vasilito
0a4a77a56b
The capability bitmask patch was missing the critical proc.rs hunk that
derives caps from euid when procmgr writes ProcSchemeAttrs to a child
context. Without this, all child processes had caps=0, causing
EACCES on dup("create-scheme") and crashing boot.
Fix: in ContextHandle::Attr kwrite path, after setting euid/egid/pid/prio,
set guard.caps = CAP_ALL when euid==0, else 0.
141 lines
5.3 KiB
Diff
141 lines
5.3 KiB
Diff
diff --git a/src/context/context.rs b/src/context/context.rs
|
|
index 6d723f4..836ce25 100644
|
|
--- a/src/context/context.rs
|
|
+++ b/src/context/context.rs
|
|
@@ -153,0 +154,3 @@ pub struct Context {
|
|
+ /// Capability bitmask — derived from euid by procmgr: euid==0 → CAP_ALL, else 0.
|
|
+ pub caps: u64,
|
|
+
|
|
@@ -159,0 +163,6 @@ pub struct Context {
|
|
+impl Context {
|
|
+ pub fn has_cap(&self, cap: u64) -> bool {
|
|
+ self.caps & cap == cap
|
|
+ }
|
|
+}
|
|
+
|
|
@@ -210,0 +220,2 @@ impl Context {
|
|
+ caps: 0,
|
|
+
|
|
@@ -485,0 +497 @@ impl Context {
|
|
+ caps: self.caps,
|
|
diff --git a/src/scheme/acpi.rs b/src/scheme/acpi.rs
|
|
index 5d73469..7e1558a 100644
|
|
--- a/src/scheme/acpi.rs
|
|
+++ b/src/scheme/acpi.rs
|
|
@@ -142 +142 @@ impl KernelScheme for AcpiScheme {
|
|
- if ctx.uid != 0 {
|
|
+ if !ctx.has_cap(crate::scheme::caps::CAP_ACPI) {
|
|
diff --git a/src/scheme/caps.rs b/src/scheme/caps.rs
|
|
new file mode 100644
|
|
index 0000000..6886e88
|
|
--- /dev/null
|
|
+++ b/src/scheme/caps.rs
|
|
@@ -0,0 +1,29 @@
|
|
+//! Kernel capability bitmask for fine-grained privilege control.
|
|
+//!
|
|
+//! Each capability is a single bit in a `u64`. Processes with `euid == 0`
|
|
+//! (via procmgr SetResugid) receive `CAP_ALL`. Non-root processes receive `0`
|
|
+//! by default. Future work: explicit capability assignment via proc scheme.
|
|
+
|
|
+/// Register or unregister kernel schemes.
|
|
+pub const CAP_SCHEME_REGISTER: u64 = 1 << 0;
|
|
+/// Map physical memory (scheme:memory/physical).
|
|
+pub const CAP_PHYS_MEM: u64 = 1 << 1;
|
|
+/// Allocate IRQ vectors (scheme:irq).
|
|
+pub const CAP_IRQ: u64 = 1 << 2;
|
|
+/// Access ACPI tables (scheme:acpi).
|
|
+pub const CAP_ACPI: u64 = 1 << 3;
|
|
+/// Use kernel debugger (scheme:debug).
|
|
+pub const CAP_SYS_DEBUG: u64 = 1 << 4;
|
|
+/// Write to arbitrary files / sys:action (scheme:sys write).
|
|
+pub const CAP_SYS_WRITE: u64 = 1 << 5;
|
|
+/// Read/write model-specific registers (scheme:msr).
|
|
+pub const CAP_SYS_MSR: u64 = 1 << 6;
|
|
+/// Access PS/2 keyboard/mouse (scheme:serio).
|
|
+pub const CAP_SERIO: u64 = 1 << 7;
|
|
+/// Change file ownership (scheme:user chown).
|
|
+pub const CAP_CHOWN: u64 = 1 << 8;
|
|
+/// Modify process attributes: setuid/setgid, ptrace, signal to arbitrary procs.
|
|
+pub const CAP_PROC_ATTR: u64 = 1 << 9;
|
|
+
|
|
+/// All capabilities set — assigned to euid == 0 processes.
