@amritk/nish-x86_64-linux 0.28.0 → 0.30.0

package/runtime/runtime-parallel.c

@@ -41,6 +41,7 @@
 
 #if defined(NISH_THREADS) && !defined(__wasi__) && !defined(__wasm__)
 #define NISH_PAR_REAL 1
+#include <errno.h>
 #include <pthread.h>
 #include <sched.h>
 #ifdef __GLIBC__
@@ -360,6 +361,51 @@ static void *nish_job_thread(void *p) {
   return 0;
 }
 
+/* The end of the program when a thread with the stack a scope asked for
+ * cannot be started: running the task on a smaller one would trade the panic
+ * for an overflow nobody can read. `limit` is pthread's EAGAIN, the system out
+ * of threads or of memory for the stack; anything else is the size refused. */
+__attribute__((noinline, cold)) static void nish_stack_fail(int limit) {
+  static const char size[] = "nish: cannot start a thread with the stack scopeWithStack asked for\n";
+  static const char room[] =
+      "nish: cannot start a thread for scopeWithStack: out of threads or of memory for its stack\n";
+  nish_panic_claim();
+  if (limit)
+    (void)!write(2, room, sizeof room - 1);
+  else
+    (void)!write(2, size, sizeof size - 1);
+  nish_fatal_exit();
+}
+
+/* Runs every job of the list `jobs` on a thread of its own with a stack of
+ * `stack` bytes, as the unpooled path does, and returns once every one has
+ * finished; the calling thread runs none of them, since its own stack is the
+ * one that was too small. The size is rounded up to the page and to the
+ * platform's minimum, a page is added for what the C library keeps at the top
+ * of a thread's stack, and a guard page sits below it, so a task that
+ * overflows faults. A job runs at depth 1, as on a worker, so anything it
+ * divides runs inline. Out of line and cold, so `nish_scope_join` keeps the
+ * body it had before the option, plus one load and a branch. */
+__attribute__((noinline, cold)) static void nish_jobs_run_sized(nish_job *jobs, int64_t stack) {
+  long sys = sysconf(_SC_PAGESIZE);
+  size_t page = sys > 0 ? (size_t)sys : 4096;
+  size_t size = ((size_t)stack + page - 1) / page * page;
+  /* sysconf, not PTHREAD_STACK_MIN: a strict -std=c11 build hides the macro. */
+  long min = sysconf(_SC_THREAD_STACK_MIN);
+  if (min > 0 && size < (size_t)min) size = (size_t)min;
+  pthread_attr_t attr;
+  int rc = pthread_attr_init(&attr);
+  if (rc != 0) nish_stack_fail(rc == EAGAIN || rc == ENOMEM);
+  if (pthread_attr_setguardsize(&attr, page) != 0 || pthread_attr_setstacksize(&attr, size + page) != 0)
+    nish_stack_fail(0);
+  for (nish_job *j = jobs; j; j = j->next) {
+    rc = pthread_create(&j->th, &attr, nish_job_thread, j);
+    if (rc != 0) nish_stack_fail(rc == EAGAIN);
+  }
+  pthread_attr_destroy(&attr);
+  for (nish_job *j = jobs; j; j = j->next) pthread_join(j->th, 0);
+}
+
 /* Runs `lead` on this thread and the list `rest` elsewhere, oldest first, and
  * returns once every one of them has finished. The caller runs `lead` itself,
  * so N jobs keep N-1 other threads busy and this one is not idle, and then
@@ -608,11 +654,20 @@ void nish_scope_join(void *scope) {
   }
   if (!mine) return;
 #ifdef NISH_PAR_REAL
-  /* The first task on this thread and the rest on the pool, in the order they
-   * were spawned, which is the order a task no worker is free for runs in here,
-   * and the order every task runs in when the scope is joined inside another
-   * job (`nish_jobs_run`). */
-  nish_jobs_run(&mine->job, mine->job.next);
+  /* The stack `scopeWithStack` asked for, `ThreadScope`'s first and only field
+   * (std/threads.ts), or 0 for `scope()`. A scope with one runs every task on
+   * a thread of its own that has it; the checker refuses a scope inside a
+   * task, so this thread is never one of those. */
+  int32_t stack = *(const int32_t *)scope;
+  if (__builtin_expect(stack > 0, 0)) {
+    nish_jobs_run_sized(&mine->job, stack);
+  } else {
+    /* The first task on this thread and the rest on the pool, in the order
+     * they were spawned, which is the order a task no worker is free for runs
+     * in here, and the order every task runs in when the scope is joined
+     * inside another job (`nish_jobs_run`). */
+    nish_jobs_run(&mine->job, mine->job.next);
+  }
 #else
   for (nish_task *t = mine; t; t = t->next) t->run(t->payload);
 #endif

