80 lines
4.2 KiB
Markdown
80 lines
4.2 KiB
Markdown
# Phase 0.7 hardened runtime — offline review
|
|
|
|
Decision: **READY_FOR_HARDENED_RUNTIME_DEPLOYMENT**.
|
|
|
|
This is an offline deployment-readiness decision. No PS5 connection,
|
|
installation, transfer, or execution occurred.
|
|
|
|
## Exact identities
|
|
|
|
| Component | Base | Hardened source | ELF SHA-256 | Size |
|
|
|---|---|---|---|---:|
|
|
| elfldr | `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2` | `197623058f509eddde18868dafcb92fdcac66464` | `63e810982471eb40cae3a20aa9df9a0a02892f420e429874fae4e99aa400b561` | 397000 |
|
|
| controlled Payload Manager | `cfbc70f30f419b09bf2b52283f7409e2d3117ee1` | `e23d94ff91233aa770e2342800c1467875bdef44` | `8fecf8241a46246eddbd21e8bb4d875f5d76f1f4f4c6a11384df1f131aa5e5b1` | 99560 |
|
|
| lifecycle probe | Chimera GFX | `fe08300339a13f899fb78ea404ada381a5cba87c` | `bfb4a5cc768e162fe4c2fddf41c3978e152722918a39085277fd172cb95a7182` | 112680 |
|
|
|
|
All three pairs of clean builds are byte-identical. Complete disassembly,
|
|
symbol tables, relocations, normalized linker maps, and call-edge inventories
|
|
are in the ignored offline package under `outputs/phase07/audit/`; their
|
|
hashes and the complete call-edge lists are committed in
|
|
`manifests/runtime/phase-0.7-offline-audit.json`.
|
|
|
|
## Lifecycle binary boundary
|
|
|
|
The only undefined imports are:
|
|
|
|
- `_exit`
|
|
- `sceKernelSendNotificationRequest`
|
|
|
|
The only `DT_NEEDED` modules are:
|
|
|
|
- `libSceLibcInternal.sprx`
|
|
- `libkernel_web.sprx`
|
|
|
|
There are no GNM, VideoOut, SDL, SceNet, socket, download, thread, retry, or
|
|
autoload imports. The normal SDK startup object is statically present and
|
|
reaches its documented `__patch_init` and rtld initialization before `main`;
|
|
absence from imports is not used to hide that fact. The linker map also
|
|
contains `sceKernelLoadStartModule`/`sceKernelStopUnloadModule` through the
|
|
stock SDK rtld; its conditional module behavior is payload-process-local and
|
|
supervised by the external watchdog, but remains unobserved on firmware 9.60.
|
|
After one notification, `main` calls `_exit`, so the uncertain SDK
|
|
`main -> payload_terminate` return branch is not taken.
|
|
|
|
## Hardening closure
|
|
|
|
| Phase-0.6 finding | Phase-0.7 implementation | Review |
|
|
|---|---|---|
|
|
| unbounded ptrace loop | monotonic one-second deadline plus 65,536 steps | `SAFE` offline logic |
|
|
| incomplete child credential restore | UID, jaildir, rootdir, caps, auth-ID all restored and checked | `SAFE` offline logic |
|
|
| restore failure continues | fail-closed kill and deadline-bounded reap; no detach | `SAFE` offline logic |
|
|
| scattered cleanup | one tracked cleanup state machine for breakpoint, mappings, fds, child | `SAFE` offline logic |
|
|
| breakpoint page stays RWX | original byte restored and page reset RX | `SAFE` source fact |
|
|
| detached runtime unbounded | 2000 ms wait, SIGTERM grace, SIGKILL, reap | `SAFE` offline logic |
|
|
| ignored SIGCHLD/zombie risk | default SIGCHLD plus explicit reap | `SAFE` offline logic |
|
|
| path-based Manager load | one no-follow FD, fstat, hash, rewind, stream, post-check | `SAFE` offline logic |
|
|
| upload TOCTOU | exclusive temp, fsync, verify, atomic rename, inode check | `SAFE` offline logic |
|
|
| arbitrary controlled artifact | manager binary compiled for exact hash, size, and ID | `SAFE` offline configuration |
|
|
| sender-only hash | elfldr rehashes received bytes and checks denylist | `SAFE` offline logic |
|
|
|
|
`SAFE` here means source, test, map, and disassembly evidence agree. It is not
|
|
a hardware execution claim.
|
|
|
|
## Remaining risks
|
|
|
|
- No on-device observation exists yet; loader/firmware behavior remains
|
|
unverified at runtime.
|
|
- QA flags are an existing expected volatile loader bootstrap effect.
|
|
- Normal SDK startup performs known process-local credential/capability and
|
|
syscall-bound writes before `main`.
|
|
- The controlled manager listens for the later operator workflow, but accepts
|
|
only the compiled exact artifact identity; installation security and
|
|
network exposure still require a separate review.
|
|
- Abrupt platform failure can bypass userland reporting, though OS process
|
|
teardown should reclaim child mappings and descriptors.
|
|
- Rollback has only been prepared offline; its on-device paths and installed
|
|
hashes must be captured before any replacement.
|
|
|
|
These are deployment/execution residual risks, not unresolved compiler,
|
|
linker, or ABI blockers for preparing the hardened runtime.
|