feat(apps): permission manager equips apps (manifest+consent+decisions in /system), launches via init w/ file grant; shell unprivileged (/home); install/apps/allow/revoke; revoke stops running app; app-image tool; counter app

crates/servers/permission-manager/src/store.rs

@@ -0,0 +1,196 @@
+//! The `Store` port on the storage server: apps in `/apps/<id>/`, their
+//! data in `/data/<id>/`, the owner's decisions in `/system/permissions/`.
+
+use libkos::fs::Storage;
+use manifest::{AppId, Decision, MAX_DECISION_TEXT, Manifest};
+use types::address::VirtualAddress;
+use types::bounded::CapSlot;
+
+use crate::policy::{MAX_MANIFEST, Store};
+
+const APPS: &str = "apps";
+const DATA: &str = "data";
+const DECISIONS: &str = "system/permissions";
+const MANIFEST: &str = "manifest.toml";
+/// Apps `find` looks through.
+pub const MAX_APPS: usize = 32;
+const LONGEST_PATH: usize = 160;
+const COPY_CHUNK: usize = 4096;
+
+/// `parts` joined with `/`, in `buf`.
+fn path<'a>(buf: &'a mut [u8; LONGEST_PATH], parts: &[&str]) -> Option<&'a [u8]> {
+    let mut len = 0;
+    for (i, p) in parts.iter().enumerate() {
+        let sep = usize::from(i > 0);
+        let end = len + sep + p.len();
+        let room = buf.get_mut(len..end)?;
+        room[..sep].copy_from_slice(&b"/"[..sep]);
+        room[sep..].copy_from_slice(p.as_bytes());
+        len = end;
+    }
+    Some(&buf[..len])
+}
+
+/// All of the file at `path` into `buf`, as text.
+fn read_text<'a>(fs: &mut Storage, path: &[u8], buf: &'a mut [u8]) -> Option<&'a str> {
+    let h = fs.open(path).ok()?;
+    let size = fs.file_size(h).ok().filter(|s| *s <= buf.len());
+    let read = size.and_then(|s| fs.read(h, &mut buf[..s]).ok());
+    let _ = fs.close(h);
+    let n = read.filter(|r| Some(*r) == size)?;
+    core::str::from_utf8(&buf[..n]).ok()
+}
+
+/// Copies the file at `from` (in `src`) to `to` (in `dst`), replacing
+/// what an earlier, failed attempt left there.
+fn copy(src: &mut Storage, from: &[u8], dst: &mut Storage, to: &[u8]) -> bool {
+    let Ok(input) = src.open(from) else { return false };
+    let _ = dst.delete(to);
+    let Ok(output) = dst.create(to) else {
+        let _ = src.close(input);
+        return false;
+    };
+    let mut chunk = [0u8; COPY_CHUNK];
+    let ok = loop {
+        match src.read(input, &mut chunk) {
+            Ok(0) => break true,
+            Ok(n) if dst.write(output, &chunk[..n]) == Ok(n) => {}
+            _ => break false,
+        }
+    };
+    let _ = src.close(input);
+    let _ = dst.close(output);
+    ok
+}
+
+pub struct DiskStore {
+    fs: Storage,
+    /// Where an offered app folder's grant is mapped while it is read.
+    source_va: VirtualAddress,
+}
+
+impl DiskStore {
+    pub fn new(fs: Storage, source_va: VirtualAddress) -> Self {
+        Self { fs, source_va }
+    }
+
+    /// Storage itself, for grants on the app's behalf.
+    pub fn storage(&mut self) -> &mut Storage {
+        &mut self.fs
+    }
+
+    /// The ids of the installed apps (folder names in `/apps`).
+    pub fn ids(&mut self, mut each: impl FnMut(AppId)) {
+        let _ = self.fs.list_dir(APPS.as_bytes(), |e| {
+            if let Some(id) = core::str::from_utf8(e.name()).ok().and_then(AppId::new) {
+                each(id);
+            }
+        });
+    }
+
+    fn with_source<T>(&self, source: CapSlot, f: impl FnOnce(&mut Storage) -> T) -> Option<T> {
+        let mut src = Storage::attach(source, self.source_va).ok()?;
+        let out = f(&mut src);
+        src.detach();
+        Some(out)
+    }
+}
+
+impl Store for DiskStore {
+    /// A read-only storage grant to the offered app's folder.
