vfs: add vfs_check_permission_real for POSIX strict access()

Implement M2: POSIX access() with real IDs instead of effective IDs.

Added vfs_check_permission_real() function that uses current_process->uid
and current_process->gid instead of euid/egid for POSIX strict compliance.
The access() syscall now uses this function, while other operations continue
to use vfs_check_permission() with effective IDs.

This ensures access() behaves according to POSIX specification which requires
real IDs for permission checks, while preserving existing behavior for other
file operations that use effective IDs.

Test: make test-battery PASS (157/157), make analyzer PASS

diff --git a/include/fs.h b/include/fs.h
index bc130c275a7daf70b0f7afd8aa282983926924d8..5e4fa267c96d47858b2487d2cc32f44a14de577f 100644 (file)
--- a/include/fs.h
+++ b/include/fs.h
@@ -140,6 +140,7 @@ int vfs_truncate(const char* path, uint32_t length);
 int vfs_truncate_node(struct fs_node* node, uint32_t length);
 int vfs_check_parent_permission(const char* path, int perm);
 int vfs_check_permission(struct fs_node* node, int want);
+int vfs_check_permission_real(struct fs_node* node, int want);
 int vfs_link(const char* old_path, const char* new_path);
 
 int vfs_mount(const char* mountpoint, fs_node_t* root);

diff --git a/src/kernel/fs.c b/src/kernel/fs.c
index 9ef5b4b26df7397f3ae8f3675e018f9874d05e2b..aab903c421af5072c406eb5ba71afe49d415b3d8 100644 (file)
--- a/src/kernel/fs.c
+++ b/src/kernel/fs.c
@@ -685,6 +685,31 @@ int vfs_check_permission(fs_node_t* node, int want) {
     return 0;
 }
 
+/*
+ * Check permission using real UID/GID for POSIX strict compliance.
+ * Used by access() syscall which must use real IDs, not effective IDs.
+ * want: bitmask of 4 (read), 2 (write), 1 (execute).
+ * Returns 0 if allowed, -EACCES if denied.
+ */
+int vfs_check_permission_real(fs_node_t* node, int want) {
+    if (!current_process) return 0;       /* kernel context — allow all */
+    if (current_process->uid == 0) return 0;  /* root — allow all */
+
+    uint32_t mode = node->mode;
+    uint32_t perm;
+
+    if (current_process->uid == node->uid) {
+        perm = (mode >> 6) & 7;  /* owner bits */
+    } else if (current_process->gid == node->gid) {
+        perm = (mode >> 3) & 7;  /* group bits */
+    } else {
+        perm = mode & 7;         /* other bits */
+    }
+
+    if ((want & perm) != (uint32_t)want) return -EACCES;
+    return 0;
+}
+
 int vfs_link(const char* old_path, const char* new_path) {
     if (!old_path || !new_path) return -EINVAL;
     

diff --git a/src/kernel/syscall.c b/src/kernel/syscall.c
index 023b7cca639a729dfba80caec5deec6eb4e4d197..4e7237895b7b9c29d4185ee4ac545e751c84035e 100644 (file)
--- a/src/kernel/syscall.c
+++ b/src/kernel/syscall.c
@@ -4595,12 +4595,12 @@ static void posix_ext_syscall_dispatch(struct registers* regs, uint32_t syscall_
             sc_ret(regs) = 0;
             return;
         }
-        /* Use vfs_check_permission for R_OK/W_OK/X_OK */
+        /* Use vfs_check_permission_real for R_OK/W_OK/X_OK (POSIX strict: use real IDs) */
         int want = 0;
         if (mode & 4) want |= 4; /* R_OK = 4 */
         if (mode & 2) want |= 2; /* W_OK = 2 */
         if (mode & 1) want |= 1; /* X_OK = 1 */
-        int perm_rc = vfs_check_permission(node, want);
+        int perm_rc = vfs_check_permission_real(node, want);
         if (perm_rc < 0) {
             sc_ret(regs) = (uint32_t)perm_rc;
             return;