Kernel: Use Process::require_promise() instead of REQUIRE_PROMISE()

This change lays the foundation for making the require_promise return
an error hand handling the process abort outside of the syscall
implementations, to avoid cases where we would leak resources.

It also has the advantage that it makes removes a gs pointer read
to look up the current thread, then process for every syscall. We
can instead go through the Process this pointer in most cases.

Kernel/Graphics/FramebufferDevice.cpp

@@ -29,8 +29,8 @@ NonnullRefPtr<FramebufferDevice> FramebufferDevice::create(const GenericGraphics
 
 ErrorOr<Memory::Region*> FramebufferDevice::mmap(Process& process, OpenFileDescription&, Memory::VirtualRange const& range, u64 offset, int prot, bool shared)
 {
+ process.require_promise(Pledge::video);
  SpinlockLocker lock(m_activation_lock);
- REQUIRE_PROMISE(video);
  if (!shared)
  return ENODEV;
  if (offset != 0)

Kernel/Graphics/GenericFramebufferDevice.cpp

@@ -33,7 +33,7 @@ ErrorOr<void> GenericFramebufferDevice::verify_head_index(int head_index) const
 
 ErrorOr<void> GenericFramebufferDevice::ioctl(OpenFileDescription&, unsigned request, Userspace<void*> arg)
 {
- REQUIRE_PROMISE(video);
+ Process::current().require_promise(Pledge::video);
  switch (request) {
  case FB_IOCTL_GET_PROPERTIES: {
  auto user_properties = static_ptr_cast<FBProperties*>(arg);

Kernel/Graphics/VirtIOGPU/FramebufferDevice.cpp

@@ -257,7 +257,7 @@ void FramebufferDevice::set_buffer(int buffer_index)
 
 ErrorOr<Memory::Region*> FramebufferDevice::mmap(Process& process, OpenFileDescription&, Memory::VirtualRange const& range, u64 offset, int prot, bool shared)
 {
- REQUIRE_PROMISE(video);
+ process.require_promise(Pledge::video);
  if (!shared)
  return ENODEV;
  if (offset != 0 || !m_framebuffer)

Kernel/Net/IPv4Socket.cpp

@@ -607,7 +607,7 @@ ErrorOr<void> IPv4Socket::getsockopt(OpenFileDescription& description, int level
 
 ErrorOr<void> IPv4Socket::ioctl(OpenFileDescription&, unsigned request, Userspace<void*> arg)
 {
- REQUIRE_PROMISE(inet);
+ Process::current().require_promise(Pledge::inet);
 
  auto ioctl_route = [request, arg]() -> ErrorOr<void> {
  auto user_route = static_ptr_cast<rtentry*>(arg);

Kernel/Syscalls/access.cpp

@@ -13,7 +13,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$access(Userspace<const char*> user_path, size_t path_length, int mode)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(rpath);
+ require_promise(Pledge::rpath);
  auto path = TRY(get_syscall_path_argument(user_path, path_length));
  TRY(VirtualFileSystem::the().access(path->view(), mode, current_directory()));
  return 0;

Kernel/Syscalls/alarm.cpp

@@ -12,7 +12,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$alarm(unsigned seconds)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  unsigned previous_alarm_remaining = 0;
  if (m_alarm_timer) {
  bool was_in_use = false;

Kernel/Syscalls/anon_create.cpp

@@ -14,7 +14,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$anon_create(size_t size, int options)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
 
  if (!size)
  return EINVAL;

Kernel/Syscalls/chdir.cpp

@@ -13,7 +13,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$chdir(Userspace<const char*> user_path, size_t path_length)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(rpath);
+ require_promise(Pledge::rpath);
  auto path = TRY(get_syscall_path_argument(user_path, path_length));
  m_cwd = TRY(VirtualFileSystem::the().open_directory(path->view(), current_directory()));
  return 0;
@@ -22,7 +22,7 @@ ErrorOr<FlatPtr> Process::sys$chdir(Userspace<const char*> user_path, size_t pat
 ErrorOr<FlatPtr> Process::sys$fchdir(int fd)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  auto description = TRY(fds().open_file_description(fd));
  if (!description->is_directory())
  return ENOTDIR;
@@ -35,7 +35,7 @@ ErrorOr<FlatPtr> Process::sys$fchdir(int fd)
 ErrorOr<FlatPtr> Process::sys$getcwd(Userspace<char*> buffer, size_t size)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(rpath);
+ require_promise(Pledge::rpath);
 
  if (size > NumericLimits<ssize_t>::max())
  return EINVAL;

