GKaszewski/k-os
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(users): per-user sealed folders users/<id>/{home,apps,data,permissions}; storage SET_USER/LOCK/PURGE; init sign-in/sign-out loop (purge fresh/removed/guest, seed from factory, session start/stop); shell logout; pm user+system app shelves; terminal SIGNED_OUT; per-program stack (gatekeeper 12p); 128K load scratch

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-28 01:08:50 +01:00
parent 29a25bd8c2
commit 91f7d28834
38 changed files with 1156 additions and 378 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
crates/servers/gatekeeper/src/flow.rs
View File

@@ -94,16 +94,21 @@ pub struct Unlocked {
pub removed: [Option<UserId>; SLOTS],
}
// Each step keeps its records and buffers (KiBs) to itself: inlined into
// `run` together they would overflow the 16 KiB stack init gives a program.
/// The keystore's newest record, and where the next write goes.
#[inline(never)]
fn load(ks: &mut impl Keystore) -> Result<(Option<Record>, usize), Failure> {
let (mut a, mut b) = ([0u8; RECORD_SIZE], [0u8; RECORD_SIZE]);
let (mut a, mut b) = (alloc::boxed::Box::new([0u8; RECORD_SIZE]), alloc::boxed::Box::new([0u8; RECORD_SIZE]));
if !ks.read(0, &mut a) || !ks.read(1, &mut b) {
return Err(Failure::Device);
}
let copies = Copies { copies: [&a, &b] };
let copies = Copies { copies: [&a[..], &b[..]] };
Ok((copies.newest().map(|(r, _)| r), copies.next_copy()))
}
#[inline(never)]
fn store(ks: &mut impl Keystore, copy: usize, r: &Record) -> Result<(), Failure> {
if ks.write(copy, &r.encode()) { Ok(()) } else { Err(Failure::Device) }
}
@@ -117,6 +122,7 @@ fn save(ks: &mut impl Keystore, r: &Record) -> Result<(), Failure> {
/// Destroys every slot and the directory: noise over both copies, twice,
/// then blank (the device then looks never set up). Marked as wiping
/// first, so a power cut part way is finished on the next boot.
#[inline(never)]
fn wipe(ks: &mut impl Keystore, record: &Record, next: usize, rng: &mut impl Random) -> Result<(), Failure> {
let first = record.wiping(rng).ok_or(Failure::Random)?;
let second = first.wiping(rng).ok_or(Failure::Random)?;
@@ -175,6 +181,7 @@ fn ask_passcodes(prompt: &mut impl Prompt, real: &mut Secret, duress: &mut Secre
}
/// A device never set up (or wiped): its first user, an owner.
#[inline(never)]
fn setup(ks: &mut impl Keystore, rng: &mut impl Random, prompt: &mut impl Prompt, params: KdfParams, memory: &mut [Block]) -> Result<Unlocked, Failure> {
// After a wipe nothing earlier may show: it must look like a new device.
prompt.clear();
@@ -190,6 +197,7 @@ fn setup(ks: &mut impl Keystore, rng: &mut impl Random, prompt: &mut impl Prompt
}
/// What the owner may change at the lock screen, after signing in.
#[inline(never)]
fn manage(ks: &mut impl Keystore, rng: &mut impl Random, prompt: &mut impl Prompt, memory: &mut [Block], session: &Session, removed: &mut [Option<UserId>; SLOTS]) -> Result<(), Failure> {
loop {
let (Some(record), _) = load(ks)? else { return Err(Failure::Device) };

14
crates/servers/permission-manager/src/lib.rs
View File

@@ -22,18 +22,20 @@ use types::address::VirtualAddress;
use types::bounded::CapSlot;
/// Where init's manifest put them: its own endpoint, then `uses`, then
/// storage, then the spawn endpoint.
/// storage (the user's folder, the system's apps), then the spawn endpoint.
const EP: CapSlot = CapSlot::const_new(0);
const TERMINAL: CapSlot = CapSlot::const_new(1);
const DISPLAY: CapSlot = CapSlot::const_new(2);
const STORAGE: CapSlot = CapSlot::const_new(3);
const INIT: CapSlot = CapSlot::const_new(4);
const USER: CapSlot = CapSlot::const_new(3);
const SYSTEM: CapSlot = CapSlot::const_new(4);
const INIT: CapSlot = CapSlot::const_new(5);
const STORAGE_BUF_VA: VirtualAddress = VirtualAddress::from_raw(0x0180_0000);
const USER_BUF_VA: VirtualAddress = VirtualAddress::from_raw(0x0180_0000);
const SOURCE_BUF_VA: VirtualAddress = VirtualAddress::from_raw(0x0190_0000);
const SYSTEM_BUF_VA: VirtualAddress = VirtualAddress::from_raw(0x01B0_0000);
pub fn run() -> ! {
let Ok(fs) = Storage::attach(STORAGE, STORAGE_BUF_VA) else {
let (Ok(user), Ok(system)) = (Storage::attach(USER, USER_BUF_VA), Storage::attach(SYSTEM, SYSTEM_BUF_VA)) else {
libkos::println!("permission: no storage, exiting");
syscall::exit();
};
@@ -41,7 +43,7 @@ pub fn run() -> ! {
libkos::println!("permission: no notification, exiting");
syscall::exit();
};
let store = store::DiskStore::new(fs, SOURCE_BUF_VA);
let store = store::DiskStore::new(user, system, SOURCE_BUF_VA);
let consent = consent::TerminalConsent { terminal: TERMINAL };
let mut srv = server::PermissionServer::new(store, consent, INIT, Some(DISPLAY), deaths);
libkos::println!("permission: serving");

8
crates/servers/permission-manager/src/server.rs
View File

@@ -19,7 +19,7 @@ use types::start_arg::StartArg;
use crate::consent::{CapabilityNames, TerminalConsent, version};
use crate::policy::{self, Refusal, Store};
use crate::store::{self, DiskStore, PATH_BUF};
use crate::store::DiskStore;
/// What each app gets to run in, out of the permission manager's allowance.
const PROGRAM: Limits = Limits { pages: 128, endpoints: 1, notifications: 1, regions: 1 };
@@ -164,9 +164,7 @@ impl PermissionServer {
let plan = policy::plan_launch(&mut self.store, command, available).map_err(refused)?;
let index = self.running.iter().position(Option::is_none).ok_or(code(reply::BUSY))?;
let mut p = [0u8; PATH_BUF];
let binary = store::binary_path(&mut p, &plan.app).ok_or(code(reply::FAILED))?;
let file = self.store.storage().grant(binary, false).map_err(|_| code(reply::FAILED))?;
let file = self.store.binary_grant(&plan.app).ok_or(code(reply::FAILED))?;
let spawned = libkos::spawn::spawn(self.init, file, PROGRAM);
let _ = libkos::fs::release(file);
let child = spawned.map_err(|e| match e {
@@ -176,7 +174,7 @@ impl PermissionServer {
let call = PermissionSet::empty().with(Permission::Execute);
let data = match plan.granted.contains(Capability::Storage) {
true => store::data_path(&mut p, &plan.app.id).and_then(|d| self.store.storage().grant(d, true).ok()),
true => self.store.data_grant(&plan.app.id),
false => None,
};
let staged = (badge == self.staged.badge).then_some(&self.staged);

