Run deferred macOS administrator credential and UID-quota tests

オープン
  • 何か問題がありますか？
#10 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
25/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
c, rust
領域
operating-systems, testing

調査の方向性

Read issue #1 and inspect the prepared C control, reviewed plan, and evidence archives at tests/evidence/macos-nproc-accounting.zip and tests/evidence/macos-reserve-custody.zip. When administrator authentication is available, revalidate host and artifact hashes, then run the bounded sequential M=8 control with 6, 7, and 8 retained reserves. Record credential and limit readbacks, stage errors, fork and recovery outcomes; retain raw streams and receipts, verify reaping and cleanup, and update #1 with what the results establish.

索引モデルが issue の本文から書いたものです。

説明

Related to #1.

The user has deferred macOS administrator-only tests for now. The reviewed invocation was refused with sudo: a password is required before the root controller or native primitive started. No privileged control result exists.

The corrected C control compiled on macOS 27.0.1 / build 26A434, ARM64, using the explicit macOS SDK. It requires the sole target GID and logs the failing credential step. The original incorrect zero-group-readback version was preserved and never executed as root.

Prepared identities:

  • Corrected source SHA-256: 4b72fcbf0f54d38120c2ec9878735e76c2d1b551fd79c458ac149d88653c527b.
  • Native binary SHA-256: 39e4c7ba2bf024189331e4431a8d86b4b115a78017f66a2588b7da26ce1a19a4.
  • Reviewed plan SHA-256: c826f08e070b6c9eed615574ceda9e74a8185aede630504a1d65742bf654cbde.

Validation to run when administrator authentication is available

  • Revalidate the host, tool/binary hashes and an unused numeric UID; refresh the reviewed plan if its temporary paths or inputs changed.
  • Run the bounded, sequential M=8 control with 6, 7 and 8 retained reserves. Record real/effective credentials, the exact group list, RLIMIT_NPROC readbacks, each credential-stage errno, fork outcomes and recovery after exact child reaps. Treat a negative result as evidence requiring a design response.
  • Retain every raw stream and interrupted/refused attempt. Verify exact child reaping, UID and process-group emptiness, and identity-checked artifact cleanup.
  • Publish the receipts and update #1 with what the observations actually establish.

The prepared envelope uses Windows 100s, Mac outer 65s, root controller 40s and a root-owned primitive group deadline of 25s, with internal work/cleanup limits of 14/15s. Recheck those bounds before execution. The control creates no account, changes no global limit and executes no workload.

This issue tracks the deferred administrator validation. It does not establish the backend's fork fence, custody after supervisor loss, watchdog behavior or the shared escape-test acceptance criteria in #1. Existing accounting and custody evidence remains under tests/evidence/macos-nproc-accounting.zip and tests/evidence/macos-reserve-custody.zip.

Keep administrator tests deferred under the user's current instruction; do not bypass authentication or change sudo policy.

主要言語
Rust
スター
0
フォーク
0
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

WikdSolvemProbler/process-tree-guard のほかの issue

WikdSolvemProbler/process-tree-guard の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。