vibe-qcDocumentation

Donor-denied native prefix probes

probe_fftw_prefix.py verifies a bounded serial and optionally threaded FFTW operation and reads the corresponding public-header ABI constants in an existing candidate prefix. It binds called symbols to the requested library paths and checks their hashes before and after execution. It does not attest how those libraries were built or authorize native-seed reuse.

native_probe_isolation.py provides the process confinement used by that probe:

  • Darwin uses /usr/bin/sandbox-exec with a parameterized donor path.

  • Linux requires /usr/bin/bwrap supporting mandatory user, PID, network, IPC and UTS namespaces, disabled nested user namespaces, and capability removal. The host filesystem is bound read-only. A private mode-000, read-only mount covers the donor prefix. A new procfs in the private PID namespace prevents reaching the host mount tree through another process’s /proc entry.

Neither backend modifies host permissions or installs software. If its kernel, backend, options or operation are unavailable, the probe fails; it never retries without confinement. Inherited nonstandard file descriptors are closed and loader/Python environment overrides are removed. The child must observe EACCES or EPERM for the donor; a missing donor never counts as isolation. The parent requires an existing readable canonical donor both before and after the child, with the same device/inode identity.

On Linux the candidate is read-only too. Thus an attempted candidate write or permission change cannot alter installed data during this probe. This is a confinement mechanism for the tracked probe, not an interface for executing arbitrary untrusted code.

Qualification boundary

The Linux FFTW probe can observe an existing library and header. Linux native seed admission remains unsupported by native_seed_context.py until the compiler, sysroot, options, ABI and loader context are qualified. The other library adapters and the required prospective fresh-build receipt followed by actual later-slot reuse also remain separate. A successful probe emits source_build_provenance: not_attested and seed_admission: not_evaluated.

The existing FFTW test module includes real Linux access-control tests. Set VIBEQC_TEST_FFTW_PREFIX to an existing prefix with include/fftw3.h, a core lib/libfftw3.so.* and lib/libfftw3_threads.so.* to exercise the real four-point native transform under confinement. The test never creates a substitute library, compiles a dependency, or writes the supplied prefix. Without an explicit prefix, that native test skips rather than claiming a native result.