115
crates/servers/permission-manager/src/store.rs
View File

@@ -1,5 +1,7 @@
//! The `Store` port on the storage server: apps in `/apps/<id>/`, their
//! data in `/data/<id>/`, the owner's decisions in `/system/permissions/`.
//! The `Store` port on the storage server, through two grants: the
//! signed-in user's folder (their apps in `apps/<id>/`, each app's data in
//! `data/<id>/`, their decisions in `permissions/`) and, read-only, the
//! system image's apps (`/apps/<id>/`), which every user shares.
use libkos::fs::Storage;
use manifest::{AppId, Decision, MAX_DECISION_TEXT, Manifest};
@@ -10,18 +12,18 @@ use crate::policy::{MAX_MANIFEST, Store};
const APPS: &str = "apps";
const DATA: &str = "data";
const DECISIONS: &str = "system/permissions";
const DECISIONS: &str = "permissions";
const MANIFEST: &str = "manifest.toml";
/// Apps `find` looks through.
pub const MAX_APPS: usize = 32;
const LONGEST_PATH: usize = 160;
const COPY_CHUNK: usize = 4096;
/// `parts` joined with `/`, in `buf`.
/// `parts` (the empty ones skipped) joined with `/`, in `buf`.
fn path<'a>(buf: &'a mut [u8; LONGEST_PATH], parts: &[&str]) -> Option<&'a [u8]> {
let mut len = 0;
for (i, p) in parts.iter().enumerate() {
let sep = usize::from(i > 0);
for p in parts.iter().filter(|p| !p.is_empty()) {
let sep = usize::from(len > 0);
let end = len + sep + p.len();
let room = buf.get_mut(len..end)?;
room[..sep].copy_from_slice(&b"/"[..sep]);
@@ -63,29 +65,69 @@ fn copy(src: &mut Storage, from: &[u8], dst: &mut Storage, to: &[u8]) -> bool {
ok
}
/// Where an app is installed: on the system image, or by the user.
#[derive(Clone, Copy, PartialEq, Eq)]
enum Shelf {
System,
User,
}
pub struct DiskStore {
fs: Storage,
/// The signed-in user's folder.
user: Storage,
/// The system image's apps, read-only.
system: Storage,
/// Where an offered app folder's grant is mapped while it is read.
source_va: VirtualAddress,
}
impl DiskStore {
pub fn new(fs: Storage, source_va: VirtualAddress) -> Self {
Self { fs, source_va }
pub fn new(user: Storage, system: Storage, source_va: VirtualAddress) -> Self {
Self { user, system, source_va }
}
/// Storage itself, for grants on the app's behalf.
pub fn storage(&mut self) -> &mut Storage {
&mut self.fs
/// The storage holding `shelf`, and its apps' folder in it.
fn on(&mut self, shelf: Shelf) -> (&mut Storage, &'static str) {
match shelf {
Shelf::System => (&mut self.system, ""),
Shelf::User => (&mut self.user, APPS),
}
}
/// The ids of the installed apps (folder names in `/apps`).
/// The ids of the installed apps (folder names), the system's first.
pub fn ids(&mut self, mut each: impl FnMut(AppId)) {
let _ = self.fs.list_dir(APPS.as_bytes(), |e| {
if let Some(id) = core::str::from_utf8(e.name()).ok().and_then(AppId::new) {
each(id);
}
});
for shelf in [Shelf::System, Shelf::User] {
let (fs, apps) = self.on(shelf);
let _ = fs.list_dir(apps.as_bytes(), |e| {
if let Some(id) = core::str::from_utf8(e.name()).ok().and_then(AppId::new) {
each(id);
}
});
}
}
/// Which shelf holds `id`'s manifest; the system's wins, so a user
/// cannot stand in for a system app.
fn shelf(&mut self, id: &AppId) -> Option<Shelf> {
[Shelf::System, Shelf::User].into_iter().find(|shelf| {
let (fs, apps) = self.on(*shelf);
let mut p = [0u8; LONGEST_PATH];
path(&mut p, &[apps, id.as_str(), MANIFEST]).is_some_and(|p| fs.open(p).and_then(|h| fs.close(h)).is_ok())
})
}
/// A read-only grant to `app`'s binary, for init to load it from.
pub fn binary_grant(&mut self, app: &Manifest) -> Option<CapSlot> {
let shelf = self.shelf(&app.id)?;
let (fs, apps) = self.on(shelf);
let mut p = [0u8; LONGEST_PATH];
fs.grant(path(&mut p, &[apps, app.id.as_str(), app.binary.as_str()])?, false).ok()
}
/// A read-write grant to `id`'s own data folder, for the app.
pub fn data_grant(&mut self, id: &AppId) -> Option<CapSlot> {
let mut p = [0u8; LONGEST_PATH];
self.user.grant(path(&mut p, &[DATA, id.as_str()])?, true).ok()
}
fn with_source<T>(&self, source: CapSlot, f: impl FnOnce(&mut Storage) -> T) -> Option<T> {
@@ -108,9 +150,7 @@ impl Store for DiskStore {
}
fn is_installed(&mut self, id: &AppId) -> bool {
let mut p = [0u8; LONGEST_PATH];
let Some(p) = path(&mut p, &[APPS, id.as_str(), MANIFEST]) else { return false };
self.fs.open(p).and_then(|h| self.fs.close(h)).is_ok()
self.shelf(id).is_some()
}
fn install(&mut self, source: &CapSlot, app: &Manifest, data_folder: bool) -> bool {
@@ -125,8 +165,8 @@ impl Store for DiskStore {
};
// There already if an earlier attempt failed part way; an app
// counts as installed only once its manifest is in.
let _ = self.fs.mkdir(folder);
let fs = &mut self.fs;
let _ = self.user.mkdir(folder);
let fs = &mut self.user;
let copied = Storage::attach(*source, self.source_va).ok().map(|mut src| {
// The binary first: an app folder with a manifest is installed.
let ok = copy(&mut src, app.binary.as_str().as_bytes(), fs, to_binary)
@@ -139,14 +179,16 @@ impl Store for DiskStore {
}
let mut data = [0u8; LONGEST_PATH];
// Kept from an earlier install if there is one: the app's data.
!data_folder || path(&mut data, &[DATA, id]).is_some_and(|d| self.fs.mkdir(d).is_ok() || self.fs.list_dir(d, |_| {}).is_ok())
!data_folder || path(&mut data, &[DATA, id]).is_some_and(|d| self.user.mkdir(d).is_ok() || self.user.list_dir(d, |_| {}).is_ok())
}
fn manifest(&mut self, id: &AppId) -> Option<Manifest> {
let shelf = self.shelf(id)?;
let (fs, apps) = self.on(shelf);
let mut p = [0u8; LONGEST_PATH];
let p = path(&mut p, &[APPS, id.as_str(), MANIFEST])?;
let p = path(&mut p, &[apps, id.as_str(), MANIFEST])?;
let mut text = [0u8; MAX_MANIFEST];
let m = Manifest::parse(read_text(&mut self.fs, p, &mut text)?).ok()?;
let m = Manifest::parse(read_text(fs, p, &mut text)?).ok()?;
// A manifest in the wrong folder is no app.
(m.id == *id).then_some(m)
}
@@ -167,7 +209,7 @@ impl Store for DiskStore {
let mut p = [0u8; LONGEST_PATH];
let p = path(&mut p, &[DECISIONS, id.as_str()])?;
let mut text = [0u8; MAX_DECISION_TEXT];
Decision::parse(read_text(&mut self.fs, p, &mut text)?).ok()
Decision::parse(read_text(&mut self.user, p, &mut text)?).ok()
}
fn record(&mut self, id: &AppId, decision: &Decision) -> bool {
@@ -176,21 +218,10 @@ impl Store for DiskStore {
let mut text = [0u8; MAX_DECISION_TEXT];
let n = decision.write(&mut text);
// Replaced whole: there is no truncate.
let _ = self.fs.delete(p);
let Ok(h) = self.fs.create(p) else { return false };
let written = self.fs.write(h, &text[..n]) == Ok(n);
let _ = self.fs.close(h);
let _ = self.user.delete(p);
let Ok(h) = self.user.create(p) else { return false };
let written = self.user.write(h, &text[..n]) == Ok(n);
let _ = self.user.close(h);
written
}
}
/// The path of app `id`'s binary and its data folder, for grants.
pub fn binary_path<'a>(buf: &'a mut [u8; LONGEST_PATH], app: &Manifest) -> Option<&'a [u8]> {
path(buf, &[APPS, app.id.as_str(), app.binary.as_str()])
}
pub fn data_path<'a>(buf: &'a mut [u8; LONGEST_PATH], id: &AppId) -> Option<&'a [u8]> {
path(buf, &[DATA, id.as_str()])
}
pub const PATH_BUF: usize = LONGEST_PATH;

