UP-010 · Composition · STATED CHECKABLE RUNNABLE EXECUTED STAGED

Carrier Confinement

A Carrier starts with exactly the filesystem and descriptor authority its Worker's grant names.

Standing

STATED CHECKABLE RUNNABLE EXECUTED STAGED PUBLISHED REPRODUCED

Last checked

never run

Source

none — this record cites no check

Limit

Landlock ABI 9 on one host, in one lane (super/) this session does not edit. It establishes confinement for that carrier on that kernel. It does not establish confinement on any other kernel, and a same-UID battery measures yama unless a bare control runs beside it.

Next rung

in_tree — the battery referenced here lives in super/, a lane this session does not edit, so this catalog has no witness of its own to run. Copying it in with a receipt is the step. Running it on a kernel nobody in this tree configured is the step above that, and it is the one that would count.

Intent

Capability-Bounded Composition at the operating-system boundary. Before a Carrier's payload runs, its filesystem view is restricted to the directories the grant names and every inherited descriptor beyond the allowlist is sealed. Sealing is done with a range close-on-exec, never a blind close, because a blind close leaves a duplicated master in the census.

Problem

A worker needs to write one directory and gets the parent's whole environment: every open file, every socket, the whole filesystem. The grant it was started under is then decoration. Every escape story starts here.

Solution

Build the ruleset from the grant, not from the environment. Apply it before exec. Seal descriptors by range with close-on-exec so the census can prove the seal. Run a red control: a Carrier that should be refused, and is.

Real-world analogy

A contractor given keys to one room, with the rest of the building's keys removed from the ring before they walk in — and a locksmith who checks the ring, not the contractor's promise.

Structure — on the surface

An illustration on a compute surface: loci above, carriers below. Press Play or Step; the takeaways collect as you go. Nothing here is evidence — the witness section is.

The chapter in WRL — and the chain so far

Chapter 10 of 32 — the fragment _patterns/wrl/chain/carrier-confinement.wrl, sealed alone by wrl.js

; CARRIER CONFINEMENT — the carrier (a Door) opens only through the grant (a relay); nothing else can reach
; its one input port. cc_grant is the entry and a router: chapters 11 and 12 draw from it.
[relay:cc_grant]{sig_in, sig_out}
[door:cc_carrier]{sig_in}

[cc_grant] --sig--> [cc_carrier]

Its test bench _patterns/wrl/chain/carrier-confinement.bench.wrl — drives the entry for this chapter's own film; never part of the chain

; TEST BENCH — drives this chapter's entry alone; the chain replaces it with a wire from an earlier chapter
[pulser:cc_bench](every 1){sig_out}
[cc_bench] --sig--> [cc_grant]

module + bench seal to → sem-ee08d1c837f3576064779542af916b85e8a15aa93c2762ae03895be01db3b26e

Reduced by the native reducer (ic32); the reference reducer reproduces every epoch's film hash (0.004s).

FILM v0.7
t=1
pulser:cc_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
door:cc_carrier:open=0,next_open=0
relay:cc_grant:cur_out=0,next_out=1
wire:w__cc_bench__cc_grant:cur=1,nxt=1
wire:w__cc_grant__cc_carrier:cur=0,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=2
pulser:cc_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
door:cc_carrier:open=0,next_open=0
relay:cc_grant:cur_out=1,next_out=1
wire:w__cc_bench__cc_grant:cur=1,nxt=1
wire:w__cc_grant__cc_carrier:cur=0,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=3
pulser:cc_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
door:cc_carrier:open=0,next_open=1
relay:cc_grant:cur_out=1,next_out=1
wire:w__cc_bench__cc_grant:cur=1,nxt=1
wire:w__cc_grant__cc_carrier:cur=1,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

FILM v0.7
t=4
pulser:cc_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
door:cc_carrier:open=1,next_open=1
relay:cc_grant:cur_out=1,next_out=1
wire:w__cc_bench__cc_grant:cur=1,nxt=1
wire:w__cc_grant__cc_carrier:cur=1,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0

Composes with the 9 chapters before it

The chain through this chapter — every earlier fragment, this one, and the links — seals to sem-14361f945ede4619dcaa814dedc1b218bc45e91f79958e82a5a49ddf4342a3e8: 30 objects, 29 edges (was 28 / 27; every earlier object and edge is still present — checked, or the build refuses).

Links only the chain carries

[cb_in] --sig--> [cc_grant]

The board so far: one band per Part, signal flowing left to right; relays that fan out are routers, doors are switches, pulsers are clock domains. Hover an object — or click the board and walk it with the arrow keys — for its role, its Part and what it is wired to. This board is the chain’s sealed shape; no Film drives it, so it has no state to report, and the whole board in the conclusion is where every object’s state is read epoch by epoch. Wheel zooms · drag pans · double-click fits.

Syntax — quoted from the tree at build time

The refusal token, in the review that measured it (super/docs) super/docs/reviews/D_1_3B_2F.md:177

start_carrier refused: carrier-confinement-unacceptable

Forces

Confinement must happen before the payload runs and after the runtime has what it needs, and the two windows barely overlap. Dynamic linking needs /usr/lib; a ruleset lives in a descriptor that could itself be swept by the seal. And a battery that shares a UID with its subject measures the wrong enforcement layer unless it carries a control that would fail.

Applicability

Any process that runs on behalf of a grant: agent workers, plugin hosts, build sandboxes, the T&R shell's native apps.

Transformations

A refusing transformation is not one that is discouraged: it is one that, applied, makes the invariant above false. The word is the tree's, and it is the same word the join uses.

Consequences

A Carrier's authority becomes a fact about its start, checkable from the outside. The honest status here: STATED — the receipts are in another lane, and this page cannot run them.

Failure mode it answers

Ambient Authority — Granting access to an environment because some part of it needs one capability. Paid for at: AGENCY.md §4 (the phrasing that walks into it); Miller 2003 is the term's source

Witness

No witness. This pattern is STATED — the tree has no check for its invariant.

Counterexample

No counterexample shipped (required only when WITNESSED).

What to take away

1. from the animationThe request with everything was refused; the same request with a ruleset and a seal started, confined.
2. from the syntaxThe refusal is a named token, not a crash; the seal is a range close-on-exec.
3. from the literatureLandlock, Capsicum and the E language's confinement; Miller's ambient authority is the thing being removed.
4. from the witnessSTATED: the witness is a review document in super/, referenced by path and never copied; ABI 10 on this host.

Prior art — and what is not claimed

Novelty not claimed. Confinement is a solved problem with multiple shipped implementations. The witness lives in super/, a lane this session does not edit — it is referenced, not copied, and the reference is not a claim of authorship.

Realizations in the tree

• super/docs/reviews/D_1_3B_2F.md:114

Relations with other patterns

Capability-Bounded Composition WITNESSED