kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/src/vfs/openat2.rs

@@ -0,0 +1,116 @@
+//! What an open asks for, as Linux's `openat2` takes an `open_how`.
+
+use super::inode::Mask;
+use super::FilesystemError;
+
+/// How to open a path, as Linux's `struct open_how` carries `openat2`'s
+/// flags.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct OpenHow {
+    pub read: bool,
+    pub write: bool,
+    /// Create a file where nothing stands, as `O_CREAT` does.
+    pub create: bool,
+    /// Refuse what already stands there, as `O_EXCL` does.
+    pub exclusive: bool,
+    /// Empty the file once it is open, as `O_TRUNC` does.
+    pub truncate: bool,
+    /// Refuse anything but a directory, as `O_DIRECTORY` does.
+    pub directory: bool,
+    /// Follow a link at the end of the path.
+    pub follow: bool,
+    /// Land each write at the end, as `O_APPEND` does.
+    pub append: bool,
+    /// Ask not to wait, as `O_NONBLOCK` does.
+    pub nonblock: bool,
+    /// Make what each write needs read back durable before it answers, as
+    /// `O_DSYNC` does.
+    pub dsync: bool,
+    /// Make everything each write changed durable before it answers, as
+    /// `O_SYNC` does.
+    pub sync: bool,
+}
+
+/// What an open was found to ask, as Linux's `struct open_flags` holds what
+/// `build_open_flags` made of an `open_how`, which alone makes one, so what
+/// it asks of the entry always matches the flags. A Filesystem never reads
+/// it: `->atomic_open` and `->open` take the `OpenHow` it was made of, as
+/// Linux hands them `open_flag` and `f_flags`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct OpenFlags {
+    open_flag: OpenHow,
+    acc_mode: Mask,
+    lookup_follow: bool,
+    lookup_directory: bool,
+}
+
+impl OpenFlags {
+    /// The flags the open was made with, as `open_flag` keeps them.
+    pub(crate) fn open_flag(&self) -> &OpenHow {
+        &self.open_flag
+    }
+
+    /// What the open asks of what it opens, as `acc_mode` carries it;
+    /// `may_open` adds `MAY_OPEN` when it asks.
+    pub(crate) fn acc_mode(&self) -> Mask {
+        self.acc_mode
+    }
+
+    /// Whether the walk follows a link at the end, as `LOOKUP_FOLLOW` in
+    /// `lookup_flags` asks.
+    pub(crate) fn lookup_follow(&self) -> bool {
+        self.lookup_follow
+    }
+
+    /// Whether the walk must end on a directory, as `LOOKUP_DIRECTORY` in
+    /// `lookup_flags` asks.
+    pub(crate) fn lookup_directory(&self) -> bool {
+        self.lookup_directory
+    }
+}
+
+/// Refuse flags no open can mean before any path is looked at, as Linux's
+/// `build_open_flags` refuses `O_DIRECTORY` with `O_CREAT`, and make what the
+/// open asks: `O_CREAT` with `O_EXCL` never follows a link at the end, and
+/// `O_SYNC` carries `O_DSYNC`, as Linux implements it as both. An open asking
+/// neither to read nor to write stands only for its path, as `O_PATH` keeps
+/// only `O_PATH_FLAGS` and asks nothing of the entry. An ABI asks it once,
+/// before it reserves a descriptor, and hands what it made to `do_file_open`,
+/// as `do_sys_openat2` does.
