@ai-ecoverse/slicc-kernel 1.73.0 → 1.73.1

package/README.md

@@ -95,7 +95,7 @@ The user database, `/etc/passwd` and `/etc/group` (see [Users](#users)):
 | | |
 | --- | --- |
 | `mode` | the `users` option the kernel was created with |
-| `add({ name, home?, groups?, umask?, homeGroup?, homeMode? })` | adds a user and resolves with `{ name, uid, gid, home, shell, groups, umask? }`. It's idempotent: an existing name resolves with its entry, keeps its ids and home, joins the groups in `groups` it isn't in yet (it never leaves one), remembers `umask`, creates a missing pnpm home or `config.yaml` (an existing pnpm home keeps its mode with `users: 'off'`), and, with owners on, gives the home to the user again. The new user gets the lowest free id from 1000 up, a private group of the same id and name, membership of `users` and of each group in `groups` (such as `sudo`), `home` (default `/home/<name>`, created), its pnpm home `~/.local/share/pnpm` (`0700`, `0750` for a `scoop-` user) and `~/.config/pnpm/config.yaml` with `minimumReleaseAge: 1440` (pnpm skips releases less than a day old), each only if missing, which an `add` of an existing user also does, and `/bin/bash`. `umask` is the umask its processes start with; the kernel keeps it in memory, so pass it again after a reload. With owners on, every `add`, of a new or an existing user, also gives a home under `/home/<dir>` to the user and sets its pnpm home to `0700` (`0750` for a `scoop-` user) again (see [File owners](#file-owners)). `homeGroup` names the group the home belongs to instead of the user's own, without making the user a member (`groups` does that), and its mode is then `2750`. `homeMode` sets the home's mode instead (setgid included, so `0o2750` makes new files in it take the home's group); like the owner, it is set again by every `add` with owners on, on the home itself only. A name must match `[a-z_][a-z0-9_.-]*`; a group that doesn't exist, in `groups` or `homeGroup`, rejects with `ENOENT` |
+| `add({ name, home?, groups?, umask?, homeGroup?, homeMode? })` | adds a user and resolves with `{ name, uid, gid, home, shell, groups, umask? }`. It's idempotent: an existing name resolves with its entry, keeps its ids and home, joins the groups in `groups` it isn't in yet (it never leaves one), remembers `umask`, creates a missing pnpm home or `config.yaml` (an existing pnpm home keeps its mode with `users: 'off'`), and, with owners on, gives the home to the user again. The new user gets the lowest free id from 1000 up, a private group of the same id and name, membership of `users` and of each group in `groups` (such as `sudo`), `home` (default `/home/<name>`, created), its pnpm home `~/.local/share/pnpm` (`0700`, `0750` for a `scoop-` user) and `~/.config/pnpm/config.yaml` with `minimumReleaseAge: 1440` (pnpm skips releases less than a day old), each only if missing (with owners on, the directories it makes on the way, `~/.config` and `~/.local` included, get `0777` less the user's `umask`, the file `0666` less it, and in a home with `homeGroup` they belong to that group and have the setgid bit, as new directories in a setgid directory do), which an `add` of an existing user also does, and `/bin/bash`. `umask` is the umask its processes start with; the kernel keeps it in memory, so pass it again after a reload. With owners on, every `add`, of a new or an existing user, also gives a home under `/home/<dir>` to the user and sets its pnpm home to `0700` (`0750` for a `scoop-` user) again (see [File owners](#file-owners)). `homeGroup` names the group the home belongs to instead of the user's own, without making the user a member (`groups` does that), and its mode is then `2750`. `homeMode` sets the home's mode instead (setgid included, so `0o2750` makes new files in it take the home's group); like the owner, it is set again by every `add` with owners on, on the home itself only. A name must match `[a-z_][a-z0-9_.-]*`; a group that doesn't exist, in `groups` or `homeGroup`, rejects with `ENOENT` |
 | `remove(name, { keepHome }?)` | removes the user, its private group and its group memberships, and deletes its home unless `keepHome` is set. A home outside `/home/<dir>` is never deleted. Resolves `false` for an unknown name; system accounts (ids below 1000 or above 60000) reject with `EPERM` |
 | `list()` | every user, as `add` returns them |
 
@@ -518,7 +518,7 @@ An exec'd program takes over the pid of the process it replaces, as on Linux: `g
 
