feat: add compositor capability

programs/src/capabilities/main.cpp

@@ -60,6 +60,7 @@ static const char* const kCapDescriptions[CAP_COUNT] = {
     "Manage hardware devices (Bluetooth, radio)",
     "Read the kernel log",
     "Write to 0:/os and 0:/apps (never part of \"all\")",
+    "Read and send input to other windows (never part of \"all\")",
 };
 
 // ==== Grant table model ====

programs/src/login/login_input.cpp

@@ -72,6 +72,10 @@ void launch_session(LoginState* ls) {
         pid = montauk::spawn_with_caps("0:/apps/terminal/terminal.elf",
                                        console_args, ls->username, caps);
     } else {
+        // The desktop is also the compositor. That authority is not the
+        // session's to pass on, so it is added here and not delegable.
+        caps.permitted |= montauk::abi::CAP_COMPOSITOR;
+        caps.effective |= montauk::abi::CAP_COMPOSITOR;
         pid = montauk::spawn_with_caps("0:/os/desktop.elf", ls->username,
                                        ls->username, caps);
     }

programs/src/login/main.cpp

@@ -33,6 +33,9 @@ static void maybe_run_setup_session() {
     // Matches launch_session(): a session delegates from what it holds, and
     // the grant table decides which program receives which part of it.
     caps.delegable = caps.permitted;
+    // Compositor authority for the desktop itself, never delegable onwards.
+    caps.permitted |= montauk::abi::CAP_COMPOSITOR;
+    caps.effective |= montauk::abi::CAP_COMPOSITOR;
     int pid = montauk::spawn_with_caps("0:/os/desktop.elf", user, user, caps);
     if (pid >= 0) {
         montauk::waitpid(pid);