+pub fn build_open_flags(how: &OpenHow) -> Result<OpenFlags, FilesystemError> {
+    if !how.read && !how.write {
+        return Ok(OpenFlags {
+            open_flag: OpenHow {
+                directory: how.directory,
+                follow: how.follow,
+                ..OpenHow::default()
+            },
+            acc_mode: Mask::NONE,
+            lookup_follow: how.follow,
+            lookup_directory: how.directory,
+        });
+    }
+    if how.directory && how.create {
+        return Err(FilesystemError::InvalidInput);
+    }
+    let mut acc_mode = Mask::NONE;
+    if how.read {
+        acc_mode = acc_mode | Mask::READ;
+    }
+    if how.write || how.truncate {
+        acc_mode = acc_mode | Mask::WRITE;
+    }
+    if how.append {
+        acc_mode = acc_mode | Mask::APPEND;
+    }
+    Ok(OpenFlags {
+        open_flag: OpenHow {
+            dsync: how.dsync || how.sync,
+            ..*how
+        },
+        acc_mode,
+        lookup_follow: how.follow && !(how.create && how.exclusive),
+        lookup_directory: how.directory,
+    })
+}

data/crates/kobako-runtime/src/vfs/path.rs

@@ -0,0 +1,64 @@
+//! A name beneath a mount, as Linux's `struct path` pairs a mount with a
+//! dentry.
+
+use std::sync::Arc;
+
+use super::dentry::Dentry;
+use super::mount::VfsMount;
+use super::FilesystemError;
+
+/// Where a walk starts, found once the call has taken its name, as Linux's
+/// `path_init` takes the directory a descriptor names only after the name. A
+/// caller holding a table of descriptors hands how to find it, so a call with
+/// two names answers for the first before it looks at the second's start.
+pub trait Start {
+    fn path_init(&self) -> Result<Path, FilesystemError>;
+}
+
+impl Start for Path {
+    fn path_init(&self) -> Result<Path, FilesystemError> {
+        Ok(self.clone())
+    }
+}
+
+impl<F: Fn() -> Result<Path, FilesystemError>> Start for F {
+    fn path_init(&self) -> Result<Path, FilesystemError> {
+        self()
+    }
+}
+
+/// A name beneath a mount, as an open file holds its `f_path`: the mount's
+/// root, or an entry opened beneath it. A walk starts only from a directory.
+#[derive(Clone)]
+pub struct Path {
+    mnt: Arc<VfsMount>,
+    /// The entry, wherever it moved, and whether it was removed.
+    dentry: Arc<Dentry>,
+}
+
+impl Path {
+    /// The root of `mnt`.
+    pub fn root(mnt: &Arc<VfsMount>) -> Self {
+        Self {
+            dentry: mnt.mnt_root().clone(),
+            mnt: mnt.clone(),
+        }
+    }
+
+    /// This Path standing at `dentry`.
+    pub(crate) fn with_dentry(&self, dentry: Arc<Dentry>) -> Self {
+        Self {
+            mnt: self.mnt.clone(),
+            dentry,
+        }
+    }
+
+    /// What the entry is mounted on.
+    pub fn mnt(&self) -> &Arc<VfsMount> {
+        &self.mnt
+    }
+
+    pub(crate) fn dentry(&self) -> &Arc<Dentry> {
+        &self.dentry
+    }
+}

data/crates/kobako-runtime/src/vfs/readdir.rs

@@ -0,0 +1,163 @@
+//! Listing a directory, as Linux's `fs/readdir.c` hands each entry a
+//! Filesystem emits to the actor a listing names, with the helpers `libfs.c`
+//! gives every Filesystem.
+
+use std::sync::Arc;
+
+use super::cred::Cred;
+use super::dentry::Dentry;
+use super::inode::Identity;
+use super::{FileType, FilesystemError, Kstat, PATH_MAX};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct DirEntry {
+    pub name: String,
+    pub file_type: FileType,
+    /// The device and inode numbers naming the entry, as `Kstat` reports
+    /// them and `dir_emit` hands `d_ino`. An `ino` of zero reports none.
+    pub dev: u64,
+    pub ino: u64,
+}
+
+impl DirEntry {
+    /// The entry `name` in its directory, naming a `file_type`.
+    pub fn new(name: impl Into<String>, file_type: FileType) -> Self {
+        Self {
+            name: name.into(),
+            file_type,
+            dev: 0,
+            ino: 0,
+        }
+    }
+
+    /// This entry naming `dev` and `ino`, as a stat of it reports them.
