@ai-ecoverse/slicc-kernel 1.176.1 → 1.176.2

package/dist/kernel-worker.js

@@ -5580,14 +5580,21 @@ async function ownerOnly(g, op, path, follow2) {
   return walked;
 }
 async function chmodMode(g, path, mode) {
-  const perm = (await ownerOnly(g, "chmod", path, true)).perm;
-  if (!g.dac.enforcing || !perm || g.cred.euid === 0 || inGroup(g.cred, perm.gid)) return mode;
+  const walked = await need(g, "chmod", path, 0, { follow: true });
+  const perm = walked.perm;
+  const st = await g.fs.stat(walked.path).catch(() => void 0);
+  if (!st?.fat && perm && g.cred.euid !== 0 && perm.uid !== g.cred.euid) {
+    if (await present(g.fs, walked.path, false)) deny(g, "chmod", path, "EPERM");
+  }
+  if (!g.dac.enforcing || !perm || g.cred.euid === 0 || st?.fat || inGroup(g.cred, perm.gid)) {
+    return mode;
+  }
   return mode & ~S_ISGID3;
 }
 function heldChmodMode(g, path, st, mode) {
   const perm = permOf(st);
-  if (g.cred.euid !== 0 && perm.uid !== g.cred.euid) deny(g, "fchmod", path, "EPERM");
-  if (!g.dac.enforcing || g.cred.euid === 0 || inGroup(g.cred, perm.gid)) return mode;
+  if (!st.fat && g.cred.euid !== 0 && perm.uid !== g.cred.euid) deny(g, "fchmod", path, "EPERM");
+  if (!g.dac.enforcing || g.cred.euid === 0 || st.fat || inGroup(g.cred, perm.gid)) return mode;
   return mode & ~S_ISGID3;
 }
 function heldRetimable(g, path, st, now) {
@@ -8767,7 +8774,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.176.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.176.2" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -13912,10 +13919,15 @@ var DriverConnection = class _DriverConnection {
 // src/mount/mount-fs.ts
 var S_ISGID4 = 1024;
 var ID = /^\d{1,10}$/;
+var MASK = /^0*[0-7]{1,4}$/;
 var MAX_ID2 = 4294967294;
 function idOption(value2) {
   return value2 === void 0 ? 0 : Number(value2);
 }
+function maskOption(value2) {
+  if (value2 === void 0) return void 0;
+  return Number.parseInt(value2, 8) & 511;
+}
 function checkIds(options) {
   for (const key of ["uid", "gid"]) {
     const value2 = options[key];
@@ -13923,6 +13935,27 @@ function checkIds(options) {
     if (!ID.test(value2) || Number(value2) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value2}`);
   }
 }
+function checkMasks(options) {
+  for (const key of ["umask", "fmask", "dmask"]) {
+    const value2 = options[key];
+    if (value2 === void 0) continue;
+    if (!MASK.test(value2) || Number.parseInt(value2, 8) > 511) {
+      throw errnoError("EINVAL", `${key}=${value2}`);
+    }
+  }
+}
+function modeOf(attr2, mount) {
+  const type = attr2.kind === "directory" ? 16384 : attr2.kind === "symlink" ? 40960 : attr2.kind === "fifo" ? 4096 : 32768;
+  const fallback = type | (attr2.kind === "directory" ? 493 : attr2.kind === "symlink" ? 511 : 420);
+  if (mount.caps.owners) return attr2.mode ?? fallback;
+  const umask = maskOption(mount.options.umask);
+  const fmask = maskOption(mount.options.fmask) ?? umask;
+  const dmask = maskOption(mount.options.dmask) ?? umask;
+  const mask = attr2.kind === "directory" ? dmask : fmask;
+  if (mask === void 0) return attr2.mode ?? fallback;
+  const base = attr2.kind === "directory" || attr2.kind === "symlink" ? 511 : 438;
+  return type | base & ~mask;
+}
 var MAX_LINKS7 = 40;
 var STALE_RETRIES = 3;
 var SETTLE_ROUNDS = 4;
@@ -14189,14 +14222,13 @@ function inodeless(mount, attr2) {
 }
 function statOf2(attr2, path, mount) {
   const mtime = new Date(attr2.mtime);
-  const fallback = attr2.kind === "directory" ? 16877 : attr2.kind === "symlink" ? 41471 : attr2.kind === "fifo" ? 4516 : 33188;
   return {
     isFile: attr2.kind === "file",
     isDirectory: attr2.kind === "directory",
     isSymbolicLink: attr2.kind === "symlink",
     ...attr2.kind === "fifo" ? { isFifo: true } : {},
     size: attr2.size,
-    mode: attr2.mode ?? fallback,
+    mode: modeOf(attr2, mount),
     mtime,
     atime: attr2.atime === void 0 ? mtime : new Date(attr2.atime),
     ctime: mtime,
@@ -14210,7 +14242,8 @@ function statOf2(attr2, path, mount) {
     ...attr2.etag !== void 0 ? { version: attr2.etag } : {},
     ...mount.owners ? {
       uid: (mount.caps.owners ? attr2.uid : void 0) ?? idOption(mount.options.uid),
-      gid: (mount.caps.owners ? attr2.gid : void 0) ?? idOption(mount.options.gid)
+      gid: (mount.caps.owners ? attr2.gid : void 0) ?? idOption(mount.options.gid),
+      ...!mount.caps.owners && !mount.caps.chmod && (mount.options.umask !== void 0 || mount.options.fmask !== void 0 || mount.options.dmask !== void 0) ? { fat: true } : {}
     } : {}
   };
 }
@@ -14317,6 +14350,7 @@ var MountTable = class {
     if (!st.isDirectory) throw errnoError("ENOTDIR", target);
     const options = { ...spec.options };
     if (this.deps.owners) checkIds(options);
+    checkMasks(options);
     const maxFile = options.maxfile !== void 0 ? parseSize(options.maxfile) : void 0;
     const opened2 = await this.deps.open(spec.type, { ...spec, target, options });
     let mounted;
@@ -24451,7 +24485,7 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-function modeOf(start2) {
+function modeOf2(start2) {
   const sniffs = [
     ["http1", sniffHttp1(start2)],
     ["smtp", sniffSmtp(start2)],
@@ -24560,7 +24594,7 @@ var SessionWriter = class {
     joined5.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined5;
-    if (this.mode === "sniff") this.mode = modeOf(latin12(joined5.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "sniff") this.mode = modeOf2(latin12(joined5.subarray(0, 8))) ?? "sniff";
     if (this.mode === "pg" && !this.sawPg) {
       this.sawPg = true;
       if (!this.s.verified) void this.proof("pg");