26 lines
823 B
C++
26 lines
823 B
C++
/*
|
|
* ProtectedPaths.hpp
|
|
* Capability required to modify paths on the booted system volume
|
|
* Copyright (c) 2026 Daniel Hammer
|
|
*/
|
|
|
|
#pragma once
|
|
#include <cstdint>
|
|
|
|
namespace Fs {
|
|
|
|
// Capability a process must hold to create, write, delete, rename or
|
|
// re-timestamp `path`. Returns 0 when the path is unprotected.
|
|
uint64_t RequiredFileWriteCapability(const char* path);
|
|
|
|
// True for an installed program image: one on the system volume that
|
|
// cannot be replaced without CAP_SYSTEM_IMAGE (0:/os, 0:/apps). Only such
|
|
// an image is identified by its path well enough to carry a grant.
|
|
bool IsSystemImage(const char* path);
|
|
|
|
// Log the rule table at boot, so a path that should be protected and is
|
|
// not is visible rather than silently missing.
|
|
void LogProtectedPaths();
|
|
|
|
}
|