| 1 | # Plan 14 census ruling zddr3 (#272): the agent's exec shim replaces clone3 placement. Its reads, and the reads of the parent-side start and VerifyPlacement, are accepted legacy because they stay within the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. |
| 2 | # If the shim ever runs as root or reads outside that boundary it stops being legacy and needs the Plan 14 owner's ruling. Earlier overlays are immutable. |
| 3 | @legacy 47342b08763898bff8f58e91a39c63d8f376e68202a1343465ff7bd8a2ab7cf2 internal/cgroup/shim_linux.go joinCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: Openat of cgroup.procs relative to the validated dir fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Openat@47 fc7b193b461306cd596cf052be09e7f00dd6c13685e1febc7fd930a8b4146ea0 |
| 4 | internal/cgroup/shim_linux.go joinCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: Openat of cgroup.procs relative to the validated dir fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Openat@47 fc7b193b461306cd596cf052be09e7f00dd6c13685e1febc7fd930a8b4146ea0 |
| 5 | @legacy 08551c090f04d40d1013baee16200faf9ebf7b1b9948ef8f84fc695a23276718 internal/cgroup/shim_linux.go verifyCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstat of the dir fd and the Lstat of /sys/fs/cgroup plus expected are identity checks that keep placement inside the subtree; they tighten it and widen no trust; the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstat@376,file:Lstat@441,file:ReadFile@67 3cfeb2e9c2ccbf65372ddb5a639c3a10a72e5532211c6507d56343e5e98f4e5b |
| 6 | internal/cgroup/shim_linux.go verifyCgroup legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstat of the dir fd and the Lstat of /sys/fs/cgroup plus expected are identity checks that keep placement inside the subtree; they tighten it and widen no trust; the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstat@376,file:Lstat@441,file:ReadFile@67 3cfeb2e9c2ccbf65372ddb5a639c3a10a72e5532211c6507d56343e5e98f4e5b |
| 7 | @legacy f3c761d0e8d81cb908229d3512a39cb968a5dadb0fb8185d82741eae0ed86eff internal/cgroup/shim_linux.go runProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@35 5356bb77d65caf264da4536608cd925c7e68ed466aa25e5ab007b43eae56fe8f |
| 8 | internal/cgroup/shim_linux.go runProbe legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/cgroup is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@35 5356bb77d65caf264da4536608cd925c7e68ed466aa25e5ab007b43eae56fe8f |
| 9 | @legacy 3e0187927a2d63bb61bd0c158712bfb74abdee75e52b1a2380812d3fb77ae3c9 internal/cgroup/shim_linux.go Manager.startViaShimBy legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the opened cgroup dir is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the Open of that dir is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstatfs@699,file:Open@455 d218799999581dbd6fe80b5906891b6f2d1e033d6c33423836175429d33f407a |
| 10 | internal/cgroup/shim_linux.go Manager.startViaShimBy legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the opened cgroup dir is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the Open of that dir is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Fstatfs@699,file:Open@455 d218799999581dbd6fe80b5906891b6f2d1e033d6c33423836175429d33f407a |
| 11 | @legacy 95d1d262f694c674484b3a6729def30201a23ecdd3b7321d001da0bbd47fe128 internal/cgroup/shim_linux.go runShim legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the dir fd is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the tenant Exec is the same act as the agent's existing tenant spawn and the spec arrives from its own parent over the pipe; the Read of the release byte from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Exec@3014,file:Fstatfs@1305,file:Read@1927 8f164d8c1f0681064813ad4bf9e1850da0b270f9970f47e025b549b05e763a6d |
| 12 | internal/cgroup/shim_linux.go runShim legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Fstatfs of the dir fd is one of the identity checks that keep placement inside the subtree; they tighten it and widen no trust; the tenant Exec is the same act as the agent's existing tenant spawn and the spec arrives from its own parent over the pipe; the Read of the release byte from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Exec@3014,file:Fstatfs@1305,file:Read@1927 8f164d8c1f0681064813ad4bf9e1850da0b270f9970f47e025b549b05e763a6d |
