@ai-ecoverse/slicc-kernel 1.175.1 → 1.176.0

package/dist/node-process-worker.cjs

@@ -7514,7 +7514,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.175.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node-process-worker.js

@@ -7513,7 +7513,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.175.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node.js

@@ -3702,7 +3702,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.175.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.176.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9064,6 +9064,7 @@ var EmbedderBroker = class {
   budget;
   open = /* @__PURE__ */ new Map();
   tagsOf;
+  denied;
   constructor(users, lookup4, tagsOf2 = () => void 0, budget = EMBEDDER_BUDGET) {
     this.users = users;
     this.tagsOf = tagsOf2;
@@ -9081,7 +9082,8 @@ var EmbedderBroker = class {
     return this.hooks.get(client);
   }
   async allowed(policy, caller) {
-    if (caller.euid === 0 || caller.euid === caller.sessionUid) return true;
+    if (caller.euid === 0) return true;
+    if (policy.session !== false && caller.euid === caller.sessionUid) return true;
     if (policy.group !== void 0) {
       const gid = await this.lookup.groupId(policy.group);
       if (gid !== void 0 && (caller.egid === gid || caller.groups.includes(gid))) return true;
@@ -9097,9 +9099,22 @@ var EmbedderBroker = class {
     if (!hook) throw new KernelError("ENOTSUP", "no page answers requests for this session");
     const policy = Object.hasOwn(hook.kinds, kind) ? hook.kinds[kind] : void 0;
     if (!policy) throw new KernelError("ENOTSUP", `this embedder does not answer ${kind}`);
-    if (this.users !== "off" && !await this.allowed(policy, caller))
-      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
     const tags = caller.tags;
+    if (this.users !== "off" && !await this.allowed(policy, caller)) {
+      try {
+        this.denied?.({
+          pid: caller.pid,
+          uid: caller.euid,
+          op: "embedder",
+          path: EMBEDDER_PATH,
+          errno: "EACCES",
+          kind,
+          ...tags?.length ? { tag: tags[0] } : {}
+        });
+      } catch {
+      }
+      throw new KernelError("EACCES", `${kind} is not allowed for this user`);
+    }
     return {
       pid: caller.shownPid,
       uid: caller.euid,
@@ -9142,7 +9157,8 @@ function kindsOf(hook) {
       kind,
       {
         ...policy?.group !== void 0 ? { group: String(policy.group) } : {},
-        ...policy?.users ? { users: [...policy.users] } : {}
+        ...policy?.users ? { users: [...policy.users] } : {},
+        ...policy?.session === false ? { session: false } : {}
       }
     ])
   );
@@ -15429,11 +15445,12 @@ function parsePolicy(text, file) {
 var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
-var DEFAULT_GROUP = "root:x:0:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
+var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
 var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
+var MAX_GID = 4294967294;
 var USERS_GROUP = "users";
 var HOME_DIR = /^\/home\/[^/]+$/;
 var SYSTEM_PNPM_HOME = "/usr/local/share/pnpm";
@@ -15729,6 +15746,26 @@ var UserDb = class {
     const { group } = await this.tables();
     return parsed(group).map(({ name: name2, gid, members }) => ({ name: name2, gid, members: [...members] }));
   }
+  addGroup(name2, gid) {
+    return this.serial(async () => {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+        throw fsError("EINVAL", `not a group name: ${String(name2)}`);
+      }
+      if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
+        throw fsError("EINVAL", `not a group id: ${String(gid)}`);
+      }
+      const { group } = await this.tables();
+      const rows = parsed(group);
+      const found = rows.find((g) => g.name === name2);
+      if (found) return { name: found.name, gid: found.gid, members: [...found.members] };
+      const taken = rows.find((g) => g.gid === gid);
+      if (taken) throw fsError("EEXIST", `group id ${gid} is group ${taken.name}`);
+      group.push({ name: name2, gid, members: [] });
+      await this.fs.mkdir("/etc", { recursive: true });
+      await this.fs.writeFile(GROUP, formatGroup(group));
+      return { name: name2, gid, members: [] };
+    });
+  }
   addMember(group, user) {
     return this.member(group, user, true);
   }
@@ -32360,6 +32397,7 @@ var Launcher = class {
       (pid) => this.tagsOf(pid)
     );
     this.embedder = this.embedderBroker(options.embedder);
+    this.embedder.denied = options.onDenial;
     this.sealed = new SealedBroker(
       options.sealed,
       this.usersMode,
@@ -37686,6 +37724,7 @@ async function createNodeKernel(options = {}) {
     },
     groups: {
       list: () => guard2(() => launcher.users.groups()),
+      add: (name2, options2) => guard2(() => launcher.users.addGroup(name2, options2?.gid)),
       addMember: (group, user) => guard2(() => launcher.users.addMember(group, user)),
       removeMember: (group, user) => guard2(() => launcher.users.removeMember(group, user))
     },