10
crates/servers/storage-server/src/adapters/mock_fs.rs
View File

@@ -139,4 +139,14 @@ impl FileSystem for MockFileSystem {
fn rmdir(&mut self, _path: &[u8]) -> bool {
false
}
/// Flat: a tree is the files named under it.
fn purge(&mut self, path: &[u8]) -> bool {
for slot in self.files.iter_mut() {
if slot.as_ref().is_some_and(|f| f.name.as_bytes().starts_with(path)) {
*slot = None;
}
}
true
}
}

101
crates/servers/storage-server/src/encrypted.rs
View File

@@ -1,9 +1,12 @@
//! The encrypted areas (see the vision's Encryption note), over any file
//! system: each app's `data/<id>/`, the owner's `home/`, and `system/` are
//! kept as `filecrypt` files under their own keys, derived from the
//! master key; the rest (programs, `factory/`) is plaintext. Before the key
//! arrives the encrypted areas refuse everything, and a plaintext file in
//! one is refused too: nothing there is trusted unless it was sealed.
//! The encrypted areas (see the vision's Encryption and Users notes), over
//! any file system. Each user's folder `users/<id>/` holds their areas:
//! `home/`, `permissions/`, and per app `apps/<app>/` and `data/<app>/`,
//! each kept as `filecrypt` files under its own key, derived from that
//! user's master key. Only the signed-in user's areas open; anyone else's
//! are refused (and noise to their key anyway). The rest (programs,
//! `factory/`) is plaintext. Signed out, every area refuses everything, and
//! a plaintext file in one is refused too: nothing there is trusted unless
//! it was sealed.
use filecrypt::{CHUNK, Drbg, HEADER, Header, Key, OVERHEAD, PLAIN_CHUNK, area_key, chunk_offset, chunks, plain_len};
@@ -22,15 +25,28 @@ enum Area<'a> {
Neither,
}
fn area(path: &[u8]) -> Area<'_> {
/// Where `path` falls, and whose it is: the user folder's name.
fn area(path: &[u8]) -> (Area<'_>, Option<&[u8]>) {
let path = path.strip_prefix(b"/").unwrap_or(path);
let mut parts = path.splitn(3, |b| *b == b'/');
match (parts.next(), parts.next(), parts.next()) {
(Some(b"home" | b"system"), _, _) => Area::Sealed(&path[..path.iter().position(|b| *b == b'/').unwrap_or(path.len())]),
(Some(b"data"), Some(id), Some(rest)) if !id.is_empty() && !rest.is_empty() => Area::Sealed(&path[..5 + id.len()]),
(Some(b"data"), _, _) => Area::Neither,
_ => Area::Plain,
let mut parts = path.splitn(5, |b| *b == b'/');
let (users, user, kind, app, rest) = (parts.next(), parts.next(), parts.next(), parts.next(), parts.next());
if users != Some(b"users") {
return (Area::Plain, None);
}
// `users/` itself holds only the folders, which anyone may list.
let Some(user) = user else { return (Area::Plain, None) };
if user.is_empty() {
return (Area::Neither, None);
}
// `users/<id>/` up to and including `kind`, and the app's folder.
let upto = |n: usize| &path[..n];
let base = 6 + user.len() + 1;
let area = match (kind, app, rest) {
(Some(k @ (b"home" | b"permissions")), _, _) => Area::Sealed(upto(base + k.len())),
(Some(k @ (b"apps" | b"data")), Some(a), Some(r)) if !a.is_empty() && !r.is_empty() => Area::Sealed(upto(base + k.len() + 1 + a.len())),
_ => Area::Neither,
};
(area, Some(user))
}
/// An open encrypted file.
@@ -44,15 +60,20 @@ struct Open {
pub struct Encrypted<F: FileSystem> {
inner: F,
/// The master key and randomness, once the gatekeeper has unlocked.
/// The signed-in user's master key and folder name, and randomness.
master: Option<Key>,
user: [u8; USER_NAME],
user_len: usize,
rng: Option<Drbg>,
open: [Option<Open>; MAX_HANDLES],
}
/// A user folder's name: 16 hex digits, or `guest`.
pub const USER_NAME: usize = 16;
impl<F: FileSystem> Encrypted<F> {
pub fn new(inner: F) -> Self {
Self { inner, master: None, rng: None, open: [const { None }; MAX_HANDLES] }
Self { inner, master: None, user: [0; USER_NAME], user_len: 0, rng: None, open: [const { None }; MAX_HANDLES] }
}
pub fn inner(&self) -> &F {
@@ -68,21 +89,27 @@ impl<F: FileSystem> Encrypted<F> {
self.inner
}
/// The key of `path`'s area, if it is encrypted and the store unlocked:
/// Whether `user`'s folder is the signed-in user's.
fn signed_in(&self, user: Option<&[u8]>) -> bool {
self.master.is_some() && user == Some(&self.user[..self.user_len])
}
/// The key of `path`'s area, if it is encrypted and its user signed in:
/// `Ok(None)` for a plaintext path, `Err` for one it must refuse.
fn key_for(&self, path: &[u8]) -> Result<Option<Key>, ()> {
match area(path) {
Area::Plain => Ok(None),
Area::Neither => Err(()),
Area::Sealed(name) => self.master.as_ref().map(|m| Some(area_key(m, name))).ok_or(()),
(Area::Plain, _) => Ok(None),
(Area::Sealed(name), user) if self.signed_in(user) => Ok(self.master.as_ref().map(|m| area_key(m, name))),
_ => Err(()),
}
}
/// Whether `path` may be used as a directory (made, listed, removed).
/// Whether `path` may be used as a directory (made, listed, removed):
/// anywhere plaintext, and in the signed-in user's own folder.
fn dir_allowed(&self, path: &[u8]) -> bool {
match area(path) {
Area::Plain => true,
_ => self.master.is_some(),
(Area::Plain, _) => true,
(_, user) => self.signed_in(user),
}
}
@@ -115,13 +142,33 @@ impl<F: FileSystem> FileSystem for Encrypted<F> {
self.inner.writable()
}
fn unlock(&mut self, master: &[u8; 32], seed: &[u8; 32]) {
if self.master.is_none() {
fn unlock(&mut self, master: &[u8; 32], seed: &[u8; 32], user: &[u8]) {
if self.master.is_none() && !user.is_empty() && user.len() <= USER_NAME {
self.master = Some(Key(*master));
self.rng = Some(Drbg::new(*seed));
self.user[..user.len()].copy_from_slice(user);
self.user_len = user.len();
}
}
fn lock(&mut self) {
for (i, slot) in self.open.iter_mut().enumerate() {
if slot.take().is_some() {
self.inner.close(FileHandle::new(i as u16));
}
}
self.master = None;
self.rng = None;
self.user = [0; USER_NAME];
self.user_len = 0;
}
/// Removes a whole tree without opening anything in it: a removed
/// user's or a guest's files go though no key for them is held.
fn purge(&mut self, path: &[u8]) -> bool {
crate::filesystem::remove_tree(&mut self.inner, path)
}
fn open(&mut self, path: &[u8]) -> Option<FileHandle> {
let key = self.key_for(path).ok()?;
let h = self.inner.open(path)?;
@@ -242,8 +289,8 @@ impl<F: FileSystem> FileSystem for Encrypted<F> {
}
let n = self.inner.list_dir(path, entries)?;
// In an encrypted area a file's size is what it holds, not its disk size.
// (Listing an app's own folder, `data/<id>`, shows its sealed files.)
let sealed = area(path) != Area::Plain;
// In a user's folder, a file's size is what it holds.
let sealed = area(path).0 != Area::Plain;
for e in entries[..n].iter_mut().filter(|e| sealed && !e.is_dir) {
e.size = plain_len(e.size).unwrap_or(0);
}
@@ -265,7 +312,7 @@ impl<F: FileSystem> FileSystem for Encrypted<F> {
#[cfg(test)]
pub(crate) fn area_of(path: &[u8]) -> &'static str {
match area(path) {
match area(path).0 {
Area::Plain => "plain",
Area::Sealed(_) => "sealed",
Area::Neither => "neither",

