71 lines
2.7 KiB
Python
71 lines
2.7 KiB
Python
#!/usr/bin/env python3
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Validate the fail-closed Phase-0.6 exact-loader evidence."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
|
|
|
|
def load(path: Path) -> dict[str, object]:
|
|
document = json.loads(path.read_text(encoding="utf-8"))
|
|
if not isinstance(document, dict):
|
|
raise RuntimeError(f"{path}: expected an object")
|
|
return document
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--root", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
root = args.root.resolve()
|
|
|
|
audit = load(root / "manifests/runtime/phase-0.6-loader-runtime-audit.json")
|
|
denylist = load(root / "manifests/artifact-denylist.json")
|
|
|
|
decision = "BLOCKED_VERSION_OR_UNBOUNDED_EFFECT"
|
|
if audit.get("decision") != decision:
|
|
raise RuntimeError("Phase-0.6 no longer fails closed")
|
|
if audit["artifact"]["built"] is not False:
|
|
raise RuntimeError("Phase-0.6 unexpectedly produced an ELF")
|
|
if audit["identity"]["elfldr"]["installed_asset_hash_match"] is not True:
|
|
raise RuntimeError("installed elfldr exact identity is no longer proven")
|
|
if audit["identity"]["payload_manager"]["installed_asset_hash_match"] is not True:
|
|
raise RuntimeError("installed Payload Manager exact identity is no longer proven")
|
|
if audit["identity"]["exact_exploit_autoloader"]["identified"] is not False:
|
|
raise RuntimeError("unproven exploit identity was promoted without evidence")
|
|
if any(audit["no_console_actions"].values()):
|
|
raise RuntimeError("Phase-0.6 records a forbidden console action")
|
|
|
|
effects = {item["id"]: item for item in audit["effects"]}
|
|
for required in (
|
|
"ptrace_single_step_completion",
|
|
"payload_runtime_limit",
|
|
"payload_manager_launch_hash_binding",
|
|
"payload_manager_upload",
|
|
):
|
|
if required not in effects or effects[required]["blocker"] is not True:
|
|
raise RuntimeError(f"hard blocker disappeared: {required}")
|
|
if effects["payload_manager_upload"]["classification"] != "PERSISTENT_WRITE":
|
|
raise RuntimeError("Payload Manager upload write was reclassified")
|
|
if (
|
|
effects["ptrace_single_step_completion"]["classification"]
|
|
!= "UNBOUNDED_OR_UNKNOWN"
|
|
):
|
|
raise RuntimeError("elfldr single-step loop was reclassified")
|
|
|
|
blocked_hash = (
|
|
"4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63"
|
|
)
|
|
if [entry["sha256"] for entry in denylist["entries"]] != [blocked_hash]:
|
|
raise RuntimeError("permanent denylist changed")
|
|
|
|
print("Phase-0.6 exact-loader audit remains fail-closed")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|