feat(storage): scoped grants (subtree, ro/rw), narrow-only, release revokes all holders; IPC KEEP_DELEGATE opt-in; shell cd/pwd, programs get ro cwd

crates/kernel/src/syscall/ipc/endpoint.rs

@@ -38,23 +38,23 @@ impl<P: Platform> Kernel<P> {
     pub(super) fn transfer_cap(
         &mut self,
         from: ProcessId,
-        slot: Option<CapSlot>,
+        message: &Message,
         grant: bool,
         to: ProcessId,
     ) -> Option<CapSlot> {
-        let slot = slot?;
+        let slot = message.cap()?;
         if !grant {
             return None;
         }
         // The receiver gets the capability but not the right to pass it
-        // on; a sender that wants that uses Delegate with explicit rights.
+        // on, unless the sender says so; it can only give what it holds.
         let source = self.check_cap(from, slot, Permission::Delegate).ok()?;
-        let copy = Capability::new(
-            *source.resource(),
-            source.permissions().without(Permission::Delegate),
-            *source.generation(),
-        )
-        .with_badge(source.badge());
+        let permissions = match message.keeps_delegate() {
+            true => *source.permissions(),
+            false => source.permissions().without(Permission::Delegate),
+        };
+        let copy = Capability::new(*source.resource(), permissions, *source.generation())
+            .with_badge(source.badge());
         let parent = self.cap_ref(from, slot);
         self.insert_derived(to, copy, parent).ok()
     }
@@ -71,7 +71,7 @@ impl<P: Platform> Kernel<P> {
         let from = self.thread_process(sender);
         let to = self.thread_process(receiver);
         let cap = match (from, to) {
-            (Some(from), Some(to)) => self.transfer_cap(from, out.message.cap(), out.grant, to),
+            (Some(from), Some(to)) => self.transfer_cap(from, &out.message, out.grant, to),
             _ => None,
         };
         if kind == DeliveryKind::Call {
@@ -234,7 +234,7 @@ impl<P: Platform> Kernel<P> {
         }
         let to = self.thread_process(caller.tid);
         // A reply may always carry a capability the server can delegate.
-        let cap = to.and_then(|to| self.transfer_cap(pid, message.cap(), true, to));
+        let cap = to.and_then(|to| self.transfer_cap(pid, &message, true, to));
         let delivery = Delivery {
             kind: DeliveryKind::Message,
             badge: 0,