@ai-ecoverse/slicc-kernel 1.34.1 → 1.35.1

package/README.md

@@ -421,6 +421,22 @@ An exec'd program takes over the pid of the process it replaces, as on Linux: `g
 - **Emscripten:** `Module.sliccKernel.execve(file, argv, env, cwd)` runs `file` as this process's new image on its fds 0, 1 and 2, waits for it, and returns its wait status, or a negative errno when it cannot start. `env` and `cwd` may be `null` for this process's own. An exec shim detects it with `typeof Module.sliccKernel.execve === 'function'` and exits with the status it returns, as `execve` never returns on success. Older shims spawn the program and then call `Module.sliccKernel.execWait(pid)`; that works the same way: a new program asks the kernel for its pid before `main`, and the kernel answers once its parent has made its next call, so an image an older shim execs also reports the pid it replaced (the wait starts once the program is loaded; should the parent make no call within 100 ms after that, the kernel answers anyway, and the image may then report its own pid; `launcher.identities` counts the programs that asked and those answered by that timeout).
 - **WASIX:** `proc_exec` does this by itself.
 
+### File modes and the umask
+
+Every process has a umask in the kernel, `022` for a process the embedder starts, inherited across fork, spawn and exec and shown in `/proc/<pid>/status` (`Umask:`). The kernel applies it when a program creates a file or directory, whatever its libc does: an Emscripten program's `open` with `O_CREAT`, `mkdir` and `mknod` (so `umask 077; touch f` gives `600` in a child too), and a WASI program's `path_open` with `O_CREAT` and `path_create_directory` (`0666` and `0777` less the umask).
+
+WASI and WASIX have no call for file modes, so the kernel adds the import module `slicc_fs`, whose functions return a preview1 errno (kernels without them answer `ENOSYS`):
+
+| Import | Does |
+| --- | --- |
+| `fd_chmod(fd, mode)` | `fchmod` on an open file or directory |
+| `path_chmod(dirfd, path, path_len, mode, flags)` | `fchmodat`; with `flags & 1` (`AT_SYMLINK_NOFOLLOW`) a symlink answers `ENOTSUP` and is never followed |
+| `umask(mask, old_out)` | sets the process's umask and writes the previous one |
+| `fd_mode(fd, mode_out)` | the permission bits of an open file or directory |
+| `path_mode(dirfd, path, path_len, flags, mode_out)` | those of a path, of the link itself with `flags & 1` |
+
+Lowering a soft resource limit (`ulimit -S -n 64`) still fails with `EPERM` in Emscripten programs: their libc's `setrlimit` is a stub compiled into the program, not a call to the kernel.
+
 ### `/proc`
 
 Every process of the kernel has `/proc/<pid>/` with `cmdline`, `comm`, `stat`, `statm` and `status`, in the formats procps reads, and `/proc/self` is a link to the `/proc/<pid>` of the process that reads it, as on Linux (`readlink /proc/self` is its pid, the one it was exec'd under included). They come from the kernel's process table when they are opened, so a terminal sees the processes of every client; an exec'd program shows under the pid its parent knows. `/proc/uptime`, `/proc/loadavg`, `/proc/stat` and `/proc/meminfo` are there too, and `/proc/mounts`. A process with no parent in the kernel (one a page, a client or the Node entry started) has parent 1, as children of init do, in `getppid()`, `/proc/<pid>/stat` and `ps` alike, and so does a process whose parent has ended, waited for or not (`getppid()` asks the kernel each time; a shell's `$PPID` keeps the value it started with, as on Linux). Pids, parents, process groups, sessions, command lines, terminals, start and boot times are real, and so is each process's memory: the size of its wasm memory (`VSZ` and `RSS` alike, as wasm has no paging), which `/proc/meminfo` counts as used. CPU times, load and `MemTotal` (from `navigator.deviceMemory`, else 4 GiB) are placeholders. Only Emscripten processes see this `/proc`.

