Run deferred macOS administrator credential and UID-quota tests

Aperta
  • Qualcosa non va?
#10 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, rust
Ambito
operating-systems, testing

Direzione di ricerca

Read issue #1 and inspect the prepared C control, reviewed plan, and evidence archives at tests/evidence/macos-nproc-accounting.zip and tests/evidence/macos-reserve-custody.zip. When administrator authentication is available, revalidate host and artifact hashes, then run the bounded sequential M=8 control with 6, 7, and 8 retained reserves. Record credential and limit readbacks, stage errors, fork and recovery outcomes; retain raw streams and receipts, verify reaping and cleanup, and update #1 with what the results establish.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Related to #1.

The user has deferred macOS administrator-only tests for now. The reviewed invocation was refused with sudo: a password is required before the root controller or native primitive started. No privileged control result exists.

The corrected C control compiled on macOS 27.0.1 / build 26A434, ARM64, using the explicit macOS SDK. It requires the sole target GID and logs the failing credential step. The original incorrect zero-group-readback version was preserved and never executed as root.

Prepared identities:

  • Corrected source SHA-256: 4b72fcbf0f54d38120c2ec9878735e76c2d1b551fd79c458ac149d88653c527b.
  • Native binary SHA-256: 39e4c7ba2bf024189331e4431a8d86b4b115a78017f66a2588b7da26ce1a19a4.
  • Reviewed plan SHA-256: c826f08e070b6c9eed615574ceda9e74a8185aede630504a1d65742bf654cbde.

Validation to run when administrator authentication is available

  • Revalidate the host, tool/binary hashes and an unused numeric UID; refresh the reviewed plan if its temporary paths or inputs changed.
  • Run the bounded, sequential M=8 control with 6, 7 and 8 retained reserves. Record real/effective credentials, the exact group list, RLIMIT_NPROC readbacks, each credential-stage errno, fork outcomes and recovery after exact child reaps. Treat a negative result as evidence requiring a design response.
  • Retain every raw stream and interrupted/refused attempt. Verify exact child reaping, UID and process-group emptiness, and identity-checked artifact cleanup.
  • Publish the receipts and update #1 with what the observations actually establish.

The prepared envelope uses Windows 100s, Mac outer 65s, root controller 40s and a root-owned primitive group deadline of 25s, with internal work/cleanup limits of 14/15s. Recheck those bounds before execution. The control creates no account, changes no global limit and executes no workload.

This issue tracks the deferred administrator validation. It does not establish the backend's fork fence, custody after supervisor loss, watchdog behavior or the shared escape-test acceptance criteria in #1. Existing accounting and custody evidence remains under tests/evidence/macos-nproc-accounting.zip and tests/evidence/macos-reserve-custody.zip.

Keep administrator tests deferred under the user's current instruction; do not bypass authentication or change sudo policy.

Lingua principale
Rust
Stelle
0
Fork
0
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di WikdSolvemProbler/process-tree-guard

Tutte le issue di WikdSolvemProbler/process-tree-guard

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.