 ### File modes and the umask
 
-Every process has a umask in the kernel, `022` for a process the embedder starts, inherited across fork, spawn and exec and shown in `/proc/<pid>/status` (`Umask:`). The kernel applies it when a program creates a file or directory, whatever its libc does: an Emscripten program's `open` with `O_CREAT`, `mkdir` and `mknod` (so `umask 077; touch f` gives `600` in a child too), and a WASI program's `path_open` with `O_CREAT` and `path_create_directory` (`0666` and `0777` less the umask). An Emscripten program's `umask()` sets and reads the kernel's umask through the glue's `__syscall_umask` import, so `umask 077` in bash shows in `/proc` and reaches every child. A build that resolves `umask` inside its wasm, as wasm-bash 5.3.0-8 to 5.3.0-10 do, keeps a umask of its own that the kernel never sees.
+Every process has a umask in the kernel, `022` for a process the embedder starts, inherited across fork, spawn and exec and shown in `/proc/<pid>/status` (`Umask:`). The kernel applies it when a program creates a file or directory, whatever its libc does: an Emscripten program's `open` with `O_CREAT`, `mkdir` and `mknod` (so `umask 077; touch f` gives `600` in a child too), and a WASI program's `path_open` with `O_CREAT` and `path_create_directory` (`0666` and `0777` less the umask). An Emscripten program's `umask()` sets and reads the kernel's umask through the glue's `__syscall_umask` import, so `umask 077` in bash shows in `/proc` and reaches every child. The kernel finds these imports by the glue's own functions (`___syscall_openat`, `___syscall_mkdirat`, `___syscall_mknodat`, `___syscall_umask`, and `___syscall_faccessat` for `access(2)`), so it also does so for glue whose imports are minified to short names, as wasm-curl's and wasm-clang's are; a glue that has one of those functions but doesn't import it under any name is refused. A build that resolves `umask` inside its wasm, as wasm-bash 5.3.0-8 to 5.3.0-10 do, keeps a umask of its own that the kernel never sees.
 
 WASI and WASIX have no call for file modes, so the kernel adds the import module `slicc_fs`, whose functions return a preview1 errno (kernels without them answer `ENOSYS`):
 
