153 lines
5.2 KiB
Markdown
153 lines
5.2 KiB
Markdown
# Phase 0.9B observer static audit
|
||
|
||
Status: **NOT PERFORMED — BLOCKED BEFORE SOURCE AND BUILD**.
|
||
|
||
This is a truthful negative audit record. No observer artifact exists, so no
|
||
ELF property can be reported as passing. Absence of imports or strings is not
|
||
used as a substitute for a reachable-code proof.
|
||
|
||
## Build decision
|
||
|
||
The source audit stopped the target build because:
|
||
|
||
- normal SDK startup reaches `__patch_init()` and performs prohibited writes;
|
||
- a freestanding observer return/exit and cleanup contract remains unproven;
|
||
- the hash-bound controlled route suppresses payload stdout/stderr; and
|
||
- the controlled manager sends the ELF and closes without receiving observer
|
||
output.
|
||
|
||
No observer source path or CMake target was added. The existing
|
||
`CHIMERA_GFX_BUILD_PS5_MINIMAL_STARTUP` configure-time blocker remains intact.
|
||
|
||
## Required artifact audit status
|
||
|
||
| Audit | Status | Reason |
|
||
|---|---|---|
|
||
| SHA-256 and size | `NOT_APPLICABLE_NO_ARTIFACT` | no binary |
|
||
| source commit binding | `NOT_APPLICABLE_NO_ARTIFACT` | no target source |
|
||
| toolchain identity | `PARTIAL_OFFLINE_REFERENCE_ONLY` | SDK v0.41 pinned; no observer link |
|
||
| double clean build | `NOT_PERFORMED_BLOCKED_BEFORE_BUILD` | hard gates failed |
|
||
| ELF header | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| program headers | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| section headers | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| dynamic dependencies | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| imported/undefined symbols | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| exported symbols | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| relocations | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| linker map | `NOT_CREATED` | no link |
|
||
| reachable callgraph | `NOT_CREATED` | no code |
|
||
| disassembly | `NOT_CREATED` | no code |
|
||
| strings | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| denied capabilities | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| filesystem open flags | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| network functions | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| threads/loops | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
| kernelwrites | `NOT_APPLICABLE_NO_ARTIFACT` | no ELF |
|
||
|
||
The validator fails if a Phase-0.9B ELF, map, observer target, observer source
|
||
directory, installation package or lifecycle package appears while the
|
||
manifest remains blocked.
|
||
|
||
## Transitive startup audit
|
||
|
||
### Normal SDK link
|
||
|
||
The SDK compiler wrapper at commit
|
||
`d2e2e585740362976a39fdd5ccf390f199a7bc37` selects
|
||
`target/lib/crt1.o` unless `-nostartfiles` is present. The CRT Makefile links:
|
||
|
||
`crt.o`, `syscall.o`, `klog.o`, `nid.o`, `kernel.o`, `rtld.o`, `rtld_so.o`,
|
||
`rtld_sprx.o`, `rtld_payload.o`, `rtld_dlfcn.o`, `mdbg.o`, and `patch.o`.
|
||
|
||
The installed `crt1.o` is 112256 bytes with SHA-256
|
||
`0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238`.
|
||
It was inspected as source-bound evidence and was not linked into a new
|
||
artifact.
|
||
|
||
Reachable sequence from normal `_start`:
|
||
|
||
```text
|
||
_start
|
||
-> clear BSS
|
||
-> payload_init
|
||
-> __crt_syscall_init
|
||
-> __kernel_init
|
||
-> __klog_init
|
||
-> write __isthreaded
|
||
-> __patch_init
|
||
-> patch_kernel_ucred
|
||
-> kernel_set_ucred_caps
|
||
-> kernel_set_ucred_attrs
|
||
-> patch_syscall_permissions
|
||
-> kernel_copyin syscall low bound
|
||
-> kernel_copyin syscall high bound
|
||
-> __rtld_init
|
||
-> payload_run
|
||
-> constructors
|
||
-> main
|
||
-> destructors
|
||
-> payload_terminate
|
||
```
|
||
|
||
Result: **UNSAFE** for the Phase-0.9B kernelwrite-free contract.
|
||
|
||
### Custom entry
|
||
|
||
`-nostartfiles -nodefaultlibs` can remove `crt1.o` and default libraries.
|
||
However, compile/link capability alone does not establish safe behavior.
|
||
elfldr `elfldr_prepare_exec()` shows `RDI=args`, `RIP=entry`, and the old RIP
|
||
stored on the adjusted stack. No source establishes the complete observer
|
||
post-return cleanup, process-exit, crash, or resource-lifetime contract for a
|
||
new bare entry. Result: **UNPROVEN**.
|
||
|
||
## Output audit
|
||
|
||
Controlled elfldr call path:
|
||
|
||
```text
|
||
controlled manager
|
||
-> connect_loopback
|
||
-> send_all(control header)
|
||
-> send_all(ELF bytes)
|
||
-> close_socket
|
||
|
||
elfldr controlled route
|
||
-> payload_read_controlled
|
||
-> payload_spawn
|
||
-> elfldr_spawn(stdio = -1)
|
||
-> no stdio duplication
|
||
-> watchdog/reap
|
||
-> fixed "Controlled payload exited" loader response
|
||
```
|
||
|
||
There is no manager receive callback and no payload-provided response body.
|
||
Result: **NO PROVEN NON-PERSISTENT OUTPUT CHANNEL**.
|
||
|
||
## Existing loader effects versus observer effects
|
||
|
||
The hardened loader performs ptrace, credential, mapping, socket-overlap,
|
||
breakpoint, protection and cleanup operations before and around entry. Those
|
||
are existing loader effects, not code introduced by an observer artifact.
|
||
They are still relevant to the risk of a later execution and do not make the
|
||
observer’s own startup kernelwrite-free.
|
||
|
||
Because no observer was built:
|
||
|
||
- observer imports: none to report;
|
||
- observer filesystem reads: none implemented;
|
||
- observer network functions: none implemented;
|
||
- observer threads or loops: none implemented;
|
||
- observer prohibited capabilities: none implemented; and
|
||
- absence of an artifact is not hardware-safety proof.
|
||
|
||
## Reproducibility
|
||
|
||
Build 1 hash: `null`.
|
||
|
||
Build 2 hash: `null`.
|
||
|
||
Final artifact hash/size: `null` / `null`.
|
||
|
||
Result: `NOT_PERFORMED_BLOCKED_BEFORE_BUILD`, not
|
||
`REPRODUCIBILITY_PASSED`.
|