feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

crates/apps/spawntest/src/main.rs

@@ -125,10 +125,46 @@ fn revoke_stops_a_running_app(died: CapSlot) -> Result<(), &'static str> {
     Ok(())
 }
 
+/// The owner's area is sealed: seeded from the factory, and what is
+/// written there one boot reads back the next.
+fn encrypted_home(fs: &mut Storage) -> Result<(), &'static str> {
+    let mut home = [0u8; 512];
+    let mut factory = [0u8; 512];
+    let read = |fs: &mut Storage, path: &[u8], out: &mut [u8]| -> Result<usize, &'static str> {
+        let h = fs.open(path).map_err(|_| "cannot open")?;
+        let n = fs.read(h, out).map_err(|_| "cannot read (a seal broken?)")?;
+        let _ = fs.close(h);
+        Ok(n)
+    };
+    let n = read(fs, b"home/readme.txt", &mut home)?;
+    let m = read(fs, b"factory/home/readme.txt", &mut factory)?;
+    if home[..n] != factory[..m] {
+        return Err("the encrypted home does not hold the factory's readme");
+    }
+    libkos::println!("spawntest: home seeded from the factory, reads back through its seal: ok");
+    const NOTE: &[u8] = b"sealed across a reboot";
+    let mut back = [0u8; 64];
+    match read(fs, b"home/persist.txt", &mut back) {
+        Ok(n) if &back[..n] == NOTE => libkos::println!("spawntest: an encrypted file from the last boot reads back: ok"),
+        Ok(_) => return Err("an encrypted file from the last boot reads back wrong"),
+        Err(_) => {
+            let h = fs.create(b"home/persist.txt").map_err(|_| "cannot create in home")?;
+            let wrote = fs.write(h, NOTE) == Ok(NOTE.len());
+            let _ = fs.close(h);
+            if !wrote {
+                return Err("cannot write in home");
+            }
+            libkos::println!("spawntest: wrote an encrypted file for the next boot");
+        }
+    }
+    Ok(())
+}
+
 fn check() -> Result<(), &'static str> {
     let mut fs = Storage::attach(STORAGE, STORAGE_BUF_VA).map_err(|_| "cannot attach to storage")?;
     write_a_file(&mut fs)?;
     libkos::println!("spawntest: a file written to ext4 reads back: ok");
+    encrypted_home(&mut fs)?;
 
     let died = syscall::create_notification().map_err(|_| "no notification")?;
     narrow_storage(&mut fs, died)?;