49
crates/servers/storage-server/src/filesystem.rs
View File

@@ -78,12 +78,55 @@ pub trait FileSystem {
fn seek(&mut self, handle: FileHandle, offset: usize) -> bool;
/// Removes the directory at `path`, which must be empty.
fn rmdir(&mut self, path: &[u8]) -> bool;
/// The master key and a fresh random seed, once the owner is in; only
/// an encrypting file system has a use for them.
fn unlock(&mut self, _master: &[u8; 32], _seed: &[u8; 32]) {}
/// The signed-in user's master key, a fresh random seed, and the name
/// of their folder; only an encrypting file system has a use for them.
fn unlock(&mut self, _master: &[u8; 32], _seed: &[u8; 32], _user: &[u8]) {}
/// The user signed out: their key is forgotten.
fn lock(&mut self) {}
/// Removes the tree at `path`, whatever is in it.
fn purge(&mut self, path: &[u8]) -> bool {
remove_tree(self, path)
}
/// Whether anything can be written at all; the server refuses
/// writing requests up front when not.
fn writable(&self) -> bool {
true
}
}
/// Removes everything under `path` and `path` itself, a directory or a
/// file; true if nothing is left there.
pub fn remove_tree<F: FileSystem + ?Sized>(fs: &mut F, path: &[u8]) -> bool {
if fs.delete(path) {
return true;
}
const BATCH: usize = 16;
const LONGEST: usize = 255;
loop {
let mut entries = [DirEntry::empty(); BATCH];
let Some(n) = fs.list_dir(path, &mut entries) else {
// Neither a file nor a directory: nothing there.
return true;
};
let children = entries[..n].iter().filter(|e| e.name.as_bytes() != b"." && e.name.as_bytes() != b"..");
let mut any = false;
for e in children {
any = true;
let mut child = [0u8; LONGEST];
let name = e.name.as_bytes();
let len = path.len() + 1 + name.len();
if len > LONGEST {
return false;
}
child[..path.len()].copy_from_slice(path);
child[path.len()] = b'/';
child[path.len() + 1..len].copy_from_slice(name);
if !remove_tree(fs, &child[..len]) {
return false;
}
}
if !any {
return fs.rmdir(path);
}
}
}

10
crates/servers/storage-server/src/grants.rs
View File

@@ -66,6 +66,16 @@ impl Grants {
Some(cap)
}
/// The grants init made directly, into `out`; how many.
pub fn roots(&self, out: &mut [usize; MAX_GRANTS]) -> usize {
let mut n = 0;
for g in self.grants.iter().flatten().filter(|g| g.parent == 0) {
out[n] = g.badge;
n += 1;
}
n
}
/// Forgets `badge` and every grant narrowed from it, transitively,
/// calling `gone` with each one's badge and capability.
pub fn release(&mut self, badge: usize, mut gone: impl FnMut(usize, CapSlot)) {

10
crates/servers/storage-server/src/protocol.rs
View File

@@ -30,6 +30,10 @@ pub enum StorageRequest {
/// Half of the seed for randomness.
SetSeed { half: usize, words: [usize; 2] },
Rmdir { path_len: usize },
/// Whose areas the key will open.
SetUser { id: u64, guest: bool },
Lock,
Purge { path_len: usize },
/// A capability to the path (`path_len` bytes of the buffer), inside
/// the caller's scope.
Grant {
@@ -82,6 +86,9 @@ impl Encode for StorageRequest {
SetKey { half, words } => [op::SET_KEY, half, words[0], words[1]],
SetSeed { half, words } => [op::SET_SEED, half, words[0], words[1]],
Rmdir { path_len } => [op::RMDIR, path_len, 0, 0],
SetUser { id, guest } => [op::SET_USER, id as usize, usize::from(guest), 0],
Lock => [op::LOCK, 0, 0, 0],
Purge { path_len } => [op::PURGE, path_len, 0, 0],
Grant { path_len, write } => [op::GRANT, path_len, usize::from(write), 0],
Release => [op::RELEASE, 0, 0, 0],
}
@@ -106,6 +113,9 @@ impl Decode for StorageRequest {
op::SET_KEY => SetKey { half: w[1], words: [w[2], w[3]] },
op::SET_SEED => SetSeed { half: w[1], words: [w[2], w[3]] },
op::RMDIR => Rmdir { path_len: w[1] },
op::SET_USER => SetUser { id: w[1] as u64, guest: w[2] != 0 },
op::LOCK => Lock,
op::PURGE => Purge { path_len: w[1] },
op::GRANT => Grant {
path_len: w[1],
write: w[2] != 0,

31
crates/servers/storage-server/src/server.rs
View File

@@ -7,6 +7,8 @@ use crate::grants::Grants;
use crate::protocol::{DIR_ENTRY_SIZE, DIR_NAME_SIZE, MAX_PATH, StorageRequest, StorageResponse};
use crate::scope::Scope;
mod session;
const MAX_CLIENTS: usize = 8;
/// Handles at or past this are never valid (the file systems hand out
/// fewer), so ownership fits a small table.
@@ -54,6 +56,8 @@ pub struct StorageServer<F: FileSystem, H: Host> {
/// init; handed to the file system (and forgotten here) once all in.
key: [Option<[usize; 2]>; 2],
seed: [Option<[usize; 2]>; 2],
/// Whose areas they open, said first.
user: Option<types::user::UserFolder>,
unlocked: bool,
}
@@ -68,6 +72,7 @@ impl<F: FileSystem, H: Host> StorageServer<F, H> {
log: None,
key: [None; 2],
seed: [None; 2],
user: None,
unlocked: false,
}
}
@@ -91,27 +96,6 @@ impl<F: FileSystem, H: Host> StorageServer<F, H> {
}
}
/// Only the unbadged holder (init), each half only once: nobody can
/// replace the key or the seed later.
fn set_half(&mut self, badge: usize, seed: bool, half: usize, words: [usize; 2]) -> StorageResponse {
let halves = if seed { &mut self.seed } else { &mut self.key };
match (badge, self.unlocked, halves.get_mut(half)) {
(0, false, Some(slot @ None)) => *slot = Some(words),
_ => return StorageResponse::Error,
}
if let ([Some(k0), Some(k1)], [Some(s0), Some(s1)]) = (self.key, self.seed) {
let bytes = |w: [usize; 4]| -> [u8; 32] { core::array::from_fn(|i| w[i / 8].to_le_bytes()[i % 8]) };
let (mut master, mut seed) = (bytes([k0[0], k0[1], k1[0], k1[1]]), bytes([s0[0], s0[1], s1[0], s1[1]]));
self.fs.unlock(&master, &seed);
master.fill(0);
seed.fill(0);
self.key = [None; 2];
self.seed = [None; 2];
self.unlocked = true;
}
StorageResponse::Ok
}
/// Whether the encrypted areas are open: the key and seed are in.
pub fn unlocked(&self) -> bool {
self.unlocked
@@ -300,7 +284,7 @@ impl<F: FileSystem, H: Host> StorageServer<F, H> {
None => R::NotFound,
};
let response = match request {
Attach | SetLog | SetKey { .. } | SetSeed { .. } | Release => R::Error,
Attach | SetLog | SetKey { .. } | SetSeed { .. } | SetUser { .. } | Lock | Purge { .. } | Release => R::Error,
Grant { path_len, write } => {
let narrower = scope.narrow(&buf[sent(path_len)], write);
return match narrower.and_then(|s| grants.add(badge, s, |b| host.mint(b))) {
@@ -412,6 +396,9 @@ impl<F: FileSystem, H: Host> Server for StorageServer<F, H> {
Some(StorageRequest::SetLog) => (self.set_log(badge, cap).encode(), None),
Some(StorageRequest::SetKey { half, words }) => (self.set_half(badge, false, half, words).encode(), None),
Some(StorageRequest::SetSeed { half, words }) => (self.set_half(badge, true, half, words).encode(), None),
Some(StorageRequest::SetUser { id, guest }) => (self.set_user(badge, id, guest).encode(), None),
Some(StorageRequest::Lock) => (self.lock(badge).encode(), None),
Some(StorageRequest::Purge { path_len }) => (self.purge(badge, path_len).encode(), None),
// A badge storage never issued, or one it has taken back.
Some(request) => match self.grants.scope(badge) {
None => (StorageResponse::Denied.encode(), None),

