kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/src/snapshot.rs

@@ -18,6 +18,7 @@ use kobako_transport::envelope::Outcome;
 /// pre-invocation sentinel — no bytes, cap not reached — shared by every
 /// frontend's before-first-invocation readout.
 #[derive(Default)]
+#[non_exhaustive]
 pub struct Capture {
     pub bytes: Vec<u8>,
     pub truncated: bool,
@@ -39,12 +40,13 @@ pub enum Completion {
     Trap(Trap),
 }
 
-/// Resource usage of one guest invocation, measured across the same
-/// bracket as the wall-clock / memory caps: `wall_time` is the seconds
-/// spent inside the guest export call; `memory_peak` is the high-water
-/// `memory.grow` delta in bytes past the entry-time baseline. `Default`
-/// (all zeros) is the pre-invocation sentinel.
+/// Resource usage of one guest invocation, each measured across the span
+/// its cap governs: `wall_time` is the seconds from setting the guest up to
+/// its export call returning, the span the deadline covers; `memory_peak`
+/// is the high-water `memory.grow` delta in bytes past the entry-time
+/// baseline. `Default` (all zeros) is the pre-invocation sentinel.
 #[derive(Clone, Copy, Default)]
+#[non_exhaustive]
 pub struct Usage {
     pub wall_time: f64,
     pub memory_peak: usize,
@@ -54,9 +56,22 @@ pub struct Usage {
 /// kinds: captures and usage are collected on trap and outcome alike.
 /// What a frontend exposes from the trap path is its own contract
 /// decision.
+#[non_exhaustive]
 pub struct Snapshot {
     pub completion: Completion,
     pub stdout: Capture,
     pub stderr: Capture,
     pub usage: Usage,
 }
+
+impl Snapshot {
+    /// What an engine hands back from one invocation.
+    pub fn new(completion: Completion, stdout: Capture, stderr: Capture, usage: Usage) -> Self {
+        Self {
+            completion,
+            stdout,
+            stderr,
+            usage,
+        }
+    }
+}

data/crates/kobako-runtime/src/vfs/attr.rs

@@ -0,0 +1,162 @@
+//! What a change sets of an entry, as Linux's `fs/attr.c` takes a
+//! `struct iattr`.
+
+use std::fmt;
+use std::time::SystemTime;
+
+use super::dentry::Dentry;
+use super::file::FileOperations;
+use super::FilesystemError;
+use crate::locking::RwSemaphoreGuard;
+
+/// Apply `attr` to what `dentry` names, as Linux's `notify_change` reaches
+/// `->setattr`, the moment it lands read once, as `current_time` is, so every
+/// time it sets to now reads the same. The caller holds the entry's lock and
+/// hands its guard over, as `notify_change` warns unless `inode_is_locked`;
+/// the lock was reached through the entry, which a dentry never drops.
+pub(crate) fn notify_change(
+    dentry: &Dentry,
+    held: &RwSemaphoreGuard,
+    attr: &Iattr,
+) -> Result<(), FilesystemError> {
+    let inode = dentry
+        .inode()
+        .expect("a dentry whose entry is locked names it");
+    debug_assert!(
+        inode.is_locked_by(held),
+        "notify_change takes the guard of the entry's own lock"
+    );
+    let attr = Iattr {
+        ctime: Some(SystemTime::now()),
+        ..*attr
+    };
+    inode.ops().setattr(dentry, &attr)
+}
+
+/// What a change sets of an entry, as Linux's `struct iattr`; a field left
+/// `None` is one `ia_valid` does not name.
+#[derive(Clone, Copy)]
+#[non_exhaustive]
+pub struct Iattr<'a> {
+    /// The length to truncate or extend a file to, extending with zeros.
+    pub size: Option<u64>,
+    /// The access and modification times to set.
+    pub atime: Option<SetTime>,
+    pub mtime: Option<SetTime>,
+    /// Whether the size comes from an open asking to truncate, as `ATTR_OPEN`
+    /// says, so a Filesystem that truncated in `->open` has nothing left to do.
+    pub open: bool,
+    /// The moment the change lands, which `notify_change` sets, as Linux's
+    /// `ia_ctime`: what a time set to now reads, and the entry's change time.
+    pub ctime: Option<SystemTime>,
+    /// The open file a truncate is made through, as `ATTR_FILE` names
+    /// `ia_file`, so a Filesystem acts through what that open holds, as 9p
+    /// takes its fid.
