P7 login diagnostics, P11 init noise reduction, config layering fix

config/redbear-mini.toml

@@ -144,6 +144,7 @@ type = "oneshot_async"
 
 [[files]]
 path = "/etc/issue"
+postinstall = true
 data = """
  ____          _ ____                     ___  ____
 |  _ \\ ___  __| | __ )  ___  __ _ _ __   / _ \\/ ___|
@@ -159,6 +160,7 @@ data = """
 
 [[files]]
 path = "/etc/motd"
+postinstall = true
 data = """
  ____          _ ____                     ___  ____
 |  _ \\ ___  __| | __ )  ___  __ _ _ __   / _ \\/ ___|

local/patches/base/P11-init-noise-reduction.patch

@@ -0,0 +1,13 @@
+diff --git a/init/src/main.rs b/init/src/main.rs
+index e7f6712f..6b9da2b2 100644
+--- a/init/src/main.rs
++++ b/init/src/main.rs
+@@ -169,0 +170 @@ fn main() {
++            if init_config.log_debug {
+@@ -171 +172,2 @@ fn main() {
+-                init_warn(&format!("rootfs-file: {}", name));
++                    init_debug(&format!("rootfs-file: {}", name));
++                }
+@@ -180 +182 @@ fn main() {
+-        init_warn(&format!(
++        init_debug(&format!(

local/patches/bootloader/P7-redbear-branding.patch

@@ -0,0 +1,7 @@
+diff --git a/src/main.rs b/src/main.rs
+index be5f3b7..531b167 100644
+--- a/src/main.rs
++++ b/src/main.rs
+@@ -514 +514 @@ fn main(os: &impl Os) -> (usize, u64, KernelArgs) {
+-        "Redox OS Bootloader {} on {}",
++        "RedBear OS Bootloader {} on {}",

local/patches/userutils/P7-login-diagnostics.patch

@@ -0,0 +1,46 @@
+diff --git a/src/bin/login.rs b/src/bin/login.rs
+index 6e1fda6..e0878c9 100644
+--- a/src/bin/login.rs
++++ b/src/bin/login.rs
+@@ -193,2 +193,7 @@ pub fn main() {
+-                        let before_ns_fd =
+-                            apply_login_schemes(user, &DEFAULT_SCHEMES).unwrap_or_exit(1);
++                        let before_ns_fd = match apply_login_schemes(user, &DEFAULT_SCHEMES) {
++                            Ok(fd) => fd,
++                            Err(err) => {
++                                eprintln!("login: apply_login_schemes failed: {}", err);
++                                std::process::exit(1);
++                            }
++                        };
+@@ -201,2 +206,8 @@ pub fn main() {
+-                        drop_privileges(user).unwrap_or_exit(1);
+-                        spawn_shell(user).unwrap_or_exit(1);
++                        if let Err(err) = drop_privileges(user) {
++                            eprintln!("login: drop_privileges failed: {}", err);
++                            std::process::exit(1);
++                        }
++                        if let Err(err) = spawn_shell(user) {
++                            eprintln!("login: spawn_shell failed: {}", err);
++                            std::process::exit(1);
++                        }
+@@ -225,2 +236,7 @@ pub fn main() {
+-                            let before_ns_fd =
+-                                apply_login_schemes(user, &DEFAULT_SCHEMES).unwrap_or_exit(1);
++                            let before_ns_fd = match apply_login_schemes(user, &DEFAULT_SCHEMES) {
++                                Ok(fd) => fd,
++                                Err(err) => {
++                                    eprintln!("login: apply_login_schemes failed: {}", err);
++                                    std::process::exit(1);
++                                }
++                            };
+@@ -233,2 +249,8 @@ pub fn main() {
+-                            drop_privileges(user).unwrap_or_exit(1);
+-                            spawn_shell(user).unwrap_or_exit(1);
++                            if let Err(err) = drop_privileges(user) {
++                                eprintln!("login: drop_privileges failed: {}", err);
++                                std::process::exit(1);
++                            }
++                            if let Err(err) = spawn_shell(user) {
++                                eprintln!("login: spawn_shell failed: {}", err);
++                                std::process::exit(1);
++                            }

local/recipes/branding/redbear-release/source/motd

@@ -1,12 +1,10 @@
- 
-     _       _                         
-    | |     (_)                        
-    | | ___  _  ___   _ __  _   _ ___ 
-    | |/ / || |/ _ \ | '_ \| | | / __|
-    |   < | || | (_) || |_) | |_| \__ \
-    |_|\_\|_|/ |\___/ | .__/ \__,_|___/
-           |__/       | |              
-                       |_|             
 
