feat: add permission consent prompts, drop permitted capability mask

programs/include/montauk/capabilities.h

@@ -56,6 +56,32 @@ namespace caps {
         return 0;
     }
 
+    // True when a grant for `path` can apply: the program is installed under
+    // 0:/os or 0:/apps, which cannot be rewritten without system_image. The
+    // kernel enforces this (Fs::IsSystemImage) by starting any other program
+    // without capabilities; this copy of the rule is only for display.
+    inline bool is_installed_path(const char* path) {
+        if (path == nullptr) return false;
+        const char* p = path;
+        uint64_t drive = 0;
+        if (*p < '0' || *p > '9') return false;
+        while (*p >= '0' && *p <= '9') drive = drive * 10 + (uint64_t)(*p++ - '0');
+        if (*p != ':' || drive != 0) return false;
+        p++;
+        static const char* const roots[] = {"/os", "/apps"};
+        for (const char* root : roots) {
+            int i = 0;
+            while (root[i]) {
+                char c = p[i];
+                if (c >= 'A' && c <= 'Z') c = (char)(c + ('a' - 'A'));
+                if (c != root[i]) break;
+                i++;
+            }
+            if (root[i] == '\0' && (p[i] == '\0' || p[i] == '/')) return true;
+        }
+        return false;
+    }
+
     // Read an array-of-strings key into a capability mask.
     inline uint64_t mask_from_key(const montauk::toml::Doc& doc, const char* key) {
         montauk::toml::Value* arr = doc.get_array(key);
@@ -97,7 +123,7 @@ namespace caps {
     // path has no entry, which is the common case and means "no authority".
     inline bool lookup(const char* binary_path,
                        montauk::abi::SpawnCapabilities& out) {
-        out = {0, 0, 0};
+        out = {0, 0};
         if (binary_path == nullptr || binary_path[0] == '\0') return false;
 
         montauk::toml::Doc doc = montauk::config::load(GRANT_CONFIG);
@@ -117,15 +143,7 @@ namespace caps {
             uint64_t effective = mask_from_key(doc, sibling);
             build_sibling_key(entry->key, "delegable", sibling, sizeof(sibling));
             uint64_t delegable = mask_from_key(doc, sibling);
-            build_sibling_key(entry->key, "permitted", sibling, sizeof(sibling));
-            uint64_t permitted = mask_from_key(doc, sibling);
 
-            // A grant that does not name `permitted` owns exactly what it can
-            // use or pass on.  Declaring it separately is only needed by a
-            // supervisor that holds authority in reserve (login).
-            if (permitted == 0) permitted = effective | delegable;
-
-            out.permitted = permitted;
             out.effective = effective;
             out.delegable = delegable;
             found = true;
@@ -137,7 +155,7 @@ namespace caps {
 
     // The calling process's own capability masks.
     inline bool self(montauk::abi::SpawnCapabilities& out) {
-        out = {0, 0, 0};
+        out = {0, 0};
         return montauk::getcaps(&out) == 0;
     }
 
@@ -150,15 +168,14 @@ namespace caps {
     // actually delegate.
     inline montauk::abi::SpawnCapabilities for_binary(const char* binary_path,
                                                       uint64_t caller_delegable) {
-        montauk::abi::SpawnCapabilities caps{0, 0, 0};
+        montauk::abi::SpawnCapabilities caps{0, 0};
 
         if (caller_delegable == 0) return caps;
 
         if (!lookup(binary_path, caps)) return caps;
 
-        caps.permitted &= caller_delegable;
-        caps.effective &= caps.permitted;
-        caps.delegable &= caps.permitted;
+        caps.effective &= caller_delegable;
+        caps.delegable &= caller_delegable;
         return caps;
     }