bigmerge
c2d9596e76
Capability differs from prohibits_outside in one way that matters: a utility program cannot be trusted to declare its own restrictions, because it would declare none. So the policy comes from OUTSIDE the program -- it ships with the language as data, editable without a compiler release. tools/check/capabilities.rel 18 names that were string literals in codegen tools/check/capabilities.sh the query that decides PREDICTIONS AND RESULTS P1 codegen emits kind + call graph, drops the 4 name tests TRUE zero #errors P2 the 18 literals become a data file TRUE P3 the checker catches capability violations TRUE exit=1 P4 codegen drops ~76 lines TRUE 4963 -> 4881 P5 below the 4661 baseline FALSE ~+230 TWO DEFECTS THE HARNESS FOUND THAT READING WOULD NOT HAVE 1. Calls inside main became invisible. cg_fn returns early for main -- C provides its own -- so hooking the recording there left every call in main unrecorded: a blind spot exactly where a program does its work. The old cap_check_call ran from cg_expr and did see main. Moved the recording to cg_expr. 2. Caller attribution was stale. __cg_current_fn kept whatever cg_fn set last, so a violation in main was reported against the previously emitted function. The test still PASSED, because the violation was detected -- only the name was wrong, and a diagnostic naming the wrong fn is worse than none. Fixed at all three main-emission sites; the first patch missed two because the live path is codegen_streaming. 98/98 native, 7/7 + 4/4 + 5/5 integration, fixpoint ok.
25 lines
1.1 KiB
Bash
Executable File
25 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# capabilities.sh — enforce the capability tier as a QUERY over emitted
|
|
# relations plus a shipped policy file. The compiler records the program's kind
|
|
# and its call graph; deciding what that tier may call is not an emitter's job.
|
|
set -uo pipefail
|
|
REL="${1:?usage: capabilities.sh <relations-file> [policy]}"
|
|
POLICY="${2:-$(dirname "${BASH_SOURCE[0]}")/capabilities.rel}"
|
|
[ -f "$REL" ] || exit 0
|
|
KIND=$(grep -m1 '^program calls is_kind:' "$REL" | sed 's/.*is_kind://')
|
|
[ -n "$KIND" ] || KIND=utility
|
|
V=0
|
|
while read -r kind rel names; do
|
|
[ "$kind" = "$KIND" ] && [ "$rel" = "prohibits_within" ] || continue
|
|
IFS=',' read -ra NAMES <<< "$names"
|
|
for n in "${NAMES[@]}"; do
|
|
while read -r caller _ callee; do
|
|
[ "$callee" = "$n" ] || continue
|
|
printf "capability violation: '%s' programs may not call '%s' (called from %s)\n" "$KIND" "$n" "$caller"
|
|
V=$((V+1))
|
|
done < <(sort -u "$REL")
|
|
done
|
|
done < <(grep -v '^#' "$POLICY" | grep -v '^[[:space:]]*$')
|
|
[ "$V" -eq 0 ] && echo "capabilities: clean ($KIND)"
|
|
exit "$V"
|