native-ipc 0.6.0

One safe API for least-authority native shared memory: sealed memfd on Linux, Mach memory entries on macOS, exact-rights sections on Windows
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

#![doc = include_str!("../README.md")]

#[cfg(not(any(
    all(
        target_os = "linux",
        any(target_arch = "aarch64", target_arch = "x86_64")
    ),
    all(
        target_os = "windows",
        any(target_arch = "aarch64", target_arch = "x86_64")
    ),
    all(target_os = "macos", target_arch = "aarch64")
)))]
compile_error!("native-ipc supports Linux and Windows on aarch64/x86_64, and macOS on aarch64");

/// Platform-neutral wire, layout, and sequencing primitives.
pub use native_ipc_core as core;

/// Checked allocation-free runtime access after batch commit.
pub mod active;
#[allow(dead_code)]
/// Atomic transfer-batch construction, expectations, and committed active sets.
pub mod batch;
/// Safe audited binding from committed active mappings to core capabilities.
pub mod binding;
/// Common native shared-memory allocation, policy, and cleanup interface.
pub mod memory;
/// Platform-neutral consuming region ownership states.
pub mod region;
/// Finite session limits, target capabilities, and absolute deadlines.
pub mod session;

mod backend;
/// Bounded opaque application-control records and validation errors.
pub mod control;
#[allow(dead_code)]
mod liveness;
#[allow(dead_code)]
mod negotiation;
mod protocol;

/// Runs the fixed macOS broker gate executable boundary without callbacks.
///
/// This hidden artifact entry performs no launch effect: it validates the
/// fixed process vector, FIFO reader, and control stream; receives and
/// acknowledges one canonical launch plan, waits for one start byte, then
/// retains the reader until service-death EOF. It exists only so a separately
/// compiled minimal broker executable can enter reviewed crate-private code.
///
/// # Safety
///
/// This must run in the just-execed dedicated broker before threads, children,
/// policy, or effect-bearing endpoints. The exact fixed spawner must
/// exclusively transfer descriptors 3 and 4 and the installed process vector;
/// no Rust value may already own either descriptor. `installed_path` must be an
/// absolute compile-time constant in the deployer's broker artifact and must
/// not derive from request data. Read-only fixture dispatch over `argv[0]` is
/// permitted before entry.
#[cfg(all(target_os = "macos", target_arch = "aarch64"))]
#[doc(hidden)]
pub unsafe fn __private_macos_broker_gate_main(installed_path: &std::ffi::CStr) -> ! {
    // SAFETY: the caller supplies the complete fixed process-entry contract.
    unsafe { backend::macos::run_fixed_broker_gate_process(installed_path) }
}

/// Runs the complete fixed macOS broker launcher lifecycle without callbacks.
///
/// This hidden artifact entry stages and activates the exact parent plan,
/// pre-creates its fixed clean-exec authentication worker, spawns the fixed
/// launcher, delivers the plan, verifies the target at its exec trap, reports
/// the held trace state, and resumes only after the Ready-bound reverse commit.
/// Public macOS construction uses the direct-spawn session path and does not
/// call this entry.
///
/// # Safety
///
/// This must run in the just-execed dedicated broker before threads, children,
/// policy, or effect-bearing endpoints. The exact fixed spawner must
/// exclusively transfer descriptors 3 through 5 and the installed process
/// vector. Each path must be an absolute compile-time constant in the
/// deployer's broker artifact, must not derive from request data, and must name
/// the exact replacement-resistant signed image verified by the installation.
#[cfg(all(target_os = "macos", target_arch = "aarch64"))]
#[doc(hidden)]
pub unsafe fn __private_macos_broker_main(
    installed_path: &std::ffi::CStr,
    launcher_path: &std::ffi::CStr,
    auth_worker_path: &std::ffi::CStr,
) -> ! {
    // SAFETY: the caller supplies the complete fixed process-entry contract.
    unsafe {
        backend::macos::run_fixed_broker_process(installed_path, launcher_path, auth_worker_path)
    }
}

/// Runs the fixed macOS trusted-launcher boundary without callbacks.
///
/// The launcher exists because the target is foreign code that cannot trace
/// itself. This image designates the broker as its tracer, stops for identity
/// proof, contains itself, then becomes the target. It needs no privilege and
/// refuses to run as root.
///
/// # Safety
///
/// This must run in the just-execed launcher before threads, children, or
/// effect-bearing endpoints exist. The fixed spawner must exclusively transfer
/// descriptor 3 (broker death) and descriptor 4 (plan) plus the installed
/// process vector; no Rust value may already own either descriptor.
/// `installed_path` must be an absolute compile-time constant in the deployer's
/// launcher artifact and must not derive from request data.
#[cfg(all(target_os = "macos", target_arch = "aarch64"))]
#[doc(hidden)]
pub unsafe fn __private_macos_launcher_main(installed_path: &std::ffi::CStr) -> ! {
    // SAFETY: the caller supplies the complete fixed process-entry contract.
    unsafe { backend::macos::run_fixed_launcher_process(installed_path) }
}

/// Runs the fixed macOS clean-exec authentication-worker boundary.
///
/// This hidden artifact entry validates one exact inherited request, performs
/// the installed fixed Security requirement check against its audit token,
/// emits one canonical result, and exits. It exists only for a separately
/// compiled minimal signed worker executable.
///
/// # Safety
///
/// This must run in the just-execed dedicated worker before threads or
/// Security.framework initialization. `installed_path`, `requirement`, and
/// `code_identity` must be compile-time installed-policy constants in that
/// artifact; `installed_path` must be absolute. None may derive from request
/// data. The exact spawner must exclusively transfer descriptors 3 and 4 plus
/// the fixed vector.
#[cfg(all(target_os = "macos", target_arch = "aarch64"))]
#[doc(hidden)]
pub unsafe fn __private_macos_auth_worker_main(
    installed_path: &std::ffi::CStr,
    requirement: &std::ffi::CStr,
    code_identity: [u8; 32],
) -> ! {
    // SAFETY: the caller supplies the complete fixed process-entry contract.
    unsafe {
        backend::macos::run_fixed_auth_worker_process(installed_path, requirement, code_identity)
    }
}