P7 login diagnostics, P11 init noise reduction, config layering fix

recipes/core/kernel/source/src/context/context.rs

@@ -147,17 +147,25 @@ pub struct Context {
     // TODO: Temporary replacement for existing kernel logic, replace with capabilities!
     pub euid: u32,
     pub egid: u32,
-    pub caps: u64,
     pub pid: usize,
     /// Supplementary group IDs for access control decisions.
     pub groups: Vec<u32>,
 
+    /// Capability bitmask — derived from euid by procmgr: euid==0 → CAP_ALL, else 0.
+    pub caps: u64,
+
     // See [`PreemptGuard`]
     //
     // When > 0, preemption is disabled.
     pub(super) preempt_locks: usize,
 }
 
+impl Context {
+    pub fn has_cap(&self, cap: u64) -> bool {
+        self.caps & cap == cap
+    }
+}
+
 #[derive(Debug)]
 pub struct SignalState {
     /// Offset to jump to when a signal is received.
@@ -206,10 +214,11 @@ impl Context {
 
             euid: 0,
             egid: 0,
-            caps: crate::scheme::caps::CAP_ALL,
             pid: 0,
             groups: Vec::new(),
 
+            caps: 0,
+
             #[cfg(feature = "syscall_debug")]
             syscall_debug_info: crate::syscall::debug::SyscallDebugInfo::default(),
 
@@ -479,9 +488,6 @@ impl Context {
 
         (for_thread, for_proc, sig)
     }
-    pub fn has_cap(&self, cap: u64) -> bool {
-        self.caps & cap != 0
-    }
     pub fn caller_ctx(&self) -> CallerCtx {
         CallerCtx {
             uid: self.euid,

recipes/core/kernel/source/src/scheme/acpi.rs

@@ -13,7 +13,6 @@ use crate::{
     arch::sleep,
     context::file::InternalFlags,
     event,
-    scheme::caps,
     sync::{CleanLockToken, RwLock, WaitCondition, L1},
 };
 
@@ -140,7 +139,7 @@ impl KernelScheme for AcpiScheme {
             .or(Err(Error::new(EINVAL)))?
             .trim_start_matches('/');
 
-        if !ctx.has_cap(caps::CAP_ACPI) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_ACPI) {
             return Err(Error::new(EACCES));
         }
         if flags & O_CREAT == O_CREAT {

recipes/core/kernel/source/src/scheme/caps.rs

@@ -1,11 +1,29 @@
+//! Kernel capability bitmask for fine-grained privilege control.
+//!
+//! Each capability is a single bit in a `u64`. Processes with `euid == 0`
+//! (via procmgr SetResugid) receive `CAP_ALL`. Non-root processes receive `0`
+//! by default. Future work: explicit capability assignment via proc scheme.
+
+/// Register or unregister kernel schemes.
 pub const CAP_SCHEME_REGISTER: u64 = 1 << 0;
+/// Map physical memory (scheme:memory/physical).
 pub const CAP_PHYS_MEM: u64 = 1 << 1;
+/// Allocate IRQ vectors (scheme:irq).
 pub const CAP_IRQ: u64 = 1 << 2;
+/// Access ACPI tables (scheme:acpi).
 pub const CAP_ACPI: u64 = 1 << 3;
+/// Use kernel debugger (scheme:debug).
 pub const CAP_SYS_DEBUG: u64 = 1 << 4;
+/// Write to arbitrary files / sys:action (scheme:sys write).
 pub const CAP_SYS_WRITE: u64 = 1 << 5;
+/// Read/write model-specific registers (scheme:msr).
 pub const CAP_SYS_MSR: u64 = 1 << 6;
+/// Access PS/2 keyboard/mouse (scheme:serio).
 pub const CAP_SERIO: u64 = 1 << 7;
+/// Change file ownership (scheme:user chown).
 pub const CAP_CHOWN: u64 = 1 << 8;
+/// Modify process attributes: setuid/setgid, ptrace, signal to arbitrary procs.
 pub const CAP_PROC_ATTR: u64 = 1 << 9;
+
+/// All capabilities set — assigned to euid == 0 processes.
 pub const CAP_ALL: u64 = !0u64;

recipes/core/kernel/source/src/scheme/debug.rs

@@ -73,7 +73,7 @@ impl KernelScheme for DebugScheme {
         }
 
         let path = user_buf.as_str().or(Err(Error::new(EINVAL)))?;
-        if !ctx.has_cap(caps::CAP_SYS_DEBUG) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_SYS_DEBUG) {
             return Err(Error::new(EPERM));
         }
 

recipes/core/kernel/source/src/scheme/irq.rs

@@ -18,7 +18,6 @@ use syscall::{
 use crate::context::file::InternalFlags;
 
 use super::{CallerCtx, HandleMap, OpenResult, SchemeExt, StrOrBytes};
-use super::caps;
 #[cfg(any(target_arch = "x86_64", target_arch = "x86"))]
 use crate::arch::device::{ioapic, local_apic::ApicId};
 