+    pub fn with_identity(self, dev: u64, ino: u64) -> Self {
+        Self { dev, ino, ..self }
+    }
+}
+
+/// One entry a listing hands its actor, as `dir_emit` does.
+#[non_exhaustive]
+pub struct DirEmit<'a> {
+    pub name: &'a str,
+    pub file_type: FileType,
+    /// What the entry is, `None` where its Filesystem names no inode number.
+    pub identity: Option<Identity>,
+    /// Where the entry stands, as `dir_emit` hands `ctx->pos`, so a listing
+    /// from there reaches it first.
+    pub offset: u64,
+}
+
+impl DirEmit<'_> {
+    /// This entry as a list keeps one.
+    pub fn to_dir_entry(&self) -> DirEntry {
+        let entry = DirEntry::new(self.name, self.file_type);
+        match self.identity {
+            Some(identity) => {
+                let named = identity.onto(Kstat::new(self.file_type, 0));
+                entry.with_identity(named.dev, named.ino)
+            }
+            None => entry,
+        }
+    }
+}
+
+/// A listing under way, as Linux's `struct dir_context`: where it stands, who
+/// takes each entry, answering whether to go on, and who the listing is for.
+pub struct DirContext<'a> {
+    pub(super) pos: u64,
+    actor: &'a mut dyn FnMut(&DirEmit<'_>) -> bool,
+    pub(super) cred: Arc<Cred>,
+}
+
+impl<'a> DirContext<'a> {
+    /// A listing from `pos`, each entry going to `actor`. A listing of an open
+    /// directory starts where that directory stands instead.
+    pub fn new(pos: u64, actor: &'a mut dyn FnMut(&DirEmit<'_>) -> bool) -> Self {
+        Self {
+            pos,
+            actor,
+            cred: Cred::new(Vec::new()),
+        }
+    }
+
+    /// Where the listing stands, as `ctx->pos`.
+    pub fn pos(&self) -> u64 {
+        self.pos
+    }
+
+    /// Who the listing is for, as `file->f_cred`.
+    pub fn cred(&self) -> &Arc<Cred> {
+        &self.cred
+    }
+
+    /// Move the listing to `pos`, as a Filesystem sets `ctx->pos` to where its
+    /// next entry stands, or past its last.
+    pub fn set_pos(&mut self, pos: u64) {
+        self.pos = pos;
+    }
+
+    /// Hand the actor `entry`, standing where the listing stands, answering
+    /// whether to go on, as `dir_emit` does. The Filesystem moves the listing
+    /// past what the actor took. The actor judges the name, as `filldir64` asks
+    /// `verify_dirent_name`.
+    pub fn dir_emit(&mut self, entry: &DirEntry) -> bool {
+        let identity = Identity::from_numbers(entry.dev, entry.ino);
+        self.emit(&entry.name, entry.file_type, identity)
+    }
+
+    fn emit(&mut self, name: &str, file_type: FileType, identity: Option<Identity>) -> bool {
+        (self.actor)(&DirEmit {
+            name,
+            file_type,
+            identity,
+            offset: self.pos,
+        })
+    }
+}
+
+/// The identity the inode `dentry` holds was looked up with, as Linux reads
+/// `i_ino`.
+fn i_ino(dentry: &Dentry) -> Option<Identity> {
+    dentry.inode().and_then(|inode| inode.identity())
+}
+
+/// Hand `ctx` the `.` and `..` it has yet to reach, as Linux's `dir_emit_dots`
+/// does with the inode numbers the dentries hold, `..` naming what stands above
+/// `dentry`, or itself at the root. It asks no Filesystem and answers whether
+/// to go on.
+pub fn dir_emit_dots(dentry: &Dentry, ctx: &mut DirContext<'_>) -> bool {
+    if ctx.pos == 0 {
+        if !ctx.emit(".", FileType::Dir, i_ino(dentry)) {
+            return false;
+        }
+        ctx.pos = 1;
+    }
+    if ctx.pos == 1 {
+        if !ctx.emit("..", FileType::Dir, i_ino(&dentry.parent())) {
+            return false;
+        }
+        ctx.pos = 2;
+    }
+    true
+}
+
+/// What a directory's read answers, as Linux's `generic_read_dir` is every
+/// directory's `f_op->read`.