| 13 | @legacy 4b87c9076f8511fa2b55735368daa56bec6bbac3d4f183a97e3d83e4bb14ab6c internal/cgroup/shim_linux.go Manager.startShimCore legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadAll and ReadBytes on the shim's status pipe are the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadAll@4798,file:ReadAll@5531,file:ReadBytes@3682 6f8213988e3058c6a28ecb2ab6163a0707559370c10def0bff6c11df145e5d37 |
| 14 | internal/cgroup/shim_linux.go Manager.startShimCore legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadAll and ReadBytes on the shim's status pipe are the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadAll@4798,file:ReadAll@5531,file:ReadBytes@3682 6f8213988e3058c6a28ecb2ab6163a0707559370c10def0bff6c11df145e5d37 |
| 15 | @legacy 09b132e3d911ff8377041f276aeb9302fa5061b15b471695246ab6802004baec internal/cgroup/shim_linux.go readFull legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Read of the spec from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Read@70 18102503e2e905c6d2f66bf283a1771b040901453da54de6b38187482bfb35f0 |
| 16 | internal/cgroup/shim_linux.go readFull legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Read of the spec from the parent pipe is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Read@70 18102503e2e905c6d2f66bf283a1771b040901453da54de6b38187482bfb35f0 |
| 17 | @legacy ca4a93ae17133c7672ab2c32d1c648d5fc1e3d51d22dd54447f832aa1798921c internal/cgroup/shim_linux.go cloexecFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadDir of /proc/self/fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadDir@247 2616633acc24c5f94832c1908a5d1cb982331fb32596f8d1cfc9abb883607d7d |
| 18 | internal/cgroup/shim_linux.go cloexecFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadDir of /proc/self/fd is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadDir@247 2616633acc24c5f94832c1908a5d1cb982331fb32596f8d1cfc9abb883607d7d |
| 19 | @legacy e92f485cac500d854b9ba8a49cf4eb16f8b5779970b91435b0cc1893713557f1 internal/cgroup/shim_linux.go ignoredSignals legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/status is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@53 2137cd40a78ffa3d19ba3791c97ad50b7faf029fa778ebd419ea66516603f063 |
| 20 | internal/cgroup/shim_linux.go ignoredSignals legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the ReadFile of /proc/self/status is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:ReadFile@53 2137cd40a78ffa3d19ba3791c97ad50b7faf029fa778ebd419ea66516603f063 |
| 21 | @legacy b7e7496ed98ddf3ec9adfc3e6e776a20e81b38fae822e304e9f8e5ea5e1be656 internal/cgroup/verify_linux.go Manager.VerifyPlacement legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Statfs of the delegated root, the scratch child's memory.max and the __cgprobe self-exec of /proc/self/exe are all under the agent's own delegated root. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@1475,file:ReadFile@2227,file:Statfs@714 932c2d38e3fa6b24a7724f2a72155d248540fb0f82d76362e04b8804f198c636 |
| 22 | internal/cgroup/verify_linux.go Manager.VerifyPlacement legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: the Statfs of the delegated root, the scratch child's memory.max and the __cgprobe self-exec of /proc/self/exe are all under the agent's own delegated root. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@1475,file:ReadFile@2227,file:Statfs@714 932c2d38e3fa6b24a7724f2a72155d248540fb0f82d76362e04b8804f198c636 |
| 23 | @legacy 22beb37296952b24cf000b4b3f6379a3e7f61761f6c9fd7237083a0a72bb1ebf internal/cgroup/cleanup_linux.go Manager.openCleanupAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row; its OpenFile is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:OpenFile@302 dd1825275361cddc52d34652f5030d3c74d04081e823e1bc2c34c90d9abeeddd |
| 24 | internal/cgroup/cleanup_linux.go Manager.openCleanupAt legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row; its OpenFile is the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:OpenFile@302 dd1825275361cddc52d34652f5030d3c74d04081e823e1bc2c34c90d9abeeddd |
