@ai-ecoverse/slicc-kernel 1.80.0 → 1.82.0

package/dist/kernel-worker.js

@@ -360,10 +360,106 @@ async function chownAs(fs, cred, path, change) {
   });
 }
 
+// src/fs/integrity.ts
+var KERNEL_CALLER = { pid: 0, uid: 0 };
+function integrityOptions(options) {
+  if (options && typeof options.lookup !== "function") {
+    throw new TypeError("protect.integrity.lookup must be a function");
+  }
+  integrityUnknown(options);
+}
+function integrityUnknown(options) {
+  const unknown = options?.unknown ?? "allow";
+  if (unknown !== "allow" && unknown !== "deny") {
+    throw new TypeError("protect.integrity.unknown must be 'allow' or 'deny'");
+  }
+  return unknown;
+}
+function hex(digest) {
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256(bytes) {
+  return hex(await crypto.subtle.digest("SHA-256", bytes));
+}
+var Integrity = class {
+  prefixes;
+  root;
+  lookup;
+  unknown;
+  report;
+  unverified = /* @__PURE__ */ new Set();
+  constructor(prefixes2, root, options, report) {
+    this.prefixes = prefixes2;
+    this.root = root;
+    this.lookup = options.lookup;
+    this.unknown = integrityUnknown(options);
+    this.report = report;
+  }
+  async real(path) {
+    const at = normalizePath(path);
+    const real = await this.root.realpath?.(at, true).catch(() => void 0) ?? at;
+    return isProtected(this.prefixes, real) ? real : void 0;
+  }
+  async key(path) {
+    const real = await this.real(path);
+    if (real === void 0 || !this.root.version) return void 0;
+    return `${real}\0${await this.root.version(real)}`;
+  }
+  async read(path, caller, plain) {
+    return (await this.readKeyed(path, caller, plain)).bytes;
+  }
+  async readKeyed(path, caller, plain) {
+    const real = await this.real(path);
+    if (real === void 0) return { bytes: await plain() };
+    const read = this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const { bytes } = read;
+    const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
+    const actual = await sha256(bytes);
+    const denial = { pid: caller.pid, uid: caller.uid, path: real, actual };
+    const tagged = caller.tag !== void 0 ? { tag: caller.tag } : {};
+    let expected;
+    try {
+      expected = await this.expected(real);
+    } catch {
+      this.say({ ...denial, ...tagged, op: "exec-integrity", errno: "EACCES" });
+      throw fsError("EACCES", `integrity lookup failed: ${real}`);
+    }
+    if (expected === void 0) {
+      if (this.unknown === "allow") {
+        if (!this.unverified.has(real)) {
+          this.unverified.add(real);
+          this.say({ ...denial, ...tagged, op: "exec-unverified", errno: "ENODATA" });
+        }
+        return keyed;
+      }
+    } else if (expected === actual) {
+      return keyed;
+    }
+    const known = expected !== void 0 ? { expected } : {};
+    this.say({ ...denial, ...tagged, ...known, op: "exec-integrity", errno: "EACCES" });
+    throw fsError("EACCES", `integrity check failed: ${real}`);
+  }
+  async expected(path) {
+    const answer = await this.lookup(path);
+    return typeof answer === "string" ? answer.toLowerCase() : void 0;
+  }
+  say(event) {
+    try {
+      this.report(event);
+    } catch {
+    }
+  }
+};
+
 // src/fs/protect.ts
 function protectInit(protection) {
   const writers = [...writerTags(protection)];
-  return { paths: [...protection.paths], ...writers.length > 0 ? { writers } : {} };
+  const { integrity } = protection;
+  return {
+    paths: [...protection.paths],
+    ...writers.length > 0 ? { writers } : {},
+    ...integrity ? { integrity: { unknown: integrityUnknown(integrity) } } : {}
+  };
 }
 function writerTags(protection) {
   const writers = protection?.writers ?? [];
@@ -1220,6 +1316,29 @@ var OpfsFs = class {
       false
     );
   }