@@ -257,7 +256,7 @@ impl crate::scheme::KernelScheme for IrqScheme {
         }
 
         let path = user_buf.as_str().or(Err(Error::new(EINVAL)))?;
-        if !ctx.has_cap(caps::CAP_IRQ) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_IRQ) {
             return Err(Error::new(EACCES));
         }
 

recipes/core/kernel/source/src/scheme/memory.rs

@@ -9,7 +9,6 @@ use crate::{
         memory::{handle_notify_files, AddrSpace, AddrSpaceWrapper, Grant, PageSpan},
     },
     memory::{free_frames, used_frames, Frame, VirtualAddress, PAGE_SIZE},
-    scheme::caps,
     sync::CleanLockToken,
     syscall::{
         data::{Map, StatVfs},
@@ -233,7 +232,7 @@ impl KernelScheme for MemoryScheme {
             .ok_or(Error::new(ENOENT))?;
 
         // TODO: Support arches with other default memory types?
-        if !ctx.has_cap(caps::CAP_PHYS_MEM)
+        if !ctx.has_cap(crate::scheme::caps::CAP_PHYS_MEM)
             && (!flags.is_empty()
                 || !matches!(
                     (handle_ty, mem_ty),

recipes/core/kernel/source/src/scheme/mod.rs

@@ -51,7 +51,6 @@ use self::{
 };
 
 /// When compiled with the "acpi" feature - `acpi:` - allows drivers to read a limited set of ACPI tables.
-pub mod caps;
 pub mod acpi;
 
 pub mod dtb;
@@ -80,6 +79,8 @@ pub mod serio;
 /// `sys:` - system information, such as the context list and scheme list
 pub mod sys;
 
+pub mod caps;
+
 /// `time:` - allows reading time, setting timeouts and getting events when they are met
 pub mod time;
 
@@ -816,7 +817,7 @@ pub struct CallerCtx {
 }
 impl CallerCtx {
     pub fn has_cap(&self, cap: u64) -> bool {
-        self.caps & cap != 0
+        self.caps & cap == cap
     }
     pub fn filter_uid_gid(self, euid: u32, egid: u32) -> Self {
         if self.uid == 0 && self.gid == 0 {

recipes/core/kernel/source/src/scheme/proc.rs

@@ -1273,7 +1273,11 @@ impl ContextHandle {
                 guard.pid = info.pid as usize;
                 guard.euid = info.euid;
                 guard.egid = info.egid;
-                guard.caps = if info.euid == 0 { crate::scheme::caps::CAP_ALL } else { 0 };
+                guard.caps = if info.euid == 0 {
+                    crate::scheme::caps::CAP_ALL
+                } else {
+                    0
+                };
                 guard.prio = (info.prio as usize).min(39);
                 Ok(size_of::<ProcSchemeAttrs>())
             }

recipes/core/kernel/source/src/scheme/serio.rs

@@ -79,7 +79,7 @@ impl KernelScheme for SerioScheme {
         }
 
         let path = user_buf.as_str().or(Err(Error::new(EINVAL)))?;
-        if !ctx.has_cap(caps::CAP_SERIO) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_SERIO) {
             return Err(Error::new(EPERM));
         }
 

recipes/core/kernel/source/src/scheme/sys/mod.rs

@@ -24,7 +24,6 @@ use crate::{
 };
 
 use super::{CallerCtx, HandleMap, KernelScheme, OpenResult, StrOrBytes};
-use super::caps;
 
 mod block;
 mod context;
@@ -142,7 +141,7 @@ impl KernelScheme for SysScheme {
         } else if path.starts_with("msr/") {
             #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
             {
-                if !ctx.has_cap(caps::CAP_SYS_MSR) {
+                if !ctx.has_cap(crate::scheme::caps::CAP_SYS_MSR) {
                     return Err(Error::new(EPERM));
                 }
                 let rest = &path[4..];
@@ -168,7 +167,7 @@ impl KernelScheme for SysScheme {
                 .find(|(entry_path, _)| *entry_path == path)
                 .ok_or(Error::new(ENOENT))?;
 
-            if matches!(entry.1, Wr(_)) && !ctx.has_cap(caps::CAP_SYS_WRITE) {
+            if matches!(entry.1, Wr(_)) && !ctx.has_cap(crate::scheme::caps::CAP_SYS_WRITE) {
                 return Err(Error::new(EPERM));
             }
 

recipes/core/kernel/source/src/scheme/user.rs

@@ -26,7 +26,7 @@ use crate::{
     },
     event,
     memory::{Frame, Page, VirtualAddress, PAGE_SIZE},
-    scheme::{caps, SchemeId},
+    scheme::SchemeId,
     sync::{CleanLockToken, LockToken, Mutex, RwLock, WaitQueue, L1},
     syscall::{
         data::{Map, StdFsCallMeta},
@@ -1590,7 +1590,7 @@ impl KernelScheme for UserScheme {
         {
             let ctx = context::current();
             let cx = &ctx.read(token.token());
-            if !cx.has_cap(caps::CAP_CHOWN) && (uid != cx.euid || gid != cx.egid) {
+            if !cx.has_cap(crate::scheme::caps::CAP_CHOWN) && (uid != cx.euid || gid != cx.egid) {
                 return Err(Error::new(EPERM));
             }
         }