@@ -590,9 +590,10 @@ With `users: 'enforce'` the kernel checks every file call that reaches it agains
 - **Opening a file:** an open needs `r` to read and `w` to write or truncate, checked once when the file is opened, in every runtime: Emscripten, WASI (a second open of a path the program already has open is checked as well), JS programs' `ctx.open` and `ctx.fs.writeFile`, and the kernel's own opens. A file the open itself creates is not checked (only its directory is), so `open(O_CREAT | O_WRONLY, 0444)` works. An open descriptor keeps the access it was opened with, through a later `chmod`, and so do descriptors a child inherits. Reads and writes without a descriptor (`ctx.fs.readFile`, `ctx.sync.fs.readFile`) are checked each time.
 - **`access(2)`:** `faccessat` (bash's `[ -r ]`, `test -w`) answers from the same checks, with the real uid and gid, or the effective ones with `AT_EACCESS`, for Emscripten programs, and for WASI programs through `slicc_fs.path_access` (see [File modes and the umask](#file-modes-and-the-umask)).
 - **Exec:** running a program by path needs `x` on it, and `r` too when it's a script (`#!` or a `binfmt` suffix); a WASI or Emscripten binary needs only `x`. Root needs an `x` bit as well. Commands found by name, and `/usr/bin` and `/bin`, are always executable; a user's own commands in `~/.local/share/pnpm/bin` are reached through the user's home, so another user gets `EACCES` there, as for any file. A refused exec is `EACCES` (126 in bash).
-- **The layout:** with `users: 'report'` or `'enforce'`, the kernel gives its own paths an owner and a mode when they have no owner record yet: on a fresh root, and once on a root from before owners. These are `/` `0755`, `/root` `0700`, `/home` `0755`, `/etc` `0755`, `/etc/passwd` and `/etc/group` `0644`, `/usr` and `/usr/local` `0755`, `/node_modules` (or the `modules` option) and the system `PNPM_HOME` `0755`, all root's. A path that has a record keeps it, so an admin's `chmod 711 /home` or `chown cone /node_modules` lasts across restarts; a mounted path is left to its mount, and a path below a symlinked directory is stamped where it really is. Only a root that records owners is stamped: the OPFS root with its sidecar, which the page and the Node entry (in memory) both use; a custom root file system without owner records is left as it is. The directory for files removed while open, `/.slicc-unlinked`, is made root's `0700`. `/tmp` is the exception: it is set to `1777` at every start. Emscripten programs see `/` at `0755`, `/dev` at `0755`, `null`, `zero`, `full`, `random`, `urandom` and `tty` at `0666`, and `/dev/shm` at `1777`. With `users: 'off'` nothing is stamped. Paths the embedder makes (bios's `/opt` and `/var/lib/slicc`) are the embedder's to set. `/etc/sudoers` and `/etc/sudoers.d` are written when missing (see [Sudo](#sudo)).
+- **The layout:** with `users: 'report'` or `'enforce'`, the kernel gives its own paths an owner and a mode when they have no owner record yet: on a fresh root, and once on a root from before owners. These are `/` `0755`, `/root` `0700`, `/home` `0755`, `/etc` `0755`, `/etc/passwd` and `/etc/group` `0644`, `/usr` and `/usr/local` `0755`, `/node_modules` (or the `modules` option) and the system `PNPM_HOME` `0755`, all root's. A path that has a record keeps it, so an admin's `chmod 711 /home` or `chown cone /node_modules` lasts across restarts; a mounted path is left to its mount, and a path below a symlinked directory is stamped where it really is. Only a root that records owners is stamped: the OPFS root with its sidecar, which the page and the Node entry (in memory) both use; a custom root file system without owner records is left as it is. The directory for files removed while open, `/.slicc-unlinked`, is made root's `0700`. `/tmp` is the exception: it is set to `1777` at every start, and the first time owners are on for a root from before owners, what is in it without an owner of its own is removed (as a boot empties `/tmp` on Linux; a file that is open is kept, a symlinked `/tmp` is left alone, and one `console.warn` line says how many entries went), since it would otherwise be root's, and a program that made it for its user, such as pnpm's lock directories, would find it isn't its own. Emscripten programs see `/` at `0755`, `/dev` at `0755`, `null`, `zero`, `full`, `random`, `urandom` and `tty` at `0666`, and `/dev/shm` at `1777`. With `users: 'off'` nothing is stamped. Paths the embedder makes (bios's `/opt` and `/var/lib/slicc`) are the embedder's to set. `/etc/sudoers` and `/etc/sudoers.d` are written when missing (see [Sudo](#sudo)).
 - **Terminals:** a terminal from `openTerminal` belongs to its session's user, with group `tty` when `/etc/group` has one (the user's own group otherwise), mode `0620`; a pseudo-terminal's slave `/dev/pts/N` belongs to the uid and gid that opened `/dev/ptmx`, mode `0620`. Opening one by name (`/dev/ttyN`, `/dev/pts/N`, from every runtime) needs both `r` and `w`, so only its owner and root open it: the kernel's terminal descriptor always reads and writes, so the group's `w` bit (`write`, `wall` on Linux) does not let a group member open it. `/dev/tty` is the opener's own controlling terminal and is not checked, and descriptors a process inherited (across `sudo` or a `setresuid` too) keep working. Emscripten programs' `stat` of `/dev/ttyN` and `/dev/pts/N` shows the owner and mode. With `users: 'off'` terminals have no owner, as before.
 - **A client's `fs`:** checked as the client's user; a page's client (root) passes.
+- **Removed files still open:** a process that holds a removed file may look it up (`stat`, `lstat`) under the hidden name the kernel gave it in `/.slicc-unlinked`, which is root's `0700`; every other process is refused there, so the kernel's own bookkeeping of held files raises no denials for their holders.
 
 `users: 'enforce'` is not the default yet; it becomes so once the embedders have checked their programs under `'report'`.
 