88
crates/servers/storage-server/src/server/session.rs Normal file
View File

@@ -0,0 +1,88 @@
//! Who is signed in, as far as storage cares: init says whose areas open,
//! hands over the key and seed, and at sign-out locks everything again.
//! Every one of these is init's alone (the unbadged holder).
use types::user::UserFolder;
use super::{Host, StorageServer};
use crate::filesystem::{FileHandle, FileSystem};
use crate::grants::MAX_GRANTS;
use crate::protocol::{MAX_PATH, StorageResponse};
impl<F: FileSystem, H: Host> StorageServer<F, H> {
/// Once per sign-in, before the key.
pub(super) fn set_user(&mut self, badge: usize, id: u64, guest: bool) -> StorageResponse {
if badge != 0 || self.unlocked || self.user.is_some() {
return StorageResponse::Error;
}
self.user = Some(if guest { UserFolder::GUEST } else { UserFolder::of(id) });
StorageResponse::Ok
}
/// Each half only once per sign-in: nobody can replace the key or the
/// seed while someone is in. Without a user said first, refused.
pub(super) fn set_half(&mut self, badge: usize, seed: bool, half: usize, words: [usize; 2]) -> StorageResponse {
let halves = if seed { &mut self.seed } else { &mut self.key };
match (badge, self.unlocked, self.user, halves.get_mut(half)) {
(0, false, Some(_), Some(slot @ None)) => *slot = Some(words),
_ => return StorageResponse::Error,
}
if let ([Some(k0), Some(k1)], [Some(s0), Some(s1)], Some(user)) = (self.key, self.seed, self.user) {
let bytes = |w: [usize; 4]| -> [u8; 32] { core::array::from_fn(|i| w[i / 8].to_le_bytes()[i % 8]) };
let (mut master, mut seed) = (bytes([k0[0], k0[1], k1[0], k1[1]]), bytes([s0[0], s0[1], s1[0], s1[1]]));
self.fs.unlock(&master, &seed, user.as_bytes());
master.fill(0);
seed.fill(0);
self.key = [None; 2];
self.seed = [None; 2];
self.unlocked = true;
}
StorageResponse::Ok
}
/// Sign-out: every grant goes (and with them every app's files and
/// buffers), init's own files close, the key is forgotten.
pub(super) fn lock(&mut self, badge: usize) -> StorageResponse {
if badge != 0 {
return StorageResponse::Error;
}
let mut roots = [0usize; MAX_GRANTS];
let n = self.grants.roots(&mut roots);
for &root in &roots[..n] {
self.release(root);
}
for (raw, owner) in self.owners.iter_mut().enumerate() {
if owner.take().is_some() {
self.fs.close(FileHandle::new(raw as u16));
}
}
self.fs.lock();
self.key = [None; 2];
self.seed = [None; 2];
self.user = None;
self.unlocked = false;
StorageResponse::Ok
}
/// While nobody is in, so no one's open file can be pulled away.
pub(super) fn purge(&mut self, badge: usize, path_len: usize) -> StorageResponse {
if badge != 0 || self.unlocked || !self.fs.writable() {
return StorageResponse::Error;
}
let Some(client) = self.clients.iter().flatten().find(|c| c.badge == Some(0)) else {
return StorageResponse::NotAttached;
};
let mut path = [0u8; MAX_PATH];
let len = path_len.min(MAX_PATH).min(client.buf.len());
path[..len].copy_from_slice(&client.buf[..len]);
let path = &path[..len];
let path = path.strip_prefix(b"/").unwrap_or(path);
// `users` (everyone, on a new keystore) or what is in it.
let inside = path == b"users"
|| path.strip_prefix(b"users/").is_some_and(|rest| !rest.split(|b| *b == b'/').any(|p| p.is_empty() || p == b"." || p == b".."));
if !inside {
return StorageResponse::Denied;
}
if self.fs.purge(path) { StorageResponse::Ok } else { StorageResponse::Error }
}
}

