@ai-ecoverse/slicc-kernel 1.173.3 → 1.174.0

package/dist/kernel-worker.js

@@ -8740,7 +8740,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.173.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.174.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -27458,9 +27458,10 @@ var WasmProcess = class {
       cwd: typeof req.cwd === "string" && req.cwd.startsWith("/") ? req.cwd : "/",
       ...typeof req.term === "string" ? { term: req.term } : {}
     };
-    const answer2 = await sudo(call, this.blockingSignal(cancelled));
+    const answer2 = await sudo(call, this.blockingSignal(cancelled), this.stdinKind());
     if (!("grant" in answer2)) return answer2;
     if (this.dying) throw new KernelError("EINTR");
+    if (answer2.notice !== void 0) await this.complainLine(answer2.notice);
     const { file, argv, env, cwd, cred, caller } = answer2.grant;
     const stdio = [{ fd: 0 }, { fd: 1 }, { fd: 2 }];
     return {
@@ -27470,6 +27471,14 @@ var WasmProcess = class {
       })
     };
   }
+  stdinKind() {
+    if (!this.fds.has(0)) return "none";
+    const { file } = this.fds.get(0);
+    if (file.tty) return "tty";
+    const meta = file.heldMeta;
+    if (meta && "device" in meta) return meta.device === "null" ? "none" : "file";
+    return file.seek || file.held ? "file" : "pipe";
+  }
   async mountSyscall(req, cancelled) {
     const { mount, umount } = this.options;
     if (!mount || !umount) throw new KernelError("ENOSYS");
@@ -31745,24 +31754,36 @@ var SUDO_TIMEOUT_MS = 3e5;
 var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
 var WORD = String.raw`(?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|[^\s'"\\])+`;
 var RULE = new RegExp(
-  String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?(?:Cwd\s+(${WORD})\s+)?Cmnd(?:\s+(.*))?$`
+  String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()\s]+)\)\s+)?(?:Cwd\s+(${WORD})\s+)?(?:Stdin\s+(none)\s+)?Cmnd(?:\s+(.*))?$`
 );
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN3 = /^[A-Za-z0-9_@%+=:,./-]+$/;
-var CONTROL = /[\0-\x1f\x7f]/;
+var CONTROL = /[\p{Cc}\u2028\u2029]/u;
+var CONTROLS = /[\p{Cc}\u2028\u2029]/gu;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
 var DENIED2 = "sudo: approval denied";
 var DENIAL_MAX = 500;
 var ABORTED = /* @__PURE__ */ Symbol("aborted");
+var RAN_ONCE = "sudo: ran once; this command line can't be recorded as always";
+var ROOT_ONLY_MAX = 64;
+var OPERANDS_MAX = 256;
+var PATH_MAX = 4096;
 function hasControl(text) {
   return CONTROL.test(text);
 }
+function stdinMatches(rule, stdin) {
+  return rule.stdin === void 0 || stdin === "tty" || stdin === "none";
+}
+function recordable(cwd, argv) {
+  return !hasControl(cwd) && !argv.some(hasControl);
+}
 function withoutControl(text) {
-  return text.replace(CONTROL, (ch) => {
+  return text.replace(CONTROLS, (ch) => {
     const n = ch.charCodeAt(0);
     if (n === 9) return "\\t";
     if (n === 10) return "\\n";
     if (n === 13) return "\\r";
+    if (n > 255) return `\\u${n.toString(16)}`;
     return `\\x${n.toString(16).padStart(2, "0")}`;
   });
 }
@@ -31946,11 +31967,17 @@ function parseRule(line) {
   if (text === "" || text.startsWith("#")) return null;
   const m = RULE.exec(text);
   if (!m) return void 0;
-  const [, nopasswd, who = "", target = "root", dir, rest2 = ""] = m;
+  const [, nopasswd, who = "", target = "root", dir, stdin, rest2 = ""] = m;
   if (!validWho(who) || target !== "ALL" && !NAME3.test(target)) return void 0;
   const cwd = dir === void 0 ? void 0 : cwdOf(dir);
   if (cwd === "") return void 0;
-  const rule = { nopasswd: !!nopasswd, who, target, ...cwd !== void 0 ? { cwd } : {} };
+  const rule = {
+    nopasswd: !!nopasswd,
+    who,
+    target,
+    ...cwd !== void 0 ? { cwd } : {},
+    ...stdin === "none" ? { stdin: "none" } : {}
+  };
   if (rest2.trim() === "*") return { ...rule, cmnd: "*" };
   const words2 = splitPatterns(rest2);
   const [first, ...args] = words2 ?? [];
@@ -31968,7 +31995,8 @@ function recordedBare(line, file, rule) {
   const head = `NOPASSWD ${rule.who} (${rule.target}) `;
   const cmnd = `Cmnd ${quoteWord(rule.cmnd.path)}`;
   const cwd = rule.cwd === void 0 ? "" : `Cwd ${quoteWord(rule.cwd)} `;
-  return line.trimEnd() === `${head}${cwd}${cmnd}`;
+  const stdin = rule.stdin === void 0 ? "" : "Stdin none ";
+  return line.trimEnd() === `${head}${cwd}${stdin}${cmnd}`;
 }
 function flags(parsed2, arg, next3) {
   for (let j = 1; j < arg.length; j++) {
@@ -32008,7 +32036,8 @@ function parseArgs(args) {
 function described(rule) {
   const cmnd = rule.cmnd === "*" ? "ALL" : commandText(rule.cmnd);
   const cwd = rule.cwd === void 0 ? "" : `CWD=${quoteWord(rule.cwd)} `;
-  return `    (${rule.target}) ${cwd}${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
+  const stdin = rule.stdin === void 0 ? "" : "STDIN=none ";
+  return `    (${rule.target}) ${cwd}${stdin}${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
 }
 var Sudo = class {
   o;
@@ -32043,6 +32072,51 @@ var Sudo = class {
     }
     return true;
   }
+  async rootOnly(cwd, args) {