package/dist/kernel-worker.js

@@ -755,6 +755,9 @@ var OpfsFs = class {
       ctimeMs: now
     }));
   }
+  async realpath(path, follow) {
+    return (await this.locate(path, follow)).path;
+  }
   async readlink(path) {
     const found = await this.locate(path, false);
     if (found.link) return found.link.link;
@@ -4787,6 +4790,7 @@ function withCommandDirs(fs, names) {
     rename: (from, to) => fs.rename(from, to),
     symlink: (target, path) => fs.symlink(target, path),
     readlink: (path) => fs.readlink(path),
+    ...fs.realpath ? { realpath: fs.realpath.bind(fs) } : {},
     chmod: (path, mode) => fs.chmod(path, mode),
     utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime),
     lutimes: (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
@@ -5784,6 +5788,12 @@ var MountFs = class {
     this.table.forget(found.mount, normalizePath(path));
     await found.mount.conn.call({ op: "symlink", target, path: found.rel });
   }
+  async realpath(path, follow) {
+    if (this.at(path) || !this.base.realpath) throw errnoError("ENOSYS", path);
+    const real = await this.base.realpath(path, follow);
+    if (this.at(real)) throw errnoError("ENOSYS", path);
+    return real;
+  }
   async readlink(path) {
     const found = this.at(path);
     if (!found) return this.base.readlink(path);
@@ -7556,9 +7566,21 @@ var VfsNodes = class {
   }
   async entryKey(path) {
     const parent = parentOf5(path);
-    const dir = await realDir(this.fs, parent).catch(() => parent);
-    const name2 = path.slice(path.lastIndexOf("/") + 1);
-    return dir === "/" ? `/${name2}` : `${dir}/${name2}`;
+    const dir = await this.real(parent, true, () => realDir(this.fs, parent));
+    return joinName(dir, path.slice(path.lastIndexOf("/") + 1));
+  }
+  targetKey(path) {
+    return this.real(path, true, () => realTarget(this.fs, path));
+  }
+  async real(path, follow, walk) {
+    if (this.fs.realpath) {
+      try {
+        return await this.fs.realpath(path, follow);
+      } catch (err) {
+        if (errCode(err) === "ELOOP") throw err;
+      }
+    }
+    return walk();
   }
   createExclusive(path) {
     return this.onEntry(path, async () => {
@@ -7653,10 +7675,9 @@ function parentOf5(path) {
 async function linkOf(fs, path) {
   return fs.readlink?.(path).catch(() => void 0);
 }
-async function realDir(fs, dir) {
+async function realDir(fs, dir, budget = { hops: 0 }) {
   const queue = dir.split("/").filter(Boolean);
   let at = "/";
-  let hops = 0;
   while (queue.length > 0) {
     const part = queue.shift();
     if (part === ".") continue;
@@ -7665,28 +7686,41 @@ async function realDir(fs, dir) {
       continue;
     }
     const next = at === "/" ? `/${part}` : `${at}/${part}`;
-    const link2 = hops < MAX_LINKS5 ? await linkOf(fs, next) : void 0;
+    const link2 = await linkOf(fs, next);
     if (link2 === void 0) {
       at = next;
       continue;
     }
-    hops++;
+    if (budget.hops >= MAX_LINKS5) throw fsError("ELOOP", dir);
+    budget.hops++;
     queue.unshift(...link2.split("/").filter(Boolean));
     if (link2.startsWith("/")) at = "/";
   }
   return at;
 }
-async function targetDir(fs, path) {
-  let dir = await realDir(fs, parentOf5(path));
+function errCode(err) {
+  return err?.code;
+}
+function joinName(dir, name2) {
+  return dir === "/" ? `/${name2}` : `${dir}/${name2}`;
+}
+async function realTarget(fs, path) {
+  const budget = { hops: 0 };
+  let dir = await realDir(fs, parentOf5(path), budget);
   let name2 = path.slice(path.lastIndexOf("/") + 1);
-  for (let hops = 0; hops < MAX_LINKS5; hops++) {
-    const link2 = await linkOf(fs, dir === "/" ? `/${name2}` : `${dir}/${name2}`);
-    if (link2 === void 0) return dir;
