8.0 KiB
8.0 KiB
Kernelwrite proof matrix
Statuses mean: SAFE is proven only for the named scope, UNSAFE has a proven
policy violation, and UNPROVEN lacks necessary primary evidence. Absence of
an import is never used as the sole proof because SDK code is statically
combined in crt1.o.
| Component or behavior | Source | Linked in stock crt1.o |
Reachable from stock _start |
Status | Basis |
|---|---|---|---|---|---|
payload_args_t order/offsets |
public header + disassembly | yes | yes | SAFE |
six x86-64 fields; payloadout at 0x28 |
| stock SDK startup | crt/crt.c |
yes | yes | UNSAFE |
invokes patch and rtld paths |
__patch_init |
crt/patch.c |
yes | yes | UNSAFE |
relocation and callgraph edge from _start |
kernel_copyin/out |
crt/kernel.c |
yes | yes | UNSAFE |
reachable read/write transport |
kernel_set_ucred_caps |
crt/kernel.c |
yes | yes | UNSAFE |
reaches kernel_copyin |
kernel_set_ucred_attrs |
crt/kernel.c |
yes | yes | UNSAFE |
reaches kernel_copyin |
| syscall address lower/upper bounds | crt/patch.c |
yes | yes | UNSAFE |
writes offsets 0xf0 and 0xf8 |
| JIT capability change | crt/patch.c |
yes | yes | UNSAFE |
`caps[15] |
| ptrace attribute change | crt/patch.c |
yes | yes | UNSAFE |
`attrs[3] |
| runtime symbol discovery | syscall.c, crt.c, rtld |
yes | yes | UNSAFE for minimal profile |
multiple reachable dynamic resolutions |
__dlopen/__dlsym facade |
rtld_dlfcn.c |
yes | no static startup edge | UNSAFE linked capability |
absence from imports is not absence from bytes |
| Sce module load/start | rtld_sprx.c |
yes | yes | UNSAFE |
__rtld_sprx_init reaches function-pointer call |
| Sce module stop/unload | rtld_sprx.c |
yes | cleanup-dependent | UNPROVEN cleanup |
no guarantee after crash or partial init |
SO mapping/mprotect |
rtld_so.c |
yes | path-dependent | UNSAFE linked capability |
forbidden for minimal profile |
| socket-overlap helper | kernel.c |
yes | no static startup edge | UNSAFE linked capability |
still present in monolithic startup object |
| new network initialization | driver adds libSceNet |
dependency present in stock links | module-init internals unknown | UNPROVEN |
no caller/module initialization contract |
| GNM calls | no Phase-0.5 candidate source | no candidate | no candidate | SAFE source scope only |
no custom source or artifact created |
| VideoOut calls | no Phase-0.5 candidate source | no candidate | no candidate | SAFE source scope only |
no custom source or artifact created |
| SDL calls | no Phase-0.5 candidate source | no candidate | no candidate | SAFE source scope only |
no custom source or artifact created |
| direct MMIO/register writes | audited project source | no candidate | no candidate | SAFE source scope only |
none added |
-nostartfiles -nodefaultlibs suppression |
compiler -### |
not linked in trace | n/a | SAFE driver fact |
no CRT or default library added |
| loader stack/return contract | exact caller absent | n/a | n/a | UNPROVEN |
callee cannot prove caller |
| pre-entry loader changes | exact caller absent | n/a | before entry | UNPROVEN |
incoming kernel access exists; origin unknown |
The full source hashes, stock-object hashes, relocation-table hash,
disassembly hash, all reachable edges, and linked-but-unreachable prohibited
functions are in manifests/runtime/phase-0.5-startup-audit.json.
Phase 0.6 controlled-runtime classification
The table above preserves the stricter Phase-0.5 "kernelwrite-free" question.
Phase 0.6 uses the user's corrected policy: a documented temporary runtime
write is not automatically unsafe. Only PERSISTENT_WRITE and
UNBOUNDED_OR_UNKNOWN are hard blockers.