-   Red Bear OS v0.2.0 "Liliya" — Built on Redox OS
+    ____          _ ____                     ___  ____
+   |  _ \ ___  __| | __ )  ___  __ _ _ __   / _ \/ ___|
+   | |_) / _ \ / _` |  _ \ / _ \/ _` | '__| | | | \___ \
+   |  _ <  __/ (_| | |_) |  __/ (_| | |    | |_| |___) |
+   |_| \_\___|\__,_|____/ \___|\__,_|_|     \___/|____/
+
+              v0.2.2 "Liliya" — Built on Redox OS
+
    Type 'help' for available commands.

local/recipes/branding/redbear-release/source/os-release

@@ -1,7 +1,7 @@
-PRETTY_NAME="Red Bear OS 0.2.0 (Liliya)"
+PRETTY_NAME="Red Bear OS 0.2.2 (Liliya)"
 NAME="Red Bear OS"
-VERSION_ID="0.2.0"
+VERSION_ID="0.2.2"
-VERSION="0.2.0 (Liliya)"
+VERSION="0.2.2 (Liliya)"
 VERSION_CODENAME="liliya"
 ID="redbear-os"
 ID_LIKE="redox-os"

recipes/core/base/recipe.toml

@@ -4,6 +4,7 @@ rev = "463f76b9608a896e6f6c9f63457f57f6409873c7"
 patches = [
     "redox.patch",
     "P10-rootfs-uuid-search-no-block.patch",
+    "P11-init-noise-reduction.patch",
 ]
 
 [package]

recipes/core/bootloader/recipe.toml

@@ -1,6 +1,6 @@
 [source]
 git = "https://gitlab.redox-os.org/redox-os/bootloader.git"
-patches = ["redox.patch", "fix-uefi-alloc-panic.patch", "P0-gpt-partition-offset.patch", "P5-live-preload-cap-128mib.patch", "P6-full-ramdisk-preload.patch"]
+patches = ["redox.patch", "fix-uefi-alloc-panic.patch", "P0-gpt-partition-offset.patch", "P5-live-preload-cap-128mib.patch", "P6-full-ramdisk-preload.patch", "P7-redbear-branding.patch"]
 
 [build]
 template = "custom"

recipes/core/kernel/source/src/context/context.rs

@@ -147,17 +147,25 @@ pub struct Context {
     // TODO: Temporary replacement for existing kernel logic, replace with capabilities!
     pub euid: u32,
     pub egid: u32,
-    pub caps: u64,
     pub pid: usize,
     /// Supplementary group IDs for access control decisions.
     pub groups: Vec<u32>,
 
+    /// Capability bitmask — derived from euid by procmgr: euid==0 → CAP_ALL, else 0.
+    pub caps: u64,
+
     // See [`PreemptGuard`]
     //
     // When > 0, preemption is disabled.
     pub(super) preempt_locks: usize,
 }
 
+impl Context {
+    pub fn has_cap(&self, cap: u64) -> bool {
+        self.caps & cap == cap
+    }
+}
+
 #[derive(Debug)]
 pub struct SignalState {
     /// Offset to jump to when a signal is received.
@@ -206,10 +214,11 @@ impl Context {
 
             euid: 0,
             egid: 0,
-            caps: crate::scheme::caps::CAP_ALL,
             pid: 0,
             groups: Vec::new(),
 
+            caps: 0,
+
             #[cfg(feature = "syscall_debug")]
             syscall_debug_info: crate::syscall::debug::SyscallDebugInfo::default(),
 
@@ -479,9 +488,6 @@ impl Context {
 
         (for_thread, for_proc, sig)
     }
-    pub fn has_cap(&self, cap: u64) -> bool {
-        self.caps & cap != 0
-    }
     pub fn caller_ctx(&self) -> CallerCtx {
         CallerCtx {
             uid: self.euid,

recipes/core/kernel/source/src/scheme/acpi.rs

@@ -13,7 +13,6 @@ use crate::{
     arch::sleep,
     context::file::InternalFlags,
     event,
-    scheme::caps,
     sync::{CleanLockToken, RwLock, WaitCondition, L1},
 };
 
