@ai-ecoverse/slicc-kernel 1.73.0 → 1.73.1

package/dist/node.js

@@ -2246,6 +2246,9 @@ var UserDb = class {
     const pnpm = `${home}/.local/share/pnpm`;
     if (await this.realDir(pnpm)) await this.fs.chmod(pnpm, scoop ? 488 : 448);
   }
+  umaskFor(options) {
+    return (options.umask ?? this.umasks.get(options.name) ?? 18) & 511;
+  }
   async realDir(path) {
     const parts2 = path.split("/").filter(Boolean);
     for (let n = 1; n <= parts2.length; n++) {
@@ -2269,9 +2272,11 @@ var UserDb = class {
       group: parseGroup(await this.read(GROUP, DEFAULT_GROUP))
     };
   }
-  async provision(row) {
-    const owner = this.owners ? { uid: row.uid, gid: row.gid } : void 0;
-    const made2 = owner ? { recursive: true, owner } : { recursive: true };
+  async provision(row, umask, shared) {
+    const dirs = 511 & ~umask | (shared ? 1024 : 0);
+    const gid = shared?.gid ?? row.gid;
+    const owner = this.owners ? { uid: row.uid, gid } : void 0;
+    const made2 = owner ? { recursive: true, owner: { ...owner, mode: dirs, parents: dirs } } : { recursive: true };
     const pnpm = `${row.home}/.local/share/pnpm`;
     if (!await this.fs.exists(pnpm)) {
       await this.fs.mkdir(pnpm, made2);
@@ -2280,7 +2285,7 @@ var UserDb = class {
     const config = `${row.home}/.config/pnpm/config.yaml`;
     if (!await this.fs.exists(config)) {
       await this.fs.mkdir(`${row.home}/.config/pnpm`, made2);
-      await this.fs.writeFile(config, PNPM_CONFIG, owner);
+      await this.fs.writeFile(config, PNPM_CONFIG, owner && { ...owner, mode: 438 & ~umask });
     }
   }
   async commit(passwd, group, then) {
@@ -2371,7 +2376,7 @@ var UserDb = class {
           throw fsError("EINVAL", `a user is no member of its own group ${name2}`);
         }
         if (found.uid >= FIRST_UID && found.uid <= LAST_UID) {
-          await this.provision(found);
+          await this.provision(found, this.umaskFor(options), shared);
           await this.stampHome(found, shared, homeMode);
         }
         if (joined(name2, more)) await this.fs.writeFile(GROUP, formatGroup(group));
@@ -2389,7 +2394,7 @@ var UserDb = class {
       const fresh2 = !await this.fs.exists(home);
       await this.fs.mkdir(home, { recursive: true });
       try {
-        await this.provision(row);
+        await this.provision(row, this.umaskFor(options), shared);
         await this.stampHome(row, shared, homeMode);
         await this.fs.mkdir("/etc", { recursive: true });
         await this.commit(formatPasswd(passwd), formatGroup(group));
@@ -3944,7 +3949,7 @@ var OpfsFs = class {
       const above = owner && {
         uid: owner.uid,
         gid: owner.gid,
-        ...mode ? { mode, parents: mode } : {}
+        ...mode !== void 0 ? { mode, parents: mode } : {}
       };
       await this.mkdir(parentOf4(path), { recursive: true, ...above ? { owner: above } : {} });
     }
@@ -6248,6 +6253,11 @@ var HeldPaths = class extends Map {
   keptFor(handle) {
     return this.keptHandles.get(handle);
   }
+  keeps(hidden) {
+    for (const file of this.uses.keys()) if (file.hidden === hidden) return true;
+    for (const file of this.unlinked.values()) if (file.hidden === hidden) return true;
+    return false;
+  }
   keep(path, file) {
     const fresh2 = this.handlesAt(path).filter((id2) => !this.keptHandles.has(id2));
     for (const id2 of fresh2) this.keptHandles.set(id2, file);
@@ -7349,6 +7359,7 @@ function guardOf(entry) {
   return { fs: entry.fs, cred, pid: entry.pid ?? 0, dac: entry.dac };
 }
 var FOLLOWING = /* @__PURE__ */ new Set(["exists", "stat", "chown", "statfs"]);
+var LOOKS = /* @__PURE__ */ new Set(["exists", "stat", "lstat"]);
 var NOT_FOLLOWING = /* @__PURE__ */ new Set(["lstat", "readlink", "lchown"]);
 async function guard(g, path, req, cwd) {
   const { op } = req;
@@ -7418,6 +7429,7 @@ async function accessOp(entry, path, req) {
 async function guarded(entry, path, req) {
   const g = guardOf(entry);
   if (!g) return void 0;
+  if (LOOKS.has(req.op) && await entry.holdsKept?.(path)) return void 0;
   try {
     await guard(g, path, req, entry.cwd);
     return void 0;
@@ -12309,6 +12321,13 @@ var WasmProcess = class {
     }
   }
   keptPath;
+  async holds(path) {
+    for (const fd of this.fds.numbers()) {
+      const { file } = this.fds.get(fd);
+      if ((await file.stat?.().catch(() => void 0))?.path === path) return true;
+    }
+    return false;
+  }
   keptHandle;