| Component/effect | Classification | Review status | Basis |
|---|---|---|---|
| first-stage QA flag enable | EXPECTED_VOLATILE_RUNTIME_EFFECT |
SAFE only as exact-source classification |
loader bootstrap, before payload |
child creation with rfork_thread/execve |
PAYLOAD_PROCESS_LOCAL |
SAFE source fact |
separate SceSpZeroConf child |
| ptrace service authid, normal path | RESTORED_BY_LOADER |
SAFE success path |
authid backed up and restored |
| ptrace authid restore failure | UNBOUNDED_OR_UNKNOWN |
UNSAFE for controlled profile |
returns without a second restore |
pt_call/pt_syscall completion |
UNBOUNDED_OR_UNKNOWN |
UNSAFE |
no step or time bound |
| breakpoint byte | RESTORED_BY_LOADER |
SAFE source fact |
original byte copied back |
| breakpoint page RWX permission | PAYLOAD_PROCESS_LOCAL |
UNPROVEN cleanup |
permission not restored; relies on child exit |
| child root/jail/caps/authid | RESTORED_BY_LOADER on success |
UNPROVEN partial |
UID is not restored |
| payload mapping, argument page, sockets, pipe | UNBOUNDED_OR_UNKNOWN |
UNSAFE for controlled profile |
no success-path cleanup before detach |
SDK __patch_init |
PAYLOAD_PROCESS_LOCAL |
SAFE classification, not execution proof |
affects payload child; not an automatic blocker |
| SDK terminate branch | UNBOUNDED_OR_UNKNOWN |
UNSAFE for controlled profile |
return/exit/trap branch unresolved |
| detached payload runtime | UNBOUNDED_OR_UNKNOWN |
UNSAFE |
no two-second watchdog |
| child reaping | UNBOUNDED_OR_UNKNOWN |
UNSAFE |
SIGCHLD ignored; semantics undocumented |
| Manager load hash binding | UNBOUNDED_OR_UNKNOWN |
UNSAFE |
path streamed without SHA-256 check |
| Manager upload path | PERSISTENT_WRITE |
UNSAFE |
writes and commits under /data/pldmgr/payloads |
No source or binary evidence showed a GNM, VideoOut, SDL, direct MMIO, flash, firmware, savegame, database, or system-configuration write in the proposed payload path. Because no payload was built, that is a source-scope absence, not an execution claim.
Phase 0.7 hardened-runtime classification
The machine-readable counterpart is
manifests/runtime/phase-0.7-kernelwrite-proof-matrix.json.
| Component/effect | Phase-0.7 status | Classification | Evidence boundary |
|---|---|---|---|
| freestanding kernelwrite-free startup | UNPROVEN |
historical blocked target | exact safe return contract still absent |
stock SDK __patch_init |
UNSAFE for a kernelwrite-free claim |
PAYLOAD_PROCESS_LOCAL accepted effect |
source, linker map, disassembly, reachable callgraph |
| stock SDK rtld module loading | UNPROVEN runtime branch; bounded externally |
PAYLOAD_PROCESS_LOCAL accepted effect |
linked module start/stop symbols, SDK source, child watchdog |
| ptrace step completion | SAFE offline |
BOUNDED_WATCHDOG |
source, unit/fuzz tests, disassembly |
| five-field credential restoration | SAFE offline |
RESTORED_BY_LOADER |
source, failure injection tests, callgraph |
| restoration failure | SAFE fail-closed logic |
FAIL_CLOSED_TERMINATION |
child killed/reaped; service disables ptrace |
| breakpoint byte/page | SAFE offline |
RESTORED_BY_LOADER |
source and disassembly |
| payload child lifetime | SAFE offline |
BOUNDED_WATCHDOG |
2000 ms, SIGTERM, SIGKILL, reap |
| mapping/descriptor cleanup | SAFE offline |
OS_RECLAIMED_ON_EXIT plus tracked cleanup |
source, tests, callgraph |
| manager hash-to-stream binding | SAFE offline |
HASH_BOUND_SAME_FD |
source, TOCTOU and negative tests |
| receiver digest/denylist enforcement | SAFE offline |
fail-closed | source, tests, disassembly |
| controlled artifact-directory write | SAFE for reviewed deployment budget |
ALLOWED_APPLICATION_WRITE |
exclusive temp, fsync, verify, atomic rename |
| GNM/VideoOut/SDL/MMIO/firmware mutation | SAFE absence claim |
prohibited | source scan, imports, map, disassembly |
| firmware-9.60 runtime behavior | UNPROVEN |
no execution evidence | no PS5 action occurred |
| installation, transfer, execution | UNPROVEN and unauthorized |
action state false | manifests and offline audit |
The overall decision is
READY_FOR_HARDENED_RUNTIME_DEPLOYMENT, not PROVEN KERNELWRITE-FREE.
The known normal-CRT process-local write prevents the latter claim.