A started program receives the three streams and its grants, and nothing else

Builds on the previous commit, which left a started program a descriptor for
its own file instead of one for its base directory. Three further departures
from clause 7.13 of the specification are removed.

The descriptor for the program is opened close-on-exec, and only a program that
needs an interpreter keeps it: the kernel refuses such a program with ENOENT
before the point of no return, and the start is repeated with the flag cleared.
An ordinary executable now starts with nothing above the three streams. The
descriptor is moved above the placed positions, so that a caller without a
standard input does not hand a script its own descriptor as one.

What the caller itself inherited without the close-on-exec flag is no longer
passed on. Everything above the grants is marked in the started image with
close_range, or from /proc/self/fd or up to the descriptor limit on a kernel
older than 5.11.

Grants arrive. Every source is moved above the positions being filled before
any is placed, so one placement no longer overwrites another grant, a stream,
or the base the program's name is resolved under; a grant already at its own
position no longer keeps the flag that closed it. The names travel in
KAL_PREOPENS=<pid>{;<fd>,<len>,<name>}, bound to the started process by its
pid in the way systemd's LISTEN_FDS is, and kal_fs_preopen in the started
program enumerates exactly the grants, in order and by name. A count of zero
leaves none; not asking leaves the working directory and / as before.

tests/conformance_spawn.cpp observes each of these from the started program.
Against 0.15.0 seven of its observations fail.

Co-authored-by: speak-agent <248744407+speak-agent@users.noreply.github.com>

Author: Sunrisepeak

src/fs.cpp

@@ -3,6 +3,8 @@
 #include <openkal/fs.h>
 #include <openkal/memory.h>
 
+namespace okl { extern char** g_envp; }
+
 namespace {
 
 
@@ -20,11 +22,74 @@ struct preopen { const char* name; kal_uintptr len; okl_uptr handle; };
 
 char g_cwd[4096];
 
+constexpr kal_uintptr kMaxGrants = 16;
+
+// THE DIRECTORIES A STARTER GRANTED, WHEN THE PROGRAM WAS STARTED WITH GRANTS.
+//
+// They arrive as descriptors at 3 and upward, and their names in the variable
+// `kal_process_spawn' writes (see `vector::build_env' in process.cpp):
+//
+//     KAL_PREOPENS=<pid>{;<fd>,<len>,<name>}
+//
+// The value is read only when `<pid>' is this process, so one inherited through
+// a program that does not read it is not mistaken for a grant. A descriptor that
+// is not a directory is reported as a preopen this program may not use, which is
+// how an entry that could not be opened is reported anyway. Each descriptor is
+// marked to close on replacement as it is taken over, so that a grant reaches
+// the program it was made to and not that program's own children (SPEC.md
+// clause 7.13). The names point into the environment, which lives as long as
+// the program does.
+//
+// Answers false when there is no such value, which leaves the directories this
+// implementation supplies by default.
+bool granted(preopen* t, kal_uintptr* n) {
+    constexpr char key[] = "KAL_PREOPENS=";
+    constexpr okl_uptr key_len = sizeof key - 1;
+    const char* v = nullptr;
+    for (char** e = okl::g_envp; e && *e; ++e) {
+        okl_uptr i = 0;
+        while (i < key_len && (*e)[i] == key[i]) ++i;
+        if (i == key_len) { v = *e + key_len; break; }
+    }
+    if (v == nullptr) return false;
+
+    auto number = [&](okl_uptr& out) {
+        if (*v < '0' || *v > '9') return false;
+        out = 0;
+        while (*v >= '0' && *v <= '9') out = out * 10 + static_cast<okl_uptr>(*v++ - '0');
+        return true;
+    };
+    okl_uptr pid = 0;
+    if (!number(pid) || static_cast<okl_long>(pid) != okl::sys(okl::nr_getpid)) return false;
+
+    kal_uintptr k = 0;
+    while (*v == ';' && k < kMaxGrants) {
+        ++v;
+        okl_uptr fd = 0, len = 0;
+        if (!number(fd) || *v++ != ',' || !number(len) || *v++ != ',') return false;
+        for (okl_uptr i = 0; i < len; ++i) if (v[i] == '\0') return false;
+
+        okl::kstat st{};
+        const bool dir = !okl::failed(okl::sys(okl::nr_fstat, static_cast<okl_long>(fd),
+                                               reinterpret_cast<okl_long>(&st)))
+                      && (st.mode & okl::s_ifmt) == okl::s_ifdir;
+        if (dir) okl::sys(okl::nr_fcntl, static_cast<okl_long>(fd), okl::f_setfd, okl::fd_cloexec);
+        t[k++] = { v, len, dir ? okl::pack(static_cast<int>(fd)) : 0u };
+        v += len;
+    }
+    if (*v != '\0') return false;
+    *n = k;
+    return true;
+}
+
 preopen* table(kal_uintptr* count) {
-    static preopen t[2];
+    static preopen t[kMaxGrants];
+    static kal_uintptr n = 2;
     static bool opened = false;
     if (!opened) {
         opened = true;
+        if (granted(t, &n)) { if (count) *count = n; return t; }
+        n = 2;
 
         const okl_long n = okl::sys(okl::nr_getcwd, reinterpret_cast<okl_long>(g_cwd),
                                     static_cast<okl_long>(sizeof g_cwd));
@@ -45,7 +110,7 @@ preopen* table(kal_uintptr* count) {
         t[0] = { g_cwd, cwd_len, okl::failed(fd0) ? 0u : okl::pack(static_cast<int>(fd0)) };
         t[1] = { "/",   1,       okl::failed(fd1) ? 0u : okl::pack(static_cast<int>(fd1)) };
     }
-    if (count) *count = 2;
+    if (count) *count = n;
     return t;
 }