package/runtime/runtime-region.c

@@ -0,0 +1,231 @@
+/* Nish runtime, the region half: arenas a program makes, enters, leaves and
+ * frees one at a time, so a long-running program can give back the memory of
+ * one session, one cache entry or one connection without a garbage collector
+ * (docs/wp46-long-running-memory.md, section 2.1, "Runtime and ABI").
+ *
+ * A translation unit of its own, paired with runtime.c in scripts/build.sh's
+ * `halves` and src/run-cache.ts's `runtimeUnits()` like the others, so it has
+ * its own measured `.text*` ceiling in tests/runtime-budgets.js and a program
+ * that never makes a region links none of it. The wasm profile has no malloc
+ * to give a region its chunks, so `scripts/build.sh --profile wasm` refuses IR
+ * that names `@nish_region_`; the wasi profile links this file.
+ *
+ * **A handle is a number.** `nish_region_new` answers an `i64`: the slot's
+ * index in the low 24 bits and the slot's generation in the 40 above them.
+ * Generations start at 1, so 0 -- what a fresh `Region<T>[]` holds -- is never
+ * a handle. `nish_region_free` moves the slot's generation on, so a copy of a
+ * freed handle is stale; a slot whose generation would pass 40 bits is
+ * retired rather than reused, so no handle ever names a slot twice. Every
+ * call that takes a handle checks it first and panics on a zero handle, a
+ * stale one, and one made on another thread. The 24-bit index caps a process
+ * at 16,777,216 live regions; `nish_region_new` past that panics.
+ *
+ * **The table** is one per process: a directory of pages, each page 1,024
+ * slots allocated (zeroed) the first time a slot in it is handed out, so a
+ * program that makes ten regions holds one page. Taking a slot and giving one
+ * back take the table's lock, once per `new` and once per `free`; `enter` and
+ * `leave` take none, because a slot is only ever entered by the thread that
+ * made it and the check reads the two fields another thread's `free` could
+ * write (generation and thread) with atomic loads. Only a threads build
+ * (`-DNISH_THREADS`) has a second thread to lock against, so only it pays for
+ * the lock.
+ *
+ * **Entering swaps arenas.** A slot holds a whole `struct nish_arena`.
+ * `nish_region_enter` swaps it with the thread's `nish_arena`, so every
+ * allocation the program makes until `nish_region_leave` -- the inlined bump
+ * as well as the runtime's own -- lands in the region; `leave` swaps them
+ * back. While a region is entered its slot holds the arena it displaced, so
+ * entering a second region inside the first nests: each leave restores what
+ * its enter took. A slot that is entered cannot be entered again (it would
+ * swap its own arena with itself) or freed, and `leave` must name the region
+ * entered last on this thread.
+ *
+ * **Chunk size.** A thread's own arena grows by 64 KiB chunks, which is right
+ * for one arena a thread and wrong for a hundred thousand of them. A region's
+ * first chunk is the size of its first allocation, and each later chunk
+ * doubles, or takes the allocation's own size when that is more. The size of
+ * the next chunk is runtime.c's thread-local `nish_region_chunk`, which
+ * `nish_arena_grow` reads on its slow path and which `enter` and `leave` swap
+ * with the slot's as they swap the arena; 0 there means the thread's own
+ * arena and the 64 KiB floor. A region starts it at 8, the smallest block.
+ *
+ * **The root.** `Region<T>` is only the number, so the slot keeps the root
+ * object `region`'s function answered: `nish_region_leave` records it and
