@ai-ecoverse/slicc-kernel 1.63.0 → 1.64.1

package/README.md

@@ -560,7 +560,8 @@ With `users: 'enforce'` the kernel checks every file call that reaches it agains
 - **Opening a file:** an open needs `r` to read and `w` to write or truncate, checked once when the file is opened, in every runtime: Emscripten, WASI (a second open of a path the program already has open is checked as well), JS programs' `ctx.open` and `ctx.fs.writeFile`, and the kernel's own opens. A file the open itself creates is not checked (only its directory is), so `open(O_CREAT | O_WRONLY, 0444)` works. An open descriptor keeps the access it was opened with, through a later `chmod`, and so do descriptors a child inherits. Reads and writes without a descriptor (`ctx.fs.readFile`, `ctx.sync.fs.readFile`) are checked each time.
 - **`access(2)`:** `faccessat` (bash's `[ -r ]`, `test -w`) answers from the same checks, with the real uid and gid, or the effective ones with `AT_EACCESS`, for Emscripten programs, and for WASI programs through `slicc_fs.path_access` (see [File modes and the umask](#file-modes-and-the-umask)).
 - **Exec:** running a program by path needs `x` on it, and `r` too when it's a script (`#!` or a `binfmt` suffix); a WASI or Emscripten binary needs only `x`. Root needs an `x` bit as well. Commands found by name, and `/usr/bin` and `/bin`, are always executable; a user's own commands in `~/.local/share/pnpm/bin` are reached through the user's home, so another user gets `EACCES` there, as for any file. A refused exec is `EACCES` (126 in bash).
-- **`/tmp` and `/dev`:** with `users: 'report'` or `'enforce'`, `/tmp` is `1777` (set again at every start), and Emscripten programs see `/dev` at `0755`, `null`, `zero`, `full`, `random`, `urandom` and `tty` at `0666`, and `/dev/shm` at `1777`. With `users: 'off'` they keep their modes as before.
+- **The layout:** with `users: 'report'` or `'enforce'`, the kernel gives its own paths an owner and a mode when they have no owner record yet: on a fresh root, and once on a root from before owners. These are `/` `0755`, `/root` `0700`, `/home` `0755`, `/etc` `0755`, `/etc/passwd` and `/etc/group` `0644`, `/usr` and `/usr/local` `0755`, `/node_modules` (or the `modules` option) and the system `PNPM_HOME` `0755`, all root's. A path that has a record keeps it, so an admin's `chmod 711 /home` or `chown cone /node_modules` lasts across restarts; a mounted path is left to its mount, and a path below a symlinked directory is stamped where it really is. Only a root that records owners is stamped: the OPFS root with its sidecar, which the page and the Node entry (in memory) both use; a custom root file system without owner records is left as it is. The directory for files removed while open, `/.slicc-unlinked`, is made root's `0700`. `/tmp` is the exception: it is set to `1777` at every start. Emscripten programs see `/` at `0755`, `/dev` at `0755`, `null`, `zero`, `full`, `random`, `urandom` and `tty` at `0666`, and `/dev/shm` at `1777`. With `users: 'off'` nothing is stamped. Paths the embedder makes (bios's `/opt` and `/var/lib/slicc`) are the embedder's to set, and `/etc/sudoers` comes with `sudo`.
+- **Terminals:** a terminal from `openTerminal` belongs to its session's user, with group `tty` when `/etc/group` has one (the user's own group otherwise), mode `0620`; a pseudo-terminal's slave `/dev/pts/N` belongs to the uid and gid that opened `/dev/ptmx`, mode `0620`. Opening one by name (`/dev/ttyN`, `/dev/pts/N`, from every runtime) needs both `r` and `w`, so only its owner and root open it: the kernel's terminal descriptor always reads and writes, so the group's `w` bit (`write`, `wall` on Linux) does not let a group member open it. `/dev/tty` is the opener's own controlling terminal and is not checked, and descriptors a process inherited (across `sudo` or a `setresuid` too) keep working. Emscripten programs' `stat` of `/dev/ttyN` and `/dev/pts/N` shows the owner and mode. With `users: 'off'` terminals have no owner, as before.