-    const target = link2.startsWith("/") ? link2 : `${dir}/${link2}`;
-    dir = await realDir(fs, parentOf5(target));
+  for (; ; ) {
+    const link2 = await linkOf(fs, joinName(dir, name2));
+    if (link2 === void 0) break;
+    if (budget.hops >= MAX_LINKS5) throw fsError("ELOOP", path);
+    budget.hops++;
+    const target = link2.startsWith("/") ? link2 : joinName(dir, link2);
+    dir = await realDir(fs, parentOf5(target), budget);
     name2 = target.slice(target.lastIndexOf("/") + 1);
   }
-  return dir;
+  return joinName(dir, name2);
+}
+async function targetDir(fs, path) {
+  return parentOf5(await realTarget(fs, path).catch(() => path));
 }
 async function refuseReadonly(fs, path, flags, opts = {}) {
   const writes = (flags & O_ACCMODE) !== 0 || opts.truncate === true;
@@ -7705,13 +7739,14 @@ function keepingOpen(fs, nodes) {
   return {
     ...fs,
     async rm(path, options) {
-      const at = fs.resolvePath("/", path);
+      const at = await nodes.entryKey(fs.resolvePath("/", path));
       await nodes.unlinking(at);
       await fs.rm(path, options);
       nodes.unlinked(at);
     },
-    rename(from, to) {
-      const [a, b] = [fs.resolvePath("/", from), fs.resolvePath("/", to)];
+    async rename(from, to) {
+      const a = await nodes.entryKey(fs.resolvePath("/", from));
+      const b = await nodes.entryKey(fs.resolvePath("/", to));
       return nodes.onEntry(b, async () => {
         await nodes.unlinking(b);
         await fs.rename(from, to);
@@ -7857,10 +7892,12 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-cloexec",
   "fd-list",
   "proc-alarm",
+  "proc-umask",
   "dl-log",
   "fd-renumber",
   "fd-promote",
   "fd-open-tty",
+  "fd-tty-names",
   "tty-get",
   "tty-set",
   "tty-winsz",
@@ -7894,6 +7931,7 @@ function isWasmSyscall(req) {
   return typeof op === "string" && SYSCALL_OPS.has(op);
 }
 var MAX_READ = 1024 * 1024;
+var DEFAULT_UMASK = 18;
 var DYING = { ok: false, errno: "EINTR", message: "the process is being killed" };
 var HOSTS_ONLY = new Resolver({ routes: new Routes() });
 var WasmProcess = class {
@@ -7904,6 +7942,7 @@ var WasmProcess = class {
   inherited = 0;
   interrupt = new AbortController();
   dying = false;
+  umask = DEFAULT_UMASK;
   execChild;
   execTermsig;
   stopped = 0;
@@ -7921,6 +7960,7 @@ var WasmProcess = class {
     this.fds = fds;
     this.options = options;
     this.inherited = options.ignored ?? 0;
+    this.umask = options.umask ?? DEFAULT_UMASK;
     this.children = new ChildTable(fds, options.spawner, options.forker);
     this.nodes = options.nodes ?? new VfsNodes(options.fs);
     if (!options.nodes) options.openFiles?.add(this.nodes);
@@ -7993,6 +8033,11 @@ var WasmProcess = class {
       return result;
     }
   }
+  setUmask(mask) {
+    const old = this.umask;
+    if (mask !== void 0) this.umask = mask & 511;
+    return old;
+  }
   die() {
     if (this.dying) return;
     this.dying = true;
@@ -8063,9 +8108,21 @@ var WasmProcess = class {
     await refuseReadonly(this.options.fs, req.path, req.flags, req);
     const fd = this.fds.install(heldFile(), 3);
     try {
-      if (req.exclusive) await this.nodes.createExclusive(req.path);
-      this.fds.installAt(fd, this.openVfsFile(req));
-      if (req.existing && !await present(this.options.fs, req.path, true)) {
+      const nodes = this.nodes;
+      const path = req.orphan ? req.path : req.exclusive ? await nodes.entryKey(req.path) : await nodes.targetKey(req.path);
+      const open = { ...req, path };
+      if (req.exclusive) {
+        await nodes.createExclusive(path);
+        this.fds.installAt(fd, this.openVfsFile(open));
+      } else if (req.create) {
+        await nodes.onEntry(path, async () => {
