feat: implement kernel capability model

kernel/src/Api/Filesystem.hpp

@@ -17,8 +17,14 @@
 #include <Ipc/Ipc.hpp>
 #include <Timekeeping/Time.hpp>
 #include "Path.hpp"
+#include <Fs/ProtectedPaths.hpp>
 
 namespace montauk::abi {
+    static bool CanModifyFilePath(const char* resolved) {
+        uint64_t required = Fs::RequiredFileWriteCapability(resolved);
+        return required == 0 || Sched::HasCapability(required);
+    }
+
     static int Sys_Open(const char* path) {
         char resolved[256];
         if (!ResolveProcessPath(path, resolved, sizeof(resolved))) return -1;
@@ -108,12 +114,14 @@ namespace montauk::abi {
     static int Sys_FCreate(const char* path) {
         char resolved[256];
         if (!ResolveProcessPath(path, resolved, sizeof(resolved))) return -1;
+        if (!CanModifyFilePath(resolved)) return SYS_ERR_PERMISSION;
         return Ipc::CreateFileHandle(resolved);
     }
 
     static int Sys_FDelete(const char* path) {
         char resolved[256];
         if (!ResolveProcessPath(path, resolved, sizeof(resolved))) return -1;
+        if (!CanModifyFilePath(resolved)) return SYS_ERR_PERMISSION;
         return Fs::Vfs::VfsDelete(resolved);
     }
 
@@ -138,6 +146,9 @@ namespace montauk::abi {
                          bool useCurrent) {
         char resolved[256];
         if (!ResolveProcessPath(path, resolved, sizeof(resolved))) return -1;
+        // Timestamps are file state like any other: a protected path must not
+        // be mutable through a side door that skips the write check.
+        if (!CanModifyFilePath(resolved)) return SYS_ERR_PERMISSION;
         if (useCurrent) {
             int64_t now = Timekeeping::GetUnixTimestamp();
             atime = now;
@@ -149,6 +160,7 @@ namespace montauk::abi {
     static int Sys_FMkdir(const char* path) {
         char resolved[256];
         if (!ResolveProcessPath(path, resolved, sizeof(resolved))) return -1;
+        if (!CanModifyFilePath(resolved)) return SYS_ERR_PERMISSION;
         return Fs::Vfs::VfsMkdir(resolved);
     }
 
@@ -157,6 +169,8 @@ namespace montauk::abi {
         char resolvedNew[256];
         if (!ResolveProcessPath(oldPath, resolvedOld, sizeof(resolvedOld))) return -1;
         if (!ResolveProcessPath(newPath, resolvedNew, sizeof(resolvedNew))) return -1;
+        if (!CanModifyFilePath(resolvedOld) || !CanModifyFilePath(resolvedNew))
+            return SYS_ERR_PERMISSION;
         return Fs::Vfs::VfsRename(resolvedOld, resolvedNew);
     }