@ai-ecoverse/slicc-kernel 1.175.0 → 1.176.0

package/dist/kernel-worker.js

@@ -2239,8 +2239,10 @@ var OpfsFs = class {
     for (let at = from; at < parts2.length; at++) {
       this.calls++;
       dir = await dir.getDirectoryHandle(parts2[at]);
-      this.dirs.set(`/${parts2.slice(0, at + 1).join("/")}`, dir);
+      const path = `/${parts2.slice(0, at + 1).join("/")}`;
+      this.dirs.set(path, dir);
       this.checked.set(dir, performance.now());
+      this.absent.delete(path);
     }
     return dir;
   }
@@ -2322,6 +2324,7 @@ var OpfsFs = class {
       if (looked) {
         this.dirs.set(path, handle);
         this.checked.set(handle, performance.now());
+        this.absent.delete(path);
       }
       return handle;
     }
@@ -2972,7 +2975,8 @@ var OpfsFs = class {
     }
     const [entry] = await this.meta.get([path]);
     const wanted = entry?.link === void 0 ? path : resolvePath(parentOf4(path), entry.link);
-    return [resolvePath((await this.locate(parentOf4(wanted), true)).path, baseOf(wanted)), false];
+    const parent = await this.exactly(() => this.locate(parentOf4(wanted), true));
+    return [resolvePath(parent.path, baseOf(wanted)), false];
   }
   async fileFor(path, create = true) {
     const [target, existed] = await this.writeTarget(path);
@@ -3079,10 +3083,12 @@ var OpfsFs = class {
     await this.mkdir(parentOf4(path), { recursive: true, ...above ? { owner: above } : {} });
     const parent = await this.locate(parentOf4(path), true);
     if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
-    this.refuse(resolvePath(parent.path, baseOf(path)));
-    await this.io(parent.handle.getDirectoryHandle(baseOf(path), { create: true }));
+    const made2 = resolvePath(parent.path, baseOf(path));
+    this.forget(made2);
+    this.refuse(made2);
+    const handle = await this.io(parent.handle.getDirectoryHandle(baseOf(path), { create: true }));
+    this.remember(made2, handle, true);
     const now = Date.now();
-    const made2 = `${parent.path === "/" ? "" : parent.path}/${baseOf(path)}`;
     await this.stampNew(made2, owner, true);
     this.touch(now, parent.path, made2);
   }
@@ -7738,11 +7744,12 @@ function serveTransport(peer, transport, {
 var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
-var DEFAULT_GROUP = "root:x:0:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
+var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
 var NAME = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
+var MAX_GID = 4294967294;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
@@ -8038,6 +8045,26 @@ var UserDb = class {
     const { group } = await this.tables();
     return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
   }
+  addGroup(name2, gid) {
+    return this.serial(async () => {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME.test(name2)) {
+        throw fsError("EINVAL", `not a group name: ${String(name2)}`);
+      }
+      if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
+        throw fsError("EINVAL", `not a group id: ${String(gid)}`);
+      }
+      const { group } = await this.tables();
+      const rows = parsed(group);
+      const found = rows.find((g) => g.name === name2);
+      if (found) return { name: found.name, gid: found.gid, members: [...found.members] };
+      const taken = rows.find((g) => g.gid === gid);
+      if (taken) throw fsError("EEXIST", `group id ${gid} is group ${taken.name}`);
+      group.push({ name: name2, gid, members: [] });
+      await this.fs.mkdir("/etc", { recursive: true });
+      await this.fs.writeFile(GROUP, formatGroup(group));
+      return { name: name2, gid, members: [] };
+    });
+  }
   addMember(group, user) {
     return this.member(group, user, true);
   }
@@ -8740,7 +8767,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.175.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -13381,6 +13408,7 @@ var EmbedderBroker = class {
   budget;
   open = /* @__PURE__ */ new Map();
   tagsOf;
+  denied;
   constructor(users, lookup2, tagsOf2 = () => void 0, budget = EMBEDDER_BUDGET) {
     this.users = users;
     this.tagsOf = tagsOf2;
@@ -13398,7 +13426,8 @@ var EmbedderBroker = class {
     return this.hooks.get(client);
   }
   async allowed(policy, caller) {
-    if (caller.euid === 0 || caller.euid === caller.sessionUid) return true;
+    if (caller.euid === 0) return true;
+    if (policy.session !== false && caller.euid === caller.sessionUid) return true;
     if (policy.group !== void 0) {
       const gid = await this.lookup.groupId(policy.group);
       if (gid !== void 0 && (caller.egid === gid || caller.groups.includes(gid))) return true;
@@ -13414,9 +13443,22 @@ var EmbedderBroker = class {
     if (!hook) throw new KernelError("ENOTSUP", "no page answers requests for this session");
     const policy = Object.hasOwn(hook.kinds, kind) ? hook.kinds[kind] : void 0;
     if (!policy) throw new KernelError("ENOTSUP", `this embedder does not answer ${kind}`);
-    if (this.users !== "off" && !await this.allowed(policy, caller))
-      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
     const tags = caller.tags;
+    if (this.users !== "off" && !await this.allowed(policy, caller)) {
+      try {
+        this.denied?.({
+          pid: caller.pid,
+          uid: caller.euid,
+          op: "embedder",
+          path: EMBEDDER_PATH,
+          errno: "EACCES",
+          kind,
+          ...tags?.length ? { tag: tags[0] } : {}
+        });
+      } catch {
+      }
+      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
+    }
     return {
       pid: caller.shownPid,
       uid: caller.euid,
@@ -33458,6 +33500,7 @@ var Launcher = class {
       (pid) => this.tagsOf(pid)
     );
     this.embedder = this.embedderBroker(options.embedder);
+    this.embedder.denied = options.onDenial;
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -36428,6 +36471,7 @@ var USERS_OPS = /* @__PURE__ */ new Set([
   "users-remove",
   "users-list",
   "groups-list",
+  "groups-add",
   "groups-add-member",
   "groups-remove-member"
 ]);
@@ -36479,6 +36523,7 @@ function usersOp(l, req) {
   if (req.op === "users-add") return l.users.add(req.user);
   if (req.op === "users-remove") return l.users.remove(req.name, req.options);
   if (req.op === "groups-list") return l.users.groups();
+  if (req.op === "groups-add") return l.users.addGroup(req.name, req.gid);
   if (req.op === "groups-add-member") return l.users.addMember(req.group, req.user);
   if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();