 - **A client's `fs`:** checked as the client's user; a page's client (root) passes.
 
 With `users: 'enforce'` not yet the default, no release turns it on before `sudo` exists.

package/dist/kernel-worker.js

@@ -427,6 +427,9 @@ var OpfsFs = class {
   trackOwners() {
     this.owners = true;
   }
+  async hasOwner(path) {
+    return ownOf((await this.meta.get([path]))[0]) !== void 0;
+  }
   async ancestry(path) {
     const entries = await this.meta.get(chain(path));
     const out = [];
@@ -1481,6 +1484,11 @@ var Created = class {
 function deny(g, op, path, errno = "EACCES") {
   g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno });
 }
+var TTY_MODE = 400;
+function ttyOpenable(g, tty) {
+  if (!g || !tty.owner || permits(g.cred, tty.owner, R_OK | W_OK, false)) return;
+  deny(g, "open", tty.name ?? "/dev/tty");
+}
 async function need(g, op, path, want, options = {}, shown = path) {
   const walked = await access(g.fs, g.cred, path, want, options);
   if (walked.denied !== void 0) deny(g, op, shown);
@@ -3193,10 +3201,18 @@ var UserDb = class {
     };
   }
   async lookup(user) {
+    return (await this.lookupTerminal(user))?.account;
+  }
+  async ttyGroup() {
+    return parsed(parseGroup(await this.read(GROUP, DEFAULT_GROUP))).find((g) => g.name === "tty")?.gid;
+  }
+  async lookupTerminal(user) {
     const { passwd, group } = await this.tables();
     const key = typeof user === "number" ? "uid" : "name";
     const row = parsed(passwd).find((r) => r[key] === user);
-    return row && this.account(row, parsed(group));
+    const groups = parsed(group);
+    const tty = groups.find((g) => g.name === "tty")?.gid;
+    return row && { account: this.account(row, groups), tty };
   }
   async list() {
     const { passwd, group } = await this.tables();
@@ -6427,6 +6443,7 @@ function withCommandDirs(fs, names, userDir = async () => void 0, owners = false
     ...fs.realpath ? { realpath: fs.realpath.bind(fs) } : {},
     ...fs.chown ? { chown: fs.chown.bind(fs) } : {},
     ...fs.ancestry ? { ancestry: fs.ancestry.bind(fs) } : {},
+    ...fs.hasOwner ? { hasOwner: fs.hasOwner.bind(fs) } : {},
     chmod: (path, mode) => fs.chmod(path, mode),
     utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime),
     lutimes: (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
@@ -6526,8 +6543,10 @@ var UnlinkedKeeper = class {
   count = 0;
   links = /* @__PURE__ */ new Map();
   linked = /* @__PURE__ */ new Map();
+  dirOwner;
   constructor(fs, holders, rootOf, options = {}) {
     const { locks, owner } = options;
+    this.dirOwner = options.dirOwner;
     this.fs = fs;
     this.holders = holders;
     this.rootOf = rootOf;
@@ -6638,7 +6657,8 @@ var UnlinkedKeeper = class {
       const dir = dirOf(this.rootOf(path));
       const hidden = `${dir}/${this.instance}.${++this.count}`;
       try {
-        await this.fs.mkdir(dir, { recursive: true });
+        const owner = this.dirOwner;
+        await this.fs.mkdir(dir, { recursive: true, ...owner ? { owner } : {} });
         await this.fs.rename(path, hidden);
         await this.linkedName(hidden);
         return hidden;
@@ -8017,6 +8037,10 @@ var MountFs = class {
     if (this.at(real)) throw errnoError("ENOSYS", path);
     return real;
   }
+  async hasOwner(path) {
+    if (this.at(path)) return true;
+    return await this.base.hasOwner?.(path) ?? true;
+  }
   async ancestry(path) {
     const names = chain(normalizePath(path));
     const first = names.findIndex((name2) => this.at(name2));
@@ -9805,6 +9829,7 @@ var KernelTty = class {
   waiters = [];
   hungUp = false;
   name;
+  owner;
   onRead;
   readers = 0;
   screen;
@@ -10148,10 +10173,11 @@ var PtyTable = class {
