starry-kernel 0.9.0

A Linux-compatible OS kernel built on ArceOS unikernel
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

//! Resolution and authorization of `perf_event_open(2)` ownership targets.

use alloc::sync::Arc;

use super::{
    access_policy::{
        PerfAccessCapabilities, PerfCredentialIds, PerfCredentialSnapshot, perf_task_access_allowed,
    },
    target::{PerfCpuId, PerfTarget, PerfTargetError, PerfTargetKind, PerfTaskTarget},
};
use crate::task::{Cred, TidNumber, UserTaskRef, current_user_task, get_user_task_by_number};

/// Strong target identity with its CPU selector validated in Linux order.
pub(super) enum ResolvedPerfTarget {
    /// A live task plus its optional CPU filter.
    Task {
        task: UserTaskRef,
        cpu: Option<PerfCpuId>,
    },
    /// A system-wide event owned by one logical CPU.
    Cpu(PerfCpuId),
}

/// Strong, authorized ownership target retained through event construction.
pub(crate) enum AuthorizedPerfTarget {
    /// A live task plus its optional CPU filter.
    Task {
        task: UserTaskRef,
        cpu: Option<PerfCpuId>,
    },
    /// A system-wide event owned by one logical CPU.
    Cpu(PerfCpuId),
}

impl ResolvedPerfTarget {
    /// Returns the owner class without exposing the resolved task lease.
    pub(super) const fn kind(&self) -> PerfTargetKind {
        match self {
            Self::Task { .. } => PerfTargetKind::Task,
            Self::Cpu(_) => PerfTargetKind::Cpu,
        }
    }

    /// Resolves task identity before validating its CPU filter.
    pub(super) fn resolve(target: PerfTarget, cpu_count: usize) -> crate::StarryResult<Self> {
        match target {
            PerfTarget::Task { task, cpu } => {
                let current = current_user_task();
                let task = match task {
                    PerfTaskTarget::Current => current,
                    PerfTaskTarget::Tid(tid) => get_user_task_by_number(TidNumber::try_from(tid)?)?,
                };
                let cpu = cpu
                    .resolve_optional(cpu_count)
                    .map_err(target_error_to_ax)?;
                Ok(Self::Task { task, cpu })
            }
            PerfTarget::Cpu(cpu) => Ok(Self::Cpu(
                cpu.resolve_required(cpu_count)
                    .map_err(target_error_to_ax)?,
            )),
        }
    }

    /// Serializes authorization and installation against target exec.
    ///
    /// Linux retains `signal->exec_update_lock` from
    /// `perf_check_permission()` through `perf_install_in_context()`. Starry's
    /// process `exec_lock` provides the corresponding lifetime boundary.
    pub(super) fn with_authorized<R>(
        self,
        signal_delivery: bool,
        install: impl FnOnce(AuthorizedPerfTarget) -> crate::StarryResult<R>,
    ) -> crate::StarryResult<R> {
        let (task, cpu) = match self {
            Self::Task { task, cpu } => (task, cpu),
            Self::Cpu(cpu) => return install(AuthorizedPerfTarget::Cpu(cpu)),
        };

        let caller = current_user_task();
        let target_process = Arc::clone(&task.as_thread().proc_data);
        let _exec_guard = target_process.exec_lock().lock();
        let caller_thread = caller.as_thread();
        let target_thread = task.as_thread();
        let caller_cred = caller_thread.cred();
        let target_cred = target_thread.cred();
        let same_thread_group = Arc::ptr_eq(&caller_thread.proc_data, &target_thread.proc_data);
        let allowed = perf_task_access_allowed(
            credential_snapshot(&caller_cred),
            credential_snapshot(&target_cred),
            same_thread_group,
            target_thread.proc_data.dumpable() == 1,
            signal_delivery,
        );
        if !allowed {
            return Err(crate::StarryError::PermissionDenied);
        }

        install(AuthorizedPerfTarget::Task { task, cpu })
    }
}

impl AuthorizedPerfTarget {
    /// Returns the strongly held task target for task-specific event backends.
    ///
    /// The syscall PID was resolved in the caller's active PID namespace and
    /// authorized before this target was constructed. Backends must use this
    /// reference instead of interpreting the namespace-local syscall PID again.
    pub(crate) fn task(&self) -> Option<&UserTaskRef> {
        match self {
            Self::Task { task, .. } => Some(task),
            Self::Cpu(_) => None,
        }
    }
}

fn target_error_to_ax(error: PerfTargetError) -> crate::StarryError {
    match error {
        PerfTargetError::InvalidTuple => crate::StarryError::InvalidInput,
        PerfTargetError::NoSuchProcess => crate::StarryError::NoSuchProcess,
    }
}

fn credential_snapshot(cred: &Cred) -> PerfCredentialSnapshot {
    PerfCredentialSnapshot::new(
        PerfCredentialIds::new(
            cred.uid, cred.gid, cred.euid, cred.egid, cred.suid, cred.sgid,
        ),
        PerfAccessCapabilities::new(
            cred.has_cap_perfmon(),
            cred.has_cap_sys_ptrace(),
            cred.has_cap_kill(),
        ),
    )
}