| 25 | @legacy b2323851f8abd44a94b29e78db9bf5bb80a1247e6172d74232c4fbae4e2c5572 internal/activator/backend_exec.go ExecBackend.StartWorkerStaged legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@3507,registry:Args@227,registry:Args@378,registry:Host@1388,registry:Host@2610,registry:Host@3629,registry:Host@369,registry:Host@4515,registry:Host@473,registry:Host@589,registry:Host@685,whole:Route@1148,whole:Route@1692,whole:Route@2238,whole:Route@3459,whole:Route@3590,whole:Route@4356,whole:Route@4446 f6e9b917b370986421fbc258dc95a723a6f4fb55bbd18b13f061129aa36ea89e |
| 26 | internal/activator/backend_exec.go ExecBackend.StartWorkerStaged legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@3507,registry:Args@227,registry:Args@378,registry:Host@1388,registry:Host@2610,registry:Host@3629,registry:Host@369,registry:Host@4515,registry:Host@473,registry:Host@589,registry:Host@685,whole:Route@1148,whole:Route@1692,whole:Route@2238,whole:Route@3459,whole:Route@3590,whole:Route@4356,whole:Route@4446 f6e9b917b370986421fbc258dc95a723a6f4fb55bbd18b13f061129aa36ea89e |
| 27 | @legacy 6a1b077906f03ba5b111c525310be6b60aff1b294d3ddaec6bcf84f1364838d5 internal/activator/backend_exec.go ExecBackend.spawnChildFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@9682,registry:Host@10964,registry:Host@11058,registry:Host@164,registry:Host@3773,registry:Host@3828,registry:Host@3908,registry:Host@4006,registry:Host@4127,whole:Route@10079,whole:Route@11355,whole:Route@11447,whole:Route@1602,whole:Route@1864,whole:Route@193,whole:Route@4321,whole:Route@6392,whole:Route@8365,whole:Route@9628 2ca8591aed976f81f770a3fdc96499393d59936ede24cb42a79f5aa3dd017ae8 |
| 28 | internal/activator/backend_exec.go ExecBackend.spawnChildFrom legacy accepted-legacy accepted-legacy;rev3=census-ruling-zddr3;basis=Census ruling zddr3: changed legacy row (comment-only change describing the shim placement); the same class as the accepted-legacy Manager.startIn and placementLive under fix1-merge-review (existing agent delegated-cgroup management remains legacy); no root decision; no registry, /data, release or claim reads. Boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. file:Command@9682,registry:Host@10964,registry:Host@11058,registry:Host@164,registry:Host@3773,registry:Host@3828,registry:Host@3908,registry:Host@4006,registry:Host@4127,whole:Route@10079,whole:Route@11355,whole:Route@11447,whole:Route@1602,whole:Route@1864,whole:Route@193,whole:Route@4321,whole:Route@6392,whole:Route@8365,whole:Route@9628 2ca8591aed976f81f770a3fdc96499393d59936ede24cb42a79f5aa3dd017ae8 |
| 29 | @remove internal/cgroup/cgroup_linux.go placementLive |
| 30 | @removed internal/cgroup/cgroup_linux.go placementLive H3 census-ruling-zddr3: placement verification moved into the agent's exec shim; its reads are accepted-legacy rows in this overlay. |
| 31 | @remove internal/cgroup/cgroup.go Manager.startIn |
| 32 | @removed internal/cgroup/cgroup.go Manager.startIn H3 census-ruling-zddr3: no longer reads; cgroup placement moved into the agent's exec shim (accepted-legacy rows in this overlay). |
| 33 | # Envelopes, census ruling zddr3: each changed root source envelope below is accepted only because the units inside it are the ones listed above; boundary: the agent's own delegated cgroup subtree (including its scratch probe child), /proc/self, and pipes to and from its own parent, running as carlos. |
| 34 | @coverage . f1e899cdd021baecbf67a2458be91fcf82baa0510f0af863942f7f510cce9519 |
| 35 | @coverage cmd/zddprobe ba4960a38c316deb4032b5569bf7ed9aa3c762262e560b351f43c73fbc3a64e2 |
| 36 | @coverage internal/activator aaa8f424e27268dcc8c53cacc711cbbd6bab1b96f5905523bca609fa22a7abe4 |
| 37 | @coverage internal/cgroup 6fbf28661b36f73d612e4af02efbccd6a6567be3d2a987de6178fd407f8eaaac |
| 38 | @coverage internal/host 834daf0443763909fe447fb029891d129ac9e178c8bace1915cf6e5f25b5f68f |
| 39 | @coverage internal/instancectl 0a4b786ac0b7eb01285fb51bc2711abd87e53eaf33e6d881a6cc3a8683289416 |
| 40 | @coverage internal/rolloutwords 0ec71bcebe6e5573ef8bb3e520228bc7f1fdb02feab0788d8cad3a1f2997b02e |
| 41 | @coverage internal/status f1b105f9144165c6a03ffc7d06f60fe4b9de74454ba540a9c5909e72b7e6b67e |
| 42 | |
amadan