+    type Source = CapSlot;
+
+    fn source_manifest<'a>(&mut self, source: &CapSlot, buf: &'a mut [u8]) -> Option<&'a str> {
+        let mut text = [0u8; MAX_MANIFEST];
+        let n = self.with_source(*source, |src| read_text(src, MANIFEST.as_bytes(), &mut text).map(str::len))??;
+        buf.get_mut(..n)?.copy_from_slice(&text[..n]);
+        core::str::from_utf8(&buf[..n]).ok()
+    }
+
+    fn is_installed(&mut self, id: &AppId) -> bool {
+        let mut p = [0u8; LONGEST_PATH];
+        let Some(p) = path(&mut p, &[APPS, id.as_str(), MANIFEST]) else { return false };
+        self.fs.open(p).and_then(|h| self.fs.close(h)).is_ok()
+    }
+
+    fn install(&mut self, source: &CapSlot, app: &Manifest, data_folder: bool) -> bool {
+        let id = app.id.as_str();
+        let (mut folder, mut to_manifest, mut to_binary) = ([0u8; LONGEST_PATH], [0u8; LONGEST_PATH], [0u8; LONGEST_PATH]);
+        let (Some(folder), Some(to_manifest), Some(to_binary)) = (
+            path(&mut folder, &[APPS, id]),
+            path(&mut to_manifest, &[APPS, id, MANIFEST]),
+            path(&mut to_binary, &[APPS, id, app.binary.as_str()]),
+        ) else {
+            return false;
+        };
+        // There already if an earlier attempt failed part way; an app
+        // counts as installed only once its manifest is in.
+        let _ = self.fs.mkdir(folder);
+        let fs = &mut self.fs;
+        let copied = Storage::attach(*source, self.source_va).ok().map(|mut src| {
+            // The binary first: an app folder with a manifest is installed.
+            let ok = copy(&mut src, app.binary.as_str().as_bytes(), fs, to_binary)
+                && copy(&mut src, MANIFEST.as_bytes(), fs, to_manifest);
+            src.detach();
+            ok
+        });
+        if copied != Some(true) {
+            return false;
+        }
+        let mut data = [0u8; LONGEST_PATH];
+        // Kept from an earlier install if there is one: the app's data.
+        !data_folder || path(&mut data, &[DATA, id]).is_some_and(|d| self.fs.mkdir(d).is_ok() || self.fs.list_dir(d, |_| {}).is_ok())
+    }
+
+    fn manifest(&mut self, id: &AppId) -> Option<Manifest> {
+        let mut p = [0u8; LONGEST_PATH];
+        let p = path(&mut p, &[APPS, id.as_str(), MANIFEST])?;
+        let mut text = [0u8; MAX_MANIFEST];
+        let m = Manifest::parse(read_text(&mut self.fs, p, &mut text)?).ok()?;
+        // A manifest in the wrong folder is no app.
+        (m.id == *id).then_some(m)
+    }
+
+    fn find(&mut self, command: &str) -> Option<AppId> {
+        let mut ids = [None; MAX_APPS];
+        let mut n = 0;
+        self.ids(|id| {
+            if let Some(slot) = ids.get_mut(n) {
+                *slot = Some(id);
+                n += 1;
+            }
+        });
+        ids.into_iter().flatten().find(|id| self.manifest(id).is_some_and(|m| m.command.as_str() == command))
+    }
+
+    fn decision(&mut self, id: &AppId) -> Option<Decision> {
+        let mut p = [0u8; LONGEST_PATH];
+        let p = path(&mut p, &[DECISIONS, id.as_str()])?;
+        let mut text = [0u8; MAX_DECISION_TEXT];
+        Decision::parse(read_text(&mut self.fs, p, &mut text)?).ok()
+    }
+
+    fn record(&mut self, id: &AppId, decision: &Decision) -> bool {
+        let mut p = [0u8; LONGEST_PATH];
+        let Some(p) = path(&mut p, &[DECISIONS, id.as_str()]) else { return false };
+        let mut text = [0u8; MAX_DECISION_TEXT];
+        let n = decision.write(&mut text);
+        // Replaced whole: there is no truncate.
+        let _ = self.fs.delete(p);
+        let Ok(h) = self.fs.create(p) else { return false };
+        let written = self.fs.write(h, &text[..n]) == Ok(n);
+        let _ = self.fs.close(h);
+        written
+    }
+}
+
+/// The path of app `id`'s binary and its data folder, for grants.
+pub fn binary_path<'a>(buf: &'a mut [u8; LONGEST_PATH], app: &Manifest) -> Option<&'a [u8]> {
+    path(buf, &[APPS, app.id.as_str(), app.binary.as_str()])
+}
+
+pub fn data_path<'a>(buf: &'a mut [u8; LONGEST_PATH], id: &AppId) -> Option<&'a [u8]> {
+    path(buf, &[DATA, id.as_str()])
+}
+
+pub const PATH_BUF: usize = LONGEST_PATH;