+    pub file: Option<&'a dyn FileOperations>,
+}
+
+impl Iattr<'static> {
+    /// A change truncating or extending a file to `len`, moving its modification
+    /// time to the moment it lands, as Linux's `do_truncate` names `ATTR_MTIME`
+    /// with `ATTR_SIZE`.
+    pub fn size(len: u64) -> Self {
+        Self {
+            size: Some(len),
+            atime: None,
+            mtime: Some(SetTime::Now),
+            open: false,
+            ctime: None,
+            file: None,
+        }
+    }
+
+    /// A change emptying a file an open asked to truncate.
+    pub(crate) fn open_truncate() -> Self {
+        Self {
+            open: true,
+            ..Self::size(0)
+        }
+    }
+
+    /// A change setting the times named, leaving any other as it stands.
+    pub fn times(atime: Option<SetTime>, mtime: Option<SetTime>) -> Self {
+        Self {
+            size: None,
+            atime,
+            mtime,
+            open: false,
+            ctime: None,
+            file: None,
+        }
+    }
+}
+
+impl<'a> Iattr<'a> {
+    /// This change made through the open file `file`, as `do_truncate` sets
+    /// `ATTR_FILE`.
+    pub(crate) fn through<'b>(self, file: &'b dyn FileOperations) -> Iattr<'b>
+    where
+        'a: 'b,
+    {
+        Iattr {
+            file: Some(file),
+            ..self
+        }
+    }
+
+    /// The time `set` names, now read as the moment this change lands.
+    pub fn time_of(&self, set: SetTime) -> SystemTime {
+        match set {
+            SetTime::Now => self.ctime.unwrap_or_else(SystemTime::now),
+            SetTime::At(time) => time,
+        }
+    }
+}
+
+/// Two changes compare equal through the same open file.
+impl PartialEq for Iattr<'_> {
+    fn eq(&self, other: &Self) -> bool {
+        let file = |attr: &Self| {
+            attr.file
+                .map(|file| file as *const dyn FileOperations as *const ())
+        };
+        (
+            self.size,
+            self.atime,
+            self.mtime,
+            self.open,
+            self.ctime,
+            file(self),
+        ) == (
+            other.size,
+            other.atime,
+            other.mtime,
+            other.open,
+            other.ctime,
+            file(other),
+        )
+    }
+}
+
+impl Eq for Iattr<'_> {}
+
+impl fmt::Debug for Iattr<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Iattr")
+            .field("size", &self.size)
+            .field("atime", &self.atime)
+            .field("mtime", &self.mtime)
+            .field("open", &self.open)
+            .field("ctime", &self.ctime)
+            .field("file", &self.file.is_some())
+            .finish()
+    }
+}
+
+/// A time a change sets, as Linux's `ATTR_ATIME` names the moment it lands and
+/// `ATTR_ATIME_SET` the time it carries.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SetTime {
+    Now,
+    At(SystemTime),
+}

data/crates/kobako-runtime/src/vfs/cred.rs

@@ -0,0 +1,334 @@
+//! Who a call is made for, as Linux's `struct cred`, and the hooks a security
+//! module answers, as `security_*` call each registered LSM. The VFS asks them
+//! where Linux does and knows nothing of what they decide.
+
+use std::any::Any;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Arc;
+
+use super::dentry::Dentry;
+use super::file::FMode;
+use super::inode::Mask;
+use super::mount::VfsMount;
+use super::openat2::OpenHow;
+use super::{FileType, FilesystemError};
+
+/// What one security module keeps on an open file, as Linux's `f_security`
+/// blob holds each module's part; `None` where it keeps nothing.
+pub type FileSecurity = Option<Arc<dyn Any + Send + Sync>>;
+
+/// A path a security hook is asked about: the mount it stands on, and its name
+/// from that mount's root, built only for a module that reads it, as `struct path`
+/// leaves `d_path` to the module that needs one. The name is what
+/// `Dentry::path_raw` answers for the entry when the module asks.
+#[derive(Clone, Copy)]
+pub struct SecurityPath<'a> {
+    pub mnt: &'a Arc<VfsMount>,
+    pub name: &'a dyn Fn() -> String,
+}
+
+/// Answer `hook` for `dentry` on `mnt`, its name read from where the dentry
+/// stands when a module asks, as a module builds one from the `struct path` a
+/// `security_*` hook is handed.
+pub(crate) fn on_path<T>(
+    mnt: &Arc<VfsMount>,
+    dentry: &Dentry,
+    hook: impl FnOnce(SecurityPath<'_>) -> T,
+) -> T {
+    hook(SecurityPath {
+        mnt,
+        name: &|| dentry.path_raw(),
+    })
+}
+
+/// What a security module answers, as a hook in Linux's `lsm_hook_defs.h`. A hook
+/// a module does not have allows the call, and a module can only refuse.
