50 lines
2.1 KiB
Markdown
50 lines
2.1 KiB
Markdown
# ADR-0011: Phase-0.7 hardened controlled runtime
|
|
|
|
- Status: accepted for offline deployment preparation
|
|
- Date: 2026-07-17
|
|
- Decision: `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT`
|
|
|
|
## Context
|
|
|
|
Phase 0.6 identified exact upstream loader and Payload Manager versions but
|
|
found unbounded ptrace completion, incomplete credential restoration, missing
|
|
reaping/watchdog behavior, and a path-based unhashed launch route. Those
|
|
findings were implementation inputs, not permanent platform blockers.
|
|
|
|
Jens explicitly confirmed exact firmware 9.60. Independent device attestation
|
|
is therefore not a Phase-0.7 blocker. The controlled upload below
|
|
`/data/pldmgr/payloads/chimera-controlled` is an allowed, removable
|
|
application write and is not a firmware write.
|
|
|
|
## Decision
|
|
|
|
Use private GPL-3.0 hardening forks based on:
|
|
|
|
- elfldr `699e8bcff03e91e8d6ca6eba281af25c5a58d8c2`;
|
|
- Payload Manager `cfbc70f30f419b09bf2b52283f7409e2d3117ee1`;
|
|
- PS5 Payload SDK `d2e2e585740362976a39fdd5ccf390f199a7bc37`.
|
|
|
|
The controlled route is a versioned loopback-only protocol with exact
|
|
firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr
|
|
rehashes received bytes, enforces the permanent denylist, applies bounded
|
|
ptrace steps and cleanup, and reaps the child through a two-second watchdog.
|
|
The controlled manager is compiled for one exact lifecycle artifact and opens,
|
|
hashes, rewinds, and streams one no-follow file descriptor.
|
|
|
|
The lifecycle probe uses normal SDK v0.41 startup, performs one
|
|
`sceKernelSendNotificationRequest`, and calls `_exit`; it does not return
|
|
through `payload_terminate`.
|
|
|
|
## Consequences
|
|
|
|
The three ELFs are eligible for a later, separately authorized hardened
|
|
runtime installation. This decision does not authorize installation,
|
|
transfer, or execution. The previously blocked SHA-256
|
|
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
|
remains permanently denied.
|
|
|
|
Normal SDK startup still reaches documented process-local patch and runtime
|
|
initialization. The existing elfldr bootstrap still enables volatile QA flags.
|
|
Both facts are explicit expected runtime effects; neither is silently claimed
|
|
kernelwrite-free.
|