kobako 0.28.0 → 0.30.0

data/crates/kobako-runtime/src/vfs/utimes.rs

@@ -0,0 +1,289 @@
+//! Setting the times of an entry, as Linux's `utimensat` does. What answers is
+//! the entry's own `setattr`, so a Filesystem decides whether it keeps a time
+//! of the caller's choosing.
+
+use std::sync::Arc;
+
+use super::attr::notify_change;
+use super::cred::{on_path, Cred};
+use super::namei::{filename_lookup, retry_estale};
+use super::path::{Path, Start};
+use super::{FilesystemError, Iattr};
+
+/// Set `times` on what the descriptor at `path` names, as Linux's `do_utimes_fd`.
+pub fn do_utimes_fd(cred: &Arc<Cred>, path: &Path, times: &Iattr) -> Result<(), FilesystemError> {
+    vfs_utimes(cred, path, times)
+}
+
+/// Set `times` on what `path` names, as Linux's `vfs_utimes` asks the mount,
+/// then the security hook, then `setattr` under the entry's lock. An entry
+/// without `setattr` keeps no time to set, as this VFS holds none on an inode.
+fn vfs_utimes(cred: &Arc<Cred>, path: &Path, times: &Iattr) -> Result<(), FilesystemError> {
+    path.mnt().mnt_want_write()?;
+    let dentry = path.dentry();
+    on_path(path.mnt(), dentry, |at| cred.security_path_utimes(at))?;
+    let held = dentry.inode_lock()?;
+    notify_change(dentry, &held, times)
+}
+
+/// Set `times` on what `path` beneath `start` names, a link at its end
+/// followed where `follow` asks, as Linux's `do_utimes_path` walks to it first.
+pub fn do_utimes_path(
+    cred: &Arc<Cred>,
+    start: &impl Start,
+    path: &str,
+    follow: bool,
+    times: &Iattr,
+) -> Result<(), FilesystemError> {
+    retry_estale(
+        || filename_lookup(cred, start, path, follow),
+        |nd| vfs_utimes(cred, &nd.path_to(nd.path()?), times),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+    use std::time::UNIX_EPOCH;
+
+    use super::*;
+    use crate::filesystem::{
+        FileSystemType, FileType, Filesystem, InodeOperations, Kstat, SetTime, Tmpfs,
+    };
+    use crate::mount::{Access as MountAccess, Mount, Policy};
+    use crate::security::{prepare_creds_within, restrict_self};
+    use crate::vfs::Dentry;
+
+    fn times() -> Iattr<'static> {
+        Iattr::times(Some(SetTime::Now), Some(SetTime::At(UNIX_EPOCH)))
+    }
+
+    fn mount_of(filesystem: Arc<dyn FileSystemType>, access: MountAccess) -> Mount {
+        let filesystem = Filesystem::new(filesystem).expect("the instance must stand");
+        Mount::new("/data", filesystem, access).expect("/data is a guest path")
+    }
+
+    fn tmpfs() -> Arc<Tmpfs> {
+        Arc::new([("file.txt", "x")].into_iter().collect())
+    }
+
+    // A thread waiting on a lock it holds answers a deadlock, so only a change
+    // that takes the entry's lock answers one here.
