4 Commits

Include renames

Author	SHA1	Message	Date
Kaoru0822andClaude Opus 5.5	2ac6d3efe2	fix(process): re-read unreadable tokens before signaling and name the process (#8553) ... * fix(process): re-read unreadable tokens before signaling and name the process Darwin KERN_PROCARGS2 samples a process's argument length and stack top before it reads the address space, and exec publishes the new length before it copies the new strings out (xnu sysctl_procargsx, exec_copyout_strings). A read during exec can return a zero-filled or stale strings area, and exec keeps the PID and start time that bracket the read. The final sweep already re-read such tokens, but the pre-signal group check read each member's token once, so one transient read of a live group member failed the whole cleanup. Move the bounded re-read into one shared fact-reading helper and use it for both the sweep and the pre-signal group check. The group check binds re-reads to the generation it first observed, so a reused PID stays unresolved; the sweep keeps classifying the PID's current process. An unreadable-token failure now carries the native identity read after the token and the summary names the candidate by its native name, parent, group and start identity. The Darwin helper and Linux procfs reader report the short native process name (p_comm/comm) for display. Fixes #8337 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(process): refresh other pre-signal members after token re-read waits The pre-signal group check re-read only members whose token was unavailable, so a readable member kept the relation it had before the retry waits. A member that moved to another process group during those waits could be validated on its old group, and the old group signaled while the moved member kept running. After any retry wait, the shared re-read helper now reads every other live pre-signal fact once more with the same generation binding. A moved member then takes the existing changed-group path, which retains its ownership evidence and fails cleanup. An inconclusive refresh replaces the stale fact so it fails closed. Nothing changes when no re-read ran, and the sweep keeps classifying current processes because every group it finds is revalidated before signaling. Also cover PID reuse that happens before the re-read starts, where both re-read identities agree and only the first-read generation rejects the replacement's token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(process): keep known identity changes final across token re-reads The pre-signal re-read treated a first read without a same-generation identity as unbound and replaced it with the re-read. On Linux the first read can already establish PID reuse (an ESRCH token whose exit check sees another generation); the re-read then classified the replacement, so a zombie replacement could let cleanup succeed. A pre-signal check now re-reads only same-generation facts. Changed, exited, exiting and foreign-token facts are final. Each attempt also re-reads the group's owned members instead of one separate refresh after the loop, so a member that moves groups or turns unreadable while another waits is seen within the same bound. The caller's run token selects the owned members, and the sweep keeps classifying current processes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-02 00:21:23 -08:00
morluto	6c4d880f2d	fix(process): parse native teardown relation sentinels	2026-10-23 16:10:04 +08:00
gensokyo-dev	1c2c2f1e78	fix(process): settle native exit and repair ownership verification (#5249) ... * fix(process): classify baseline cleanup with current ownership facts Use the pre-launch baseline only to select candidates for current native identity/token validation. Preserve confirmed absence and verified foreign generations instead of carrying a premature baseline identity failure. Exercise the real Linux enumeration/exit race and retain countercontrols for unknown identities and live token-owned processes. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) * fix(ci): distinguish process inventory from historical PID lookups * test(ci): verify decoded historical PID controls before tracing * fix(ci): trace historical PID handles and signal probes * fix(ci): resolve traced directory paths across pathname syscalls Classify producer-decoded FD/path pairs once instead of limiting failed relative lookup detection to openat on /proc. This preserves attempted readlinkat, statx and newfstatat accesses with no returned descriptor. Three regression cases fail against the previous policy and all 33 controls pass with the shared pathname interpretation. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) * test(ci): declare unresolved legacy pathname coverage Report the historical-PID access surfaces actually checked and explicitly mark legacy cwd-relative pathname calls unverified. The existing tracer does not provide their cwd identity, and a blanket rejection also rejects legitimate GDB build-ID metadata queries. Retain every committed access guard and document the preexisting limit without claiming absence from missing path evidence. The complete real 44-case CLI/MCP recorded-crash qualification passes with the coverage declaration. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) * fix(ci): reject priority access to historical PIDs * fix(ci): preserve C-quoted components in traced path checks strace renders non-ASCII pathname bytes as C octal escapes, not JSON strings. Keep those components opaque when resolving literal ASCII path separators and proc PID selectors, matching the existing absolute-path interpretation. Two controls fail before the correction and all 35 pass afterward. An actual strace observation independently reproduces the rejection of an unrelated Chinese filename and verifies the corrected classification. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) * fix(ci): reject historical PID resource and scheduler calls * fix(schema): preserve portable large base64 validation * fix(ci): share explicit PID syscall contracts with tracing Derive tracer selection and reported coverage from the same named target contracts used by the access checker. Cover resource limits, scheduler calls, process metadata, PID groups, capabilities and pidfd operations without mixing UIDs, policy enums, self selectors or output values with target PIDs. Interpret each target once and retain unresolved target facts as a distinct failure. Emit the coverage catalog once per verifier result. The previous oracle misses 28 new controls. All 83 controls pass after the change; real native resource/scheduler probes capture 14 previously missed calls with resource limits and affinity unchanged. All 35 selected syscall names are accepted by the pinned local strace. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) * fix(ci): classify I/O priority and qualify PID trace coverage * fix(process): keep ownership retries on the native clock * fix(ci): retain process edges in ownership trace inventory Keep fork/vfork and resumed edges along with clone events so the shared attribution owner receives the complete process relation facts it consumes. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) * fix(process): type native exit predicates and ownership fixtures precisely * fix(ci): retain trace coverage limits after integration Restore explicit unverified symlink aliases and same-Node stat/status purpose in the shared coverage contract and guide. The native-exit and trace-attribution integration does not establish those properties. Preserve both limitations rather than silently broadening the reported qualification. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)	2026-10-20 02:01:00 +08:00
morluto	49e67aa1d9	fix(process): retain native ownership evidence through cleanup ... Keep a run-scoped evidence owner from acquisition through settlement and cleanup retry. Bind token observations to native generations and retain related generations and unresolved identity lookups across table omissions, reparenting and process-group changes without treating PID hints as authority. Use native effective UID facts for withholding decisions, corroborate Linux procfs absence, and share the Linux stat parser with sampling and debugger identity checks. Signal only after current token and group revalidation. Complete swept cleanup across all groups with one bounded final family check; retain unresolved owners and successful-peer completion across retries. Validation: npm run check, docs:check and test discovery passed. Focused ownership/consumer coverage totals 513 passed and 1 skipped across 35 files, including the corrected Electron cancellation test rerun independently. Darwin helper compilation, real owned Node child cleanup, CLI/MCP capture and retained cleanup retries ran. Real Electron applications, native Linux races/PID reuse and Windows cleanup were not qualified. The original Linux reports remain open for that work. Fixes #5238 Refs #4322, #5206	2026-10-19 20:04:00 +08:00