+ * `nish_region_enter` answers it.
+ *
+ * Freeing a region frees its chunks through runtime.c's `nish_free_arena`,
+ * with the region's arena swapped in for the call, so an `-DNISH_ASAN` build
+ * forgets the freed blocks as it does for the thread's arena. */
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#include "nish.h"
+
+#define NISH_COLD __attribute__((noreturn, cold, noinline))
+
+/* runtime.c's: the size of the next chunk `nish_arena_grow` makes for the
+   arena in `nish_arena`, or 0 for a thread's own, which takes 64 KiB. */
+extern NISH_TLS uint64_t nish_region_chunk;
+
+#define NISH_REGION_SLOT_BITS 24
+#define NISH_REGION_SLOTS ((uint64_t)1 << NISH_REGION_SLOT_BITS)
+#define NISH_REGION_GEN_END ((uint64_t)1 << 40)
+#define NISH_REGION_PAGE 1024
+
+typedef struct nish_region_slot {
+  struct nish_arena arena; /* the region's arena, or, while entered, the one it displaced */
+  uint64_t gen;            /* the live handle's generation; NISH_REGION_GEN_END once retired */
+  uint64_t thread;         /* the thread that made it, 0 while the slot is free */
+  uint64_t chunk;          /* the region's next chunk size, or, while entered, the displaced one */
+  uint64_t outer;          /* while entered: the handle entered before it; while free: the next free slot + 1 */
+  void *root;              /* what `leave` recorded, answered by `enter` */
+  uint64_t entered;
+} nish_region_slot;
+
+static nish_region_slot *nish_region_pages[NISH_REGION_SLOTS / NISH_REGION_PAGE];
+static uint64_t nish_region_used; /* slots ever handed out: the next never-used index */
+static uint64_t nish_region_free_list; /* a free slot's index + 1, or 0 */
+/* The handle entered last on this thread, or 0. */
+static NISH_TLS uint64_t nish_region_current;
+
+#ifdef NISH_THREADS
+static int nish_region_lock_word;
+static uint64_t nish_region_threads;
+static NISH_TLS uint64_t nish_region_thread_id;
+static void nish_region_lock(void) {
+  while (__atomic_exchange_n(&nish_region_lock_word, 1, __ATOMIC_ACQUIRE))
+    while (__atomic_load_n(&nish_region_lock_word, __ATOMIC_RELAXED)) {}
+}
+static void nish_region_unlock(void) { __atomic_store_n(&nish_region_lock_word, 0, __ATOMIC_RELEASE); }
+/* A number no other thread of the process has: 64 bits, so it never wraps
+   back onto a live thread's. */
+static uint64_t nish_region_me(void) {
+  if (!nish_region_thread_id) nish_region_thread_id = __atomic_add_fetch(&nish_region_threads, 1, __ATOMIC_RELAXED);
+  return nish_region_thread_id;
+}
+#else
+static void nish_region_lock(void) {}
+static void nish_region_unlock(void) {}
+static uint64_t nish_region_me(void) { return 1; }
+#endif
+
+/* The panics, by number: one cold function and one table, rather than a
+   message's address loaded at each call site. Each ends in `nish_panic`, so
+   only the first panic of a process prints and atexit handlers run. */
+enum {
+  NISH_REGION_ZERO,
+  NISH_REGION_STALE,
+  NISH_REGION_THREAD,
+  NISH_REGION_ENTERED,
+  NISH_REGION_FREE_ENTERED,
+  NISH_REGION_LEAVE,
+  NISH_REGION_FULL,
+  NISH_REGION_OOM,
+};
+#define NISH_REGION_MSG(text) { sizeof text - 1, text }
+static const struct { uint64_t len; char data[72]; } nish_region_messages[] = {
+  NISH_REGION_MSG("nish: a zero region handle: no region was made for it"),
+  NISH_REGION_MSG("nish: a stale region handle: the region was freed"),
+  NISH_REGION_MSG("nish: a region handle made on another thread"),
+  NISH_REGION_MSG("nish: enter of a region that is already entered"),
+  NISH_REGION_MSG("nish: free of a region that is entered"),