+    // @behavior RT-236
+    #[test]
+    fn a_change_to_an_entry_holds_its_lock() {
+        let mount = mount_of(tmpfs(), MountAccess::ReadWrite);
+        let root = Path::root(mount.mnt());
+        let _held = root.dentry().inode_lock().expect("the lock must be free");
+        assert_eq!(
+            vfs_utimes(&Arc::default(), &root, &times()),
+            Err(FilesystemError::Deadlock),
+            "vfs::vfs_utimes on an entry whose lock its own thread holds must answer EDEADLK"
+        );
+    }
+
+    // @behavior RT-236
+    #[test]
+    fn a_truncate_through_a_descriptor_holds_the_entry_lock() {
+        let mount = mount_of(tmpfs(), MountAccess::ReadWrite);
+        let write = crate::vfs::OpenHow {
+            write: true,
+            ..Default::default()
+        };
+        let mut file = crate::vfs::kern_path::filp_open(
+            &Arc::default(),
+            &Path::root(mount.mnt()),
+            "file.txt",
+            &write,
+        )
+        .expect("the file opens to write");
+        let dentry = file.path().dentry().clone();
+        let _held = dentry.inode_lock().expect("the lock must be free");
+        assert_eq!(
+            file.truncate(0),
+            Err(FilesystemError::Deadlock),
+            "vfs::File::truncate on a file whose lock its own thread holds must answer EDEADLK, \
+             as do_ftruncate holds the inode's lock around notify_change"
+        );
+    }
+
+    // @behavior RT-186
+    #[test]
+    fn setting_times_asks_the_mount_then_the_entry() {
+        let set = |access, path: &str| {
+            let mount = mount_of(tmpfs(), access);
+            do_utimes_path(
+                &Arc::default(),
+                &Path::root(mount.mnt()),
+                path,
+                false,
+                &times(),
+            )
+        };
+        assert_eq!(
+            (
+                set(MountAccess::ReadWrite, "missing"),
+                set(MountAccess::Read, "file.txt"),
+                set(MountAccess::ReadWrite, "file.txt"),
+            ),
+            (
+                Err(FilesystemError::NotFound),
+                Err(FilesystemError::ReadOnlyFilesystem),
+                Ok(()),
+            ),
+            "vfs::do_utimes_path must answer what is not there ENOENT, a read-only Mount EROFS, and \
+             hand a Tmpfs entry the times"
+        );
+    }
+
+    /// A directory answering every call but `setattr` by default.
+    struct NoSetattr;
+
+    impl FileSystemType for NoSetattr {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(crate::vfs::Inode::new(
+                &crate::vfs::Kstat::new(crate::vfs::FileType::Dir, 0),
+                self,
+            ));
+            Ok(())
+        }
+    }
+
+    impl InodeOperations for NoSetattr {
+        fn getattr(&self, _dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            Ok(Kstat::new(FileType::Dir, 0))
+        }
+    }
+
+    // @behavior RT-186
+    #[test]
+    fn an_entry_without_setattr_answers_enotsup() {
+        let mount = mount_of(Arc::new(NoSetattr), MountAccess::ReadWrite);
+        assert_eq!(
+            vfs_utimes(&Arc::default(), &Path::root(mount.mnt()), &times()),
+            Err(FilesystemError::Unsupported),
+            "vfs::vfs_utimes on an entry without setattr must answer ENOTSUP"
+        );
+    }
+
+    /// A Filesystem keeping what it was last asked to set.
+    #[derive(Default)]
+    struct KeepsTimes(Mutex<Option<Iattr<'static>>>);
+
+    impl FileSystemType for KeepsTimes {
+        fn fill_super(self: Arc<Self>, sb: &mut Filesystem) -> Result<(), FilesystemError> {
+            sb.d_make_root(crate::vfs::Inode::new(
+                &crate::vfs::Kstat::new(crate::vfs::FileType::Dir, 0),
+                self,
+            ));
+            Ok(())
+        }
+    }
+
+    impl InodeOperations for KeepsTimes {
+        fn getattr(&self, _dentry: &Dentry) -> Result<Kstat, FilesystemError> {
+            Ok(Kstat::new(FileType::Dir, 0))
+        }
+
+        fn setattr(&self, _dentry: &Dentry, attr: &Iattr) -> Result<(), FilesystemError> {
+            *self.0.lock().unwrap() = Some(Iattr {
+                size: attr.size,
+                atime: attr.atime,
+                mtime: attr.mtime,
+                open: attr.open,
+                ctime: attr.ctime,
+                file: None,
+            });
+            Ok(())
+        }
+    }
+
+    // @behavior RT-186
+    #[test]
+    fn a_filesystem_with_setattr_answers_for_the_times_itself() {
+        let filesystem = Arc::new(KeepsTimes::default());
+        let mount = mount_of(filesystem.clone(), MountAccess::ReadWrite);
+        let answer = vfs_utimes(&Arc::default(), &Path::root(mount.mnt()), &times());
+        let handed = filesystem
+            .0
+            .lock()
+            .unwrap()
+            .map(|attr| (attr.atime, attr.mtime, attr.ctime.is_some()));
+        assert_eq!(
+            (answer, handed),
+            (Ok(()), Some((times().atime, times().mtime, true))),
+            "vfs::vfs_utimes on a Filesystem with setattr must hand it the times and the moment \
+             the change lands, and answer what it answers"
+        );
+    }
+
+    /// A Policy allowing everything, keeping each path it was asked about.