Kernel/Syscalls/chmod.cpp

@@ -13,7 +13,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$chmod(Userspace<const char*> user_path, size_t path_length, mode_t mode)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(fattr);
+ require_promise(Pledge::fattr);
  auto path = TRY(get_syscall_path_argument(user_path, path_length));
  TRY(VirtualFileSystem::the().chmod(path->view(), mode, current_directory()));
  return 0;
@@ -22,7 +22,7 @@ ErrorOr<FlatPtr> Process::sys$chmod(Userspace<const char*> user_path, size_t pat
 ErrorOr<FlatPtr> Process::sys$fchmod(int fd, mode_t mode)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(fattr);
+ require_promise(Pledge::fattr);
  auto description = TRY(fds().open_file_description(fd));
  TRY(description->chmod(mode));
  return 0;

Kernel/Syscalls/chown.cpp

@@ -12,7 +12,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$fchown(int fd, UserID uid, GroupID gid)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(chown);
+ require_promise(Pledge::chown);
  auto description = TRY(fds().open_file_description(fd));
  TRY(description->chown(uid, gid));
  return 0;
@@ -21,7 +21,7 @@ ErrorOr<FlatPtr> Process::sys$fchown(int fd, UserID uid, GroupID gid)
 ErrorOr<FlatPtr> Process::sys$chown(Userspace<const Syscall::SC_chown_params*> user_params)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(chown);
+ require_promise(Pledge::chown);
  auto params = TRY(copy_typed_from_user(user_params));
  auto path = TRY(get_syscall_path_argument(params.path));
  TRY(VirtualFileSystem::the().chown(path->view(), params.uid, params.gid, current_directory()));

Kernel/Syscalls/clock.cpp

@@ -13,7 +13,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$map_time_page()
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
 
  auto& vmobject = TimeManagement::the().time_page_vmobject();
 
@@ -25,7 +25,7 @@ ErrorOr<FlatPtr> Process::sys$map_time_page()
 ErrorOr<FlatPtr> Process::sys$clock_gettime(clockid_t clock_id, Userspace<timespec*> user_ts)
 {
  VERIFY_NO_PROCESS_BIG_LOCK(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
 
  if (!TimeManagement::is_valid_clock_id(clock_id))
  return EINVAL;
@@ -38,7 +38,7 @@ ErrorOr<FlatPtr> Process::sys$clock_gettime(clockid_t clock_id, Userspace<timesp
 ErrorOr<FlatPtr> Process::sys$clock_settime(clockid_t clock_id, Userspace<const timespec*> user_ts)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(settime);
+ require_promise(Pledge::settime);
 
  if (!is_superuser())
  return EPERM;
@@ -58,7 +58,7 @@ ErrorOr<FlatPtr> Process::sys$clock_settime(clockid_t clock_id, Userspace<const
 ErrorOr<FlatPtr> Process::sys$clock_nanosleep(Userspace<const Syscall::SC_clock_nanosleep_params*> user_params)
 {
  VERIFY_NO_PROCESS_BIG_LOCK(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  auto params = TRY(copy_typed_from_user(user_params));
 
  auto requested_sleep = TRY(copy_time_from_user(params.requested_sleep));
@@ -105,7 +105,7 @@ ErrorOr<FlatPtr> Process::sys$adjtime(Userspace<const timeval*> user_delta, User
  }
 
  if (user_delta) {
- REQUIRE_PROMISE(settime);
+ require_promise(Pledge::settime);
  if (!is_superuser())
  return EPERM;
  auto delta = TRY(copy_time_from_user(user_delta));

Kernel/Syscalls/disown.cpp

@@ -11,7 +11,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$disown(ProcessID pid)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(proc);
+ require_promise(Pledge::proc);
  auto process = Process::from_pid(pid);
  if (!process)
  return ESRCH;

Kernel/Syscalls/dup2.cpp

@@ -12,7 +12,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$dup2(int old_fd, int new_fd)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  auto description = TRY(fds().open_file_description(old_fd));
  if (old_fd == new_fd)
  return new_fd;

Kernel/Syscalls/execve.cpp

@@ -859,7 +859,7 @@ ErrorOr<void> Process::exec(NonnullOwnPtr<KString> path, NonnullOwnPtrVector<KSt
 ErrorOr<FlatPtr> Process::sys$execve(Userspace<const Syscall::SC_execve_params*> user_params)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(exec);
+ require_promise(Pledge::exec);
 
  // NOTE: Be extremely careful with allocating any kernel memory in exec().
  // On success, the kernel stack will be lost.

