jason.woltje
068d868a99
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
22 lines
1.4 KiB
Python
22 lines
1.4 KiB
Python
# Linux inotify observes opens, not just content validation. Only an owned temp fixture is watched.
|
|
import ctypes, os, struct, subprocess, tempfile
|
|
from pathlib import Path
|
|
repo=Path('/mnt/storage/src/mosaic-stack-rocko-178')
|
|
libc=ctypes.CDLL(None,use_errno=True)
|
|
fd=libc.inotify_init1(os.O_NONBLOCK|os.O_CLOEXEC)
|
|
assert fd>=0,'inotify unavailable'
|
|
try:
|
|
with tempfile.TemporaryDirectory(prefix='proof-render-watch-',dir=os.environ['TMPDIR']) as d:
|
|
file=Path(d)/'proof.fixture';file.write_text('fixture-invalid-proof-bytes');file.chmod(0o600)
|
|
# IN_ACCESS | IN_OPEN: metadata stat/realpath never opens or reads the watched file.
|
|
wd=libc.inotify_add_watch(fd,os.fsencode(file),0x1|0x20)
|
|
assert wd>=0,'watch failed'
|
|
r=subprocess.run(['bash',str(repo/'scripts/webui-service.sh'),'render','--public-host','console.example','--auth-header','x-user','--allow-user','jason','--proof-header','x-console-proof','--proof-file',str(file)],env={**os.environ,'HOME':d,'XDG_CONFIG_HOME':str(Path(d)/'config')},capture_output=True,text=True,timeout=10)
|
|
assert r.returncode==0,'render failed'
|
|
try:events=os.read(fd,65536)
|
|
except BlockingIOError:events=b''
|
|
assert not events,'render opened or read the fixture proof file'
|
|
assert 'fixture-invalid-proof-bytes' not in r.stdout+r.stderr,'render disclosed fixture contents'
|
|
print('PASS: render carries both flags without opening or reading the watched fixture')
|
|
finally:os.close(fd)
|