@@ -603,7 +604,7 @@ With `users: 'enforce'` the kernel checks every file call that reaches it agains
 - **`sudo` elevates only under `users: 'enforce'`.** With `'off'` and `'report'`, `sudo command` just runs `command`, as the caller, with its environment. Under `'report'` nothing is refused, so anyone could rewrite the policy or a command; `sudo` grants nothing until the kernel enforces.
 - **The policy** is `/etc/sudoers` and the files in `/etc/sudoers.d/` (in name order, skipping names that start with `.` or end in `~`), which the kernel writes at start when they're missing, with owners on: `/etc/sudoers` root's `0440` with the one line `%sudo Cmnd *`, and `/etc/sudoers.d` root's `0750`. There is no API: an admin (bios, as root) edits `/etc/sudoers.d/<user>`. A line is `[NOPASSWD] <user|%group|ALL> [(<target>)] Cmnd <argv…|*>`: who (a user name, a group, or anyone), the user it may run as (`root` by default, or `ALL`), and the command, as shell-quoted words whose first is an absolute path, matched exactly against the resolved path and the arguments, or `*` for any command. `#` lines and blank lines are ignored. A line that doesn't parse is skipped, and so is a policy file that isn't root's, is a symlink, or is writable by group or others, or one in a directory that is (each logged once with `console.warn`): what's skipped grants nothing. Groups are the caller's process groups, as `id` shows them.
 - **The embedders' recipe** puts cones in `sudo` (`groups: ['sudo']`) and scoops not, so a cone may ask for any command and a scoop for none.
-- **The command** is found once, on `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin` for a bare name or against the caller's directory for a path, and its real path (symlinks resolved) is what runs and what the policy sees. That file, and every file that will really run for it (a catalog command's glue, module and imports module, and the `package.json` that defines it, a script and the interpreter its `#!` line or `binfmt` suffix names), must be root's and writable by root only, and so must every directory above each, or `sudo` refuses (`EPERM`), whatever the policy says. Other files a program loads at run time (a package's libraries) are the admin's to keep safe, as on Linux. The caller's directory, which the program passes on, must be a directory the caller may enter, or `sudo` refuses (`EACCES`). The kernel resolves it to its real path once, shows that in the request, and runs the command there; if it no longer resolves the same, or the caller can no longer enter it, when the answer comes or when the command starts, nothing runs.
+- **The command** is found once, on `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin` for a bare name or against the caller's directory for a path, and its real path (symlinks resolved) is what runs and what the policy sees. That file, and every file that will really run for it (a catalog command's glue, module and imports module, and the `package.json` that defines it, a script and the interpreter its `#!` line or `binfmt` suffix names), must be root's and writable by root only, and so must every directory above each, or `sudo` refuses (`EPERM`), whatever the policy says. A command that wouldn't start as the target user (a `#!` line naming an interpreter that is only the caller's, say) fails with `command not found` before anything is asked. Other files a program loads at run time (a package's libraries) are the admin's to keep safe, as on Linux. The caller's directory, which the program passes on, must be a directory the caller may enter, or `sudo` refuses (`EACCES`). The kernel resolves it to its real path once, shows that in the request, and runs the command there; if it no longer resolves the same, or the caller can no longer enter it, when the answer comes or when the command starts, nothing runs.
 - **The decision:** a caller whose effective uid is 0 runs anything (the check on the command's path still applies). Otherwise a matching `NOPASSWD` line runs the command at once; any other matching line asks `approve`; nothing matching is refused (`sudo: cone is not allowed to run /usr/bin/ls as root`).
 - **Approval:** `approve(req, { signal })` gets `{ id, kind: 'sudo', user, uid, target, argv, path, cwd, pid, tag?, tty?, createdAt, expiresAt, always: true }`: the caller's name and real uid, the target user, the argv as typed, the resolved `path`, the caller's directory, pid, tag and terminal, and the times in ms. It answers `'once'` (run it), `'always'` (run it, and append `NOPASSWD <user> (<target>) Cmnd <path> <args…>` to `/etc/sudoers.d/<user>`, root's `0440`, so it's never asked again; if that can't be written, nothing runs) or `'deny'`; a throw, any other answer or no hook at all is `sudo: approval denied`. After 5 minutes the request expires (`signal` aborts with `'expired'`, and `sudo` fails with `sudo: the request expired`); when the requester ends or gets a signal while it waits, `^C` included, `signal` aborts with `'withdrawn'` and `sudo` ends with that signal's status. A user has at most one request waiting; another fails with `sudo: another request is pending`. On the page, `createKernel` relays the request from the kernel worker and back, and the abort too; `terminate()` or a failed worker aborts every request still waiting with `'withdrawn'`.
 - **Running:** the command runs as the caller's child, with all six ids and the groups of the target user, in the caller's directory, on its terminal, standard input, output and error, and in its process group; `sudo` exits with its status, and passes `SIGTERM` and `SIGHUP` on to it, also one that comes while it starts (the kernel lets it signal the command it started, which its own user may not); `SIGINT` and `SIGQUIT` it leaves to the command, which gets them from the terminal itself. It's found among the system's commands only, never a user's own. Its environment is the kernel's (the embedder's `env` and the proxy settings), the target's `HOME`, `USER`, `LOGNAME`, `SHELL`, `PNPM_HOME` and `NPM_CONFIG_PREFIX`, `PATH` set to the path above, `PWD`, the caller's `TERM` when it is a plain name (letters, digits, `.`, `_`, `+`, `-`), and `SUDO_USER`, `SUDO_UID`, `SUDO_GID` and `SUDO_COMMAND`; nothing else of the caller's comes through.