+  NISH_REGION_MSG("nish: leave of a region that is not the one entered last"),
+  NISH_REGION_MSG("nish: more than 16777216 live regions"),
+  NISH_REGION_MSG("nish: out of memory"),
+};
+static NISH_COLD void nish_region_die(int why) {
+  nish_panic((const nish_str *)&nish_region_messages[why]);
+}
+
+/* The slot `r` names, or a panic: zero, stale, another thread's. */
+static nish_region_slot *nish_region_slot_of(uint64_t r) {
+  if (!r) nish_region_die(NISH_REGION_ZERO);
+  uint64_t index = r & (NISH_REGION_SLOTS - 1);
+  nish_region_slot *page = __atomic_load_n(&nish_region_pages[index / NISH_REGION_PAGE], __ATOMIC_ACQUIRE);
+  if (!page) nish_region_die(NISH_REGION_STALE);
+  nish_region_slot *s = &page[index % NISH_REGION_PAGE];
+  uint64_t thread = __atomic_load_n(&s->thread, __ATOMIC_RELAXED);
+  if (!thread || __atomic_load_n(&s->gen, __ATOMIC_RELAXED) != r >> NISH_REGION_SLOT_BITS)
+    nish_region_die(NISH_REGION_STALE);
+  if (thread != nish_region_me()) nish_region_die(NISH_REGION_THREAD);
+  return s;
+}
+
+/* Swap the slot's arena and chunk size with the thread's: `enter` and `leave`
+   both, and `free` around its `nish_free_arena`. */
+static void nish_region_swap(nish_region_slot *s) {
+  struct nish_arena a = nish_arena;
+  nish_arena = s->arena;
+  s->arena = a;
+  uint64_t c = nish_region_chunk;
+  nish_region_chunk = s->chunk;
+  s->chunk = c;
+}
+
+uint64_t nish_region_new(void) {
+  uint64_t me = nish_region_me();
+  nish_region_lock();
+  uint64_t index;
+  nish_region_slot *s;
+  if (nish_region_free_list) {
+    index = nish_region_free_list - 1;
+    s = &nish_region_pages[index / NISH_REGION_PAGE][index % NISH_REGION_PAGE];
+    nish_region_free_list = s->outer;
+  } else {
+    if (nish_region_used == NISH_REGION_SLOTS) nish_region_die(NISH_REGION_FULL);
+    index = nish_region_used++;
+    nish_region_slot **page = &nish_region_pages[index / NISH_REGION_PAGE];
+    if (!*page) {
+      nish_region_slot *p = calloc(NISH_REGION_PAGE, sizeof *p);
+      if (!p) nish_region_die(NISH_REGION_OOM);
+      __atomic_store_n(page, p, __ATOMIC_RELEASE);
+    }
+    s = &(*page)[index % NISH_REGION_PAGE];
+    __atomic_store_n(&s->gen, 1, __ATOMIC_RELAXED);
+  }
+  s->chunk = 8;
+  s->outer = 0;
+  __atomic_store_n(&s->thread, me, __ATOMIC_RELAXED);
+  uint64_t r = s->gen << NISH_REGION_SLOT_BITS | index;
+  nish_region_unlock();
+  return r;
+}
+
+void *nish_region_enter(uint64_t r) {
+  nish_region_slot *s = nish_region_slot_of(r);
+  if (s->entered) nish_region_die(NISH_REGION_ENTERED);
+  s->entered = 1;
+  s->outer = nish_region_current;
+  nish_region_current = r;
+  nish_region_swap(s);
+  return s->root;
+}
+
+void nish_region_leave(uint64_t r, void *root) {
+  nish_region_slot *s = nish_region_slot_of(r);
+  if (nish_region_current != r) nish_region_die(NISH_REGION_LEAVE);
+  nish_region_swap(s);
+  nish_region_current = s->outer;
+  s->entered = 0;
+  s->root = root;
+}
+
+void nish_region_free(uint64_t r) {
+  nish_region_slot *s = nish_region_slot_of(r);
+  if (s->entered) nish_region_die(NISH_REGION_FREE_ENTERED);
+  nish_region_swap(s);
+  nish_free_arena();
+  nish_region_swap(s);
+  s->root = 0;
+  uint64_t index = r & (NISH_REGION_SLOTS - 1);
+  nish_region_lock();
+  __atomic_store_n(&s->thread, 0, __ATOMIC_RELAXED);
+  uint64_t gen = s->gen + 1;
+  __atomic_store_n(&s->gen, gen, __ATOMIC_RELAXED);
+  if (gen < NISH_REGION_GEN_END) {
+    s->outer = nish_region_free_list;
+    nish_region_free_list = index + 1;
+  }
+  nish_region_unlock();
+}