     this.signal = signal;
     this.onRead = onRead;
   }
-  open() {
+  open(owner) {
     let index = 0;
     while (this.pairs.has(index)) index += 1;
     const pair = new PtyPair(index, this.signal, (p) => this.pairs.delete(p.index), this.onRead);
+    if (owner) pair.slave.owner = { uid: owner.uid, gid: owner.gid, mode: TTY_MODE };
     this.pairs.set(index, pair);
     return { pair, master: pair.master() };
   }
@@ -10164,6 +10190,10 @@ var PtyTable = class {
     return [...this.pairs.keys()].sort((a, b) => a - b);
   }
 };
+function ptsNumber(path) {
+  const m = /^\/dev\/pts\/(\d+)$/.exec(path);
+  return m ? Number(m[1]) : void 0;
+}
 var PTY_OPS = [
   "pty-open",
   "pty-slave-open",
@@ -10191,11 +10221,12 @@ function ptySyscall(req, ctx) {
   switch (req.op) {
     case "pty-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
-      return json4(ctx.fds.install(ctx.ptys.open().master, 3));
+      return json4(ctx.fds.install(ctx.ptys.open(ctx.owner).master, 3));
     }
     case "pty-slave-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
       const pair = ctx.ptys.get(req.n);
+      ttyOpenable(ctx.guard, pair.slave);
       const fd = ctx.fds.install(pair.openSlave(), 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
       return json4(fd);
@@ -11011,6 +11042,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-promote",
   "fd-open-tty",
   "fd-tty-names",
+  "fd-tty-owner",
   "tty-get",
   "tty-set",
   "tty-winsz",
@@ -11212,7 +11244,9 @@ var WasmProcess = class {
       }
       if (isPtySyscall(req)) {
         const { ptys, jobs } = this.options;
-        return ptySyscall(req, { pid: this.pid, fds: this.fds, ptys, jobs });
+        const owner = this.options.owners ? this.ttyOwner() : void 0;
+        const guard2 = this.guarded();
+        return ptySyscall(req, { pid: this.pid, fds: this.fds, ptys, jobs, guard: guard2, owner });
       }
       return await this.procSyscall(req, cancelled);
     } catch (e) {
@@ -11344,6 +11378,25 @@ var WasmProcess = class {
     const want = (access2 === 1 ? 0 : R_OK) | (access2 !== 0 || req.truncate ? W_OK : 0);
     await openable(g, "open", req.path, want, req.create === true);
   }
+  openTty(name2) {
+    const tty = name2 === void 0 ? this.controllingTerminal() : this.options.jobs?.terminalNamed(name2);
+    if (!tty) throw new KernelError("ENXIO");
+    if (name2 !== void 0) ttyOpenable(this.guarded(), tty);
+    return this.fds.install(tty.file(), 3);
+  }
+  guarded() {
+    const { guard: guard2 } = this.options;
+    return guard2 && { fs: guard2.fs, dac: guard2.dac, cred: this.cred, pid: this.pid };
+  }
+  ttyOwner() {
+    return { uid: this.cred.euid, gid: this.cred.egid, mode: TTY_MODE };
+  }
+  terminalByName(name2) {
+    const n = ptsNumber(name2);
+    const tty = n === void 0 ? this.options.jobs?.terminalNamed(name2) : this.options.ptys?.get(n).slave;
+    if (!tty) throw new KernelError("ENOENT");
+    return tty;
+  }
   newOwner() {
     if (!this.options.owners) return void 0;
     return { uid: this.cred.euid, gid: this.cred.egid, mode: 438 & ~this.umask };
@@ -11447,13 +11500,12 @@ var WasmProcess = class {
           if (!req.keep) await Promise.resolve(this.fds.close(req.from));
         }
         return { ok: true, kind: "void" };
-      case "fd-open-tty": {
-        const tty = req.name === void 0 ? this.controllingTerminal() : this.options.jobs?.terminalNamed(req.name);
-        if (!tty) throw new KernelError("ENXIO");
-        return { ok: true, kind: "json", json: this.fds.install(tty.file(), 3) };
-      }
+      case "fd-open-tty":
+        return { ok: true, kind: "json", json: this.openTty(req.name) };