@@ -140,7 +139,7 @@ impl KernelScheme for AcpiScheme {
             .or(Err(Error::new(EINVAL)))?
             .trim_start_matches('/');
 
-        if !ctx.has_cap(caps::CAP_ACPI) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_ACPI) {
             return Err(Error::new(EACCES));
         }
         if flags & O_CREAT == O_CREAT {

recipes/core/kernel/source/src/scheme/caps.rs

@@ -1,11 +1,29 @@
+//! Kernel capability bitmask for fine-grained privilege control.
+//!
+//! Each capability is a single bit in a `u64`. Processes with `euid == 0`
+//! (via procmgr SetResugid) receive `CAP_ALL`. Non-root processes receive `0`
+//! by default. Future work: explicit capability assignment via proc scheme.
+
+/// Register or unregister kernel schemes.
 pub const CAP_SCHEME_REGISTER: u64 = 1 << 0;
+/// Map physical memory (scheme:memory/physical).
 pub const CAP_PHYS_MEM: u64 = 1 << 1;
+/// Allocate IRQ vectors (scheme:irq).
 pub const CAP_IRQ: u64 = 1 << 2;
+/// Access ACPI tables (scheme:acpi).
 pub const CAP_ACPI: u64 = 1 << 3;
+/// Use kernel debugger (scheme:debug).
 pub const CAP_SYS_DEBUG: u64 = 1 << 4;
+/// Write to arbitrary files / sys:action (scheme:sys write).
 pub const CAP_SYS_WRITE: u64 = 1 << 5;
+/// Read/write model-specific registers (scheme:msr).
 pub const CAP_SYS_MSR: u64 = 1 << 6;
+/// Access PS/2 keyboard/mouse (scheme:serio).
 pub const CAP_SERIO: u64 = 1 << 7;
+/// Change file ownership (scheme:user chown).
 pub const CAP_CHOWN: u64 = 1 << 8;
+/// Modify process attributes: setuid/setgid, ptrace, signal to arbitrary procs.
 pub const CAP_PROC_ATTR: u64 = 1 << 9;
+
+/// All capabilities set — assigned to euid == 0 processes.
 pub const CAP_ALL: u64 = !0u64;

recipes/core/kernel/source/src/scheme/debug.rs

@@ -73,7 +73,7 @@ impl KernelScheme for DebugScheme {
         }
 
         let path = user_buf.as_str().or(Err(Error::new(EINVAL)))?;
-        if !ctx.has_cap(caps::CAP_SYS_DEBUG) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_SYS_DEBUG) {
             return Err(Error::new(EPERM));
         }
 

recipes/core/kernel/source/src/scheme/irq.rs

@@ -18,7 +18,6 @@ use syscall::{
 use crate::context::file::InternalFlags;
 
 use super::{CallerCtx, HandleMap, OpenResult, SchemeExt, StrOrBytes};
-use super::caps;
 #[cfg(any(target_arch = "x86_64", target_arch = "x86"))]
 use crate::arch::device::{ioapic, local_apic::ApicId};
 
@@ -257,7 +256,7 @@ impl crate::scheme::KernelScheme for IrqScheme {
         }
 
         let path = user_buf.as_str().or(Err(Error::new(EINVAL)))?;
-        if !ctx.has_cap(caps::CAP_IRQ) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_IRQ) {
             return Err(Error::new(EACCES));
         }
 

recipes/core/kernel/source/src/scheme/memory.rs

@@ -9,7 +9,6 @@ use crate::{
         memory::{handle_notify_files, AddrSpace, AddrSpaceWrapper, Grant, PageSpan},
     },
     memory::{free_frames, used_frames, Frame, VirtualAddress, PAGE_SIZE},
-    scheme::caps,
     sync::CleanLockToken,
     syscall::{
         data::{Map, StatVfs},
@@ -233,7 +232,7 @@ impl KernelScheme for MemoryScheme {
             .ok_or(Error::new(ENOENT))?;
 
         // TODO: Support arches with other default memory types?
-        if !ctx.has_cap(caps::CAP_PHYS_MEM)
+        if !ctx.has_cap(crate::scheme::caps::CAP_PHYS_MEM)
             && (!flags.is_empty()
                 || !matches!(
                     (handle_ty, mem_ty),

recipes/core/kernel/source/src/scheme/mod.rs

@@ -51,7 +51,6 @@ use self::{
 };
 
