Run deferred macOS administrator credential and UID-quota tests

未关闭
  • 哪里不对？
#10 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
c, rust
领域
operating-systems, testing

调研方向

Read issue #1 and inspect the prepared C control, reviewed plan, and evidence archives at tests/evidence/macos-nproc-accounting.zip and tests/evidence/macos-reserve-custody.zip. When administrator authentication is available, revalidate host and artifact hashes, then run the bounded sequential M=8 control with 6, 7, and 8 retained reserves. Record credential and limit readbacks, stage errors, fork and recovery outcomes; retain raw streams and receipts, verify reaping and cleanup, and update #1 with what the results establish.

由索引模型根据 Issue 内容生成。

描述

Related to #1.

The user has deferred macOS administrator-only tests for now. The reviewed invocation was refused with sudo: a password is required before the root controller or native primitive started. No privileged control result exists.

The corrected C control compiled on macOS 27.0.1 / build 26A434, ARM64, using the explicit macOS SDK. It requires the sole target GID and logs the failing credential step. The original incorrect zero-group-readback version was preserved and never executed as root.

Prepared identities:

  • Corrected source SHA-256: 4b72fcbf0f54d38120c2ec9878735e76c2d1b551fd79c458ac149d88653c527b.
  • Native binary SHA-256: 39e4c7ba2bf024189331e4431a8d86b4b115a78017f66a2588b7da26ce1a19a4.
  • Reviewed plan SHA-256: c826f08e070b6c9eed615574ceda9e74a8185aede630504a1d65742bf654cbde.

Validation to run when administrator authentication is available

  • Revalidate the host, tool/binary hashes and an unused numeric UID; refresh the reviewed plan if its temporary paths or inputs changed.
  • Run the bounded, sequential M=8 control with 6, 7 and 8 retained reserves. Record real/effective credentials, the exact group list, RLIMIT_NPROC readbacks, each credential-stage errno, fork outcomes and recovery after exact child reaps. Treat a negative result as evidence requiring a design response.
  • Retain every raw stream and interrupted/refused attempt. Verify exact child reaping, UID and process-group emptiness, and identity-checked artifact cleanup.
  • Publish the receipts and update #1 with what the observations actually establish.

The prepared envelope uses Windows 100s, Mac outer 65s, root controller 40s and a root-owned primitive group deadline of 25s, with internal work/cleanup limits of 14/15s. Recheck those bounds before execution. The control creates no account, changes no global limit and executes no workload.

This issue tracks the deferred administrator validation. It does not establish the backend's fork fence, custody after supervisor loss, watchdog behavior or the shared escape-test acceptance criteria in #1. Existing accounting and custody evidence remains under tests/evidence/macos-nproc-accounting.zip and tests/evidence/macos-reserve-custody.zip.

Keep administrator tests deferred under the user's current instruction; do not bypass authentication or change sudo policy.

主要语言
Rust
星标
0
派生
0
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

WikdSolvemProbler/process-tree-guard 的其他 Issue

查看 WikdSolvemProbler/process-tree-guard 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。