feat: add permission consent prompts, drop permitted capability mask

programs/data/config/capabilities.toml

@@ -4,6 +4,17 @@
 # Capability names: process_admin, power_request, power_control, suspend,
 # storage_admin, raw_storage, network_admin, set_time, user_admin,
 # display_admin, device_admin, log_read, system_image, compositor and "all".
+#
+# `effective` is what the program itself may use; `delegable` is what it may
+# pass on to programs it launches. The two are independent, and both are
+# clamped by the kernel to what the launcher can delegate.
+#
+# A grant only applies to a program under 0:/os or 0:/apps. Anything else can
+# be replaced by any process, so the kernel starts it with no capabilities.
+#
+# A program with no grant here can still ask for storage_admin, network_admin,
+# set_time, display_admin or log_read the first time it needs one: the desktop
+# prompts, and the answer is stored in 0:/config/consent.toml (docs/consent.md).
 
 # ==== System services (started by init) ====
 
@@ -17,7 +28,6 @@ effective = ["set_time"]
 
 [grant.login]
 path = "0:/os/login.elf"
-permitted = ["all", "compositor"]
 effective = [
     "power_control", "storage_admin", "device_admin",
     "user_admin", "process_admin", "log_read",
@@ -86,6 +96,11 @@ effective = ["set_time"]
 path = "0:/apps/bluetooth/bluetooth.elf"
 effective = ["device_admin"]
 
+# Writes 0:/config/consent.toml when a stored consent decision is forgotten.
+[grant.capabilities]
+path = "0:/apps/capabilities/capabilities.elf"
+effective = ["user_admin"]
+
 [grant.syslog]
 path = "0:/apps/syslog/syslog.elf"
 effective = ["log_read"]