+pub trait SecurityOperations: Send + Sync {
+    /// Whether a call may do what `mask` asks of what `dentry` names, as
+    /// `security_inode_permission` is asked once the entry itself allowed it.
+    fn inode_permission(&self, _dentry: &Dentry, _mask: Mask) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether a file may be made at `path`, as `security_path_mknod`.
+    fn path_mknod(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether a directory may be made at `path`, as `security_path_mkdir`.
+    fn path_mkdir(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether the directory at `path` may go, as `security_path_rmdir`.
+    fn path_rmdir(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether the file at `path` may go, as `security_path_unlink`.
+    fn path_unlink(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether a link may be made at `path`, as `security_path_symlink`.
+    fn path_symlink(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether what `old` names may also go by `new`, as `security_path_link`.
+    fn path_link(
+        &self,
+        _old: SecurityPath<'_>,
+        _new: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether what `old` names may move to `new`, the dentries of each given, as
+    /// `security_path_rename` is handed both.
+    fn path_rename(
+        &self,
+        _old: SecurityPath<'_>,
+        _new: SecurityPath<'_>,
+        _dentries: (&Arc<Dentry>, &Arc<Dentry>),
+    ) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether a file of `kind` at `path` may be opened for `mode` as `how` asks,
+    /// as `security_file_open` reads `f_mode` and `f_flags` once `may_open`
+    /// allowed it, a file the open just made included, which `FMode::CREATED`
+    /// marks. What the module keeps on the open file answers its later hooks, as
+    /// Landlock keeps what it allowed in the file's security blob.
+    fn file_open(
+        &self,
+        _path: SecurityPath<'_>,
+        _kind: FileType,
+        _mode: FMode,
+        _how: &OpenHow,
+    ) -> Result<FileSecurity, FilesystemError> {
+        Ok(None)
+    }
+
+    /// Whether the open file may be truncated, judged from what this module kept
+    /// on it as it opened, as Landlock's `hook_file_truncate` reads the file's
+    /// blob.
+    fn file_truncate(&self, _kept: &FileSecurity) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether times may be set on the entry at `path`. Linux has no path hook
+    /// for times, so this is kobako's own, beside `path_truncate` and
+    /// `path_chmod` in kind, letting a module judge the path a call names.
+    fn path_utimes(&self, _path: SecurityPath<'_>) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+
+    /// Whether where the link `dentry` names points may be read, as
+    /// `security_inode_readlink` is handed the link.
+    fn inode_readlink(&self, _dentry: &Dentry) -> Result<(), FilesystemError> {
+        Ok(())
+    }
+}
+
+/// How many bytes Filesystems hold on one caller's behalf between calls, and the
+/// most they may, as Linux's `__vm_enough_memory` weighs what `vm_committed_as`
+/// counts against its limit, so a guest's descriptors cannot multiply a directory
+/// past what it was allotted.
+pub(crate) struct VmCommitted {
+    limit: usize,
+    used: AtomicUsize,
+}
+
+impl VmCommitted {
+    pub(crate) fn new(limit: usize) -> Arc<Self> {
+        Arc::new(Self {
+            limit,
+            used: AtomicUsize::new(0),
+        })
+    }
+}
+
+/// Who a call is made for, holding the security modules registered for it, as
+/// `cred->security` holds a Landlock domain, and the memory held on its behalf,
+/// which every Cred restricted from it shares, as a task's memory cgroup does.
+pub struct Cred {
+    security: Vec<Arc<dyn SecurityOperations>>,
+    committed: Option<Arc<VmCommitted>>,
+}
+
+/// One no module is registered for, which this crate's tests make calls as.
+#[cfg(test)]
+impl Default for Cred {
+    fn default() -> Self {
+        Self {
+            security: Vec::new(),
+            committed: None,
+        }
+    }
+}
+
+impl Cred {
+    /// One with `security` registered.
+    pub(crate) fn new(security: Vec<Arc<dyn SecurityOperations>>) -> Arc<Self> {
+        Self::within(security, None)
+    }
+
+    /// One with `security` registered and the memory held on its behalf counted
+    /// in `committed`, without bound where none.
