Skip to content

xprobe/startxfce: tell a stale socket from a live server (bug 24) - #11

Merged
12hrformat merged 1 commit into
mainfrom
fix/xprobe-startxfce-hardening
Oct 14, 2026
Merged

12hrformat merged 1 commit into
mainfrom
fix/xprobe-startxfce-hardening

Conversation

@farcrowx

Copy link
Copy Markdown
Collaborator

What

Bug 24: startxfce could announce an X server is already on :0, using it and
hand XFCE a display nothing was listening on, once persistence puts /tmp on
disk.

The build-integration half was already fixed in-tree (5aed0ad: xprobe is
compiled and staged as /usr/bin/xprobe). This branch closes the residual ways
the same symptom could return, and adds regression coverage.

xprobe

  • Every socket operation is bounded by SO_RCVTIMEO/SO_SNDTIMEO
    (XPROBE_TIMEOUT, default 5s), so an accept-but-silent listener no longer
    hangs the probe (and the launcher).
  • Exit-code contract: 0 live, 1 not-live (no socket / refused / peer
    closed), 2 usage, 3 unknown (timeout / permission / auth / malformed).
    Previously every failure was 1.

startxfce

  • display_state() returns live/dead/unknown; the socket is cleared only
    on dead and left alone on unknown.
  • With no probe installed, consult /proc/net/unix (exact path match,
    busybox-safe); unreadable means unknown, never live.
  • Passes XPROBE_TIMEOUT through and says once when no probe is present.

Tests

  • tests/xprobe-gate.sh (new): drives the real compiled binary against a
    synthetic X server; no third-party deps; skips cleanly without a C compiler.
    Wired into tests/branch-gate.sh and the ISO workflow.
  • tests/startxfce-gate.sh: cases 16-21 (no-probe fallback, live reuse,
    unknown-leaves-the-socket, bounded startup timeout, XPROBE_TIMEOUT
    passthrough, probe stuck at "not live").

Verification

  • tests/startxfce-gate.sh - 21 cases / 84 checks, pass.
  • tests/xprobe-gate.sh - 18 checks, pass.
  • tests/branch-gate.sh - both new gates pass. (smoke.sh and charge.sh
    fail for pre-existing, unrelated reasons in this checkout: no built
    copper-sh; they fail identically with this branch stashed.)

Not verified

No full ISO build and no real two-boot persistence test were run, so bug 24
stays open in BUGS.md until that boot is done.

The build-integration half of bug 24 landed in 5aed0ad: xprobe is compiled
and staged as /usr/bin/xprobe, so the launcher finally has a liveness probe
instead of trusting the bare socket. Three residual paths could still
reproduce the same symptom -- reusing a dead display after a persisted /tmp
-- so harden the probe and the launcher, and add regression coverage.

xprobe:
- Bound every socket operation with SO_RCVTIMEO/SO_SNDTIMEO, so a listener
  that accepts the connection and then says nothing returns instead of
  hanging the caller. XPROBE_TIMEOUT (default 5s) sets the bound.
- Give the exit code a contract: 0 live, 1 not-live (no socket / refused /
  peer closed), 2 usage, 3 unknown (timeout / permission / auth / bad reply).
  Everything used to be 1, which erased the "stale and clearable" vs "there
  but unanswered" distinction that matters when /tmp persists.

startxfce:
- display_state() prints live, dead or unknown; only "dead" clears the
  socket, and "unknown" leaves it in place for a server still starting.
- With no probe installed, consult /proc/net/unix (exact pathname match,
  busybox-safe); if it cannot be read the answer is unknown, never live.
- Pass XPROBE_TIMEOUT through, and say once when no probe is installed.

tests:
- tests/xprobe-gate.sh drives the real compiled binary against a synthetic
  X server (no third-party deps; skips cleanly without a C compiler) and is
  wired into tests/branch-gate.sh and the ISO workflow.
- tests/startxfce-gate.sh gains cases 16-21: the no-probe socket-table
  fallback, live reuse, unknown-leaves-the-socket, the bounded startup
  timeout, XPROBE_TIMEOUT passthrough and a probe stuck at "not live".

Not verified: a full ISO build and a real two-boot persistence test were not
run, so bug 24 stays open in BUGS.md until that boot is done.
@12hrformat
12hrformat merged commit 58895c1 into main Oct 14, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants