feat: unify system status codes

template/sysroot/include/montauk/capabilities.h

@@ -0,0 +1,216 @@
+/*
+    * capabilities.h
+    * Shared reader for the capability grant table (0:/config/capabilities.toml)
+    * Copyright (c) 2026 Daniel Hammer
+*/
+
+#pragma once
+#include <montauk/syscall.h>
+#include <montauk/toml.h>
+#include <montauk/config.h>
+#include <montauk/heap.h>
+
+namespace montauk {
+namespace caps {
+
+    inline constexpr const char* GRANT_CONFIG = "capabilities";
+    inline constexpr const char* GRANT_PREFIX = "grant.";
+
+    struct CapName {
+        const char* name;
+        uint64_t    bit;
+    };
+
+    // Names as they appear in the config file.  Kept in the same order as the
+    // CAP_* bit definitions in Api/Syscall.hpp.
+    inline constexpr CapName NAMES[] = {
+        {"process_admin", montauk::abi::CAP_PROCESS_ADMIN},
+        {"power_request", montauk::abi::CAP_POWER_REQUEST},
+        {"power_control", montauk::abi::CAP_POWER_CONTROL},
+        {"suspend",       montauk::abi::CAP_SUSPEND},
+        {"storage_admin", montauk::abi::CAP_STORAGE_ADMIN},
+        {"raw_storage",   montauk::abi::CAP_RAW_STORAGE},
+        {"network_admin", montauk::abi::CAP_NETWORK_ADMIN},
+        {"set_time",      montauk::abi::CAP_SET_TIME},
+        {"user_admin",    montauk::abi::CAP_USER_ADMIN},
+        {"display_admin", montauk::abi::CAP_DISPLAY_ADMIN},
+        {"device_admin",  montauk::abi::CAP_DEVICE_ADMIN},
+        {"log_read",      montauk::abi::CAP_LOG_READ},
+        {"system_image",  montauk::abi::CAP_SYSTEM_IMAGE},
+        {"compositor",    montauk::abi::CAP_COMPOSITOR},
+    };
+
+    // Never implied by "all": each must be named explicitly in a grant.
+    inline constexpr uint64_t EXPLICIT_ONLY =
+        montauk::abi::CAP_SYSTEM_IMAGE | montauk::abi::CAP_COMPOSITOR;
+
+    inline uint64_t bit_for_name(const char* name) {
+        if (name == nullptr || name[0] == '\0') return 0;
+        // "all" means "everything this launcher may pass on".
+        if (montauk::streq(name, "all"))
+            return montauk::abi::CAP_ALL & ~EXPLICIT_ONLY;
+        for (const auto& entry : NAMES) {
+            if (montauk::streq(entry.name, name)) return entry.bit;
+        }
+
+        return 0;
+    }
+
+    // True when a grant for `path` can apply: the program is installed under
+    // 0:/os or 0:/apps, which cannot be rewritten without system_image. The
+    // kernel enforces this (Fs::IsSystemImage) by starting any other program
+    // without capabilities; this copy of the rule is only for display.
+    inline bool is_installed_path(const char* path) {
+        if (path == nullptr) return false;
+        const char* p = path;
+        uint64_t drive = 0;
+        if (*p < '0' || *p > '9') return false;
+        while (*p >= '0' && *p <= '9') drive = drive * 10 + (uint64_t)(*p++ - '0');
+        if (*p != ':' || drive != 0) return false;
+        p++;
+        static const char* const roots[] = {"/os", "/apps"};
+        for (const char* root : roots) {
+            int i = 0;
+            while (root[i]) {
+                char c = p[i];
+                if (c >= 'A' && c <= 'Z') c = (char)(c + ('a' - 'A'));
+                if (c != root[i]) break;
+                i++;
+            }
+            if (root[i] == '\0' && (p[i] == '\0' || p[i] == '/')) return true;
+        }
+        return false;
+    }
+
+    // Read an array-of-strings key into a capability mask.
+    inline uint64_t mask_from_key(const montauk::toml::Doc& doc, const char* key) {
+        montauk::toml::Value* arr = doc.get_array(key);
+        if (arr == nullptr) return 0;
+
+        uint64_t mask = 0;
+        for (int i = 0; i < arr->array.count; i++) {
+            montauk::toml::Value* item = arr->array.items[i];
+            if (item == nullptr || item->type != montauk::toml::Type::String) continue;
+            mask |= bit_for_name(item->str);
+        }
+        return mask;
+    }
+
+    // Append `suffix` to the "grant.<id>." stem of `path_key`.