+  async readVersioned(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => {
+        const file = await handle.getFile();
+        const bytes = new Uint8Array(await file.arrayBuffer());
+        return { bytes, version: `${file.lastModified}:${file.size}` };
+      },
+      false
+    );
+  }
+  async version(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => {
+        const file = await handle.getFile();
+        return `${file.lastModified}:${file.size}`;
+      },
+      false
+    );
+  }
   async pread(path, offset, length2) {
     const handle = await this.existing(path);
     return this.retrying(
@@ -2150,6 +2269,7 @@ function id(value) {
   return value;
 }
 function changeCred(cur, change) {
+  if (typeof change !== "object" || change === null) throw fsError("EINVAL", "not a change");
   const privileged = cur.euid === 0;
   const next2 = copyCred(cur);
   for (const keys of [UIDS, GIDS]) {
@@ -4466,6 +4586,27 @@ function clipboardAsker(port) {
   return { hook, answer };
 }
 
+// src/integrity-relay.ts
+function integrityAsker(port) {
+  const asks = /* @__PURE__ */ new Map();
+  let next2 = 0;
+  const lookup = (path) => {
+    const id2 = ++next2;
+    const waiting = Promise.withResolvers();
+    asks.set(id2, waiting);
+    port.postMessage({ integrityAsk: { id: id2, path } });
+    return waiting.promise;
+  };
+  const answer = ({ id: id2, hash, error }) => {
+    const waiting = asks.get(id2);
+    if (!waiting) return;
+    asks.delete(id2);
+    if (error !== void 0) waiting.reject(new Error(error));
+    else waiting.resolve(hash);
+  };
+  return { lookup, answer };
+}
+
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
 var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
@@ -7092,7 +7233,7 @@ function owned(path, st) {
 function unchanged(a, b, bytes) {
   return a.ino === b.ino && a.mtime.getTime() === b.mtime.getTime() && a.size === b.size && bytes.length === b.size;
 }
-async function sha256(bytes) {
+async function sha2562(bytes) {
   const digest = new Uint8Array(
     await crypto.subtle.digest("SHA-256", bytes)
   );
@@ -7148,7 +7289,7 @@ async function attest(fs, asked, o) {
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
-      return attested(path, after, bytes, await sha256(bytes), o, parents);
+      return attested(path, after, bytes, await sha2562(bytes), o, parents);
     }
     if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
   }
@@ -16452,6 +16593,13 @@ var Launcher = class {
   unwatchScopes = () => void 0;
   warned = /* @__PURE__ */ new Set();
   compiled = /* @__PURE__ */ new Map();
+  texts = /* @__PURE__ */ new Map();
+  integrity;
+  scannedFs;
+  get scanned() {
+    this.scannedFs ??= this.verifiedFs(this.base);
+    return this.scannedFs;
+  }
   processes = /* @__PURE__ */ new Map();
   zombies = /* @__PURE__ */ new Set();
   orphans = /* @__PURE__ */ new Set();
@@ -16555,7 +16703,7 @@ var Launcher = class {
     if (options.uplink) this.net.useUplink({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
-      engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
+      engine: kernelTlsEngine(packageTlsEngine(this.verifiedFs(options.fs), this.modulesDir)),
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
@@ -16590,6 +16738,16 @@ var Launcher = class {
     this.prefixes = protectedPrefixes(options.protect?.paths ?? []);
     this.processFs = this.prefixes.length > 0 ? new ProtectedFs(this.prefixes).view(this.fs) : this.fs;
     options.fs.protect?.(this.prefixes);
+    const integrity = options.protect?.integrity;
+    integrityOptions(integrity);
+    if (integrity && this.prefixes.length > 0) {
+      this.integrity = new Integrity(
+        this.prefixes,
+        options.fs,
+        integrity,
+        (event) => options.onDenial?.(event)
+      );
+    }