Kernel/Syscalls/fcntl.cpp

@@ -13,7 +13,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$fcntl(int fd, int cmd, u32 arg)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  dbgln_if(IO_DEBUG, "sys$fcntl: fd={}, cmd={}, arg={}", fd, cmd, arg);
  auto description = TRY(fds().open_file_description(fd));
  // NOTE: The FD flags are not shared between OpenFileDescription objects.

Kernel/Syscalls/fork.cpp

@@ -16,7 +16,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$fork(RegisterState& regs)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(proc);
+ require_promise(Pledge::proc);
  RefPtr<Thread> child_first_thread;
  auto child_name = TRY(m_name->try_clone());
  auto child = TRY(Process::try_create(child_first_thread, move(child_name), uid(), gid(), pid(), m_is_kernel_process, m_cwd, m_executable, m_tty, this));

Kernel/Syscalls/fsync.cpp

@@ -11,7 +11,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$fsync(int fd)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  auto description = TRY(fds().open_file_description(fd));
  TRY(description->sync());
  return 0;

Kernel/Syscalls/ftruncate.cpp

@@ -14,7 +14,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$ftruncate(int fd, Userspace<off_t const*> userspace_length)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  auto length = TRY(copy_typed_from_user(userspace_length));
  if (length < 0)
  return EINVAL;

Kernel/Syscalls/get_dir_entries.cpp

@@ -12,7 +12,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$get_dir_entries(int fd, Userspace<void*> user_buffer, size_t user_size)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  if (user_size > NumericLimits<ssize_t>::max())
  return EINVAL;
  auto description = TRY(fds().open_file_description(fd));

Kernel/Syscalls/getrandom.cpp

@@ -16,7 +16,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$getrandom(Userspace<void*> buffer, size_t buffer_size, [[maybe_unused]] unsigned flags)
 {
  VERIFY_NO_PROCESS_BIG_LOCK(this);
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  if (buffer_size > NumericLimits<ssize_t>::max())
  return EINVAL;
 

Kernel/Syscalls/getuid.cpp

@@ -11,35 +11,35 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$getuid()
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  return uid().value();
 }
 
 ErrorOr<FlatPtr> Process::sys$getgid()
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  return gid().value();
 }
 
 ErrorOr<FlatPtr> Process::sys$geteuid()
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  return euid().value();
 }
 
 ErrorOr<FlatPtr> Process::sys$getegid()
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  return egid().value();
 }
 
 ErrorOr<FlatPtr> Process::sys$getresuid(Userspace<UserID*> ruid, Userspace<UserID*> euid, Userspace<UserID*> suid)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  TRY(copy_to_user(ruid, &m_protected_values.uid));
  TRY(copy_to_user(euid, &m_protected_values.euid));
  TRY(copy_to_user(suid, &m_protected_values.suid));
@@ -49,7 +49,7 @@ ErrorOr<FlatPtr> Process::sys$getresuid(Userspace<UserID*> ruid, Userspace<UserI
 ErrorOr<FlatPtr> Process::sys$getresgid(Userspace<GroupID*> rgid, Userspace<GroupID*> egid, Userspace<GroupID*> sgid)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  TRY(copy_to_user(rgid, &m_protected_values.gid));
  TRY(copy_to_user(egid, &m_protected_values.egid));
  TRY(copy_to_user(sgid, &m_protected_values.sgid));
@@ -59,7 +59,7 @@ ErrorOr<FlatPtr> Process::sys$getresgid(Userspace<GroupID*> rgid, Userspace<Grou
 ErrorOr<FlatPtr> Process::sys$getgroups(size_t count, Userspace<gid_t*> user_gids)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  if (!count)
  return extra_gids().size();
  if (count != extra_gids().size())