package/runtime/runtime-sandbox.c

@@ -12,7 +12,7 @@
  * before any constructor in the executable, an `ffi` object or a shared
  * library:
  *
- *   nish_sandbox(caps, mode, read_dirs, write_dirs)
+ *   nish_sandbox(caps, mode, read_dirs, write_dirs, exec_paths)
  *
  * `caps` is `main`'s capability mask (src/capabilities.ts numbers the bits),
  * `mode` is 1 for `--sandbox` and 2 for `--sandbox=best-effort`. The two
@@ -20,6 +20,9 @@
  * scopes, each a run of NUL-terminated absolute paths ended by an empty one,
  * or null when the capability is granted whole or not at all; a list moves
  * its capability's rights from the rule on `/` to one rule per directory.
+ * `exec_paths` is the programs a dependency's `process.spawn=<program>`
+ * grants name (WP40 §2a), and their interpreters, in the same shape: with
+ * it, `EXECUTE` leaves the rule on `/` and each program gets a rule of its own.
  *
  * What it does, in the order of the note's section 3, each step before the
  * next because each needs the one before it:
@@ -169,27 +172,28 @@ static const uint16_t nish_sb_uring[] = {425, 426, 427}; /* io_uring_setup, _ent
 /* Set by step 6 and read by `nish_sandbox_check`. */
 static int nish_sb_applied = 0;
 
-/* The errno names a failure prints; a number for any other. */
+/* The errno a failure prints, as the line's parenthesized tail: its name, or
+ * its number for any other. */
 static const char *nish_sb_errno_name(int e, char *buf) {
   switch (e) {
-  case EPERM: return "EPERM";
-  case ENOSYS: return "ENOSYS";
-  case EOPNOTSUPP: return "EOPNOTSUPP";
-  case EINVAL: return "EINVAL";
-  case EACCES: return "EACCES";
-  case ENOENT: return "ENOENT";
-  case EFAULT: return "EFAULT";
-  case E2BIG: return "E2BIG";
-  case ENOMEM: return "ENOMEM";
-  case EBUSY: return "EBUSY";
+  case EPERM: return " (EPERM)";
+  case ENOSYS: return " (ENOSYS)";
+  case EOPNOTSUPP: return " (EOPNOTSUPP)";
+  case EINVAL: return " (EINVAL)";
+  case EACCES: return " (EACCES)";
+  case ENOENT: return " (ENOENT)";
+  case EFAULT: return " (EFAULT)";
+  case E2BIG: return " (E2BIG)";
+  case ENOMEM: return " (ENOMEM)";
+  case EBUSY: return " (EBUSY)";
   }
   char digits[12];
   int n = 0;
   unsigned u = (unsigned)e;
   do digits[n++] = (char)('0' + u % 10); while ((u /= 10) != 0 && n < 11);
-  memcpy(buf, "errno ", 6);
-  for (int i = 0; i < n; i++) buf[6 + i] = digits[n - 1 - i];
-  buf[6 + n] = 0;
+  memcpy(buf, " (errno ", 8);
+  for (int i = 0; i < n; i++) buf[8 + i] = digits[n - 1 - i];
+  memcpy(buf + 8 + n, ")", 2);
   return buf;
 }
 