186
crates/servers/storage-server/src/tests/encrypted.rs
View File

@@ -74,11 +74,25 @@ impl FileSystem for Memory {
let (path, _) = self.open.get(&h.raw())?;
Some(self.files[path.as_str()].len())
}
/// The direct children: files, and folders made or implied by a file.
fn list_dir(&mut self, path: &[u8], entries: &mut [DirEntry]) -> Option<usize> {
let prefix = std::format!("{}/", key(path));
let dir = key(path);
let prefix = std::format!("{dir}/");
if !self.dirs.contains(&dir) && !self.files.keys().any(|k| k.starts_with(&prefix)) {
return None;
}
let mut seen: Vec<String> = Vec::new();
let mut n = 0;
for (name, data) in self.files.iter().filter(|(k, _)| k.starts_with(&prefix)) {
entries[n] = DirEntry { name: FileName::from_bytes(name[prefix.len()..].as_bytes()), size: data.len(), is_dir: false };
let names = self.files.keys().map(|k| (k, true)).chain(self.dirs.iter().map(|d| (d, false)));
for (name, file) in names.filter(|(k, _)| k.starts_with(&prefix)) {
let rest = &name[prefix.len()..];
let (child, deeper) = rest.split_once('/').map_or((rest, false), |(c, _)| (c, true));
if seen.iter().any(|s| s == child) || n == entries.len() {
continue;
}
seen.push(child.to_string());
let size = if file && !deeper { self.files[name.as_str()].len() } else { 0 };
entries[n] = DirEntry { name: FileName::from_bytes(child.as_bytes()), size, is_dir: deeper || !file };
n += 1;
}
Some(n)
@@ -87,14 +101,22 @@ impl FileSystem for Memory {
self.files.remove(&key(path)).is_some()
}
fn mkdir(&mut self, path: &[u8]) -> bool {
self.dirs.push(key(path));
let k = key(path);
if !self.dirs.contains(&k) {
self.dirs.push(k);
}
true
}
/// Only an empty folder.
fn rmdir(&mut self, path: &[u8]) -> bool {
let k = key(path);
let before = self.dirs.len();
self.dirs.retain(|d| *d != k);
self.dirs.len() < before
let prefix = std::format!("{k}/");
let empty = !self.files.keys().chain(self.dirs.iter()).any(|f| f.starts_with(&prefix));
let was = self.dirs.contains(&k) || !empty;
if empty {
self.dirs.retain(|d| *d != k);
}
empty && was
}
}
@@ -102,7 +124,7 @@ const MASTER: [u8; 32] = [9; 32];
fn unlocked() -> Encrypted<Memory> {
let mut fs = Encrypted::new(Memory::default());
fs.unlock(&MASTER, &[3; 32]);
fs.unlock(&MASTER, &[3; 32], b"u1");
fs
}
@@ -129,17 +151,22 @@ fn on_disk(fs: &Encrypted<Memory>, path: &str) -> Vec<u8> {
#[test]
fn areas_are_told_by_path() {
for (p, a) in [
(&b"home/readme.txt"[..], "sealed"),
(b"/home", "sealed"),
(b"system/permissions/kos.snake", "sealed"),
(b"data/kos.notes/a", "sealed"),
(b"data/kos.notes", "neither"),
(b"data", "neither"),
(b"data/", "neither"),
(&b"users/u1/home/readme.txt"[..], "sealed"),
(b"/users/u1/home", "sealed"),
(b"users/u1/permissions/kos.snake", "sealed"),
(b"users/u1/data/kos.notes/a", "sealed"),
(b"users/u1/apps/kos.notes/notes", "sealed"),
(b"users/u1/data/kos.notes", "neither"),
(b"users/u1/apps", "neither"),
(b"users/u1/loose", "neither"),
(b"users/u1", "neither"),
(b"users//home", "neither"),
(b"users", "plain"),
(b"bin/shell", "plain"),
(b"apps/kos.cat/cat", "plain"),
(b"factory/home/readme.txt", "plain"),
(b"homework/x", "plain"),
(b"home/x", "plain"),
(b"usersx/u1/home/x", "plain"),
(b"selftest.txt", "plain"),
] {
assert_eq!(area_of(p), a, "{}", String::from_utf8_lossy(p));
@@ -150,9 +177,9 @@ fn areas_are_told_by_path() {
fn sealed_files_read_back_and_are_noise_on_disk() {
let mut fs = unlocked();
let text = b"Dear diary, nobody else may read this.";
put(&mut fs, b"home/diary.txt", text);
assert_eq!(get(&mut fs, b"home/diary.txt").unwrap(), text);
let disk = on_disk(&fs, "home/diary.txt");
put(&mut fs, b"users/u1/home/diary.txt", text);
assert_eq!(get(&mut fs, b"users/u1/home/diary.txt").unwrap(), text);
let disk = on_disk(&fs, "users/u1/home/diary.txt");
assert!(disk.starts_with(b"KOSFILE1"));
assert!(!disk.windows(5).any(|w| w == b"diary"), "the words are not on the disk");
assert_eq!(disk.len(), filecrypt::disk_len(text.len()));
@@ -170,37 +197,37 @@ fn plaintext_areas_stay_plaintext() {
fn big_files_and_writes_across_chunks_round_trip() {
let mut fs = unlocked();
let big: Vec<u8> = (0..3 * filecrypt::PLAIN_CHUNK + 123).map(|i| (i % 251) as u8).collect();
put(&mut fs, b"data/kos.notes/big", &big);
assert_eq!(get(&mut fs, b"data/kos.notes/big").unwrap(), big);
put(&mut fs, b"users/u1/data/kos.notes/big", &big);
assert_eq!(get(&mut fs, b"users/u1/data/kos.notes/big").unwrap(), big);
// Overwrite a stretch spanning two chunks in the middle.
let h = fs.open(b"data/kos.notes/big").unwrap();
let h = fs.open(b"users/u1/data/kos.notes/big").unwrap();
let at = filecrypt::PLAIN_CHUNK - 10;
assert!(fs.seek(h, at));
assert_eq!(fs.write(h, &[0xAA; 30]), Some(30));
fs.close(h);
let mut expect = big.clone();
expect[at..at + 30].fill(0xAA);
assert_eq!(get(&mut fs, b"data/kos.notes/big").unwrap(), expect);
assert_eq!(get(&mut fs, b"users/u1/data/kos.notes/big").unwrap(), expect);
// Grow exactly from a chunk boundary: the old last chunk stops being last.
let mut fs = unlocked();
let full = vec![7u8; filecrypt::PLAIN_CHUNK];
put(&mut fs, b"home/f", &full);
let h = fs.open(b"home/f").unwrap();
put(&mut fs, b"users/u1/home/f", &full);
let h = fs.open(b"users/u1/home/f").unwrap();
assert!(fs.seek(h, filecrypt::PLAIN_CHUNK));
assert_eq!(fs.write(h, b"more"), Some(4));
fs.close(h);
let mut expect = full.clone();
expect.extend_from_slice(b"more");
assert_eq!(get(&mut fs, b"home/f").unwrap(), expect);
assert_eq!(get(&mut fs, b"users/u1/home/f").unwrap(), expect);
}
#[test]
fn one_app_cannot_read_anothers_file_even_moved_into_its_folder() {
let mut fs = unlocked();
put(&mut fs, b"data/kos.notes/secret", b"notes only");
let stolen = on_disk(&fs, "data/kos.notes/secret");
fs.inner_mut_for_test().files.insert("data/kos.chat/secret".to_string(), stolen);
let h = fs.open(b"data/kos.chat/secret").expect("it looks like a sealed file");
put(&mut fs, b"users/u1/data/kos.notes/secret", b"notes only");
let stolen = on_disk(&fs, "users/u1/data/kos.notes/secret");
fs.inner_mut_for_test().files.insert("users/u1/data/kos.chat/secret".to_string(), stolen);
let h = fs.open(b"users/u1/data/kos.chat/secret").expect("it looks like a sealed file");
let mut out = [0u8; 64];
assert_eq!(fs.read(h, &mut out), None, "but it opens only under kos.notes' key");
}
@@ -208,68 +235,117 @@ fn one_app_cannot_read_anothers_file_even_moved_into_its_folder() {
#[test]
fn locked_the_areas_refuse_everything() {
let mut fs = unlocked();
put(&mut fs, b"home/x", b"y");
put(&mut fs, b"users/u1/home/x", b"y");
let mut locked = Encrypted::new(fs.into_inner());
assert!(locked.open(b"home/x").is_none());
assert!(locked.create(b"home/z").is_none());
assert!(!locked.delete(b"home/x"));
assert!(!locked.mkdir(b"data/kos.notes"));
assert!(locked.list_dir(b"home", &mut [DirEntry::empty(); 4]).is_none());
assert!(locked.open(b"users/u1/home/x").is_none());
assert!(locked.create(b"users/u1/home/z").is_none());
assert!(!locked.delete(b"users/u1/home/x"));
assert!(!locked.mkdir(b"users/u1/data/kos.notes"));
assert!(locked.list_dir(b"users/u1/home", &mut [DirEntry::empty(); 4]).is_none());
assert!(locked.open(b"bin/anything").is_none(), "(absent) but plaintext areas are not refused");
// Another master key (a wiped and re-set-up device) reads noise.
let mut other = Encrypted::new(locked.into_inner());
other.unlock(&[1; 32], &[2; 32]);
let h = other.open(b"home/x").unwrap();
other.unlock(&[1; 32], &[2; 32], b"u1");
let h = other.open(b"users/u1/home/x").unwrap();
assert_eq!(other.read(h, &mut [0u8; 8]), None);
}
#[test]
fn plaintext_planted_in_an_encrypted_area_is_refused() {
let mut fs = unlocked();
fs.inner_mut_for_test().files.insert("system/permissions/kos.evil".to_string(), b"[decision]\ngranted = [\"network\"]\n".to_vec());
assert!(fs.open(b"system/permissions/kos.evil").is_none());
fs.inner_mut_for_test().files.insert("users/u1/permissions/kos.evil".to_string(), b"[decision]\ngranted = [\"network\"]\n".to_vec());
assert!(fs.open(b"users/u1/permissions/kos.evil").is_none());
}
#[test]
fn tampering_and_truncation_are_caught() {
let mut fs = unlocked();
let data = vec![5u8; 2 * filecrypt::PLAIN_CHUNK + 50];
put(&mut fs, b"home/t", &data);
let good = on_disk(&fs, "home/t");
put(&mut fs, b"users/u1/home/t", &data);
let good = on_disk(&fs, "users/u1/home/t");
// One flipped byte.
let mut bent = good.clone();
bent[100] ^= 1;
fs.inner_mut_for_test().files.insert("home/t".to_string(), bent);
assert_eq!(get(&mut fs, b"home/t"), None);
fs.inner_mut_for_test().files.insert("users/u1/home/t".to_string(), bent);
assert_eq!(get(&mut fs, b"users/u1/home/t"), None);
// Cut at a chunk boundary: the remaining last chunk was not sealed as last.
let cut = good[..filecrypt::chunk_offset(2)].to_vec();
fs.inner_mut_for_test().files.insert("home/t".to_string(), cut);
assert_eq!(get(&mut fs, b"home/t"), None);
fs.inner_mut_for_test().files.insert("users/u1/home/t".to_string(), cut);
assert_eq!(get(&mut fs, b"users/u1/home/t"), None);
// Chunks swapped.
let (a, b) = (filecrypt::chunk_offset(0), filecrypt::chunk_offset(1));
let mut swapped = good.clone();
swapped[a..b].copy_from_slice(&good[b..b + filecrypt::CHUNK]);
swapped[b..b + filecrypt::CHUNK].copy_from_slice(&good[a..b]);
fs.inner_mut_for_test().files.insert("home/t".to_string(), swapped);
assert_eq!(get(&mut fs, b"home/t"), None);
fs.inner_mut_for_test().files.insert("users/u1/home/t".to_string(), swapped);
assert_eq!(get(&mut fs, b"users/u1/home/t"), None);
}
#[test]
fn listings_show_what_files_hold() {
let mut fs = unlocked();
put(&mut fs, b"home/a", b"12345");
put(&mut fs, b"users/u1/home/a", b"12345");
let mut entries = [DirEntry::empty(); 4];
let n = fs.list_dir(b"home", &mut entries).unwrap();
let n = fs.list_dir(b"users/u1/home", &mut entries).unwrap();
assert_eq!((n, entries[0].size), (1, 5));
}
#[test]
fn files_cannot_live_loose_in_data() {
fn files_cannot_live_loose_in_a_users_folder() {
let mut fs = unlocked();
assert!(fs.create(b"data/loose").is_none());
assert!(fs.mkdir(b"data/kos.notes"), "an app's folder is fine");
assert!(fs.create(b"users/u1/data/loose").is_none());
assert!(fs.create(b"users/u1/loose").is_none());
assert!(fs.create(b"users/loose").is_none());
assert!(fs.mkdir(b"users/u1/data/kos.notes"), "an app's folder is fine");
let mut entries = [DirEntry::empty(); 2];
put(&mut fs, b"data/kos.notes/a", b"xyz");
let n = fs.list_dir(b"data/kos.notes", &mut entries).unwrap();
put(&mut fs, b"users/u1/data/kos.notes/a", b"xyz");
let n = fs.list_dir(b"users/u1/data/kos.notes", &mut entries).unwrap();
assert_eq!((n, entries[0].size), (1, 3), "listing the folder shows what its files hold");
}
#[test]
fn only_the_signed_in_users_folder_opens() {
let mut fs = unlocked();
put(&mut fs, b"users/u1/home/mine", b"u1's");
let mut inner = fs.into_inner();
let theirs = inner.files["users/u1/home/mine"].clone();
let mut u2 = Encrypted::new(std::mem::take(&mut inner));
u2.unlock(&MASTER, &[3; 32], b"u2");
assert!(u2.open(b"users/u1/home/mine").is_none(), "not someone else's, even under the same key");
assert!(u2.create(b"users/u1/home/planted").is_none());
assert!(!u2.mkdir(b"users/u1/home/sub"));
assert!(u2.list_dir(b"users/u1/home", &mut [DirEntry::empty(); 4]).is_none());
assert!(!u2.delete(b"users/u1/home/mine"));
// Moved into u2's own home, it is u1's area key that sealed it.
u2.inner_mut_for_test().files.insert("users/u2/home/mine".to_string(), theirs);
let h = u2.open(b"users/u2/home/mine").unwrap();
assert_eq!(u2.read(h, &mut [0u8; 8]), None);
assert!(u2.list_dir(b"users", &mut [DirEntry::empty(); 4]).is_some(), "the folders themselves are no secret");
}
#[test]
fn locking_forgets_the_key_and_closes_sealed_files() {
let mut fs = unlocked();
put(&mut fs, b"users/u1/home/a", b"abc");
let h = fs.open(b"users/u1/home/a").unwrap();
fs.lock();
assert_eq!(fs.read(h, &mut [0u8; 4]), None, "the open file went with the key");
assert!(fs.open(b"users/u1/home/a").is_none());
fs.unlock(&MASTER, &[3; 32], b"u1");
assert_eq!(get(&mut fs, b"users/u1/home/a").unwrap(), b"abc", "and comes back with it");
}
#[test]
fn purging_removes_a_tree_without_its_key() {
let mut fs = unlocked();
put(&mut fs, b"users/u1/home/a", b"1");
put(&mut fs, b"users/u1/data/kos.notes/b", b"2");
assert!(fs.mkdir(b"users/u1/home/empty"));
fs.lock();
fs.inner_mut_for_test().files.insert("users/u2x/home/c".to_string(), b"3".to_vec());
assert!(fs.purge(b"users/u1"));
let left: Vec<&String> = fs.inner().files.keys().collect();
assert_eq!(left, ["users/u2x/home/c"]);
assert!(!fs.inner().dirs.iter().any(|d| d.starts_with("users/u1")), "folders too");
assert!(fs.purge(b"users/nobody"), "nothing there is nothing to remove");
}

