feat: add compositor capability

kernel/src/Api/BuildNo.hpp

@@ -12,4 +12,4 @@
 
 #pragma once
 
-#define MONTAUK_BUILD_NUMBER 236
+#define MONTAUK_BUILD_NUMBER 239

kernel/src/Api/Syscall.hpp

@@ -372,7 +372,14 @@ namespace montauk::abi {
        whatever that image is granted at its next launch. Formatting a data
        volume must not carry that authority with it. */
     static constexpr uint64_t CAP_SYSTEM_IMAGE   = 1ULL << 12;
-    static constexpr uint64_t CAP_ALL            = (1ULL << 13) - 1;
+    /* Map other processes' windows and deliver input events to them
+       (SYS_WINMAP, SYS_WINSENDEVENT): the desktop compositor's authority.
+       Anything holding it can read every window's pixels and click on any
+       window, including a consent prompt it is itself waiting on, so it is
+       never part of a session mask, never part of "all", and never
+       delegated by the compositor to what it launches. */
+    static constexpr uint64_t CAP_COMPOSITOR     = 1ULL << 13;
+    static constexpr uint64_t CAP_ALL            = (1ULL << 14) - 1;
     static constexpr uint64_t CAP_STANDARD_SESSION = CAP_POWER_REQUEST | CAP_SUSPEND;
     static constexpr uint64_t CAP_ADMIN_SESSION =
         CAP_STANDARD_SESSION | CAP_PROCESS_ADMIN | CAP_STORAGE_ADMIN |
@@ -384,6 +391,9 @@ namespace montauk::abi {
     static_assert((CAP_ADMIN_SESSION & CAP_SYSTEM_IMAGE) == 0,
                   "an admin session must not imply authority to rewrite the "
                   "programs it launches; grant CAP_SYSTEM_IMAGE per binary");
+    static_assert((CAP_ADMIN_SESSION & CAP_COMPOSITOR) == 0,
+                  "a session must not delegate the compositor's authority; "
+                  "login grants it to the desktop directly");
     static constexpr int SYS_ERR_PERMISSION = -13;
 
     struct SpawnCapabilities {

kernel/src/Api/Window.hpp

@@ -45,7 +45,12 @@ namespace montauk::abi {
         return WinServer::Enumerate(outArray, maxCount);
     }
 
+    // Mapping another process's window and injecting input into it are the
+    // compositor's job alone. Left open, any app could read every window's
+    // pixels or click on any window -- including a prompt asking the user
+    // whether to grant that same app authority.
     static uint64_t Sys_WinMap(int windowId) {
+        if (!Sched::HasCapability(CAP_COMPOSITOR)) return 0;
         auto* proc = Sched::GetCurrentProcessPtr();
         if (proc == nullptr) return 0;
         return WinServer::Map(windowId, proc->pid, proc->pml4Phys, proc->heapNext);
@@ -58,6 +63,7 @@ namespace montauk::abi {
     }
 
     static int Sys_WinSendEvent(int windowId, const WinEvent* event) {
+        if (!Sched::HasCapability(CAP_COMPOSITOR)) return SYS_ERR_PERMISSION;
         if (event == nullptr) return -1;
         return WinServer::SendEvent(windowId, event);
     }