     this.users = new UserDb(this.fs, this.owners);
     this.sudoer = new Sudo({
       fs: this.fs,
@@ -16635,7 +16793,7 @@ var Launcher = class {
   commands(scope = "") {
     let found = this.catalogs.get(scope);
     if (!found) {
-      found = this.roots(scope).then((roots) => scanCommands(this.base, roots)).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
+      found = this.roots(scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => commands.set(SUDO_COMMAND.name, SUDO_COMMAND));
       this.catalogs.set(scope, found);
     }
     return found;
@@ -16643,7 +16801,7 @@ var Launcher = class {
   ownCommands(scope) {
     let found = this.ownCatalogs.get(scope);
     if (!found) {
-      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.base, roots)).then((commands) => new Set(commands.keys()));
+      found = pnpmGlobalRoots(this.base, scope).then((roots) => scanCommands(this.scanned, roots)).then((commands) => new Set(commands.keys()));
       this.ownCatalogs.set(scope, found);
     }
     return found;
@@ -16652,7 +16810,7 @@ var Launcher = class {
     let found = this.binfmts.get(scope);
     if (!found) {
       found = this.roots(scope).then(
-        (roots) => scanBinfmts(this.base, roots, (message3) => {
+        (roots) => scanBinfmts(this.scanned, roots, (message3) => {
           if (this.warned.has(message3)) return;
           this.warned.add(message3);
           console.warn(message3);
@@ -16771,10 +16929,16 @@ var Launcher = class {
       }
       const inner = await this.interpreted(interp, [interp, ...passed], cwd, scope, depth + 1);
       const via = [interp, ...inner?.via ?? []];
-      return inner && { ...inner, target: withScriptEnv(inner.target, command), via };
+      const sources = [script, ...inner?.sources ?? []];
+      return inner && { ...inner, target: withScriptEnv(inner.target, command), via, sources };
     }
     const target = withScriptEnv(found, command);
-    return { target, args: [...target.prefix ?? [], ...passed], via: [interp] };
+    return {
+      target,
+      args: [...target.prefix ?? [], ...passed],
+      via: [interp],
+      sources: [script]
+    };
   }
   async plan(file, argv, cwd, scope, argv0) {
     const found = await this.resolve(file, argv[0] ?? file, cwd, scope);
@@ -16806,7 +16970,7 @@ var Launcher = class {
   }
   async binfmtManifests(scripts) {
     const sources = /* @__PURE__ */ new Map();
-    const binfmts = await scanBinfmts(this.base, await this.roots(), void 0, sources);
+    const binfmts = await scanBinfmts(this.scanned, await this.roots(), void 0, sources);
     const manifests = [];
     for (const script of scripts) {
       const head = await this.head(script);
@@ -16841,25 +17005,72 @@ var Launcher = class {
     if (!head || head[0] === 35 && head[1] === 33) return "ENOENT";
     return binfmtOf(await this.interpreters(scope), path) ? "ENOENT" : "ENOEXEC";
   }
-  module(path) {
-    return this.base.stat(path).then((st) => {
-      const key = `${path}:${st.size}:${st.mtime.getTime()}`;
-      let module = this.compiled.get(key);
-      if (!module) {
-        module = this.base.readFileBuffer(path).then(async (bytes) => {
-          const memory = importedMemory(bytes);
-          const foreign = foreignImports(bytes);
-          const compiled = await WebAssembly.compile(bytes);
-          return {
-            module: compiled,
-            ...memory ? { memory } : {},
-            foreign
-          };
-        });
-        this.compiled.set(key, module);
-        module.catch(() => this.compiled.delete(key));
-      }
-      return module;
+  verifiedFs(fs) {
+    const read = (path) => this.verified(path, KERNEL_CALLER, fs);
+    return Object.assign(Object.create(fs), {
+      readFileBuffer: read,