       case "fd-tty-names":
         return { ok: true, kind: "json", json: this.options.jobs?.terminalNames() ?? [] };
+      case "fd-tty-owner":
+        return { ok: true, kind: "json", json: this.terminalByName(req.name).owner ?? null };
       case "fd-select": {
         const { read, write, timeoutMs } = req;
         if (this.owed && timeoutMs !== 0) {
@@ -14126,6 +14178,16 @@ var NOT_FOUND = 127;
 var DECIDE_MS = 100;
 var INIT_PID = 1;
 var SHARED_DIRS = ["/tmp", "/home"];
+var LAYOUT = [
+  ["/", 493],
+  ["/root", 448],
+  ["/home", 493],
+  ["/etc", 493],
+  [PASSWD, 420],
+  [GROUP, 420],
+  ["/usr", 493],
+  ["/usr/local", 493]
+];
 var encoder3 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
@@ -14319,7 +14381,8 @@ var Launcher = class {
       {
         locks: webLocks(),
         busy: (path) => [...this.openFiles].some((nodes) => nodes.holds(path)),
-        owner: options.unlinkOwner
+        owner: options.unlinkOwner,
+        ...this.owners ? { dirOwner: { uid: 0, gid: 0, mode: 448 } } : {}
       }
     );
     this.fs = this.unlinked.wrap(keepingOpen(fs, this.nodes));
@@ -14944,6 +15007,24 @@ var Launcher = class {
       await this.provisionPnpmHome();
     return entry;
   }
+  async stampLayout() {
+    const layout = [
+      ...LAYOUT,
+      [this.modulesDir, 493],
+      [this.pnpmHome, 493],
+      [`/${UNLINKED_DIR}`, 448]
+    ];
+    for (const [path, mode] of layout) {
+      const real = await this.realLayoutPath(path);
+      const fresh = real !== void 0 && !await this.base.hasOwner?.(real);
+      if (fresh) await this.base.chown?.(real, { uid: 0, gid: 0, mode, follow: false });
+    }
+  }
+  async realLayoutPath(path) {
+    if (!await this.base.exists(path)) return void 0;
+    if (path === "/") return path;
+    return joinName(await realDir(this.base, parentOf3(path)), baseName(path));
+  }
   async provisionPnpmHome() {
     await this.base.mkdir(this.pnpmHome, { recursive: true }).catch(() => void 0);
   }
@@ -15017,6 +15098,7 @@ var Launcher = class {
     if (this.owners) await this.base.chmod("/tmp", 1023);
     await this.provisionPnpmHome();
     await this.users.ensure();
+    if (this.owners) await this.stampLayout();
     await writeCaFile(this.base, this.ca).catch(() => void 0);
     this.fstab = this.mountFstab();
   }
@@ -15045,7 +15127,12 @@ var Launcher = class {
   }
   async account(user) {
     if (typeof user === "object") return user;
-    const found = await this.users.lookup(user ?? 0);
+    return (await this.terminalAccount(user)).account;
+  }
+  async terminalAccount(user) {
+    if (typeof user === "object")
+      return { account: user, tty: this.owners ? await this.users.ttyGroup() : void 0 };
+    const found = await this.users.lookupTerminal(user ?? 0);
     if (!found) throw fsError("ENOENT", `no user ${String(user)}`);
     return found;
   }
@@ -15067,7 +15154,7 @@ var Launcher = class {
     return { cwd, file, planned };
   }
   async openTerminal(argv, options) {
-    const account = await this.account(options.user);
+    const { account, tty: ttyGroup } = await this.terminalAccount(options.user);
     const { cwd, file, planned } = await this.starting(argv, options.cwd, account);
     if (!planned) throw new Error(`${file}: command not found`);
     let leader = 0;
@@ -15077,6 +15164,7 @@ var Launcher = class {
     );
     tty.onRead = () => this.settling.reading(this.jobs.tcgetpgrp(tty, leader));
     tty.name = `/dev/tty${++this.terminals}`;
+    if (this.owners) tty.owner = { uid: account.uid, gid: ttyGroup ?? account.gid, mode: TTY_MODE };
     tty.setSize(options.cols ?? 80, options.rows ?? 24);
     const fds = new FdTable();
     const stdio = tty.file();