luajitos

OrbitManager.lua (19338B)

---

 -- OrbitManager: Secure permissions manager for LuaJIT OS
 -- Provides sandboxing and permission-based access control for global functions
 
 local OrbitManager = {}
 
 -- Private storage using weak tables to prevent external access
 local private = setmetatable({}, {__mode = "k"})
 
 -- Stub function generator - creates wrapper functions that check permissions
 local function createStub(orbitInstance, funcPath, realFunc)
     return function(...)
         local priv = private[orbitInstance]
 
         -- Find the permission category for this function
         local permCategory = priv.map[funcPath]
 
         if not permCategory then
             error("OrbitManager: Function " .. funcPath .. " is not mapped to a permission category", 2)
         end
 
         -- Check if permission is granted
         if not priv.perms[permCategory] then
             error("OrbitManager: Attempted to call " .. funcPath .. " without required permissions (needs " .. permCategory .. ")", 2)
         end
 
         -- Special handling for filesystem operations
         if permCategory == "perms.fs" then
             local path = select(1, ...)
             if path and type(path) == "string" then
                 if not orbitInstance:checkPathAllowed(path) then
                     error("OrbitManager: Attempted to access path '" .. path .. "' which is not in allowedPaths", 2)
                 end
             end
         end
 
         -- Special handling for network operations
         if permCategory == "perms.network" then
             local domain = select(1, ...)
             if domain and type(domain) == "string" then
                 if not orbitInstance:checkDomainAllowed(domain) then
                     error("OrbitManager: Attempted to access domain '" .. domain .. "' which is not in allowedDomains", 2)
                 end
             end
         end
 
         -- Call the real function
         return realFunc(...)
     end
 end
 
 -- Wildcard path matching helper
 local function matchWildcard(pattern, str)
     -- Convert wildcard pattern to Lua pattern
     -- Escape special Lua pattern characters except *
     local luaPattern = pattern:gsub("[%(%)%.%%%+%-%?%[%]%^%$]", "%%%1")
     -- Convert * to .*
     luaPattern = luaPattern:gsub("%*", ".*")
     -- Anchor the pattern
     luaPattern = "^" .. luaPattern .. "$"
 
     return str:match(luaPattern) ~= nil
 end
 
 -- Recursively iterate through a table and replace functions
 local function replaceGlobalFunctions(orbitInstance, tbl, priv, path)
     path = path or ""
 
     for key, value in pairs(tbl) do
         local fullPath = path == "" and key or (path .. "." .. key)
 
         if type(value) == "function" then
             -- Check if this function is in our map
             if priv.map[fullPath] then
                 -- Store the real function
                 priv.reals[fullPath] = value
                 -- Replace with stub
                 tbl[key] = createStub(orbitInstance, fullPath, value)
             end
         elseif type(value) == "table" and key ~= "_G" then
             -- Recursively process tables, but avoid infinite loops
             replaceGlobalFunctions(orbitInstance, value, priv, fullPath)
         end
     end
 end
 
 -- Helper function to initialize instance with common setup
 local function initializeInstance(target_G, permsData)
     local instance = {}
 
     -- Initialize private storage for this instance
     private[instance] = {
         map = {
             ["io.open"] = "perms.fs",
             ["io.read"] = "perms.fs",
             ["io.write"] = "perms.fs",
             ["io.close"] = "perms.fs",
             ["io.lines"] = "perms.fs",
             ["io.input"] = "perms.fs",
             ["io.output"] = "perms.fs",
             ["os.execute"] = "perms.os",
             ["os.exit"] = "perms.os",
             ["os.remove"] = "perms.fs",
             ["os.rename"] = "perms.fs",
             ["os.getenv"] = "perms.os",
             ["os.clock"] = "perms.os",
             ["os.date"] = "perms.os",
             ["os.time"] = "perms.os",
             ["os.tmpname"] = "perms.fs",
         },
         perms = {
             ["perms.fs"] = false,
             ["perms.os"] = false,
             ["perms.network"] = false,
         },
         reals = {},
         allowedPaths = {},
         allowedDomains = {},
         manifestData = {}, -- Store manifest metadata
     }
 
     local priv = private[instance]
 
     -- Apply permissions data if provided
     if permsData and type(permsData) == "table" then
         -- Store manifest metadata (name, dev, etc.)
         if permsData.name then
             priv.manifestData.name = permsData.name
         end
         if permsData.dev then
             priv.manifestData.dev = permsData.dev
         end
 
         -- Update permissions - handle both "perms.fs" and "fs" formats
         if permsData.perms then
             for perm, value in pairs(permsData.perms) do
                 -- Normalize permission names
                 local normalizedPerm = perm
                 if not perm:match("^perms%.") then
                     normalizedPerm = "perms." .. perm
                 end
                 priv.perms[normalizedPerm] = value
             end
         end
 
         -- Update allowed paths
         if permsData.allowedPaths then
             priv.allowedPaths = permsData.allowedPaths
         end
 
         -- Update allowed domains
         if permsData.allowedDomains then
             priv.allowedDomains = permsData.allowedDomains
         end
     end
 