|
|
+pub const CAP_ALL: u64 = !0u64;
|
|
diff --git a/src/scheme/debug.rs b/src/scheme/debug.rs
|
|
index 4a23b3c..ae9a96a 100644
|
|
--- a/src/scheme/debug.rs
|
|
+++ b/src/scheme/debug.rs
|
|
@@ -76 +76 @@ impl KernelScheme for DebugScheme {
|
|
- if ctx.uid != 0 {
|
|
+ if !ctx.has_cap(crate::scheme::caps::CAP_SYS_DEBUG) {
|
|
diff --git a/src/scheme/irq.rs b/src/scheme/irq.rs
|
|
index 4222960..bf99a85 100644
|
|
--- a/src/scheme/irq.rs
|
|
+++ b/src/scheme/irq.rs
|
|
@@ -259 +259 @@ impl crate::scheme::KernelScheme for IrqScheme {
|
|
- if ctx.uid != 0 {
|
|
+ if !ctx.has_cap(crate::scheme::caps::CAP_IRQ) {
|
|
diff --git a/src/scheme/memory.rs b/src/scheme/memory.rs
|
|
index c2f9f47..146c461 100644
|
|
--- a/src/scheme/memory.rs
|
|
+++ b/src/scheme/memory.rs
|
|
@@ -235 +235 @@ impl KernelScheme for MemoryScheme {
|
|
- if ctx.uid != 0
|
|
+ if !ctx.has_cap(crate::scheme::caps::CAP_PHYS_MEM)
|
|
diff --git a/src/scheme/mod.rs b/src/scheme/mod.rs
|
|
index 765e547..96826de 100644
|
|
--- a/src/scheme/mod.rs
|
|
+++ b/src/scheme/mod.rs
|
|
@@ -81,0 +82,2 @@ pub mod sys;
|
|
+pub mod caps;
|
|
+
|
|
@@ -356 +358 @@ impl KernelScheme for SchemeList {
|
|
- if caller.uid != 0 {
|
|
+ if !caller.has_cap(caps::CAP_SCHEME_REGISTER) {
|
|
@@ -813,0 +816 @@ pub struct CallerCtx {
|
|
+ pub caps: u64,
|
|
@@ -815,0 +819,3 @@ impl CallerCtx {
|
|
+ pub fn has_cap(&self, cap: u64) -> bool {
|
|
+ self.caps & cap == cap
|
|
+ }
|
|
@@ -822,0 +829 @@ impl CallerCtx {
|
|
+ caps: self.caps,
|
|
diff --git a/src/scheme/serio.rs b/src/scheme/serio.rs
|
|
index 2650502..8e32c98 100644
|
|
--- a/src/scheme/serio.rs
|
|
+++ b/src/scheme/serio.rs
|
|
@@ -82 +82 @@ impl KernelScheme for SerioScheme {
|
|
- if ctx.uid != 0 {
|
|
+ if !ctx.has_cap(crate::scheme::caps::CAP_SERIO) {
|
|
diff --git a/src/scheme/sys/mod.rs b/src/scheme/sys/mod.rs
|
|
index 9eb3564..902ab5a 100644
|
|
--- a/src/scheme/sys/mod.rs
|
|
+++ b/src/scheme/sys/mod.rs
|
|
@@ -144 +144 @@ impl KernelScheme for SysScheme {
|
|
- if ctx.uid != 0 {
|
|
+ if !ctx.has_cap(crate::scheme::caps::CAP_SYS_MSR) {
|
|
@@ -170 +170 @@ impl KernelScheme for SysScheme {
|
|
- if matches!(entry.1, Wr(_)) && ctx.uid != 0 {
|
|
+ if matches!(entry.1, Wr(_)) && !ctx.has_cap(crate::scheme::caps::CAP_SYS_WRITE) {
|
|
diff --git a/src/scheme/user.rs b/src/scheme/user.rs
|
|
index dfbf66b..e215b8d 100644
|
|
--- a/src/scheme/user.rs
|
|
+++ b/src/scheme/user.rs
|
|
@@ -1593 +1593 @@ impl KernelScheme for UserScheme {
|
|
- if cx.euid != 0 && (uid != cx.euid || gid != cx.egid) {
|
|
+ if !cx.has_cap(crate::scheme::caps::CAP_CHOWN) && (uid != cx.euid || gid != cx.egid) {
|
|
diff --git a/src/startup/mod.rs b/src/startup/mod.rs
|
|
index 86aabc2..4af65a3 100644
|
|
--- a/src/startup/mod.rs
|
|
+++ b/src/startup/mod.rs
|
|
@@ -190,0 +191 @@ pub(crate) fn kmain(bootstrap: Bootstrap) -> ! {
|
|
+ context.caps = crate::scheme::caps::CAP_ALL;
|
|
diff --git a/src/scheme/proc.rs b/src/scheme/proc.rs
|
|
--- a/src/scheme/proc.rs
|
|
+++ b/src/scheme/proc.rs
|
|
@@ -1275,0 +1276,5 @@ impl ContextHandle {
|
|
+ guard.caps = if info.euid == 0 {
|
|
+ crate::scheme::caps::CAP_ALL
|
|
+ } else {
|
|
+ 0
|
|
+ };
|