package/dist/kernel-worker.js

@@ -1307,7 +1307,7 @@ var OpfsFs = class {
       const above = owner && {
         uid: owner.uid,
         gid: owner.gid,
-        ...mode ? { mode, parents: mode } : {}
+        ...mode !== void 0 ? { mode, parents: mode } : {}
       };
       await this.mkdir(parentOf3(path), { recursive: true, ...above ? { owner: above } : {} });
     }
@@ -3582,6 +3582,9 @@ var UserDb = class {
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
+  umaskFor(options) {
+    return (options.umask ?? this.umasks.get(options.name) ?? 18) & 511;
+  }
   async realDir(path) {
     const parts2 = path.split("/").filter(Boolean);
     for (let n = 1; n <= parts2.length; n++) {
@@ -3605,9 +3608,11 @@ var UserDb = class {
       group: parseGroup(await this.read(GROUP, DEFAULT_GROUP))
     };
   }
-  async provision(row) {
-    const owner = this.owners ? { uid: row.uid, gid: row.gid } : void 0;
-    const made2 = owner ? { recursive: true, owner } : { recursive: true };
+  async provision(row, umask, shared) {
+    const dirs = 511 & ~umask | (shared ? 1024 : 0);
+    const gid = shared?.gid ?? row.gid;
+    const owner = this.owners ? { uid: row.uid, gid } : void 0;
+    const made2 = owner ? { recursive: true, owner: { ...owner, mode: dirs, parents: dirs } } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
     if (!await this.fs.exists(pnpm)) {
       await this.fs.mkdir(pnpm, made2);
@@ -3616,7 +3621,7 @@ var UserDb = class {
     const config = `${row.home}/.config/pnpm/config.yaml`;
     if (!await this.fs.exists(config)) {
       await this.fs.mkdir(`${row.home}/.config/pnpm`, made2);
-      await this.fs.writeFile(config, PNPM_CONFIG, owner);
+      await this.fs.writeFile(config, PNPM_CONFIG, owner && { ...owner, mode: 438 & ~umask });
     }
   }
   async commit(passwd, group, then) {
@@ -3707,7 +3712,7 @@ var UserDb = class {
           throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
         }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
-          await this.provision(found);
+          await this.provision(found, this.umaskFor(options), shared);
           await this.stampHome(found, shared, homeMode);
         }
         if (joined(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
@@ -3725,7 +3730,7 @@ var UserDb = class {
       const fresh2 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
-        await this.provision(row);
+        await this.provision(row, this.umaskFor(options), shared);
         await this.stampHome(row, shared, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
@@ -7832,6 +7837,11 @@ var HeldPaths = class extends Map {
   keptFor(handle) {
     return this.keptHandles.get(handle);
   }
+  keeps(hidden) {
+    for (const file of this.uses.keys()) if (file.hidden === hidden) return true;
+    for (const file of this.unlinked.values()) if (file.hidden === hidden) return true;
+    return false;
+  }
   keep(path, file) {
     const fresh2 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
     for (const id2 of fresh2) this.keptHandles.set(id2, file);
@@ -8933,6 +8943,7 @@ function guardOf(entry) {
   return { fs: entry.fs, cred, pid: entry.pid ?? 0, dac: entry.dac };
 }
 var FOLLOWING = /* @__PURE__ */ new Set(["exists", "stat", "chown", "statfs"]);
+var LOOKS = /* @__PURE__ */ new Set(["exists", "stat", "lstat"]);
 var NOT_FOLLOWING = /* @__PURE__ */ new Set(["lstat", "readlink", "lchown"]);
 async function guard(g, path, req, cwd) {
   const { op } = req;
@@ -9002,6 +9013,7 @@ async function accessOp(entry, path, req) {
 async function guarded(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return void 0;
+  if (LOOKS.has(req.op) && await entry.holdsKept?.(path)) return void 0;
   try {
     await guard(g, path, req, entry.cwd);
     return void 0;
@@ -12545,6 +12557,13 @@ var WasmProcess = class {
     }
   }
   keptPath;
+  async holds(path) {
+    for (const fd of this.fds.numbers()) {
+      const { file } = this.fds.get(fd);
+      if ((await file.stat?.().catch(() => void 0))?.path === path) return true;
+    }
+    return false;
+  }
   keptHandle;
   async keptOr(path, handle) {
     const held = handle === void 0 ? void 0 : this.keptHandle?.(handle);