 /// When compiled with the "acpi" feature - `acpi:` - allows drivers to read a limited set of ACPI tables.
-pub mod caps;
 pub mod acpi;
 
 pub mod dtb;
@@ -80,6 +79,8 @@ pub mod serio;
 /// `sys:` - system information, such as the context list and scheme list
 pub mod sys;
 
+pub mod caps;
+
 /// `time:` - allows reading time, setting timeouts and getting events when they are met
 pub mod time;
 
@@ -816,7 +817,7 @@ pub struct CallerCtx {
 }
 impl CallerCtx {
     pub fn has_cap(&self, cap: u64) -> bool {
-        self.caps & cap != 0
+        self.caps & cap == cap
     }
     pub fn filter_uid_gid(self, euid: u32, egid: u32) -> Self {
         if self.uid == 0 && self.gid == 0 {

recipes/core/kernel/source/src/scheme/proc.rs

@@ -1273,7 +1273,11 @@ impl ContextHandle {
                 guard.pid = info.pid as usize;
                 guard.euid = info.euid;
                 guard.egid = info.egid;
-                guard.caps = if info.euid == 0 { crate::scheme::caps::CAP_ALL } else { 0 };
+                guard.caps = if info.euid == 0 {
+                    crate::scheme::caps::CAP_ALL
+                } else {
+                    0
+                };
                 guard.prio = (info.prio as usize).min(39);
                 Ok(size_of::<ProcSchemeAttrs>())
             }

recipes/core/kernel/source/src/scheme/serio.rs

@@ -79,7 +79,7 @@ impl KernelScheme for SerioScheme {
         }
 
         let path = user_buf.as_str().or(Err(Error::new(EINVAL)))?;
-        if !ctx.has_cap(caps::CAP_SERIO) {
+        if !ctx.has_cap(crate::scheme::caps::CAP_SERIO) {
             return Err(Error::new(EPERM));
         }
 

recipes/core/kernel/source/src/scheme/sys/mod.rs

@@ -24,7 +24,6 @@ use crate::{
 };
 
 use super::{CallerCtx, HandleMap, KernelScheme, OpenResult, StrOrBytes};
-use super::caps;
 
 mod block;
 mod context;
@@ -142,7 +141,7 @@ impl KernelScheme for SysScheme {
         } else if path.starts_with("msr/") {
             #[cfg(any(target_arch = "x86", target_arch = "x86_64"))]
             {
-                if !ctx.has_cap(caps::CAP_SYS_MSR) {
+                if !ctx.has_cap(crate::scheme::caps::CAP_SYS_MSR) {
                     return Err(Error::new(EPERM));
                 }
                 let rest = &path[4..];
@@ -168,7 +167,7 @@ impl KernelScheme for SysScheme {
                 .find(|(entry_path, _)| *entry_path == path)
                 .ok_or(Error::new(ENOENT))?;
 
-            if matches!(entry.1, Wr(_)) && !ctx.has_cap(caps::CAP_SYS_WRITE) {
+            if matches!(entry.1, Wr(_)) && !ctx.has_cap(crate::scheme::caps::CAP_SYS_WRITE) {
                 return Err(Error::new(EPERM));
             }
 

recipes/core/kernel/source/src/scheme/user.rs

@@ -26,7 +26,7 @@ use crate::{
     },
     event,
     memory::{Frame, Page, VirtualAddress, PAGE_SIZE},
-    scheme::{caps, SchemeId},
+    scheme::SchemeId,
     sync::{CleanLockToken, LockToken, Mutex, RwLock, WaitQueue, L1},
     syscall::{
         data::{Map, StdFsCallMeta},
@@ -1590,7 +1590,7 @@ impl KernelScheme for UserScheme {
         {
             let ctx = context::current();
             let cx = &ctx.read(token.token());
-            if !cx.has_cap(caps::CAP_CHOWN) && (uid != cx.euid || gid != cx.egid) {
+            if !cx.has_cap(crate::scheme::caps::CAP_CHOWN) && (uid != cx.euid || gid != cx.egid) {
                 return Err(Error::new(EPERM));
             }
         }

recipes/core/userutils/recipe.toml

@@ -1,6 +1,6 @@
 [source]
 git = "https://gitlab.redox-os.org/redox-os/userutils.git"
-patches = ["P5-redbear-branding.patch", "P6-login-privilege-drop.patch"]
+patches = ["P5-redbear-branding.patch", "P6-login-privilege-drop.patch", "P7-login-diagnostics.patch"]
 
 [build]
 template = "custom"