+      readFile: (path) => this.integrity ? this.text(path, KERNEL_CALLER) : fs.readFile(path)
+    });
+  }
+  async cacheKey(path) {
+    const verified = await this.integrity?.key(path);
+    if (verified !== void 0) return verified;
+    const st = await this.base.stat(path);
+    return `${path}:${st.size}:${st.mtime.getTime()}`;
+  }
+  verified(path, caller, fs = this.base) {
+    const plain = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain) : plain();
+  }
+  keyed(path, caller) {
+    const plain = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain) : plain().then((bytes) => ({ bytes }));
+  }
+  cached(cache, key, load) {
+    const hit = cache.get(key);
+    if (hit !== void 0) return hit;
+    const loading2 = load();
+    const found = loading2.then(({ value }) => value);
+    cache.set(key, found);
+    loading2.then(
+      (done4) => {
+        if (done4.key === key || done4.key === void 0 && !key.includes("\0")) return;
+        if (cache.get(key) === found) cache.delete(key);
+        if (done4.key !== void 0) cache.set(done4.key, found);
+      },
+      () => cache.delete(key)
+    );
+    return found;
+  }
+  async module(path, caller) {
+    const key = await this.cacheKey(path);
+    return this.cached(this.compiled, key, async () => {
+      const { bytes, key: read } = await this.keyed(path, caller);
+      const memory = importedMemory(bytes);
+      const foreign = foreignImports(bytes);
+      const compiled = await WebAssembly.compile(bytes);
+      return { value: { module: compiled, ...memory ? { memory } : {}, foreign }, key: read };
+    });
+  }
+  async checkedSources(planned, caller) {
+    const { target } = planned;
+    const files = [target.wasm, target.glue, target.imports, ...planned.sources ?? []];
+    const manifests = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      const root = file === void 0 ? void 0 : PACKAGE_ROOT.exec(file)?.[1];
+      if (root !== void 0) manifests.add(`${root}/package.json`);
+    }
+    for (const source of planned.sources ?? []) await this.text(source, caller);
+    for (const manifest of manifests) {
+      if (await this.base.exists(manifest)) await this.text(manifest, caller);
+    }
+  }
+  async text(path, caller) {
+    if (!this.integrity) return this.base.readFile(path);
+    const key = await this.cacheKey(path);
+    return this.cached(this.texts, key, async () => {
+      const { bytes, key: read } = await this.keyed(path, caller);
+      return { value: new TextDecoder().decode(bytes), key: read };
     });
   }
   async names(path, module) {
@@ -16871,23 +17082,23 @@ var Launcher = class {
     const optional = `${root}-names${beside.slice(root.length)}`;
     return await this.base.exists(optional) ? optional : void 0;
   }
-  async program(target, env) {
+  async program(target, env, caller) {
     if (target.abi === "js" && target.wasm === SUDO_PATH) {
       return { abi: "js", glue: SUDO_SOURCE, path: SUDO_PATH };
     }
     if (target.abi === "js") {
-      return { abi: "js", glue: await this.base.readFile(target.wasm), path: target.wasm };
+      return { abi: "js", glue: await this.text(target.wasm, caller), path: target.wasm };
     }
     if (target.abi !== "wasi") {
       const [glue, { module: module2 }] = await Promise.all([
-        this.base.readFile(target.glue),
-        this.module(target.wasm)
+        this.text(target.glue, caller),
+        this.module(target.wasm, caller)
       ]);
       return { glue, module: module2 };
     }
-    const { module, memory, foreign } = await this.module(target.wasm);
+    const { module, memory, foreign } = await this.module(target.wasm, caller);
     const names = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
-    const imports = target.imports ? await this.base.readFile(target.imports) : void 0;
