scripts/security-assertions

1#!/usr/bin/env bash

2# Sourced in an isolated stacking compositor with the optional protocols enabled.

3msg() { bash scripts/msg "$SIGIL_WM_REPL" "$1"; }

msg '(define permission-handler (on-event! host (lambda (event) (when (= (event-kind event) 70) (reply-request! host (vector-ref (event-raw event) 1) #t)))))'

5mkfifo "$runtime_dir/virtual-control"

6exec {virtual_control}<> "$runtime_dir/virtual-control"

7build/input-driver < "$runtime_dir/virtual-control" > build/receipts/virtual-allowed.log 2>&1 &

8security_pid=$!

9wait_log build/receipts/virtual-allowed.log INPUT_DEVICE_READY

10printf 'key 39\n' >&"$virtual_control"

11wait_log "build/receipts/$manager-red.log" 'CLIENT_KEY=39,0'

msg '(define admitted-devices (filter (lambda (device) (dict-ref device virtual?:)) (dict-ref (host-snapshot host) devices:)))'

msg '(and (= (length admitted-devices) 2) (every (lambda (device) (and (string? (dict-ref device name:)) (not (dict-ref device libinput?:)))) admitted-devices))' | grep -q '(value #t)'

14msg '(define pointer-settings-result #f)'

msg '(on-event! host (lambda (event) (when (eq? (event-type event) (quote pointer-configuration-result)) (set! pointer-settings-result (map (lambda (field) (event-ref event field)) (quote (tap-status: dwt-status: middle-emulation-status: natural-scroll-status:)))))))'

msg '(configure-pointer! host (dict-ref (find (lambda (device) (= (dict-ref device device-type:) 1)) admitted-devices) id:) (dict tap: #t dwt: #t middle-emulation: #t natural-scroll: #t))'

17settings_ready=false

18for ((attempt=0; attempt<100; attempt++)); do

  if msg '(equal? pointer-settings-result (quote (1 1 1 1)))' | grep -q '(value #t)'; then settings_ready=true; break; fi

20 sleep 0.02

21done

22$settings_ready

23printf 'absolute 160 180\npress 38\nbutton 273 1\n' >&"$virtual_control"

24wait_log "build/receipts/$manager-red.log" 'CLIENT_KEY=38,1'

25wait_log "build/receipts/$manager-red.log" 'CLIENT_BUTTON=273,1'

26kill "$security_pid"

27wait "$security_pid" 2>/dev/null || true

28security_pid=

29wait_log "build/receipts/$manager-red.log" 'CLIENT_KEY=38,0'

30wait_log "build/receipts/$manager-red.log" 'CLIENT_BUTTON=273,0'

31devices_retired=false

32for ((attempt=0; attempt<100; attempt++)); do

  if msg '(null? (filter (lambda (device) (dict-ref device virtual?:)) (dict-ref (host-snapshot host) devices:)))' | grep -q '(value #t)'; then devices_retired=true; break; fi

34 sleep 0.02

35done

36$devices_retired

37echo 'DEVICE_LIFETIME=PASS copied origin metadata explicit unsupported settings held key/button releases retirement'

msg '(begin (remove-handler! host permission-handler) (set! permission-handler (on-event! host (lambda (event) (when (= (event-kind event) 70) (reply-request! host (vector-ref (event-raw event) 1) #f))))))'

39build/input-driver < "$runtime_dir/virtual-control" > build/receipts/virtual-denied.log 2>&1 &

40security_pid=$!

41sleep 0.15

42printf 'key 40\n' >&"$virtual_control"

43for ((attempt=0; attempt<100; attempt++)); do

44 kill -0 "$security_pid" 2>/dev/null || break

45 sleep 0.02

46done

47if kill -0 "$security_pid" 2>/dev/null; then echo 'denied virtual client still active' >&2; exit 1; fi

48wait "$security_pid" 2>/dev/null || true

49security_pid=

50msg '(remove-handler! host permission-handler)'

51if grep -q 'CLIENT_KEY=40,' "build/receipts/$manager-red.log"; then exit 1; fi

52exec {virtual_control}>&-

53echo 'VIRTUAL_PERMISSIONS=PASS accepted and refused separately from emulation'

55msg '(define observed-lock-state 0)'

msg '(on-event! host (lambda (event) (when (= (event-kind event) 61) (set! observed-lock-state (vector-ref (event-raw event) 1)))))'

57mkfifo "$runtime_dir/lock-control"

58exec {lock_control}<> "$runtime_dir/lock-control"

59build/lock-client draw < "$runtime_dir/lock-control" > build/receipts/lock.log 2>&1 &

60security_pid=$!

61wait_log build/receipts/lock.log '^LOCKED '

62msg '(= observed-lock-state 2)' | grep -q '(value #t)'

63msg '(emulate-key! host 1 112 #t)'

64msg '(capture-output! host (dict-ref (car (dict-ref (host-snapshot host) outputs:)) id:) "build/receipts/locked.ppm")'

65for ((attempt=0; attempt<100; attempt++)); do

66 [[ ! -s build/receipts/locked.ppm ]] || break

67 sleep 0.02

68done

69sleep 0.1

70build/readback build/receipts/locked.ppm build/receipts/locked.png locked

71printf 'u\n' >&"$lock_control"

72wait_log build/receipts/lock.log LOCK_UNLOCK_CONFIRMED

73wait "$security_pid"

74security_pid=

75msg '(= observed-lock-state 0)' | grep -q '(value #t)'

76msg '(example-redraw! example)'

77if grep -q 'CLIENT_KEY=112,' "build/receipts/$manager-red.log"; then exit 1; fi

78exec {lock_control}>&-

79echo 'LOCK=PASS opaque isolation real presentation authenticated protocol unlock emulation refused'