components: read /proc/pid/syscall without a shell, and pin the floor

popen() runs /bin/sh -c, so the preferred `cat` path needs both a shell and
cat. A target with neither still leaks, but the component reported "no kernel
address found" there -- what it also reports on a kernel that was never
vulnerable, which is why every VM run of it read as an undifferentiated
no_result. Fall back to an in-process read through kasld_fopen when popen
fails. `cat` stays preferred: measured on 32-bit arm it returned a word 0x2c4
above _text where the in-process read's lowest sat 1.9 MiB higher.

check-unattributed-leak-floor pins the confidence a component may claim when
it cannot establish which region its leaked value belongs to: below
KASLD_SOUND_FLOOR, so a region guess can never bound the guaranteed window.
Per file rather than per call -- a listed component has no region-establishing
evidence at all -- which also keeps the matcher line-oriented, since a
confidence argument routinely wraps onto its own line.

Author: bcoles

Makefile

@@ -663,6 +663,7 @@ lint :
 	@$(TEST_DIR)/check-text-floor
 	@$(TEST_DIR)/check-text-region
 	@$(TEST_DIR)/check-confidence-floor
+	@$(TEST_DIR)/check-unattributed-leak-floor
 	@$(TEST_DIR)/check-arch-macros
 	@$(TEST_DIR)/check-lattice-seam
 	@$(TEST_DIR)/check-page-offset-substitution

docs/testing.md

@@ -113,6 +113,7 @@ and `make` halts on the first.
 | `check-text-floor` | no component rolls its own text-base floor — they must use the `api.h` helper |
 | `check-shellcheck` | shellcheck over the `extra/` helper scripts |
 | `check-confidence-floor` | no engine rule pins the *guaranteed* window from a guess — a sub-floor signal may shape `likely` only, outside the reviewed allowlist |
+| `check-unattributed-leak-floor` | a component that cannot establish *which* region its leaked value belongs to stays below the sound floor. Some leaks hand over a kernel address with no evidence of what it points at: the value is real, the region is a guess, and a region guess admitted to the guaranteed window is a soundness bug rather than an imprecision — an interior-text sample implies `image_base <= sample`, so a value that is not text but sits below the real `_text` carves the truth out of the window that promises to contain it. `/proc/<pid>/syscall` (CVE-2020-28588) is the registered case: it leaks whatever the reading task's call chain left on `proc_pid_syscall()`'s kernel stack frame, which is a return address into text on x86_32, arm and riscv32, and a direct-map pointer on powerpc and mips, where the image is randomized above them so the leaked word sits *below* `_text`. Nothing in the component can tell the two apart, because the text band is the unknown being solved for. The rule is per file rather than per call — a listed component has no region-establishing evidence at all, so no emission it makes can earn the sound band — which also keeps the matcher line-oriented, since a confidence argument routinely wraps onto its own line. A component that gains real corroboration is removed from the list, never raised in place |
 | `check-arch-macros` | every macro an architecture header defines is read by something. A name nothing reads is a misspelling, a retired spelling one header kept, or dead weight — and the first two are silent: the architecture falls back to the contract's default for the macro it *meant* to set, which costs precision with nothing to show for it. No test catches that, because the tests read the same declaration the code does and assert whatever it says. Complements the retired-spelling `#error`s in `api.h`, which fail the build for one known-old name; this catches the names no such check lists |
 | `check-lattice-seam` | the quantities held to the estimate accessors (`Q_PAGE_OFFSET`, `Q_VA_BITS`) are read through `quantity_pinned/window/admits/narrowed`, never through `.lo` / `.hi`. `struct estimate` means different things per lattice — on a finite set `lo` is a live-candidate bitmask and `hi` is unused — and which lattice a quantity uses is declared once in the quantity table, so a direct read hard-codes an answer the reader never asked for. Nothing would fail loudly: a bitmask read as an address is a small integer, so the result is a plausible wrong answer rather than a crash. The pointer alias is discovered from its binding rather than assumed to be named `po`, so renaming it cannot slip a read past |
 | `check-page-offset-substitution` | no engine rule or leak component substitutes the compile-time `PAGE_OFFSET` for the target's linear-map base. That constant describes the analysing build, not the kernel under examination, and on the VMSPLIT arches the two differ routinely — code that reaches for it is asserting the split it was compiled with. The failure is invisible: it compiles everywhere, passes on the whole default-split corpus, and is off by exactly the gap between two build configurations, which is zero on every machine anyone tests. In a rule, an equality must read the resolved `Q_PAGE_OFFSET` via `quantity_pinned()`, and a bound may instead use `PAGE_OFFSET_MAX` (upper) or `PAGE_OFFSET_MIN` (lower), which hold against every target and need no resolution. A component runs before inference and can never see an estimate, so it measures the boundary instead — `kasld_kernel_pointer_floor()` for the user/kernel split, `kasld_page_offset_floor()` for a region-tagged bound. Comments and string literals are stripped first, and `#if` / `#elif` lines are exempt by construction (a constant expression cannot call an accessor, which is why the band assertions keep `PAGE_OFFSET` a plain scalar), so only C code counts |

