Daniel Samson
1379b699f3
A protocol is reached by name now, not by a compile-time integer. Init is PID 1 and already knows which binary it started, so init serves /protocol as a vfs backend: bind claims a contract with the provider's endpoint attached, open answers with that endpoint as the reply's capability, and readdir lists what is bound with the task and binary behind it. The kernel reserves the prefix — nothing may mount over it, under it, or unmount it — and ServiceId, ipc_register and ipc_lookup are gone, their syscall numbers left vacant. A bind is authorized by who the caller *is*: the kernel-stamped binary together with the supervising task's identity, matched against /system/configuration/protocol.csv. Identity, not spelling — spawn is ungated, so an attacker can run any bundled binary, and a name-only rule would have let it launder grants through an init of its own making. A name a live process holds is refused to everyone else; a dead one's is released. Three review rounds against a hostile ring-3 process found what 108 green tests could not, because the suite contains no attacker. Publishing init's supervision endpoint as the registry put PID 1's mailbox in every process's hands, where two forged bytes reached the shutdown path: privileged traffic is now believed only from the task that holds the contract it speaks for. A capability arriving on a request outlived every path that ignored it, one handle per call until the table was full — in init, and in the harness ten services share — so the arriving capability is owned by the turn and released unless a handler says otherwise. And the kernel let anyone holding an endpoint handle aim signals, timers, exit notices and interrupts at it: binding now requires having created it. Suite 108/108. The new protocol-registry case asserts eleven properties, each one an attack that must fail.
119 lines
7.2 KiB
Zig
119 lines
7.2 KiB
Zig
.{
|
|
// This is the default name used by packages depending on this one. For
|
|
// example, when a user runs `zig fetch --save <url>`, this field is used
|
|
// as the key in the `dependencies` table. Although the user can choose a
|
|
// different name, most users will stick with this provided value.
|
|
//
|
|
// It is redundant to include "zig" in this name because it is already
|
|
// within the Zig package namespace.
|
|
.name = .danos,
|
|
// This is a [Semantic Version](https://semver.org/).
|
|
// In a future version of Zig it will be used for package deduplication.
|
|
.version = "0.0.0",
|
|
// Together with name, this represents a globally unique package
|
|
// identifier. This field is generated by the Zig toolchain when the
|
|
// package is first created, and then *never changes*. This allows
|
|
// unambiguous detection of one package being an updated version of
|
|
// another.
|
|
//
|
|
// When forking a Zig project, this id should be regenerated (delete the
|
|
// field and run `zig build`) if the upstream project is still maintained.
|
|
// Otherwise, the fork is *hostile*, attempting to take control over the
|
|
// original project's identity. Thus it is recommended to leave the comment
|
|
// on the following line intact, so that it shows up in code reviews that
|
|
// modify the field.
|
|
.fingerprint = 0x402a07325b01d626, // Changing this has security and trust implications.
|
|
// Tracks the earliest Zig version that the package considers to be a
|
|
// supported use case.
|
|
.minimum_zig_version = "0.16.0",
|
|
// This field is optional.
|
|
// Each dependency must either provide a `url` and `hash`, or a `path`.
|
|
// `zig build --fetch` can be used to fetch all dependencies of a package, recursively.
|
|
// Once all dependencies are fetched, `zig build` no longer requires
|
|
// internet connectivity.
|
|
.dependencies = .{
|
|
// The danos build API — the shared user-binary recipe every build file
|
|
// (root and per-binary packages) consumes (docs/build-packages-plan.md).
|
|
.@"build-support" = .{ .path = "build-support" },
|
|
// The library domains, each a package exporting its modules.
|
|
.kernel = .{ .path = "library/kernel" },
|
|
.device = .{ .path = "library/device" },
|
|
.client = .{ .path = "library/client" },
|
|
.protocol = .{ .path = "library/protocol" },
|
|
.csv = .{ .path = "library/csv" },
|
|
.@"xkeyboard-config" = .{ .path = "library/xkeyboard-config" },
|
|
// Binary packages (phase 2), consumed as artifacts for the boot image.
|
|
.@"pci-bus" = .{ .path = "system/drivers/pci-bus" },
|
|
.init = .{ .path = "system/services/init" },
|
|
.fat = .{ .path = "system/services/fat" },
|
|
.display = .{ .path = "system/services/display" },
|
|
.@"display-demo" = .{ .path = "system/services/display-demo" },
|
|
.@"device-manager" = .{ .path = "system/services/device-manager" },
|
|
.input = .{ .path = "system/services/input" },
|
|
.logger = .{ .path = "system/services/logger" },
|
|
// The discovery pair and the /test fixtures are lazy: only what a
|
|
// given build actually ships gets its build file loaded and compiled
|
|
// (-Ddiscovery picks one of the pair; -Dtest-case pulls the fixtures).
