@ai-ecoverse/slicc-kernel 1.175.1 → 1.176.0

package/dist/kernel-worker.js

@@ -7744,11 +7744,12 @@ function serveTransport(peer, transport, {
 var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
-var DEFAULT_GROUP = "root:x:0:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
+var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
 var NAME = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
+var MAX_GID = 4294967294;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
@@ -8044,6 +8045,26 @@ var UserDb = class {
     const { group } = await this.tables();
     return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
   }
+  addGroup(name2, gid) {
+    return this.serial(async () => {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME.test(name2)) {
+        throw fsError("EINVAL", `not a group name: ${String(name2)}`);
+      }
+      if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
+        throw fsError("EINVAL", `not a group id: ${String(gid)}`);
+      }
+      const { group } = await this.tables();
+      const rows = parsed(group);
+      const found = rows.find((g) => g.name === name2);
+      if (found) return { name: found.name, gid: found.gid, members: [...found.members] };
+      const taken = rows.find((g) => g.gid === gid);
+      if (taken) throw fsError("EEXIST", `group id ${gid} is group ${taken.name}`);
+      group.push({ name: name2, gid, members: [] });
+      await this.fs.mkdir("/etc", { recursive: true });
+      await this.fs.writeFile(GROUP, formatGroup(group));
+      return { name: name2, gid, members: [] };
+    });
+  }
   addMember(group, user) {
     return this.member(group, user, true);
   }
@@ -8746,7 +8767,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.175.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -13387,6 +13408,7 @@ var EmbedderBroker = class {
   budget;
   open = /* @__PURE__ */ new Map();
   tagsOf;
+  denied;
   constructor(users, lookup2, tagsOf2 = () => void 0, budget = EMBEDDER_BUDGET) {
     this.users = users;
     this.tagsOf = tagsOf2;
@@ -13404,7 +13426,8 @@ var EmbedderBroker = class {
     return this.hooks.get(client);
   }
   async allowed(policy, caller) {
-    if (caller.euid === 0 || caller.euid === caller.sessionUid) return true;
+    if (caller.euid === 0) return true;
+    if (policy.session !== false && caller.euid === caller.sessionUid) return true;
     if (policy.group !== void 0) {
       const gid = await this.lookup.groupId(policy.group);
       if (gid !== void 0 && (caller.egid === gid || caller.groups.includes(gid))) return true;
@@ -13420,9 +13443,22 @@ var EmbedderBroker = class {
     if (!hook) throw new KernelError("ENOTSUP", "no page answers requests for this session");
     const policy = Object.hasOwn(hook.kinds, kind) ? hook.kinds[kind] : void 0;
     if (!policy) throw new KernelError("ENOTSUP", `this embedder does not answer ${kind}`);
-    if (this.users !== "off" && !await this.allowed(policy, caller))
-      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
     const tags = caller.tags;
+    if (this.users !== "off" && !await this.allowed(policy, caller)) {
+      try {
+        this.denied?.({
+          pid: caller.pid,
+          uid: caller.euid,
+          op: "embedder",
+          path: EMBEDDER_PATH,
+          errno: "EACCES",
+          kind,
+          ...tags?.length ? { tag: tags[0] } : {}
+        });
+      } catch {
+      }
+      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
+    }
     return {
       pid: caller.shownPid,
       uid: caller.euid,
@@ -33464,6 +33500,7 @@ var Launcher = class {
       (pid) => this.tagsOf(pid)
     );
     this.embedder = this.embedderBroker(options.embedder);
+    this.embedder.denied = options.onDenial;
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -36434,6 +36471,7 @@ var USERS_OPS = /* @__PURE__ */ new Set([
   "users-remove",
   "users-list",
   "groups-list",
+  "groups-add",
   "groups-add-member",
   "groups-remove-member"
 ]);
@@ -36485,6 +36523,7 @@ function usersOp(l, req) {
   if (req.op === "users-add") return l.users.add(req.user);
   if (req.op === "users-remove") return l.users.remove(req.name, req.options);
   if (req.op === "groups-list") return l.users.groups();
+  if (req.op === "groups-add") return l.users.addGroup(req.name, req.gid);
   if (req.op === "groups-add-member") return l.users.addMember(req.group, req.user);
   if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();