+    #[derive(Default)]
+    struct RecordsPaths(Mutex<Vec<String>>);
+
+    impl Policy for RecordsPaths {
+        fn allows(&self, path: &str, _access: MountAccess) -> bool {
+            self.0.lock().unwrap().push(path.to_string());
+            true
+        }
+    }
+
+    // A file's descriptor outlives its name, so only the walk's own check
+    // keeps a Policy from judging a path it no longer stands at.
+    // @behavior RT-201
+    #[test]
+    fn a_time_set_through_a_descriptor_is_judged_where_it_stands() {
+        let policy = Arc::new(RecordsPaths::default());
+        let mount = mount_of(tmpfs(), MountAccess::ReadWrite).with_policy(policy.clone());
+        let cred = restrict_self(&prepare_creds_within(&[], None), [&mount]);
+        let root = Path::root(mount.mnt());
+        let how = crate::vfs::OpenHow {
+            read: true,
+            ..Default::default()
+        };
+        let file = crate::vfs::kern_path::filp_open(&cred, &root, "file.txt", &how)
+            .unwrap_or_else(|_| panic!("the file must open"));
+        crate::vfs::filename_unlinkat(&cred, &root, "file.txt").expect("the name must go");
+        policy.0.lock().unwrap().clear();
+        assert_eq!(
+            (
+                crate::security::WalkGuard::new([&mount]).check(file.path()),
+                policy.0.lock().unwrap().clone()
+            ),
+            (Err(FilesystemError::NotFound), Vec::new()),
+            "WalkGuard::check of a descriptor of a file whose name is gone, beneath a Policy, \
+             must answer ENOENT without asking the Policy about the path it stood at"
+        );
+    }
+
+    struct RefusesAll;
+
+    impl Policy for RefusesAll {
+        fn allows(&self, _path: &str, _access: MountAccess) -> bool {
+            false
+        }
+    }
+
+    // A file opened to read reaches this with no write the Policy judged, so
+    // the call itself must ask.
+    // @behavior RT-186
+    #[test]
+    fn a_policy_is_asked_before_times_are_set() {
+        let filesystem = Arc::new(KeepsTimes::default());
+        let mount =
+            mount_of(filesystem.clone(), MountAccess::ReadWrite).with_policy(Arc::new(RefusesAll));
+        assert_eq!(
+            (
+                vfs_utimes(
+                    &restrict_self(&prepare_creds_within(&[], None), [&mount]),
+                    &Path::root(mount.mnt()),
+                    &times()
+                ),
+                *filesystem.0.lock().unwrap(),
+            ),
+            (Err(FilesystemError::PermissionDenied), None),
+            "vfs::vfs_utimes beneath a Policy refusing the path must answer EACCES and leave the \
+             Filesystem unasked"
+        );
+    }
+}

data/crates/kobako-runtime/src/vfs.rs

@@ -0,0 +1,60 @@
+//! The calls made on paths beneath a mount, answered as the VFS above a
+//! filesystem answers them, so an ABI above only carries each call's arguments
+//! in and its answer out.
+//!
+//! A path never climbs above the directory it is resolved beneath, as a
+//! capability never widens, and a read-only mount and the security hooks
+//! answer each open and each change before the Filesystem is asked, so a
+//! Filesystem of a third party's checks neither.