+    const { fs } = this.o;
+    const found = {};
+    const paths = [cwd];
+    for (const arg of args.slice(0, OPERANDS_MAX)) {
+      const value2 = /^--[^=]+=(.+)$/s.exec(arg)?.[1];
+      for (const word of value2 === void 0 ? [arg] : [arg, value2]) {
+        if (word === "" || word.length > PATH_MAX) continue;
+        const raw2 = word.startsWith("/") ? word : `${cwd}/${word}`;
+        if (word.startsWith("/") || await fs.lstat(normalizePath(raw2)).catch(() => void 0)) {
+          paths.push(raw2);
+        }
+      }
+    }
+    for (const raw2 of paths) {
+      const key = normalizePath(raw2);
+      const known = Object.hasOwn(found, key);
+      if (!known && Object.keys(found).length >= ROOT_ONLY_MAX) break;
+      if (known && !found[key]) continue;
+      found[key] = !await this.crossesLink(raw2) && await this.trusted(await this.existing(key));
+    }
+    return found;
+  }
+  async crossesLink(path) {
+    const parts2 = [];
+    for (const part of path.split("/")) {
+      if (part === "" || part === ".") continue;
+      if (part !== "..") {
+        parts2.push(part);
+        continue;
+      }
+      const at = `/${parts2.join("/")}`;
+      const st = parts2.length > 0 ? await this.o.fs.lstat(at).catch(() => void 0) : void 0;
+      if (st?.isSymbolicLink) return true;
+      parts2.pop();
+    }
+    return false;
+  }
+  async existing(path) {
+    let at = normalizePath(path);
+    while (at !== "/" && !await this.o.fs.lstat(at).catch(() => void 0)) {
+      at = at.slice(0, at.lastIndexOf("/")) || "/";
+    }
+    return at;
+  }
   async policyFile(path) {
     if (!await this.trusted(path)) {
       this.warn(`sudo: ${path} skipped: it must be root's, no symlink, and writable by root only`);
@@ -32150,7 +32224,7 @@ var Sudo = class {
     if (untrusted2) return untrusted2;
     const argv = [path, ...args];
     const matching = rules.filter(
-      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && commandMatches(rule.cmnd, argv)
+      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && stdinMatches(rule, caller.stdin) && commandMatches(rule.cmnd, argv)
     );
     const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
@@ -32172,14 +32246,19 @@ var Sudo = class {
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer2 === "always" && !await this.remember(self, target, cwd, argv)) {
-        return failed3("EIO", "sudo: the rule could not be recorded");
-      }
-      return grant();
+      if (answer2 === "once") return grant();
+      return await this.always(self, target, cwd, argv, recordable(cwd, parsed2.command), grant);
     } finally {
       this.pending.delete(cred.ruid);
     }
   }
+  async always(self, target, cwd, argv, shown, grant) {
+    if (!shown || !recordable(cwd, argv)) return { ...grant(), notice: RAN_ONCE };
+    if (!await this.remember(self, target, cwd, argv)) {
+      return failed3("EIO", "sudo: the rule could not be recorded");
+    }
+    return grant();
+  }
   listed(self, root, rules) {
     const host = this.o.hostname;
     if (root) {
@@ -32216,7 +32295,9 @@ ${lines2}
       ...caller.tty ? { tty: caller.tty } : {},
       createdAt,
       expiresAt: createdAt + timeout,
-      always: true
+      always: recordable(cwd, [path, ...argv]),
+      stdin: caller.stdin,
+      rootOnly: await this.rootOnly(cwd, argv.slice(1))
     };
     const control = new AbortController();
     const timer = setTimeout(() => control.abort("expired"), timeout);
@@ -32239,7 +32320,6 @@ ${lines2}
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
     if (!NAME3.test(self.name)) return false;
-    if (hasControl(cwd) || argv.some(hasControl)) return false;
     try {
       await this.provision();
       if (!await this.trusted(SUDOERS_D)) return false;
@@ -32247,7 +32327,7 @@ ${lines2}
       if (st && !await this.trusted(path)) return false;
       const old = st ? await fs.readFile(path) : "";
       const words2 = recordedCommand(argv);
-      const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Cmnd ${words2}
+      const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Stdin none Cmnd ${words2}
 `;
       const text = old === "" || old.endsWith("\n") ? `${old}${line}` : `${old}
 ${line}`;
@@ -34017,7 +34097,7 @@ var Launcher = class {
         fileIds: this.rootFs.fileIdWrites?.() ?? 0,
         holds: this.rootFs.holdCounts?.()
       }),
-      sudo: (call, signal) => this.sudo(pid, call, signal),
+      sudo: (call, signal, stdin) => this.sudo(pid, call, signal, stdin),
       crontab: (call) => this.crontab(pid, call),
       openFiles: this.openFiles,
       nodes: stack.nodes,
@@ -34257,12 +34337,13 @@ var Launcher = class {
       base: this.tagBases.get(pid)
     });
   }
-  sudo(pid, call, signal) {
+  sudo(pid, call, signal, stdin) {
     const caller = {
       cred: this.credOf(pid),
       pid: this.jobs.shown(pid),
       tags: this.tagsOf(pid),
-      tty: this.described.get(pid)?.tty
+      tty: this.described.get(pid)?.tty,
+      stdin
     };
     return this.sudoer.request(caller, call, signal);
   }