c3726ddd29
- scripts/pbl_runtime_event_ddl.py: append_only_sql() 两处 RETURN 改为 IF p_table=tbl AND IFNULL(@pbl_guard_ctx,'')<>ctx THEN SIGNAL 45000/45001; 新增 _procedure_body_return_errors() 静态门禁 + verify() 第10/11项接入(含坏样本自检) - scripts/patch_rtx0005.py: dry-run 先行 + 写盘后二次读取断言, 幂等确认(命中0次) - tests/evidence/rtx0005_live_evidence.py: _Tee 同步落盘取证正文(QC #11) - tests/evidence/rtx0005_live_evidence.txt: 修复后实库取证(MariaDB 10.6.23, 装载rc=0, 守卫拒绝45001/break-glass放行/触发器拦截, ensure_partitions 6->11) - docs/work-log-2026-09-22-rtx0005.md: 根因/改动点/实库验证/收口状态归档 - .gitignore: 补 .rtx5tmp/ *.egg-info/ 及 MariaDB 数据文件后缀(QC #5 仓库去污染)
63 lines
2.6 KiB
Plaintext
63 lines
2.6 KiB
Plaintext
==============================================================================
|
||
PBL-RTX-0005 实库取证（修复后 DDL 装载 + 守卫行为）
|
||
时间: 2026-09-22 14:59:45 +0800
|
||
git HEAD: 8249969 模块目录: /d/pipeline/workspaces/0/sdlc_general/modules/pbl_runtime_ext
|
||
==============================================================================
|
||
[1] 连接参数来源: projects/pbls/env/test.json db 段（dbname=pbls user=pbls，凭据不打印）
|
||
[2] mariadb-install-db rc=0
|
||
[3] mariadbd 就绪: 10.6.23-MariaDB-0ubuntu0.22.04.1
|
||
[4] 建库建号 rc=0
|
||
[5] full_script() 渲染 12346 bytes（修复后，无过程体 RETURN）
|
||
[6] DDL 装载 rc=0
|
||
stdout: note | m11b-1 migrate: 人工执行，见注释
|
||
stderr: (空) <-- 修复前此处为 ERROR 1064 (42000) at line 65
|
||
|
||
[7] SHOW PROCEDURE STATUS（过程真实存在）
|
||
|
||
[8] SHOW TRIGGERS（触发器真实存在）
|
||
TRIGGER_NAME EVENT_MANIPULATION ACTION_TIMING EVENT_OBJECT_TABLE
|
||
trg_pbl_runtime_event_append_only_del DELETE BEFORE pbl_runtime_event
|
||
trg_pbl_runtime_event_append_only_upd UPDATE BEFORE pbl_runtime_event
|
||
|
||
[9] 分区清单
|
||
PARTITION_NAME PARTITION_DESCRIPTION
|
||
p202609 '2026-10-01'
|
||
p202610 '2026-11-01'
|
||
p202611 '2026-12-01'
|
||
p202612 '2027-01-01'
|
||
p202701 '2027-02-01'
|
||
p202702 '2027-03-01'
|
||
pmax MAXVALUE
|
||
|
||
[10] CALL pbl_runtime_event_ensure_partitions(9)（修复前报 1305 does not exist）
|
||
rc=0 stderr=(空)
|
||
调用后分区数=11
|
||
[11] append-only 守卫：非 break-glass 会话 CALL pbl_assert_append_only 必须被拒(45001)
|
||
rc=1 stderr=--------------
|
||
CALL pbl_assert_append_only('pbl_runtime_event','update','probe-deny')
|
||
--------------
|
||
|
||
ERROR 45001 (45000) at line 1: PBL_APPEND_ONLY_DENIED
|
||
PASS: 拒绝生效（SQLSTATE 45000 / MYSQL_ERRNO 45001）
|
||
[12] break-glass 放行：SET @pbl_guard_ctx='append_only_admin' 后同一 CALL 不报错
|
||
rc=0 stderr=(空)
|
||
[13] 非守护表不受影响：CALL pbl_assert_append_only('other_table',...) 应放行
|
||
rc=0 stderr=(空)
|
||
[14] 触发器层：INSERT 允许 / UPDATE 拒绝 / DELETE 拒绝（同会话内逐条验证）
|
||
UPDATE 段 rc=1 stderr=--------------
|
||
UPDATE pbl_runtime_event SET event_type='x' WHERE tenant_id='t_rtx5'
|
||
--------------
|
||
|
||
ERROR 45001 (45000) at line 3: PBL_APPEND_ONLY_DENIED
|
||
DELETE 段 rc=1 stderr=--------------
|
||
DELETE FROM pbl_runtime_event WHERE tenant_id='t_rtx5'
|
||
--------------
|
||
|
||
ERROR 45001 (45000) at line 1: PBL_APPEND_ONLY_DENIED
|
||
PASS: INSERT 成功、UPDATE/DELETE 均被触发器拒绝
|
||
break-glass 清理探针 rc=0 stderr=(空)
|
||
|
||
[15] 取证结论: PASS
|
||
[16] 沙箱 datadir 已销毁: /tmp/rtx0005_evidence_db 存在=False
|
||
[17] 本取证正文已同步落盘: tests/evidence/rtx0005_live_evidence.txt
|