@@ -205,12 +209,7 @@ static void nish_sb_say(const char *a, const char *b, const char *c) {
  * named after `what`. */
 static void nish_sb_fail_at(const char *what, const char *path) {
   char buf[24];
-  char tail[40] = " (";
-  const char *name = nish_sb_errno_name(errno, buf);
-  size_t len = strlen(name);
-  memcpy(tail + 2, name, len);
-  memcpy(tail + 2 + len, ")", 2);
-  nish_sb_say(what, path, tail);
+  nish_sb_say(what, path, nish_sb_errno_name(errno, buf));
   _exit(126);
 }
 
@@ -279,15 +278,19 @@ static size_t nish_sb_name(char *line, size_t at, const char *name) {
   return at + len;
 }
 
-/* One path_beneath rule granting `rights` beneath `path`. A rule granting
+/* One path_beneath rule granting `rights` beneath `path`, opened with
+ * `oflag` added: O_DIRECTORY for a scope directory, which refuses anything
+ * else, and 0 for a program the exec allowlist names, which O_PATH opens as
+ * a file. The failure lines name a directory either way, a program's too,
+ * because a second wording costs this unit's budget more than it says. A rule granting
  * nothing is refused (ENOMSG), and nothing is what it would add, so it is
  * left out. A scope directory gone since the build refuses strict; under
  * best-effort it is named and its rule left out, which withholds the right
  * there too, so the program loses the directory rather than gaining more. */
-static void nish_sb_rule(int ruleset, const char *path, uint64_t rights, int32_t mode) {
+static void nish_sb_rule(int ruleset, const char *path, uint64_t rights, int32_t mode, int oflag) {
   struct nish_ll_path_beneath rule = {rights, -1};
   if (!rights) return;
-  rule.parent_fd = open(path, O_PATH | O_CLOEXEC | O_DIRECTORY);
+  rule.parent_fd = open(path, O_PATH | O_CLOEXEC | oflag);
   if (rule.parent_fd < 0) {
     if (mode != 2) nish_sb_fail_at("cannot open the directory ", path);
     nish_sb_say("the scope directory ", path, " cannot be opened, so the program gets no access beneath it");
@@ -297,9 +300,10 @@ static void nish_sb_rule(int ruleset, const char *path, uint64_t rights, int32_t
   close(rule.parent_fd);
 }
 
-/* One rule per directory of a scope list, each granting `rights`. */
-static void nish_sb_scope(int ruleset, const char *dirs, uint64_t rights, int32_t mode) {
-  for (; dirs && *dirs; dirs += strlen(dirs) + 1) nish_sb_rule(ruleset, dirs, rights, mode);
+/* One rule per path of a scope list, each granting `rights` and opened with
+ * `oflag` as `nish_sb_rule` says. */
+static void nish_sb_scope(int ruleset, const char *dirs, uint64_t rights, int32_t mode, int oflag) {
+  for (; dirs && *dirs; dirs += strlen(dirs) + 1) nish_sb_rule(ruleset, dirs, rights, mode, oflag);
 }
 
