feat: add compositor capability

programs/data/config/capabilities.toml

@@ -3,18 +3,7 @@
 #
 # Capability names: process_admin, power_request, power_control, suspend,
 # storage_admin, raw_storage, network_admin, set_time, user_admin,
-# display_admin, device_admin, log_read, system_image, and "all".
-#
-# "all" is every capability except system_image, which must always be named
-# explicitly: it is write access to 0:/os and 0:/apps, and since grants are
-# keyed on binary path, holding it is equivalent to holding every capability
-# the system can issue from the next launch onwards.  Nothing is granted it.
-#
-# A grant is always clamped by the kernel to what the launching process may
-# actually delegate, so "all" in a launcher entry means "whatever this session
-# was given", not "root".
-#
-#
+# display_admin, device_admin, log_read, system_image, compositor and "all".
 
 # ==== System services (started by init) ====
 
@@ -28,7 +17,7 @@ effective = ["set_time"]
 
 [grant.login]
 path = "0:/os/login.elf"
-permitted = ["all"]
+permitted = ["all", "compositor"]
 effective = [
     "power_control", "storage_admin", "device_admin",
     "user_admin", "process_admin", "log_read",
@@ -36,7 +25,7 @@ effective = [
 delegable = [
     "power_request", "suspend", "process_admin", "storage_admin",
     "raw_storage", "network_admin", "set_time", "user_admin",
-    "display_admin", "device_admin", "log_read",
+    "display_admin", "device_admin", "log_read", "compositor",
 ]
 
 [grant.sshd]
@@ -48,7 +37,7 @@ path = "0:/os/desktop.elf"
 effective = [
     "power_request", "suspend", "process_admin", "storage_admin",
     "raw_storage", "network_admin", "set_time", "user_admin",
-    "display_admin", "device_admin", "log_read",
+    "display_admin", "device_admin", "log_read", "compositor",
 ]
 delegable = [
     "power_request", "suspend", "process_admin", "storage_admin",
@@ -56,12 +45,6 @@ delegable = [
     "display_admin", "device_admin", "log_read",
 ]
 
-# The console session launchers.  terminal.elf needs no authority of its own;
-# it exists to pass the session's authority to the shell it hosts.  The shell
-# in turn exercises only power_request and suspend, but delegates on the same
-# terms as the desktop so that the tools below work from a console.  Both are
-# clamped to the launching session: a standard session narrows this to
-# power_request and suspend, and an unprivileged one to nothing.
 [grant.terminal]
 path = "0:/apps/terminal/terminal.elf"
 delegable = ["all"]