+
+mod attr;
+mod cred;
+mod dentry;
+mod errno;
+mod file;
+mod inode;
+#[cfg(test)]
+pub(crate) mod kern_path;
+mod mount;
+mod namei;
+mod openat2;
+mod path;
+mod readdir;
+mod stat;
+mod super_block;
+mod utimes;
+
+pub(crate) use namei::{
+    __start_renaming, d_revalidate, inode_permission, lookup_one_unlocked, may_create_dentry,
+    start_creating, start_removing, vfs_create, vfs_mkdir, vfs_rename, vfs_rmdir, vfs_unlink,
+};
+
+pub(crate) use attr::notify_change;
+pub use attr::{Iattr, SetTime};
+pub(crate) use cred::VmCommitted;
+pub use cred::{Cred, FileSecurity, SecurityOperations, SecurityPath};
+pub use dentry::{Dentry, DentryOperations};
+pub use errno::FilesystemError;
+pub(crate) use file::alloc_file_pseudo;
+pub use file::{
+    generic_file_llseek, generic_write_sync, FMode, File, FileOperations, Kiocb, PollMask, Whence,
+};
+pub use inode::{Finish, Identity, Inode, InodeOperations, Lookup, Mask, RenameFlag};
+pub use mount::VfsMount;
+pub use namei::{
+    do_file_open, filename_linkat, filename_mkdirat, filename_renameat2, filename_rmdir,
+    filename_symlinkat, filename_unlinkat,
+};
+pub use openat2::{build_open_flags, OpenFlags, OpenHow};
+pub use path::{Path, Start};
+pub use readdir::{
+    dir_emit_dots, generic_read_dir, verify_dirent_name, DirContext, DirEmit, DirEntry,
+};
+pub use stat::{do_readlinkat, vfs_fstatat, FileType, Kstat};
+pub use super_block::{FileSystemType, SuperBlock};
+pub use utimes::{do_utimes_fd, do_utimes_path};
+
+/// Linux's limits on a path, its terminating NUL counted, and on one name
+/// within it.
+pub const PATH_MAX: usize = 4096;
+pub const NAME_MAX: usize = 255;

data/crates/kobako-runtime/src/yielder.rs

@@ -15,11 +15,16 @@ use crate::error::Trap;
 /// Host-initiated re-entry into the in-flight guest instance to run a
 /// yielded block.
 ///
-/// `yield_to_block` ships `args` as a `yield` downcall and returns the
-/// decoded Yield Reply, `Unsupported` arm included, or a `Trap` — surfaced
-/// through the frontend's trap-error mapping — when the re-entry traps,
-/// the guest returns an empty or unframeable result, or a payload exceeds
-/// the 16 MiB cap.
+/// Each open Call has a `frame`, counted from `0` at the outermost.
+/// `yield_to_block` ships `args` as a `yield` downcall to the block of the
+/// open Call `frame` names, and returns the decoded Yield Reply,
+/// `Unsupported` arm included, or a `Trap` — surfaced through the
+/// frontend's trap-error mapping — when the re-entry traps, the guest
+/// returns an empty or unframeable result, or a payload exceeds the
+/// 16 MiB cap.
 pub trait Yielder {
-    fn yield_to_block(&mut self, args: &[u8]) -> Result<YieldReply, Trap>;
+    /// The frame of the Call this Yielder was lent for.
+    fn frame(&self) -> u32;
+
+    fn yield_to_block(&mut self, frame: u32, args: &[u8]) -> Result<YieldReply, Trap>;
 }

data/crates/kobako-runtime/tests/linux_baseline/calls.rs

@@ -0,0 +1,171 @@
+//! The calls a sequence is made of, drawn from a seed so a run repeats and an
+//! older commit can be held to the same one.
+
+/// How many descriptors a sequence holds at once.
+pub const SLOTS: usize = 4;
+
+/// The modified time a call sets, seconds past the Unix epoch.
+pub const UTIME_SECONDS: i64 = 1;
+
+/// One call, made alike through the VFS and through Linux. A path call starts
+/// from the root, or from the descriptor `base` names.
+#[derive(Clone, Debug)]
+pub enum Call {
+    Open(Open),
+    Close(usize),
+    Read(usize, usize),
+    Write(usize, usize),
+    Pread(usize, usize, u64),
+    Pwrite(usize, usize, u64),
+    Seek(usize, i64, u8),
+    Truncate(usize, u64),
+    Fallocate(usize, u64, u64),
+    Fstat(usize),
+    Fsync(usize),
+    Readdir(usize),
+    Stat {
+        base: Option<usize>,
+        path: String,
+        follow: bool,
+    },
+    Utimes {
+        base: Option<usize>,
+        path: String,
+        follow: bool,
+    },
+    Mkdir(Option<usize>, String),
+    Rmdir(Option<usize>, String),
+    Unlink(Option<usize>, String),
+    Rename(Option<usize>, String, String),
+}
+
+/// What an open asks for, and the descriptor it lands in.
+#[derive(Clone, Debug, Default)]
+pub struct Open {
+    pub base: Option<usize>,
+    pub path: String,
+    pub read: bool,
+    pub write: bool,
+    pub create: bool,
+    pub exclusive: bool,
+    pub truncate: bool,
+    pub append: bool,
+    pub directory: bool,
+    pub nofollow: bool,
+    pub slot: usize,
+}
+
+impl Call {
+    /// The call's name, which a difference and a coverage count are kept by.