+pub fn generic_read_dir() -> Result<usize, FilesystemError> {
+    Err(FilesystemError::IsADirectory)
+}
+
+/// Refuse a name no directory can hold, as Linux's `verify_dirent_name` refuses
+/// what a Filesystem hands it, so whoever walks a listing is never handed a
+/// path where it was promised one name. A Filesystem that asks about each name
+/// before it lists them asks this first.
+pub fn verify_dirent_name(name: &str) -> Result<(), FilesystemError> {
+    if name.is_empty() || name.len() >= PATH_MAX || name.contains('/') {
+        return Err(FilesystemError::Other(
+            "a Filesystem listed a name no directory can hold".to_string(),
+        ));
+    }
+    Ok(())
+}

data/crates/kobako-runtime/src/vfs/stat.rs

@@ -0,0 +1,157 @@
+//! Looking at what stands at a path, as Linux's `fstatat` and
+//! `readlinkat` do.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use super::cred::Cred;
+use super::namei::{filename_lookup, retry_estale};
+use super::path::Start;
+use super::FilesystemError;
+
+/// What a path names, as Linux's file types `FT_*` name each kind.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum FileType {
+    RegFile,
+    Dir,
+    /// A link, as only a stat that does not follow it and a listing report one.
+    Symlink,
+    /// A FIFO a host holds, or a pipe of the runtime's own.
+    Fifo,
+    Sock,
+    Blkdev,
+    /// A character device a host holds, or a whiteout, as Linux makes one.
+    Chrdev,
+    /// What a platform names no kind for.
+    Unknown,
+}
+
+/// Whether `kind` is a device, a FIFO, or a socket, as Linux's `special_file`
+/// names what an open for writing takes no write access to its mount for.
+pub(crate) fn special_file(kind: FileType) -> bool {
+    matches!(
+        kind,
+        FileType::Chrdev | FileType::Blkdev | FileType::Fifo | FileType::Sock
+    )
+}
+
+/// What a Filesystem reports of an entry, as Linux's `struct kstat`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct Kstat {
+    /// What the entry is, as the `S_IFMT` bits of `mode` say; the runtime
+    /// keeps no permission bits, so the kind stands alone.
+    pub file_type: FileType,
+    /// The length in bytes, of a directory what its Filesystem reports.
+    pub size: u64,
+    /// The device and inode numbers naming what the path holds, as
+    /// `st_dev` and `st_ino` do. An `ino` of zero reports none, so such a
+    /// directory cannot be told from one made in its place.
+    pub dev: u64,
+    pub ino: u64,
+    /// How many names the entry has, as `st_nlink` counts; one where the
+    /// Filesystem keeps no count, as Linux starts every inode.
+    pub nlink: u64,
+    /// When the entry was last read, written, or changed, as `st_atime`,
+    /// `st_mtime`, and `st_ctime` record; `None` where the Filesystem keeps
+    /// no such time.
+    pub atime: Option<SystemTime>,
+    pub mtime: Option<SystemTime>,
+    pub ctime: Option<SystemTime>,
+}
+
+impl Kstat {
+    /// What an entry is and its size, reporting no identity or time.
+    pub fn new(file_type: FileType, size: u64) -> Self {
+        Self {
+            file_type,
+            size,
+            dev: 0,
+            ino: 0,
+            nlink: 1,
+            atime: None,
+            mtime: None,
+            ctime: None,
+        }
+    }
+
+    /// The same, naming `dev` and `ino` as what the path holds.
+    pub fn with_identity(self, dev: u64, ino: u64) -> Self {
+        Self { dev, ino, ..self }
+    }
+
+    /// The same, counting `nlink` names.