src/components/proc_pid_syscall.c

@@ -79,12 +79,52 @@ KASLD_META("method:parsed\n"
            "patch:v5.10\n"
            "config:CONFIG_HAVE_ARCH_TRACEHOOK\n");
 
-static unsigned long get_kernel_addr_proc_pid_syscall(void) {
+/* One /proc/self/syscall line into `buf`. Returns 1 on success.
+ *
+ * Preferred: `cat` is the leaker, not this process. The leaked words are the
+ * READING task's kernel stack at collect_syscall() time; a freshly exec'd cat
+ * reads at a shallower depth and yields addresses closer to _stext than an
+ * in-process read, whose stack carries libc startup and the KASLD emitter call
+ * chain. Measured: on a 32-bit arm cell cat returned a word 0x2c4 above _text
+ * where the in-process read's lowest text word sat 1.9 MiB higher.
+ *
+ * Fallback: read the file directly. popen() runs /bin/sh -c, so the preferred
+ * path needs both a shell and cat; a target with neither still leaks. Without
+ * this the component reports "no kernel address found" there — the same thing
+ * it reports on a kernel that is not vulnerable at all. The fallback recovers
+ * less, not nothing, and it goes through kasld_fopen so the read is replayable.
+ */
+static int read_syscall_line(char *buf, size_t sz, int *use_popen) {
   FILE *f;
+  char *got = NULL;
+
+  if (*use_popen) {
+    f = popen("/bin/cat /proc/self/syscall", "r");
+    if (f) {
+      got = fgets(buf, (int)sz, f);
+      pclose(f);
+      if (got)
+        return 1;
+    }
+    /* No shell, no cat, or nothing on stdout — stop paying for it every pass.
+     */
+    *use_popen = 0;
+    kasld_info("no /bin/cat via popen; reading /proc/self/syscall in-process");
+  }
+
+  f = kasld_fopen("/proc/self/syscall", "r");
+  if (!f)
+    return 0;
+  got = fgets(buf, (int)sz, f);
+  fclose(f);
+  return got ? 1 : 0;
+}
+
+static unsigned long get_kernel_addr_proc_pid_syscall(void) {
   int iterations = 10;
+  int use_popen = 1;
   unsigned long addr = 0;
   unsigned long leaked_addr = 0;
-  const char *cmd = "/bin/cat /proc/self/syscall";
   char buff[1024];
   char *ptr;
   char *endptr;
@@ -93,26 +133,11 @@ static unsigned long get_kernel_addr_proc_pid_syscall(void) {
 
   int i;
   for (i = 0; i < iterations; i++) {
-    /* cat is the leaker, not this process. The CVE leaks stale upper
-     * bytes of 64-bit arg fields from the reading process's kernel
-     * stack at collect_syscall() time; cat's stack at read(2) is
-     * shallower and empirically yields lower (closer to _stext)
-     * addresses than an in-process fopen, whose stack carries libc
-     * startup + the KASLD emitter call chain. */
-    f = popen(cmd, "r");
-    if (f == NULL) {
-      perror("[-] popen");
-      return 0;
-    }
-
-    if (fgets(buff, sizeof(buff), f) == NULL) {
-      perror("[-] fgets");
-      pclose(f);
+    if (!read_syscall_line(buff, sizeof(buff), &use_popen)) {
+      kasld_err("could not read /proc/self/syscall");
       return 0;
     }
 
-    pclose(f);
-
     /* Lazy implementation. In practice we only want data after the first 24
      * bytes (from the fifth value onwards).
      *