+          this.fds.installAt(fd, this.openVfsFile(open));
+          await this.fds.get(fd).file.stat?.();
+        });
+      } else {
+        this.fds.installAt(fd, this.openVfsFile(open));
+      }
+      if (req.existing && !await present(this.options.fs, path, true)) {
         throw new KernelError("ENOENT");
       }
     } catch (err) {
@@ -8144,7 +8201,7 @@ var WasmProcess = class {
       case "fd-reserve":
         return { ok: true, kind: "json", json: this.reserve(req.fd, req.min, req.meta) };
       case "fd-promote":
-        this.promote(req);
+        await this.promote(req);
         return { ok: true, kind: "void" };
       case "fd-renumber":
         if (req.from !== req.to) {
@@ -8157,6 +8214,8 @@ var WasmProcess = class {
         if (!tty) throw new KernelError("ENXIO");
         return { ok: true, kind: "json", json: this.fds.install(tty.file(), 3) };
       }
+      case "fd-tty-names":
+        return { ok: true, kind: "json", json: this.options.jobs?.terminalNames() ?? [] };
       case "fd-select": {
         const { read, write, timeoutMs } = req;
         const signal = this.blockingSignal();
@@ -8178,10 +8237,14 @@ var WasmProcess = class {
   async vfsSyscall(req) {
     if ("path" in req || "from" in req) {
       const nodes = this.nodes;
-      if (req.op === "fd-path-flush") await nodes.flush(req.path);
-      else if (req.op === "fd-path-unlinking") await nodes.unlinking(req.path);
-      else if (req.op === "fd-path-unlinked") nodes.unlinked(req.path);
-      else if (req.op === "fd-path-renamed") nodes.renamed(req.from, req.to);
+      if (req.op === "fd-path-flush") {
+        await nodes.flush(await nodes.targetKey(req.path).catch(() => req.path));
+      } else if (req.op === "fd-path-unlinking")
+        await nodes.unlinking(await nodes.entryKey(req.path));
+      else if (req.op === "fd-path-unlinked") nodes.unlinked(await nodes.entryKey(req.path));
+      else if (req.op === "fd-path-renamed") {
+        nodes.renamed(await nodes.entryKey(req.from), await nodes.entryKey(req.to));
+      }
       return { ok: true, kind: "void" };
     }
     const file = this.fds.get(req.fd).file;
@@ -8202,17 +8265,19 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: await file.stat() };
     }
   }
-  promote(req) {
+  async promote(req) {
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     if (req.share !== void 0) {
       this.fds.dup2(req.share, req.fd);
       return;
     }
     if (req.path === void 0) throw new KernelError("EINVAL");
+    const path = req.orphan ? req.path : await this.nodes.targetKey(req.path);
+    if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
     const file = vfsFile(
       this.options.fs,
       {
-        path: req.path,
+        path,
         flags: req.flags ?? 0,
         position: req.position ?? 0,
         ...req.contents !== void 0 ? { contents: req.contents } : {},
@@ -8388,6 +8453,8 @@ var WasmProcess = class {
       case "proc-alarm":
         this.setAlarm(req.sig, req.firstMs ?? req.ms, req.repeat ? req.ms : 0, req.timer);
         return { ok: true, kind: "void" };
+      case "proc-umask":
+        return { ok: true, kind: "json", json: this.setUmask(req.mask) };
       case "dl-log":
         if (req.append) this.dlLog.push(req.append);
         return { ok: true, kind: "json", json: this.dlLog.slice(req.from) };
@@ -8537,7 +8604,7 @@ var Dying = class {
     return [typeof reported === "number" ? reported : CRASHED, void 0];
   }
 };
-function processInit(opts, sab) {
+function processInit(opts, sab, umask) {
   const base = {
     type: WASM_PROCESS_INIT,
     pid: opts.shownPid ?? opts.pid,
@@ -8546,6 +8613,7 @@ function processInit(opts, sab) {