+    pub fn kind(&self) -> &'static str {
+        match self {
+            Self::Open(_) => "Open",
+            Self::Close(_) => "Close",
+            Self::Read(..) => "Read",
+            Self::Write(..) => "Write",
+            Self::Pread(..) => "Pread",
+            Self::Pwrite(..) => "Pwrite",
+            Self::Seek(..) => "Seek",
+            Self::Truncate(..) => "Truncate",
+            Self::Fallocate(..) => "Fallocate",
+            Self::Utimes { .. } => "Utimes",
+            Self::Fstat(_) => "Fstat",
+            Self::Fsync(_) => "Fsync",
+            Self::Readdir(_) => "Readdir",
+            Self::Stat { .. } => "Stat",
+            Self::Mkdir(..) => "Mkdir",
+            Self::Rmdir(..) => "Rmdir",
+            Self::Unlink(..) => "Unlink",
+            Self::Rename(..) => "Rename",
+        }
+    }
+}
+
+/// The bytes a write of `len` carries.
+pub fn payload(len: usize) -> &'static [u8] {
+    &b"WXYZ"[..len.min(4)]
+}
+
+/// A small generator, so a seed names the same sequence on every toolchain.
+pub struct Rng(u64);
+
+impl Rng {
+    pub fn new(seed: u64) -> Self {
+        let mut rng = Self(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        for _ in 0..4 {
+            rng.next();
+        }
+        rng
+    }
+
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+
+    pub fn random_below(&mut self, bound: u64) -> u64 {
+        self.next() % bound
+    }
+
+    fn random_ratio(&mut self, numerator: u64, denominator: u64) -> bool {
+        self.random_below(denominator) < numerator
+    }
+
+    fn choose_path(&mut self, paths: &[String]) -> String {
+        paths[self.random_below(paths.len() as u64) as usize].clone()
+    }
+
+    /// The next call of a sequence over `paths`.
+    pub fn call(&mut self, paths: &[String]) -> Call {
+        let slot = self.random_below(SLOTS as u64) as usize;
+        let base = self
+            .random_ratio(25, 100)
+            .then(|| self.random_below(SLOTS as u64) as usize);
+        match self.random_below(100) {
+            0..=27 => Call::Open(Open {
+                base,
+                path: self.choose_path(paths),
+                read: self.random_ratio(70, 100),
+                write: self.random_ratio(45, 100),
+                create: self.random_ratio(30, 100),
+                exclusive: self.random_ratio(10, 100),
+                truncate: self.random_ratio(10, 100),
+                append: self.random_ratio(12, 100),
+                directory: self.random_ratio(12, 100),
+                nofollow: self.random_ratio(15, 100),
+                slot,
+            }),
+            28..=32 => Call::Close(slot),
+            33..=38 => Call::Read(slot, self.random_below(8) as usize),
+            39..=45 => Call::Write(slot, self.random_below(4) as usize),
+            46..=48 => Call::Pread(slot, self.random_below(8) as usize, self.random_below(10)),
+            49..=51 => Call::Pwrite(slot, self.random_below(4) as usize, self.random_below(10)),
+            52..=54 => Call::Seek(
+                slot,
+                self.random_below(14) as i64 - 4,
+                self.random_below(3) as u8,
+            ),
+            55..=58 => Call::Truncate(slot, self.random_below(12)),
+            59..=62 => Call::Fstat(slot),
+            63..=64 => Call::Fsync(slot),
+            65..=68 => Call::Readdir(slot),
+            69..=73 => Call::Stat {
+                base,
+                path: self.choose_path(paths),
+                follow: self.random_ratio(50, 100),
+            },
+            74..=79 => Call::Mkdir(base, self.choose_path(paths)),
+            80..=85 => Call::Rmdir(base, self.choose_path(paths)),
+            86..=89 => Call::Unlink(base, self.choose_path(paths)),
+            90 => Call::Fallocate(slot, self.random_below(10), self.random_below(5)),
+            91 => Call::Utimes {
+                base,
+                path: self.choose_path(paths),
+                follow: self.random_ratio(50, 100),
+            },
+            _ => Call::Rename(base, self.choose_path(paths), self.choose_path(paths)),
+        }
+    }
+}