feat: add permission consent prompts, drop permitted capability mask

kernel/src/Fs/ProtectedPaths.cpp

@@ -28,6 +28,7 @@ namespace Fs {
         {"/config/init.toml",        false, montauk::abi::CAP_USER_ADMIN},
         {"/config/ssh.toml",         false, montauk::abi::CAP_USER_ADMIN},
         {"/config/capabilities.toml",false, montauk::abi::CAP_USER_ADMIN},
+        {"/config/consent.toml",     false, montauk::abi::CAP_USER_ADMIN},
         {"/config/wallpaper.cache",  false, montauk::abi::CAP_USER_ADMIN},
         // Read by the Bluetooth driver at controller bring-up.
         {"/config/bluetooth.toml",   false, montauk::abi::CAP_DEVICE_ADMIN},
@@ -87,6 +88,10 @@ namespace Fs {
         return required;
     }
 
+    bool IsSystemImage(const char* path) {
+        return (RequiredFileWriteCapability(path) & montauk::abi::CAP_SYSTEM_IMAGE) != 0;
+    }
+
     void LogProtectedPaths() {
         for (const auto& rule : g_protectedPaths) {
             Kt::KernelLogStream(Kt::INFO, "IPC") << "Protected path "

kernel/src/Fs/ProtectedPaths.hpp

@@ -13,6 +13,11 @@ namespace Fs {
     // re-timestamp `path`. Returns 0 when the path is unprotected.
     uint64_t RequiredFileWriteCapability(const char* path);
 
+    // True for an installed program image: one on the system volume that
+    // cannot be replaced without CAP_SYSTEM_IMAGE (0:/os, 0:/apps). Only such
+    // an image is identified by its path well enough to carry a grant.
+    bool IsSystemImage(const char* path);
+
     // Log the rule table at boot, so a path that should be protected and is
     // not is visible rather than silently missing.
     void LogProtectedPaths();