 /* Step 4. Every right the ABI knows is handled, and one path_beneath rule on
@@ -307,7 +311,7 @@ static void nish_sb_scope(int ruleset, const char *dirs, uint64_t rights, int32_
  * everywhere or nowhere; a scoped capability's rights are granted beneath its
  * directories alone. Returns with nothing done when there is no Landlock and
  * the mode is best-effort. */
-static void nish_sb_landlock(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs) {
+static void nish_sb_landlock(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs, const char *exec_paths) {
   int abi = nish_sb_landlock_abi();
   if (abi < 0) {
     /* EPERM is a container runtime's own seccomp profile refusing the call;
@@ -331,6 +335,9 @@ static void nish_sb_landlock(int32_t caps, int32_t mode, const char *read_dirs,
   if (read_dirs) whole &= ~CAP_BIT_FS_READ;
   if (write_dirs) whole &= ~CAP_BIT_FS_WRITE;
   uint64_t granted = nish_sb_granted(whole);
+  /* An exec allowlist (a dependency's process.spawn grant, WP40 §2a) keeps
+   * EXECUTE off `/` and grants it on each listed file alone. */
+  if (exec_paths) granted &= ~LL_EXECUTE;
   uint64_t lost = ~granted & ~known & (LL_TRUNCATE | LL_IOCTL_DEV);
   int unscoped = abi < 6;
   /* Strict runs without IOCTL_DEV and without the ABI 6 scopes: a terminal
@@ -352,9 +359,10 @@ static void nish_sb_landlock(int32_t caps, int32_t mode, const char *read_dirs,
   struct nish_ll_ruleset attr = {known, 0, abi >= 6 ? LL_SCOPE_ALL : 0};
   int ruleset = (int)syscall(LL_CREATE, &attr, sizeof attr, 0);
   if (ruleset < 0) nish_sb_fail("cannot create the Landlock ruleset");
-  nish_sb_rule(ruleset, "/", granted & known, 1);
-  if (read_dirs && (caps & CAP_BIT_FS_READ)) nish_sb_scope(ruleset, read_dirs, nish_sb_granted(CAP_BIT_FS_READ) & known, mode);
-  if (write_dirs && (caps & CAP_BIT_FS_WRITE)) nish_sb_scope(ruleset, write_dirs, nish_sb_granted(CAP_BIT_FS_WRITE) & known, mode);
+  nish_sb_rule(ruleset, "/", granted & known, 1, O_DIRECTORY);
+  if (read_dirs && (caps & CAP_BIT_FS_READ)) nish_sb_scope(ruleset, read_dirs, nish_sb_granted(CAP_BIT_FS_READ) & known, mode, O_DIRECTORY);
+  if (write_dirs && (caps & CAP_BIT_FS_WRITE)) nish_sb_scope(ruleset, write_dirs, nish_sb_granted(CAP_BIT_FS_WRITE) & known, mode, O_DIRECTORY);
+  if (caps & CAP_BIT_SPAWN) nish_sb_scope(ruleset, exec_paths, LL_EXECUTE, mode, 0);
   if (syscall(LL_RESTRICT, ruleset, 0) != 0) nish_sb_fail("cannot apply the Landlock ruleset");
   close(ruleset);
 }
@@ -428,11 +436,11 @@ static void nish_sb_seccomp(int32_t caps) {
   if (loaded != 0) nish_sb_fail("cannot load the seccomp filter");
 }
 
-void nish_sandbox(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs) {
+void nish_sandbox(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs, const char *exec_paths) {
   nish_cpu_prime();
   if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) nish_sb_fail("cannot set no_new_privs");
   nish_sb_drop_capabilities();
-  nish_sb_landlock(caps, mode, read_dirs, write_dirs);
+  nish_sb_landlock(caps, mode, read_dirs, write_dirs, exec_paths);
   /* Metadata writes stay EPERM inside a scoped write directory (open
    * question 1): Landlock has no right for chmod, chown or xattrs. */
   nish_sb_seccomp(write_dirs ? caps & ~CAP_BIT_FS_WRITE : caps);
@@ -457,11 +465,12 @@ static void nish_sb_none(void) {
   _exit(126);
 }
 
-void nish_sandbox(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs) {
+void nish_sandbox(int32_t caps, int32_t mode, const char *read_dirs, const char *write_dirs, const char *exec_paths) {
   (void)caps;
   (void)mode;
   (void)read_dirs;
   (void)write_dirs;
+  (void)exec_paths;
   nish_sb_none();
 }