+    // Returns false if the key is not of that shape or does not fit.
+    inline bool build_sibling_key(const char* path_key, const char* suffix,
+                                  char* out, int outSz) {
+        int prefixLen = 0;
+        for (; GRANT_PREFIX[prefixLen]; prefixLen++) {
+            if (path_key[prefixLen] != GRANT_PREFIX[prefixLen]) return false;
+        }
+
+        // Copy through the final '.' so "grant.foo.path" yields "grant.foo.".
+        int lastDot = -1;
+        for (int i = 0; path_key[i]; i++) {
+            if (path_key[i] == '.') lastDot = i;
+        }
+        if (lastDot < prefixLen) return false;
+
+        int n = 0;
+        for (; n <= lastDot && n < outSz - 1; n++) out[n] = path_key[n];
+        for (int i = 0; suffix[i] && n < outSz - 1; i++) out[n++] = suffix[i];
+        out[n] = '\0';
+        return true;
+    }
+
+    // Look up the grant declared for `binary_path`.  Returns false when the
+    // path has no entry, which is the common case and means "no authority".
+    inline bool lookup(const char* binary_path,
+                       montauk::abi::SpawnCapabilities& out) {
+        out = {0, 0};
+        if (binary_path == nullptr || binary_path[0] == '\0') return false;
+
+        montauk::toml::Doc doc = montauk::config::load(GRANT_CONFIG);
+
+        bool found = false;
+        for (int i = 0; i < doc.entries.count && !found; i++) {
+            montauk::toml::Value* entry = doc.entries.items[i];
+            if (entry == nullptr || entry->key == nullptr) continue;
+            if (entry->type != montauk::toml::Type::String) continue;
+
+            char sibling[128];
+            if (!build_sibling_key(entry->key, "path", sibling, sizeof(sibling))) continue;
+            if (!montauk::streq(sibling, entry->key)) continue;
+            if (!montauk::streq(entry->str, binary_path)) continue;
+
+            build_sibling_key(entry->key, "effective", sibling, sizeof(sibling));
+            uint64_t effective = mask_from_key(doc, sibling);
+            build_sibling_key(entry->key, "delegable", sibling, sizeof(sibling));
+            uint64_t delegable = mask_from_key(doc, sibling);
+
+            out.effective = effective;
+            out.delegable = delegable;
+            found = true;
+        }
+
+        doc.destroy();
+        return found;
+    }
+
+    // The calling process's own capability masks.
+    inline bool self(montauk::abi::SpawnCapabilities& out) {
+        out = {0, 0};
+        return montauk::getcaps(&out) == 0;
+    }
+
+    inline uint64_t self_delegable() {
+        montauk::abi::SpawnCapabilities mine;
+        return self(mine) ? mine.delegable : 0;
+    }
+
+    // Build a spawn request for `binary_path`, clamped to what the caller may
+    // actually delegate.
+    inline montauk::abi::SpawnCapabilities for_binary(const char* binary_path,
+                                                      uint64_t caller_delegable) {
+        montauk::abi::SpawnCapabilities caps{0, 0};
+
+        if (caller_delegable == 0) return caps;
+
+        if (!lookup(binary_path, caps)) return caps;
+
+        caps.effective &= caller_delegable;
+        caps.delegable &= caller_delegable;
+        return caps;
+    }
+
+    // The calling process's delegable set, cached.
+    inline uint64_t my_delegable() {
+        static uint64_t cached = 0;
+        static bool     loaded = false;
+        if (!loaded) {
+            cached = self_delegable();
+            loaded = true;
+        }
+        return cached;
+    }
+
+    struct LaunchOptions {
+        const char* args = nullptr;
+        // Owner identity for the child.  Requires CAP_USER_ADMIN and is
+        // reserved for session creators (init, login);
+        const char* user = nullptr;
+        // True for a console host that reads and writes the child's I/O
+        // through the childio calls rather than sharing its own.
+        bool redirected = false;
+    };
+
+    // Unified launch helper.
+    inline int launch(const char* path, const LaunchOptions& opt = {}) {
+        if (path == nullptr || path[0] == '\0') return -1;
+
+        if (opt.redirected && opt.user != nullptr) return -1;
+
+        montauk::abi::SpawnCapabilities caps = for_binary(path, my_delegable());
+        return opt.redirected
+            ? spawn_redir_with_caps(path, opt.args, caps)
+            : spawn_with_caps(path, opt.args, opt.user, caps);
+    }
+
+} // namespace caps
+} // namespace montauk