     env: opts.env,
     cwd: opts.cwd,
     sab,
+    umask,
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {}
   };
   if (opts.program.abi === "js") {
@@ -8557,11 +8625,17 @@ function processInit(opts, sab) {
     ...opts.fork ? { fork: opts.fork } : { fds: inheritedFds(opts.fds) }
   };
 }
+function inherited(opts) {
+  return {
+    ...opts.ignored ? { ignored: opts.ignored } : {},
+    ...opts.umask !== void 0 ? { umask: opts.umask } : {}
+  };
+}
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
   const header2 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const process = new WasmProcess(opts.pid, opts.fds, {
-    ...opts.ignored ? { ignored: opts.ignored } : {},
+    ...inherited(opts),
     ...opts.identity ? { identity: opts.identity } : {},
     ...opts.onSyscall ? { onSyscall: opts.onSyscall } : {},
     spawner: opts.spawner,
@@ -8695,7 +8769,7 @@ function spawnWasmProcess(opts) {
     };
     tw.postMessage(tinit);
   };
-  const init = processInit(opts, sab);
+  const init = processInit(opts, sab, process.umask);
   worker.postMessage(init, opts.fork ? [opts.fork.memory.buffer] : []);
   const signal = (sig) => {
     if (process.signal(sig) !== "terminate") return;
@@ -8713,6 +8787,7 @@ function spawnWasmProcess(opts) {
     onState: (listener) => process.onState(listener),
     memory: () => Atomics.load(header2, SAB_I_MEMORY) * 65536,
     ignoredSignals: (fork) => process.inheritable(fork),
+    umask: () => process.umask,
     writesBack: () => opts.program.abi === "wasi" && !done4
   };
 }
@@ -8818,8 +8893,13 @@ var JobTable = class {
     return id;
   }
   terminalNamed(name2) {
-    const known = /* @__PURE__ */ new Set([...this.terminals.values(), ...this.foreground.keys()]);
-    return [...known].find((tty) => tty.name === name2);
+    return this.knownTerminals().find((tty) => tty.name === name2);
+  }
+  terminalNames() {
+    return this.knownTerminals().flatMap((tty) => tty.name ? [tty.name] : []);
+  }
+  knownTerminals() {
+    return [.../* @__PURE__ */ new Set([...this.terminals.values(), ...this.foreground.keys()])];
   }
   controllingTerminal(pid) {
     const member = this.members.get(pid);
@@ -10453,6 +10533,7 @@ var Launcher = class {
         this.settling.syscall(pid, call.op);
       },
       ...req.ignored ? { ignored: req.ignored } : {},
+      ...req.umask !== void 0 ? { umask: req.umask } : {},
       program: req.program,
       argv0: req.argv0,
       args: req.args,
@@ -10544,7 +10625,8 @@ var Launcher = class {
         ...described,
         started: (this.described.get(root.pid) ?? described).started,
         state: this.processes.has(member.pid) ? "S" : "Z",
-        memory: this.processes.get(member.pid)?.memory() ?? 0
+        memory: this.processes.get(member.pid)?.memory() ?? 0,
+        umask: this.umaskOf(member.pid)
       });
     }
     return listed;
@@ -10566,6 +10648,7 @@ var Launcher = class {
         report,
         ppid,
         ignored: this.ignoredBy(ppid),
+        umask: this.umaskOf(ppid),
         ...exec
       });
       deciding?.attach();
@@ -10610,7 +10693,8 @@ var Launcher = class {
         fds,
         ppid,
         fork: state,
-        ignored: this.ignoredBy(ppid, true)
+        ignored: this.ignoredBy(ppid, true),
+        umask: this.umaskOf(ppid)
       })
     );
   }
@@ -10619,6 +10703,9 @@ var Launcher = class {
     const foreground = () => this.jobs.tcgetpgrp(tty, fallback);
     this.settling.deliver(sig, pgid, send, tty.reading ? void 0 : foreground);
   }
+  umaskOf(pid) {
+    return this.processes.get(pid)?.umask?.() ?? DEFAULT_UMASK;
+  }
   ignoredBy(pid, fork = false) {
     return this.processes.get(pid)?.ignoredSignals(fork) ?? 0;
   }