   async keptOr(path, handle) {
     const held = handle === void 0 ? void 0 : this.keptHandle?.(handle);
@@ -12952,7 +12971,8 @@ function spawnWasmProcess(opts) {
   const token = holdingToken(opts, holds, {
     cred: () => process2.cred,
     umask: () => process2.umask,
-    created: created3
+    created: created3,
+    holdsKept: async (path) => path.includes(`/${UNLINKED_DIR}/`) && (holds.keeps(path) || await process2.holds(path))
   });
   process2.keptPath = (path) => holds.keptAt(path)?.hidden;
   process2.keptHandle = (handle2) => holds.keptFor(handle2)?.hidden;
@@ -15417,9 +15437,14 @@ var Sudo = class {
     if (walked.denied !== void 0 || walked.missing) return false;
     return (await this.o.fs.stat(cwd).catch(() => void 0))?.isDirectory === true;
   }
-  async untrusted(path, cwd) {
-    const files = await this.o.backing?.(path, cwd) ?? [];
-    for (const file of [path, ...files]) if (!await this.trusted(file)) return file;
+  async untrusted(path, cwd, word) {
+    const files = this.o.backing ? await this.o.backing(path, cwd) : [];
+    if (!files) return failed2("ENOENT", `sudo: ${word}: command not found`);
+    for (const file of [path, ...files]) {
+      if (!await this.trusted(file)) {
+        return failed2("EPERM", `sudo: ${file} must be root's, and writable by root only`);
+      }
+    }
     return void 0;
   }
   async locate(word, cwd) {
@@ -15460,10 +15485,8 @@ var Sudo = class {
     }
     const path = await this.locate(word, cwd);
     if (!path) return failed2("ENOENT", `sudo: ${word}: command not found`);
-    const untrusted = await this.untrusted(path, cwd);
-    if (untrusted) {
-      return failed2("EPERM", `sudo: ${untrusted} must be root's, and writable by root only`);
-    }
+    const untrusted = await this.untrusted(path, cwd, word);
+    if (untrusted) return untrusted;
     const argv = [path, ...args];
     const matching = rules.filter(
       (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
@@ -15486,10 +15509,8 @@ var Sudo = class {
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
-      const changed = await this.untrusted(path, cwd);
-      if (changed) {
-        return failed2("EPERM", `sudo: ${changed} must be root's, and writable by root only`);
-      }
+      const changed = await this.untrusted(path, cwd, word);
+      if (changed) return changed;
       if (answer === "always" && !await this.remember(self, target, argv)) {
         return failed2("EIO", "sudo: the rule could not be recorded");
       }
@@ -16119,7 +16140,7 @@ var Launcher = class {
   }
   async backing(file, cwd) {
     const planned = await this.plan(file, [file], cwd, "");
-    if (!planned) return [];
+    if (!planned) return void 0;
     const { glue, wasm, imports } = planned.target;
     const files = [glue, wasm, ...imports ? [imports] : []];
     const scripts = [];
@@ -16727,6 +16748,27 @@ var Launcher = class {
       await this.provisionPnpmHome();
     return entry;
   }
+  async ownTmp() {
+    const real = await this.realLayoutPath("/tmp");
+    const st = real === void 0 ? void 0 : await this.base.lstat(real).catch(() => void 0);
+    if (real !== void 0 && st?.isDirectory && this.base.hasOwner && !await this.base.hasOwner(real)) {
+      let removed = 0;
+      for (const name2 of await this.base.readdir(real).catch(() => [])) {
+        const path = joinName(real, name2);
+        if (await this.base.hasOwner(path) || this.inUse(path)) continue;
+        const failed3 = await this.base.rm(path, { recursive: true, force: true }).catch(String);
+        if (failed3 === void 0) removed++;
+      }
+      if (removed > 0) {
+        console.warn(`slicc-kernel users: removed ${removed} entries from /tmp that had no owner`);
+      }
+      await this.base.chown?.(real, { uid: 0, gid: 0, mode: 1023, follow: false });
+    }
+    if (st?.isDirectory) await this.base.chmod(real, 1023);
+  }
+  inUse(path) {
+    return [...this.openFiles].some((nodes) => nodes.holds(path)) || heldUnder(this.held, path);
+  }
   async stampLayout() {
     const layout = [
       ...LAYOUT,
@@ -16846,7 +16888,7 @@ var Launcher = class {
   async prepare() {
     await this.resolvePrefixes();
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
-    if (this.owners) await this.base.chmod("/tmp", 1023);
+    if (this.owners) await this.ownTmp();
     await this.provisionPnpmHome();
     await this.users.ensure();
     if (this.owners) await this.stampLayout();