feat(swift): differential-oracle lane (belief vs ground-truth confinement) - #71
Open
anagnorisis2peripeteia wants to merge 2 commits into
Open
feat(swift): differential-oracle lane (belief vs ground-truth confinement)#71anagnorisis2peripeteia wants to merge 2 commits into
anagnorisis2peripeteia wants to merge 2 commits into
Conversation
…finement) Port the differential-oracle idea to compiled Swift: instead of driving a payload through a sink, probe a target's own confinement DECISION function and diff its BELIEF (does it approve the input?) against GROUND TRUTH (does materializing the approved path escape the sandbox base?). A control that approves a path whose write escapes has diverged from its own gate. Generic and extensible, not per-target: auto-discovers String-first-arg decision functions, gates fs-escape on a genuine boundary check in the body (a variable hasPrefix / '..' / allowed-root compare, not mere normalization), and leaves a strategy seam for exec-marker. Compiles the target file + a generated main.swift driver in isolation. Ships a naive-confiner canary so the lane proves itself live. Ran on Peekaboo (0 divergences; confinement surface consistent) and CodexBar (0 divergences; surfaced launch-approval decision candidates for the exec lane).
Add the exec-marker ground-truth strategy: a command/launch-approval gate's belief (does it approve?) vs ground truth (does running the approved input fire the benign marker?). Drives Bool/throws gates named/bodied for exec, with a planted marker executable so launch-path gates are probed with a real exec. Ships a naive-command-approver canary. Tighten fs-escape discovery to require a path return or path-ish name (not just any Bool that incidentally matches a boundary pattern), removing isApplicationRunning- style noise. Both canaries fire; validate:attacker LIVE.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports the differential-oracle idea to compiled Swift. Instead of driving a payload through a code sink, it probes a target's own confinement decision function and diffs its belief (did it approve the input?) against ground truth (does materializing the approved path escape the sandbox base?). A control that approves a path whose write escapes has diverged from its own gate —
belief=approved AND ground-truth=escaped.Generic and extensible, not per-target (matches
PLAYBOOK.md):String-first-arg decision functions (security-decision-verb names), capturing each one's body, throws-ness, and return type.fs-escapeon a genuine boundary check in the body — a variablehasPrefix(base),contains(".."), or allowed-root/baseDircompare — not mere normalization (hasPrefix("/"),standardizedFileURL). This precision is deliberate: a normalizer with no containment contract has no belief to diverge from.exec-markerstub) for command/launch-approval gates.main.swiftdriver in isolation (like the other Swift lanes); a decision needing the rest of its package is an honest miss.Canary
fixtures/differential-oracle-swift/vuln.swift— a naivehasPrefix-only confiner that approves a..// symlink escape.npm run validate:attackerreports the lane LIVE.Runs
isLaunchCandidateAllowed,resolvedExecutablePath) — targets for theexec-markerstrategyAn early run flagged a normalizer (
ApplicationIdentifierResolver.resolve) — verified a false positive and tightened the classifier to require a real boundary check, per the family's no-false-positives rule.Follow-ups (not in this PR)
exec-markerso command/launch-approval gates (e.g. CodexBar's Gatekeeper gate) get driven.isApplicationRunning-style matches don't surface as candidates.