+    const imports = target.imports ? await this.text(target.imports, caller) : void 0;
     return {
       abi: "wasi",
       glue: "",
@@ -16909,7 +17120,9 @@ var Launcher = class {
     env.HOSTNAME = this.hostname;
     let program;
     try {
-      program = await this.program(target, env);
+      const caller = { pid: req.ppid ?? 0, uid: req.cred.euid, tag: req.tag };
+      if (this.integrity) await this.checkedSources(planned, caller);
+      program = await this.program(target, env, caller);
     } catch (err) {
       await req.fds.closeAll();
       throw err;
@@ -17401,11 +17614,14 @@ var Launcher = class {
         }
       };
     }
-    const module = (await scanFilesystems(this.base, await this.roots())).get(type);
+    const module = (await scanFilesystems(this.scanned, await this.roots())).get(type);
     if (!module) throw fsError("ENODEV", `unknown file system type ${type}`);
     if (!this.createDriverWorker)
       throw fsError("ENODEV", `this kernel cannot start ${type} drivers`);
-    const code = await this.base.readFile(module);
+    const root = PACKAGE_ROOT.exec(module)?.[1];
+    if (this.integrity && root !== void 0)
+      await this.text(`${root}/package.json`, KERNEL_CALLER);
+    const code = new TextDecoder().decode(await this.verified(module, KERNEL_CALLER));
     const worker = this.createDriverWorker();
     const driver = new MessageChannel();
     const client = new MessageChannel();
@@ -17976,16 +18192,20 @@ function usersOp(l, req) {
   if (req.op === "groups-remove-member") return l.users.removeMember(req.group, req.user);
   return l.users.list();
 }
-function hostOptions(req, port, sealed, clipboard) {
+function hostOptions(req, port, sealed, clipboard, lookup) {
   return {
     ...req.hostname !== void 0 ? { hostname: req.hostname } : {},
     ...req.users !== void 0 ? { users: req.users } : {},
     ...req.denials ? { onDenial: (denial) => port.postMessage({ denial }) } : {},
-    ...req.protect ? { protect: protectInit(req.protect) } : {},
+    ...req.protect ? { protect: hostProtect(req.protect, lookup) } : {},
     ...req.sealed ? { sealed } : {},
     ...req.clipboard ? { clipboard } : {}
   };
 }
+function hostProtect(init, lookup) {
+  const { integrity, ...rest2 } = protectInit(init);
+  return { ...rest2, ...integrity ? { integrity: { ...integrity, lookup } } : {} };
+}
 function policyAsker(port) {
   const policies = /* @__PURE__ */ new Map();
   let nextPolicy = 0;
@@ -18014,6 +18234,7 @@ function serveKernel(port, deps) {
   const clients = /* @__PURE__ */ new Set();
   const sealed = sealedAsker(port);
   const clipboard = clipboardAsker(port);
+  const integrity = integrityAsker(port);
   const approvals = sudoApprovals(port);
   const locks = deps.locks === null ? void 0 : deps.locks ?? locksOf();
   let holding;
@@ -18080,7 +18301,7 @@ function serveKernel(port, deps) {
         ...deps.createDriverWorker ? { createDriverWorker: deps.createDriverWorker } : {},
         ...req.modules ? { modules: req.modules } : {},
         ...req.env ? { env: req.env } : {},
-        ...hostOptions(req, port, sealed.hook, clipboard.hook),
+        ...hostOptions(req, port, sealed.hook, clipboard.hook, integrity.lookup),
         ...req.approve ? { approve: approvals.ask } : {},
         ...net,
         ...media ? { media } : {},
@@ -18150,6 +18371,8 @@ function serveKernel(port, deps) {
     if (sealedReply) return sealed.answer(sealedReply);
     const clipboardReply = event.data.clipboardReply;
     if (clipboardReply) return clipboard.answer(clipboardReply);
+    const integrityReply = event.data.integrityReply;
+    if (integrityReply) return integrity.answer(integrityReply);
     const grant = event.data.hostfsGrant;
     if (grant) return granted2(grant);
     if (allowed(event.data)) return;