bfb28a4`, with green CI 841/842 and zero final warnings. Integration CI 1603/1604 is running, including older VM regressions and the additional diagnostic. Realm producer migration, two-realms/two-clients actual byte I/O, pending-operation/provider completion, the complete authority audit and both full build generations inside EriX remain open. Current signed `90fb945e291d1f8bb0b838d7ab8deccd1895600c` passes [push CI 524](https://git.erikinkinen.fi/erix/kernel/actions/runs/524) and [PR CI 525](https://git.erikinkinen.fi/erix/kernel/actions/runs/525). Four complete logs total 622,018 bytes, with no compiler/lint warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units, plus the standalone allocation regression in all three selections. Three pre-existing experiments remain ignored per unit suite. The deterministic order regression and both originally failing allocator tests pass in all three selections; both Markdown jobs pass. Original CI523 and the deterministic pre-fix failure remain retained in #8. This closes the allocator fixture regression only; native VM, producer, audit and self-hosting gates remain open; the later manual checkpoint is recorded above. The lifetime mechanism is implemented in signed `7eb9bc32a08a8a91db2b0e88d0d8e5f3174ece3e`; current signed `90fb945e291d1f8bb0b838d7ab8deccd1895600c` corrects the allocator fixture order regression tracked in #8. The coherent IPC/capability library checkpoints have green CI. The strict lifetime matrix, ten new unit regressions and measured allocation-free deposit/prepared terminal removal pass. Original kernel CI 522 passes/CI 523 fails are retained; the corrected host matrix passes 609/633 units with ordinary concurrency, and its own CI now passes as recorded below. [WIP PR #3](https://git.erikinkinen.fi/erix/kernel/pulls/3) retains complete scope. Native VM, manual/API and producer acceptance, broader audit and two-generation guest self-hosting remain open. - Realm ownership: [posixd #1](https://git.erikinkinen.fi/erix/posixd/issues/1). - Kernel audit/implementation: [kernel #2](https://git.erikinkinen.fi/erix/kernel/issues/2) and [kernel PR #3](https://git.erikinkinen.fi/erix/kernel/pulls/3). - Shared ABI audit: [lib-ipc #1](https://git.erikinkinen.fi/erix/lib-ipc/issues/1). - Publish the ABI/shim contract first, pin that full signed commit in kernel, and implement/test the native custody mechanism before migrating realm producers. Keep existing component/image selections unchanged until a coherent new native proof is prepared. WIP status and pending gates must remain explicit.

erikinkinen added the

enhancement

security

phase-6

labels

2026-09-14 08:56:29 +02:00

~~erikinkinen referenced this issue from erix/lib-ipc 2026-09-14 09:22:18 +02:00~~

WIP: Define native authority and staged construction contracts #2

erikinkinen referenced this issue from erix/lib-ipc

2026-09-14 09:22:19 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-ipc #1

~~erikinkinen referenced this issue from erix/lib-capabi 2026-09-14 09:27:45 +02:00~~