refactor: move wallpaper.cache to 0:/state

kernel/src/Api/BuildNo.hpp

@@ -12,4 +12,4 @@
 
 #pragma once
 
-#define MONTAUK_BUILD_NUMBER 3
+#define MONTAUK_BUILD_NUMBER 4

kernel/src/Fs/ProtectedPaths.cpp

@@ -29,9 +29,13 @@ namespace Fs {
         {"/config/ssh.toml",         false, montauk::abi::CAP_USER_ADMIN},
         {"/config/capabilities.toml",false, montauk::abi::CAP_USER_ADMIN},
         {"/config/consent.toml",     false, montauk::abi::CAP_USER_ADMIN},
-        {"/config/wallpaper.cache",  false, montauk::abi::CAP_USER_ADMIN},
         // Read by the Bluetooth driver at controller bring-up.
         {"/config/bluetooth.toml",   false, montauk::abi::CAP_DEVICE_ADMIN},
+        // Login's wallpaper cache. The directory is listed for the same reason
+        // as /config: a rename only checks its own path, so an unlisted parent
+        // could be swapped for one holding a forged cache.
+        {"/state/cache",             false, montauk::abi::CAP_USER_ADMIN},
+        {"/state/cache/wallpaper.cache", false, montauk::abi::CAP_USER_ADMIN},
         {"/apps",                    true,  montauk::abi::CAP_SYSTEM_IMAGE},
         {"/os",                      true,  montauk::abi::CAP_SYSTEM_IMAGE},
     };

programs/src/login/login_wallpaper.cpp

@@ -12,9 +12,15 @@ namespace {
 constexpr const char* kDefaultWallpaperPath = "0:/os/wallpapers/default.jpg";
 
 // Screen-sized, already tinted pixels, so a re-login skips the JPEG decode and
-// the rescale entirely. Kernel-protected (CAP_USER_ADMIN) because it is drawn
+// the rescale entirely. Kernel-protected (CAP_USER_ADMIN), along with its
-// on a screen that is about to take a password.
+// directory, because it is drawn on a screen that is about to take a password.
-constexpr const char* kCachePath = "0:/config/wallpaper.cache";
+constexpr const char* kStateDir  = "0:/state";
+constexpr const char* kCacheDir  = "0:/state/cache";
+constexpr const char* kCachePath = "0:/state/cache/wallpaper.cache";
+
+// Where the cache lived before it moved out of 0:/config. Deleted when the new
+// one is first written so an upgraded install does not keep the stale copy.
+constexpr const char* kLegacyCachePath = "0:/config/wallpaper.cache";
 
 constexpr uint32_t kCacheMagic   = 0x4350574DU;  // "MWPC"
 constexpr uint32_t kCacheVersion = 1;
@@ -137,6 +143,10 @@ void save_to_cache(const LoginState* ls, const char* srcPath,
     header->overlayAlpha = kLoginOverlayAlpha;
     montauk::strncpy(header->sourcePath, srcPath, sizeof(header->sourcePath));
 
+    montauk::fdelete(kLegacyCachePath);
+    montauk::fmkdir(kStateDir);
+    montauk::fmkdir(kCacheDir);
+
     int fd = montauk::fcreate(kCachePath);
     if (fd < 0) return;  // read-only volume or no authority: not fatal
     // One write, so the file is never briefly visible half-written and the