daniel/MontaukOS
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: clean up ProtectedPaths module

Browse Source
This commit is contained in:
daniel committed 2026-09-20 16:25:29 +02:00
1 parent 95e8a739d4
commit c54181103f
1 file changed
+5 -35
Download Patch File Download Diff File Expand all files Collapse all files
kernel/src/Fs/ProtectedPaths.cpp
+5 -35
View File
@@ -2,9 +2,6 @@
* ProtectedPaths.cpp
* Capability required to modify paths on the booted system volume
* Copyright (c) 2026 Daniel Hammer
*
* Split out of Ipc.cpp: this is filesystem security policy, not IPC. It
* lived there only because OpenFileHandleForSlot was its first caller.
*/
#include "ProtectedPaths.hpp"
@@ -15,22 +12,9 @@
namespace Fs {
// ==== Protected system paths ====
// The capability required to modify (create, write, delete or rename) a
// path. The kernel only ever enumerates paths here; it never parses a
// policy file. Userspace grant policy lives in 0:/config/capabilities.toml
// and can only ever narrow what the kernel already delegated, so no input
// to that file can produce authority this table does not already allow.
//
// Rules apply ONLY to the system volume. Drive 0 is always the boot
// ramdisk (Fs/Boot.cpp registers it unconditionally); every other drive is
// a partition discovered at probe time, in probe order. A user data disk
// that happens to contain an "apps" or "config" directory must not inherit
// system protection, and an installed system's files on another volume are
// inert data until that disk is booted -- at which point its contents are
// themselves the drive-0 ramdisk.
// Anything the kernel itself reads belongs here:
// guarding only the syscall leaves the file as an unguarded second path to
// the same state (bluetooth.toml feeds the BD_ADDR override at bring-up).
// Rules apply ONLY to the system volume (drive 0).
struct ProtectedPath {
const char* pattern; // drive-relative, leading '/'
bool prefix; // also match everything beneath the pattern
@@ -38,29 +22,15 @@ namespace Fs {
};
static constexpr ProtectedPath g_protectedPaths[] = {
// Authentication, first-boot administrator creation, trusted service
// activation and capability grants. Readable by anyone; writable only
// with administrative authority. The bare directory is listed so it
// cannot be renamed or deleted out from under the files inside it.
{"/config", false, montauk::abi::CAP_USER_ADMIN},
{"/config", false, montauk::abi::CAP_USER_ADMIN}, /* listing the directory here prevents it being renamed or deleted */
{"/config/users.toml", false, montauk::abi::CAP_USER_ADMIN},
{"/config/setup.toml", false, montauk::abi::CAP_USER_ADMIN},
{"/config/init.toml", false, montauk::abi::CAP_USER_ADMIN},
{"/config/ssh.toml", false, montauk::abi::CAP_USER_ADMIN},
{"/config/capabilities.toml",false, montauk::abi::CAP_USER_ADMIN},
// Pre-scaled wallpaper the login screen blits before it has decoded
// anything. It is drawn on a screen that is about to take a password,
// so it must not be plantable by an unprivileged process.
{"/config/wallpaper.cache", false, montauk::abi::CAP_USER_ADMIN},
// Read by the Bluetooth driver at controller bring-up.
{"/config/bluetooth.toml", false, montauk::abi::CAP_DEVICE_ADMIN},
// Program images. Capability grants are keyed on binary path, so a
// writable image would let an unprivileged process substitute a binary
// and inherit the grant the next time a privileged launcher runs it.
// This is CAP_SYSTEM_IMAGE and not CAP_STORAGE_ADMIN precisely because
// it is the trusted computing base: partitioning and formatting a data
// volume is an ordinary administrative act, while replacing the image
// of login.elf is a route to every capability the system can issue.
{"/apps", true, montauk::abi::CAP_SYSTEM_IMAGE},
{"/os", true, montauk::abi::CAP_SYSTEM_IMAGE},
};
@@ -70,7 +40,7 @@ namespace Fs {
}
// The volume the running system was booted from.
static constexpr uint64_t SystemDrive = 0;
static constexpr uint64_t SystemDrive = 0; // pinned to drive 0. Must be changed in MontaukOS ever allows non-zero system drives.
// Strip the "<digits>:" prefix, but only for the system volume. Returns
// nullptr for any other drive, meaning no rule applies to it.