+    pub(crate) fn within(
+        security: Vec<Arc<dyn SecurityOperations>>,
+        committed: Option<Arc<VmCommitted>>,
+    ) -> Arc<Self> {
+        Arc::new(Self {
+            security,
+            committed,
+        })
+    }
+
+    /// This Cred with `more` modules registered after its own, sharing the
+    /// memory held on its behalf, as `landlock_restrict_self` adds a domain.
+    pub(crate) fn with_modules(&self, more: Vec<Arc<dyn SecurityOperations>>) -> Arc<Self> {
+        let mut security = self.security.clone();
+        security.extend(more);
+        Self::within(security, self.committed.clone())
+    }
+
+    /// Ask each module in turn, the first refusal answering, as `call_int_hook`.
+    fn call_int_hook(
+        &self,
+        hook: impl Fn(&dyn SecurityOperations) -> Result<(), FilesystemError>,
+    ) -> Result<(), FilesystemError> {
+        self.security
+            .iter()
+            .try_for_each(|module| hook(module.as_ref()))
+    }
+
+    pub(crate) fn security_inode_permission(
+        &self,
+        dentry: &Dentry,
+        mask: Mask,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.inode_permission(dentry, mask))
+    }
+
+    pub(crate) fn security_path_mknod(
+        &self,
+        path: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_mknod(path))
+    }
+
+    pub(crate) fn security_path_mkdir(
+        &self,
+        path: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_mkdir(path))
+    }
+
+    pub(crate) fn security_path_rmdir(
+        &self,
+        path: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_rmdir(path))
+    }
+
+    pub(crate) fn security_path_unlink(
+        &self,
+        path: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_unlink(path))
+    }
+
+    pub(crate) fn security_path_symlink(
+        &self,
+        path: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_symlink(path))
+    }
+
+    pub(crate) fn security_path_link(
+        &self,
+        old: SecurityPath<'_>,
+        new: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_link(old, new))
+    }
+
+    pub(crate) fn security_path_rename(
+        &self,
+        old: SecurityPath<'_>,
+        new: SecurityPath<'_>,
+        dentries: (&Arc<Dentry>, &Arc<Dentry>),
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_rename(old, new, dentries))
+    }
+
+    /// A file's room for what each module keeps on it, empty until an open
+    /// fills it, as `security_file_alloc` gives every file one blob per module.
+    pub(crate) fn security_file_alloc(&self) -> Vec<FileSecurity> {
+        vec![None; self.security.len()]
+    }
+
+    /// Ask each module about the open, keeping what each keeps on the file in
+    /// the order the modules stand, as `security_file_open` fills `f_security`.
+    pub(crate) fn security_file_open(
+        &self,
+        path: SecurityPath<'_>,
+        kind: FileType,
+        mode: FMode,
+        how: &OpenHow,
+    ) -> Result<Vec<FileSecurity>, FilesystemError> {
+        self.security
+            .iter()
+            .map(|module| module.file_open(path, kind, mode, how))
+            .collect()
+    }
+
+    /// Ask each module whether the file may be truncated, handing each what it
+    /// kept on the file as it opened.
+    pub(crate) fn security_file_truncate(
+        &self,
+        kept: &[FileSecurity],
+    ) -> Result<(), FilesystemError> {
+        self.security
+            .iter()
+            .zip(kept)
+            .try_for_each(|(module, kept)| module.file_truncate(kept))
+    }
+
+    pub(crate) fn security_path_utimes(
+        &self,
+        path: SecurityPath<'_>,
+    ) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.path_utimes(path))
+    }
+
+    pub(crate) fn security_inode_readlink(&self, dentry: &Dentry) -> Result<(), FilesystemError> {
+        self.call_int_hook(|module| module.inode_readlink(dentry))
+    }
+
+    /// Count `bytes` more held on this caller's behalf, refusing them past its
+    /// limit, as `security_vm_enough_memory_mm` ends in `__vm_enough_memory`.
+    pub(crate) fn security_vm_enough_memory(&self, bytes: usize) -> Result<(), FilesystemError> {
+        let Some(committed) = &self.committed else {
+            return Ok(());
+        };
+        committed
+            .used
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |used| {
+                used.checked_add(bytes)
+                    .filter(|&total| total <= committed.limit)
+            })
+            .map(|_| ())
+            .map_err(|_| FilesystemError::OutOfMemory)
+    }
+
+    /// `bytes` counted earlier are held no more, as `vm_unacct_memory` gives
+    /// them back.
+    pub(crate) fn vm_unacct_memory(&self, bytes: usize) {
+        if let Some(committed) = &self.committed {
+            committed.used.fetch_sub(bytes, Ordering::Relaxed);
+        }
+    }
+}