@@ -13188,7 +13207,8 @@ function spawnWasmProcess(opts) {
   const token = holdingToken(opts, holds, {
     cred: () => process.cred,
     umask: () => process.umask,
-    created: created3
+    created: created3,
+    holdsKept: async (path) => path.includes(`/${UNLINKED_DIR}/`) && (holds.keeps(path) || await process.holds(path))
   });
   process.keptPath = (path) => holds.keptAt(path)?.hidden;
   process.keptHandle = (handle2) => holds.keptFor(handle2)?.hidden;
@@ -15550,9 +15570,14 @@ var Sudo = class {
     if (walked.denied !== void 0 || walked.missing) return false;
     return (await this.o.fs.stat(cwd).catch(() => void 0))?.isDirectory === true;
   }
-  async untrusted(path, cwd) {
-    const files = await this.o.backing?.(path, cwd) ?? [];
-    for (const file of [path, ...files]) if (!await this.trusted(file)) return file;
+  async untrusted(path, cwd, word) {
+    const files = this.o.backing ? await this.o.backing(path, cwd) : [];
+    if (!files) return failed2("ENOENT", `sudo: ${word}: command not found`);
+    for (const file of [path, ...files]) {
+      if (!await this.trusted(file)) {
+        return failed2("EPERM", `sudo: ${file} must be root's, and writable by root only`);
+      }
+    }
     return void 0;
   }
   async locate(word, cwd) {
@@ -15593,10 +15618,8 @@ var Sudo = class {
     }
     const path = await this.locate(word, cwd);
     if (!path) return failed2("ENOENT", `sudo: ${word}: command not found`);
-    const untrusted = await this.untrusted(path, cwd);
-    if (untrusted) {
-      return failed2("EPERM", `sudo: ${untrusted} must be root's, and writable by root only`);
-    }
+    const untrusted = await this.untrusted(path, cwd, word);
+    if (untrusted) return untrusted;
     const argv = [path, ...args];
     const matching = rules.filter(
       (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
@@ -15619,10 +15642,8 @@ var Sudo = class {
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
-      const changed = await this.untrusted(path, cwd);
-      if (changed) {
-        return failed2("EPERM", `sudo: ${changed} must be root's, and writable by root only`);
-      }
+      const changed = await this.untrusted(path, cwd, word);
+      if (changed) return changed;
       if (answer === "always" && !await this.remember(self, target, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
@@ -16252,7 +16273,7 @@ var Launcher = class {
   }
   async backing(file, cwd) {
     const planned = await this.plan(file, [file], cwd, "");
-    if (!planned) return [];
+    if (!planned) return void 0;
     const { glue, wasm, imports } = planned.target;
     const files = [glue, wasm, ...imports ? [imports] : []];
     const scripts = [];
@@ -16860,6 +16881,27 @@ var Launcher = class {
       await this.provisionPnpmHome();
     return entry;
   }
+  async ownTmp() {
+    const real = await this.realLayoutPath("/tmp");
+    const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
+    if (real !== void 0 && st?.isDirectory && this.base.hasOwner && !await this.base.hasOwner(real)) {
+      let removed = 0;
+      for (const name2 of await this.base.readdir(real).catch(() => [])) {
+        const path = joinName(real, name2);
+        if (await this.base.hasOwner(path) || this.inUse(path)) continue;
+        const failed3 = await this.base.rm(path, { recursive: true, force: true }).catch(String);
+        if (failed3 === void 0) removed++;
+      }
+      if (removed > 0) {
+        console.warn(`slicc-kernel users: removed ${removed} entries from /tmp that had no owner`);
+      }
+      await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
+    }
+    if (st?.isDirectory) await this.base.chmod(real, 1023);
+  }
+  inUse(path) {
+    return [...this.openFiles].some((nodes) => nodes.holds(path)) || heldUnder(this.held, path);
+  }
   async stampLayout() {
     const layout = [
       ...LAYOUT,
@@ -16979,7 +17021,7 @@ var Launcher = class {
   async prepare() {
     await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
-    if (this.owners) await this.base.chmod("/tmp", 1023);
+    if (this.owners) await this.ownTmp();
     await this.provisionPnpmHome();
     await this.users.ensure();
     if (this.owners) await this.stampLayout();