tests/check-unattributed-leak-floor

@@ -0,0 +1,112 @@
+#!/bin/sh
+# This file is part of KASLD - https://github.com/bcoles/kasld
+#
+# check-unattributed-leak-floor — a component that cannot establish WHICH region
+# its leaked value belongs to must stay below the sound floor.
+#
+# Some leaks hand over a kernel address with no evidence of what it points at.
+# The value is real; the region is a guess. Emitting such a value at or above
+# KASLD_SOUND_FLOOR (CONF_INFERRED) lets it shape the GUARANTEED window, and a
+# region guess in the guaranteed window is a soundness bug rather than an
+# imprecision: an interior-text sample implies image_base <= sample, so a value
+# that is not text — but sits below the real _text — carves the truth out of the
+# window that promises to contain it.
+#
+# This is not hypothetical. /proc/<pid>/syscall (CVE-2020-28588) leaks whatever
+# the reading task's call chain left on proc_pid_syscall()'s kernel stack frame.
+# What lands there is per-architecture: a return address into text on x86_32, arm
+# and riscv32; a direct-map pointer on powerpc and mips, where the image is
+# randomized above them so the leaked word sits BELOW _text. Tagged
+# REGION_KERNEL_TEXT at CONF_PARSED, that truncated the guaranteed window below
+# the true base on 2 of 5 boots of a 5.9 ppc32 kernel. Nothing in the component
+# could tell the two cases apart — the text band is the unknown being solved for.
+#
+# The check is the whole-file rule rather than a per-call one: a component listed
+# here has no source of region-establishing evidence at all, so no emission it
+# makes can earn the sound band. That also keeps the check line-oriented, because
+# an emission's confidence argument routinely wraps onto its own line and a
+# multi-line matcher is exactly the kind of fragile guard that silently stops
+# checking.
+#
+# Registering a component here is a statement that its region claim rests on the
+# address's value alone. A component that gains real corroboration should be
+# removed from the list, not have its confidence raised in place.
+#
+# Comments are stripped before matching (tests/lib/c-code-grep.sh), so these
+# files may discuss CONF_PARSED and the sound floor freely — as they must, since
+# the reason for the floor is the thing worth writing down.
+#
+# Pure text, so it needs no build.
+# ---
+# <bcoles@gmail.com>
+
+set -u
+ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+COMPONENTS=$ROOT/src/components
+# shellcheck source=tests/lib/guard-scope.sh
+. "$ROOT/tests/lib/guard-scope.sh"
+# shellcheck source=tests/lib/c-code-grep.sh
+. "$ROOT/tests/lib/c-code-grep.sh"
+
+if [ -t 1 ]; then
+  RED=$(printf '\033[31m')
+  GREEN=$(printf '\033[32m')
+  RESET=$(printf '\033[0m')
+else
+  RED=
+  GREEN=
+  RESET=
+fi
+
+# Components whose leaked value carries no evidence of its own region.
+#   proc_pid_syscall — uninitialised kernel stack via /proc/<pid>/syscall; the
+#                      word is a text pointer on some arches and a direct-map
+#                      pointer on others, indistinguishable by value.
+UNATTRIBUTED="proc_pid_syscall.c"
+
+AT_OR_ABOVE_FLOOR='(^|[^A-Za-z0-9_])CONF_(PARSED|DERIVED|INFERRED)([^A-Za-z0-9_]|$)'
+BELOW_FLOOR='(^|[^A-Za-z0-9_])CONF_(HEURISTIC|TIMING|BRUTE)([^A-Za-z0-9_]|$)'
+
+bad=0
+n=0
+for base in $UNATTRIBUTED; do
+  f=$COMPONENTS/$base
+  if [ ! -f "$f" ]; then
+    echo "${RED}$base: listed here but not present in src/components${RESET}"
+    bad=1
+    continue
+  fi
+  n=$((n + 1))
+
+  hits=$(c_code_grep "$f" "$AT_OR_ABOVE_FLOOR")
+  if [ -n "$hits" ]; then
+    bad=1
+    echo "${RED}$base: emits at or above the sound floor${RESET}"
+    echo "$hits" | while IFS= read -r h; do
+      echo "  $h"
+    done
+  fi
+
+  # A file that emits nothing at all would pass the rule above vacuously, and
+  # would keep passing if its emission were deleted — so require the positive
+  # case too.
+  if [ -z "$(c_code_grep "$f" "$BELOW_FLOOR")" ]; then
+    bad=1
+    echo "${RED}$base: no sub-floor emission found — is it still emitting?${RESET}"
+  fi
+done
+
+if [ "$bad" -ne 0 ]; then
+  echo
+  echo "A component listed in this guard cannot show which region its leaked"
+  echo "value belongs to, so the value must not reach the guaranteed window."
+  echo "Emit at CONF_HEURISTIC or below. If the component has gained evidence"
+  echo "that establishes the region, drop it from UNATTRIBUTED here rather than"
+  echo "raising the confidence in place."
+  exit 1
+fi
+
+guard_scope "check-unattributed-leak-floor" "$n" 1
+
+printf '%scheck-unattributed-leak-floor: OK%s (%d component%s below the sound floor)\n' \
+  "$GREEN" "$RESET" "$n" "$([ "$n" -eq 1 ] || echo s)"