+    pub fn with_nlink(self, nlink: u64) -> Self {
+        Self { nlink, ..self }
+    }
+
+    /// The same, recording when the entry was last read, written, and changed.
+    pub fn with_times(
+        self,
+        atime: Option<SystemTime>,
+        mtime: Option<SystemTime>,
+        ctime: Option<SystemTime>,
+    ) -> Self {
+        Self {
+            atime,
+            mtime,
+            ctime,
+            ..self
+        }
+    }
+
+    /// A device number for a Filesystem with none of its own, as each
+    /// tmpfs mount takes one: no earlier call returned it, and its top bit,
+    /// which no host's `st_dev` sets, keeps it apart from a host's.
+    pub fn unique_device() -> u64 {
+        static NEXT: AtomicU64 = AtomicU64::new(1);
+        (1 << 63) | NEXT.fetch_add(1, Ordering::Relaxed)
+    }
+}
+
+/// What `path` beneath `start` names, as Linux's `vfs_fstatat` answers: a
+/// link at its end followed where `follow` asks, and otherwise reported as
+/// itself unless a trailing `/` asks for the directory it leads to, as
+/// `AT_SYMLINK_NOFOLLOW` leaves one.
+pub fn vfs_fstatat(
+    cred: &Arc<Cred>,
+    start: &impl Start,
+    path: &str,
+    follow: bool,
+) -> Result<Kstat, FilesystemError> {
+    retry_estale(
+        || filename_lookup(cred, start, path, follow),
+        |nd| nd.getattr(),
+    )
+}
+
+/// Where the link at `path` beneath `start` points, as Linux's `do_readlinkat`
+/// asks the security hook only of a link, and answers anything else invalid.
+/// It takes the name with `LOOKUP_EMPTY`, so an empty one names `start`
+/// itself, and anything but a link there is not found. The caller's buffer is
+/// the ABI's to judge, as only its syscall has one.
+pub fn do_readlinkat(
+    cred: &Arc<Cred>,
+    start: &impl Start,
+    path: &str,
+) -> Result<String, FilesystemError> {
+    let walk = || match path.is_empty() {
+        true => Ok((
+            start.path_init()?.dentry().clone(),
+            FilesystemError::NotFound,
+        )),
+        false => Ok((
+            filename_lookup(cred, start, path, false)?.path()?,
+            FilesystemError::InvalidInput,
+        )),
+    };
+    retry_estale(walk, |(target, refusal)| {
+        if target.kind()? != FileType::Symlink {
+            return Err(refusal);
+        }
+        cred.security_inode_readlink(&target)?;
+        target.get_link()
+    })
+}

data/crates/kobako-runtime/src/vfs/super_block.rs

@@ -0,0 +1,122 @@
+//! One mounted instance of a Filesystem, as Linux's `super_block` is.
+
+use std::sync::Arc;
+
+use super::dentry::{Dentries, Dentry, DentryOperations};
+use super::errno::FilesystemError;
+use super::inode::Inode;
+use crate::locking::RwSemaphore;
+
+/// What makes an instance of a Filesystem, as Linux's `file_system_type`.
+/// Every lock beneath it waits through the one `Blocking` its process
+/// registers, so a Filesystem says nothing about waiting.
+pub trait FileSystemType: Send + Sync + 'static {
+    /// Set up the instance, asked once before any walk, as a driver's
+    /// `fill_super` fills in its `super_block`. It makes the root through
+    /// `d_make_root` after any `set_default_d_op`, so the root answers through
+    /// it too. It also says what every dentry answers through, for a
+    /// Filesystem changed outside the runtime, whether nothing beneath it
+    /// changes, and whether a name goes once unused. An instance that cannot
+    /// stand answers why, and none is made.
+    fn fill_super(self: Arc<Self>, sb: &mut SuperBlock) -> Result<(), FilesystemError>;
+}
+
+/// One Filesystem instance, with the directories of it a walk reaches. Every
+/// mount of the same instance shares them, as a bind mount shares its super
+/// block, so a directory moved or removed beneath one is moved or removed
+/// beneath every other.