36
crates/servers/storage-server/src/tests/ext4_real.rs
View File

@@ -224,17 +224,19 @@ fn sealed_files_on_real_ext4_read_back_and_pass_e2fsck() {
use crate::encrypted::Encrypted;
let Some((dir, img)) = setup("sealed") else { return };
let mut fs = Encrypted::new(Ext4::mount(FileDisk(img)).expect("mount"));
fs.unlock(&[4; 32], &[5; 32]);
assert!(fs.mkdir(b"/home"));
fs.unlock(&[4; 32], &[5; 32], b"u1");
for dir in [&b"/users"[..], b"/users/u1", b"/users/u1/home"] {
assert!(fs.mkdir(dir));
}
let text: Vec<u8> = b"the quick brown fox ".iter().copied().cycle().take(3 * filecrypt::PLAIN_CHUNK + 99).collect();
let h = fs.create(b"/home/fox.txt").expect("create");
let h = fs.create(b"/users/u1/home/fox.txt").expect("create");
assert_eq!(fs.write(h, &text), Some(text.len()));
assert!(fs.seek(h, 5000));
assert_eq!(fs.write(h, b"LAZY DOG"), Some(8));
fs.close(h);
let mut expect = text.clone();
expect[5000..5008].copy_from_slice(b"LAZY DOG");
let h = fs.open(b"/home/fox.txt").expect("open");
let h = fs.open(b"/users/u1/home/fox.txt").expect("open");
let mut back = std::vec![0u8; expect.len()];
assert_eq!(fs.read(h, &mut back), Some(expect.len()));
fs.close(h);
@@ -244,3 +246,29 @@ fn sealed_files_on_real_ext4_read_back_and_pass_e2fsck() {
let (clean, report) = fsck_clean(&dir, &disk);
assert!(clean, "e2fsck: {report}");
}
#[test]
fn purging_a_users_tree_on_real_ext4_passes_e2fsck() {
use crate::encrypted::Encrypted;
let Some((dir, img)) = setup("purge") else { return };
let mut fs = Encrypted::new(Ext4::mount(FileDisk(img)).expect("mount"));
fs.unlock(&[4; 32], &[5; 32], b"u1");
for d in [&b"/users"[..], b"/users/u1", b"/users/u1/home", b"/users/u1/home/deep", b"/users/u1/data", b"/users/u1/data/kos.notes"] {
assert!(fs.mkdir(d));
}
// More files than one listing batch holds.
for i in 0..20u8 {
let name = std::format!("/users/u1/home/deep/f{i}");
let h = fs.create(name.as_bytes()).expect("create");
assert_eq!(fs.write(h, &[i; 100]), Some(100));
fs.close(h);
}
let h = fs.create(b"/users/u1/data/kos.notes/n").expect("create");
fs.close(h);
assert!(!fs.delete(b"/users/u1/home"), "a folder is not deleted as a file");
fs.lock();
assert!(fs.purge(b"/users/u1"));
assert!(fs.list_dir(b"/users", &mut [crate::filesystem::DirEntry::empty(); 4]).is_some_and(|n| n <= 2), "only . and ..");
let (clean, report) = fsck_clean(&dir, &fs.into_inner().into_device().0);
assert!(clean, "e2fsck: {report}");
}