Kernel/Syscalls/hostname.cpp

@@ -11,7 +11,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$gethostname(Userspace<char*> buffer, size_t size)
 {
  VERIFY_NO_PROCESS_BIG_LOCK(this)
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  if (size > NumericLimits<ssize_t>::max())
  return EINVAL;
  return hostname().with_shared([&](const auto& name) -> ErrorOr<FlatPtr> {

Kernel/Syscalls/inode_watcher.cpp

@@ -16,7 +16,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$create_inode_watcher(u32 flags)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(rpath);
+ require_promise(Pledge::rpath);
 
  auto fd_allocation = TRY(m_fds.allocate());
  auto watcher = TRY(InodeWatcher::try_create());
@@ -37,7 +37,7 @@ ErrorOr<FlatPtr> Process::sys$create_inode_watcher(u32 flags)
 ErrorOr<FlatPtr> Process::sys$inode_watcher_add_watch(Userspace<const Syscall::SC_inode_watcher_add_watch_params*> user_params)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(rpath);
+ require_promise(Pledge::rpath);
  auto params = TRY(copy_typed_from_user(user_params));
 
  auto description = TRY(fds().open_file_description(params.fd));

Kernel/Syscalls/keymap.cpp

@@ -14,7 +14,7 @@ constexpr size_t map_name_max_size = 50;
 ErrorOr<FlatPtr> Process::sys$setkeymap(Userspace<const Syscall::SC_setkeymap_params*> user_params)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this);
- REQUIRE_PROMISE(setkeymap);
+ require_promise(Pledge::setkeymap);
 
  if (!is_superuser())
  return EPERM;
@@ -40,7 +40,7 @@ ErrorOr<FlatPtr> Process::sys$setkeymap(Userspace<const Syscall::SC_setkeymap_pa
 ErrorOr<FlatPtr> Process::sys$getkeymap(Userspace<const Syscall::SC_getkeymap_params*> user_params)
 {
  VERIFY_NO_PROCESS_BIG_LOCK(this);
- REQUIRE_PROMISE(getkeymap);
+ require_promise(Pledge::getkeymap);
  auto params = TRY(copy_typed_from_user(user_params));
 
  String keymap_name = HIDManagement::the().keymap_name();

Kernel/Syscalls/kill.cpp

@@ -99,9 +99,9 @@ ErrorOr<FlatPtr> Process::sys$kill(pid_t pid_or_pgid, int signal)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
  if (pid_or_pgid == pid().value())
- REQUIRE_PROMISE(stdio);
+ require_promise(Pledge::stdio);
  else
- REQUIRE_PROMISE(proc);
+ require_promise(Pledge::proc);
 
  if (signal < 0 || signal >= 32)
  return EINVAL;
@@ -130,7 +130,7 @@ ErrorOr<FlatPtr> Process::sys$kill(pid_t pid_or_pgid, int signal)
 ErrorOr<FlatPtr> Process::sys$killpg(pid_t pgrp, int signum)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(proc);
+ require_promise(Pledge::proc);
  if (signum < 1 || signum >= 32)
  return EINVAL;
  if (pgrp < 0)

Kernel/Syscalls/link.cpp

@@ -13,7 +13,7 @@ namespace Kernel {
 ErrorOr<FlatPtr> Process::sys$link(Userspace<const Syscall::SC_link_params*> user_params)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(cpath);
+ require_promise(Pledge::cpath);
  auto params = TRY(copy_typed_from_user(user_params));
  auto old_path = TRY(try_copy_kstring_from_user(params.old_path));
  auto new_path = TRY(try_copy_kstring_from_user(params.new_path));
@@ -24,7 +24,7 @@ ErrorOr<FlatPtr> Process::sys$link(Userspace<const Syscall::SC_link_params*> use
 ErrorOr<FlatPtr> Process::sys$symlink(Userspace<const Syscall::SC_symlink_params*> user_params)
 {
  VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
- REQUIRE_PROMISE(cpath);
+ require_promise(Pledge::cpath);
  auto params = TRY(copy_typed_from_user(user_params));
 
  auto target = TRY(get_syscall_path_argument(params.target));