+pub struct SuperBlock {
+    /// The root dentry `fill_super` made, as `s_root`.
+    root: Option<Arc<Dentry>>,
+    dentries: Dentries,
+    /// Held by a move between two directories, as Linux's
+    /// `s_vfs_rename_mutex`, so no other such move changes which of them
+    /// stands beneath the other.
+    rename_mutex: Arc<RwSemaphore>,
+    /// Whether nothing beneath it changes, however it is mounted, as
+    /// `SB_RDONLY` in `s_flags`.
+    rdonly: bool,
+    /// Whether no dentry stays once nothing holds it, as `DCACHE_DONTCACHE` in
+    /// `s_d_flags`.
+    dontcache: bool,
+}
+
+impl SuperBlock {
+    /// The instance `fs` makes, set up as its `fill_super` asks, or why it cannot
+    /// stand. One whose `fill_super` made no root answers EINVAL.
+    pub fn new(fs: Arc<dyn FileSystemType>) -> Result<Arc<Self>, FilesystemError> {
+        let mut sb = Self {
+            root: None,
+            dentries: Dentries::new(None),
+            rename_mutex: Arc::default(),
+            rdonly: false,
+            dontcache: false,
+        };
+        fs.fill_super(&mut sb)?;
+        sb.root.as_ref().ok_or(FilesystemError::InvalidInput)?;
+        Ok(Arc::new(sb))
+    }
+
+    /// Make a root dentry for `root` and set it as this instance's root, as a
+    /// driver's `fill_super` sets `s_root` to what `d_make_root` makes.
+    pub fn d_make_root(&mut self, root: Arc<Inode>) {
+        self.root = Some(self.dentries.make_root(root));
+    }
+
+    /// This instance's root dentry, which `new` refuses an instance without.
+    pub(crate) fn s_root(&self) -> Arc<Dentry> {
+        self.root
+            .clone()
+            .expect("SuperBlock::new refuses an instance with no root")
+    }
+
+    /// Have every dentry of this instance made from now on answer through
+    /// `ops`, as a driver's `fill_super` calls `set_default_d_op` before
+    /// `d_make_root`. Without it the runtime trusts every name it holds, as
+    /// nothing changes the Filesystem outside the runtime.
+    pub fn set_default_d_op(&mut self, ops: Arc<dyn DentryOperations>) {
+        self.dentries.set_ops(ops);
+    }
+
+    /// What every dentry of this instance answers through, as `s_d_op`.
+    pub fn d_op(&self) -> Option<&Arc<dyn DentryOperations>> {
+        self.dentries.ops()
+    }
+
+    /// Refuse every change beneath this instance, as a driver's `fill_super`
+    /// sets `SB_RDONLY`. Without it the instance refuses no change, though a
+    /// read-only mount of it still does.
+    pub fn set_rdonly(&mut self) {
+        self.rdonly = true;
+    }
+
+    /// Whether nothing beneath this instance changes, as `sb_rdonly`.
+    pub fn rdonly(&self) -> bool {
+        self.rdonly
+    }
+
+    /// Keep no dentry of this instance once nothing holds it, as a driver with
+    /// nothing to gain from a cache sets `DCACHE_DONTCACHE`, as tmpfs does.
+    /// Without it a name stays for the next walk, one naming nothing too.
+    pub fn set_dontcache(&mut self) {
+        self.dontcache = true;
+    }
+
+    /// Whether no dentry of this instance stays once nothing holds it.
+    pub(crate) fn dontcache(&self) -> bool {
+        self.dontcache
+    }
+
+    pub(crate) fn rename_mutex(&self) -> &Arc<RwSemaphore> {
+        &self.rename_mutex
+    }
+
+    /// This instance's root dentry, once `fill_super` made it, as `s_root`.
+    pub fn root(&self) -> Option<&Arc<Dentry>> {
+        self.root.as_ref()
+    }
+
+    pub(crate) fn dentries(&self) -> &Dentries {
+        &self.dentries
+    }
+}