|
|
.acpi = .{ .path = "system/services/acpi", .lazy = true },
|
|
.fdt = .{ .path = "system/services/fdt", .lazy = true },
|
|
.@"ps2-bus" = .{ .path = "system/drivers/ps2-bus" },
|
|
.@"usb-xhci-bus" = .{ .path = "system/drivers/usb-xhci-bus" },
|
|
.@"usb-hid" = .{ .path = "system/drivers/usb-hid" },
|
|
.@"usb-storage" = .{ .path = "system/drivers/usb-storage" },
|
|
.@"virtio-gpu" = .{ .path = "system/drivers/virtio-gpu" },
|
|
.@"vfs-test" = .{ .path = "test/system/services/vfs-test", .lazy = true },
|
|
.@"fat-test" = .{ .path = "test/system/services/fat-test", .lazy = true },
|
|
.@"shared-memory-server" = .{ .path = "test/system/services/shared-memory-server", .lazy = true },
|
|
.@"shared-memory-client" = .{ .path = "test/system/services/shared-memory-client", .lazy = true },
|
|
.@"crash-test" = .{ .path = "test/system/services/crash-test", .lazy = true },
|
|
.@"device-list" = .{ .path = "test/system/services/device-list", .lazy = true },
|
|
.@"pci-cap-test" = .{ .path = "test/system/services/pci-cap-test", .lazy = true },
|
|
.@"iommu-fault-test" = .{ .path = "test/system/services/iommu-fault-test", .lazy = true },
|
|
.@"input-source" = .{ .path = "test/system/services/input-source", .lazy = true },
|
|
.@"input-test" = .{ .path = "test/system/services/input-test", .lazy = true },
|
|
.@"args-echo" = .{ .path = "test/system/services/args-echo", .lazy = true },
|
|
.@"process-test" = .{ .path = "test/system/services/process-test", .lazy = true },
|
|
.@"thread-test" = .{ .path = "test/system/services/thread-test", .lazy = true },
|
|
.@"user-memory-test" = .{ .path = "test/system/services/user-memory-test", .lazy = true },
|
|
.@"protocol-registry-test" = .{ .path = "test/system/services/protocol-registry-test", .lazy = true },
|
|
// See `zig fetch --save <url>` for a command-line interface for adding dependencies.
|
|
//.example = .{
|
|
// // When updating this field to a new URL, be sure to delete the corresponding
|
|
// // `hash`, otherwise you are communicating that you expect to find the old hash at
|
|
// // the new URL. If the contents of a URL change this will result in a hash mismatch
|
|
// // which will prevent zig from using it.
|
|
// .url = "https://example.com/foo.tar.gz",
|
|
//
|
|
// // This is computed from the file contents of the directory of files that is
|
|
// // obtained after fetching `url` and applying the inclusion rules given by
|
|
// // `paths`.
|
|
// //
|
|
// // This field is the source of truth; packages do not come from a `url`; they
|
|
// // come from a `hash`. `url` is just one of many possible mirrors for how to
|
|
// // obtain a package matching this `hash`.
|
|
// //
|
|
// // Uses the [multihash](https://multiformats.io/multihash/) format.
|
|
// .hash = "...",
|
|
//
|
|
// // When this is provided, the package is found in a directory relative to the
|
|
// // build root. In this case the package's hash is irrelevant and therefore not
|
|
// // computed. This field and `url` are mutually exclusive.
|
|
// .path = "foo",
|
|
//
|
|
// // When this is set to `true`, a package is declared to be lazily
|
|
// // fetched. This makes the dependency only get fetched if it is
|
|
// // actually used.
|
|
// .lazy = false,
|
|
//},
|
|
},
|
|
// Specifies the set of files and directories that are included in this package.
|
|
// Only files and directories listed here are included in the `hash` that
|
|
// is computed for this package. Only files listed here will remain on disk
|
|
// when using the zig package manager. As a rule of thumb, one should list
|
|
// files required for compilation plus any license(s).
|
|
// Paths are relative to the build root. Use the empty string (`""`) to refer to
|
|
// the build root itself.
|
|
// A directory listed here means that all files within, recursively, are included.
|
|
.paths = .{""},
|
|
}
|