42
crates/servers/storage-server/src/tests/server.rs
View File

@@ -479,6 +479,11 @@ fn only_init_unlocks_and_only_once() {
let set = |s: &mut Srv, badge, req| call(s, badge, req).0;
let key = |half| StorageRequest::SetKey { half, words: [1, 2] };
let seed = |half| StorageRequest::SetSeed { half, words: [3, 4] };
let user = StorageRequest::SetUser { id: 7, guest: false };
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "not before saying whose");
assert_eq!(set(&mut s, 5, user), StorageResponse::Error, "a client cannot say");
assert_eq!(set(&mut s, 0, user), StorageResponse::Ok);
assert_eq!(set(&mut s, 0, user), StorageResponse::Error, "once");
assert_eq!(set(&mut s, 5, key(0)), StorageResponse::Error, "a client cannot");
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Ok);
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "nor can a half be replaced");
@@ -490,3 +495,40 @@ fn only_init_unlocks_and_only_once() {
assert!(s.unlocked());
assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "once unlocked, never again");
}
#[test]
fn locking_takes_every_grant_back_and_lets_the_next_user_in() {
let mut s = server();
let set = |s: &mut Srv, badge, req| call(s, badge, req).0;
let init = Client::attach(&mut s, 0);
let shell = init.narrowed(&mut s, b"", true);
let app = shell.narrowed(&mut s, b"", false);
for req in [StorageRequest::SetUser { id: 1, guest: false }, StorageRequest::SetKey { half: 0, words: [1, 2] }, StorageRequest::SetKey { half: 1, words: [1, 2] }, StorageRequest::SetSeed { half: 0, words: [1, 2] }, StorageRequest::SetSeed { half: 1, words: [1, 2] }] {
assert_eq!(set(&mut s, 0, req), StorageResponse::Ok);
}
assert!(s.unlocked());
assert_eq!(set(&mut s, shell.badge, StorageRequest::Lock), StorageResponse::Error, "only init signs out");
assert_eq!(set(&mut s, 0, StorageRequest::Lock), StorageResponse::Ok);
assert!(!s.unlocked());
let revoked: Vec<usize> = s.host().revoked.iter().map(|c| badge_of(*c)).collect();
assert_eq!(revoked, [shell.badge, app.badge]);
assert_eq!(set(&mut s, shell.badge, StorageRequest::FileSize { handle: crate::filesystem::FileHandle::new(0) }), StorageResponse::Denied);
assert_eq!(set(&mut s, 0, StorageRequest::SetUser { id: 2, guest: true }), StorageResponse::Ok, "someone else may sign in");
}
#[test]
fn only_init_purges_only_users_and_only_while_locked() {
let mut s = server();
let init = Client::attach(&mut s, 0);
let shell = init.narrowed(&mut s, b"", true);
let purge = |s: &mut Srv, badge: usize, path: &[u8]| {
init.put(s, path);
call(s, badge, StorageRequest::Purge { path_len: path.len() }).0
};
assert_eq!(purge(&mut s, shell.badge, b"users/x"), StorageResponse::Error);
assert_eq!(purge(&mut s, 0, b"bin"), StorageResponse::Denied);
assert_eq!(purge(&mut s, 0, b"users/../bin"), StorageResponse::Denied);
assert_eq!(purge(&mut s, 0, b"users/"), StorageResponse::Denied);
assert_eq!(purge(&mut s, 0, b"users/x"), StorageResponse::Ok);
assert_eq!(purge(&mut s, 0, b"users"), StorageResponse::Ok);
}

4
crates/servers/terminal-server/src/lib.rs
View File

@@ -103,6 +103,10 @@ impl server::Console for Screen {
fn interrupt(&mut self, notification: CapSlot) {
let _ = syscall::signal(notification);
}
fn forget(&mut self, notification: CapSlot) {
syscall::drop_cap(notification);
}
}
pub fn run() -> ! {

11
crates/servers/terminal-server/src/server.rs
View File

@@ -24,6 +24,8 @@ pub trait Console {
/// Takes input focus back from whoever took it, and clears the screen.
fn take_focus(&mut self);
fn interrupt(&mut self, notification: CapSlot);
/// Lets go of a notification it was given.
fn forget(&mut self, notification: CapSlot);
}
pub const BACKSPACE: u8 = 8;
@@ -232,7 +234,7 @@ impl<C: Console> Server for TerminalServer<C> {
Done
}
fn handle_call(&mut self, _badge: usize, words: [usize; 4], cap: Option<CapSlot>) -> ([usize; 4], Option<libkos::syscall::Give>) {
fn handle_call(&mut self, badge: usize, words: [usize; 4], cap: Option<CapSlot>) -> ([usize; 4], Option<libkos::syscall::Give>) {
let reply = match words[0] {
types::terminal::READ => self.read(false),
types::terminal::READ_SECRET => self.read(true),
@@ -252,6 +254,13 @@ impl<C: Console> Server for TerminalServer<C> {
}
_ => [MALFORMED, 0, 0, 0],
},
types::terminal::SIGNED_OUT if badge == 0 => {
if let Some(n) = self.on_interrupt.take() {
self.console.forget(n);
}
[0; 4]
}
types::terminal::SIGNED_OUT => [MALFORMED, 0, 0, 0],
types::terminal::CLEAR => {
self.handle(Request::Clear);
[0; 4]

18
crates/servers/terminal-server/src/tests/server.rs
View File

@@ -20,6 +20,7 @@ struct Fake {
/// Every row drawn, with how many cells.
rows_drawn: Vec<(usize, usize)>,
interrupted: Vec<CapSlot>,
forgotten: Vec<CapSlot>,
}
impl Console for Fake {
@@ -48,6 +49,9 @@ impl Console for Fake {
fn interrupt(&mut self, notification: CapSlot) {
self.interrupted.push(notification);
}
fn forget(&mut self, notification: CapSlot) {
self.forgotten.push(notification);
}
}
fn term(keys: &[u8]) -> TerminalServer<Fake> {
@@ -186,3 +190,17 @@ fn a_secret_line_shows_stars_and_is_forgotten() {
assert_eq!(&t.grid().row(0)[..8], b"*******\x20");
assert!(!t.grid().row(0).windows(7).any(|w| w == b"hunter2"));
}
#[test]
fn only_init_lets_the_next_session_register_for_ctrl_c() {
use server_framework::MALFORMED;
let mut t = term(&[]);
assert_eq!(on_interrupt(&mut t, 7), 0);
assert_eq!(on_interrupt(&mut t, 8), MALFORMED, "an app cannot take Ctrl+C over");
let signed_out = |t: &mut TerminalServer<Fake>, badge| t.handle_call(badge, [types::terminal::SIGNED_OUT, 0, 0, 0], None).0[0];
assert_eq!(signed_out(&mut t, 1), MALFORMED, "nor say the user signed out");
assert_eq!(on_interrupt(&mut t, 8), MALFORMED);
assert_eq!(signed_out(&mut t, 0), 0);
assert_eq!(t.console().forgotten, [CapSlot::new(7).unwrap()]);
assert_eq!(on_interrupt(&mut t, 9), 0, "the next shell may");
}