     -- Replace functions in target_G
     if target_G then
         replaceGlobalFunctions(instance, target_G, priv, "")
     end
 
     -- Check if a path is allowed
     function instance:checkPathAllowed(path)
         local priv = private[self]
 
         -- If no restrictions, deny by default
         if not priv.allowedPaths or #priv.allowedPaths == 0 then
             return false
         end
 
         -- Check against all allowed paths
         for _, allowedPath in ipairs(priv.allowedPaths) do
             if matchWildcard(allowedPath, path) then
                 return true
             end
         end
 
         return false
     end
 
     -- Check if a domain is allowed
     function instance:checkDomainAllowed(domain)
         local priv = private[self]
 
         -- If no restrictions, deny by default
         if not priv.allowedDomains or #priv.allowedDomains == 0 then
             return false
         end
 
         -- Check against all allowed domains
         for _, allowedDomain in ipairs(priv.allowedDomains) do
             if matchWildcard(allowedDomain, domain) then
                 return true
             end
         end
 
         return false
     end
 
     -- Check if a function can be run with optional path/domain
     function instance:canRun(funcPath, pathOrDomain)
         local priv = private[self]
 
         -- Find the permission category
         local permCategory = priv.map[funcPath]
 
         if not permCategory then
             return false, "Function not mapped to any permission category"
         end
 
         -- Check if permission is granted
         if not priv.perms[permCategory] then
             return false, "Permission " .. permCategory .. " not granted"
         end
 
         -- Additional checks for filesystem and network
         if pathOrDomain then
             if permCategory == "perms.fs" then
                 if not self:checkPathAllowed(pathOrDomain) then
                     return false, "Path not in allowedPaths"
                 end
             elseif permCategory == "perms.network" then
                 if not self:checkDomainAllowed(pathOrDomain) then
                     return false, "Domain not in allowedDomains"
                 end
             end
         end
 
         return true
     end
 
     -- Grant a permission
     function instance:grantPermission(permCategory)
         local priv = private[self]
         -- Normalize permission name
         if not permCategory:match("^perms%.") then
             permCategory = "perms." .. permCategory
         end
         priv.perms[permCategory] = true
     end
 
     -- Revoke a permission
     function instance:revokePermission(permCategory)
         local priv = private[self]
         -- Normalize permission name
         if not permCategory:match("^perms%.") then
             permCategory = "perms." .. permCategory
         end
         priv.perms[permCategory] = false
     end
 
     -- Add an allowed path
     function instance:addAllowedPath(path)
         local priv = private[self]
         table.insert(priv.allowedPaths, path)
     end
 
     -- Add an allowed domain
     function instance:addAllowedDomain(domain)
         local priv = private[self]
         table.insert(priv.allowedDomains, domain)
     end
 
     -- Get manifest metadata
     function instance:getManifestData()
         local priv = private[self]
         -- Return a copy to prevent modification
         local copy = {}
         for k, v in pairs(priv.manifestData) do
             copy[k] = v
         end
         return copy
     end
 
     -- Protected metatable - prevents access to internal structure
     setmetatable(instance, {
         __index = function(t, k)
             if k == "map" or k == "perms" or k == "reals" or k == "manifestData" then
                 error("OrbitManager: Direct access to '" .. k .. "' is not allowed", 2)
             end
             return rawget(t, k)
         end,
         __newindex = function(t, k, v)
             if k == "map" or k == "perms" or k == "reals" or k == "manifestData" then
                 error("OrbitManager: Direct modification of '" .. k .. "' is not allowed", 2)
             end
             rawset(t, k, v)
         end,
         __metatable = false, -- Hide the metatable
     })
 
     return instance
 end
 
 -- Create a new OrbitManager instance from a permissions file
 function OrbitManager.new(target_G, permissionsFile)
     permissionsFile = permissionsFile or "perms.lua"
 
     local permsData = nil
 
     -- Load permissions from file
     local permsChunk, err = loadfile(permissionsFile)
     if permsChunk then
         permsData = permsChunk()
     end
 
     return initializeInstance(target_G, permsData)
 end
 
 -- Create a new OrbitManager instance from a manifest string
 function OrbitManager.newFromManifest(target_G, manifestString)
     if type(manifestString) ~= "string" then
         error("OrbitManager.newFromManifest: manifestString must be a string", 2)
     end
 
     -- Load and execute the manifest string
     local manifestChunk, err = load(manifestString, "manifest", "t")
     if not manifestChunk then
         error("OrbitManager.newFromManifest: Failed to parse manifest: " .. tostring(err), 2)
     end
 
     local success, manifestData = pcall(manifestChunk)
     if not success then
         error("OrbitManager.newFromManifest: Failed to execute manifest: " .. tostring(manifestData), 2)
     end
 
     if type(manifestData) ~= "table" then
         error("OrbitManager.newFromManifest: Manifest must return a table", 2)
     end
 
     return initializeInstance(target_G, manifestData)
 end
 
 -- Deep copy a table recursively
 local function deepCopy(orig, copies)
     copies = copies or {}
     local orig_type = type(orig)
     local copy
     if orig_type == 'table' then
         if copies[orig] then
             copy = copies[orig]
         else
             copy = {}
             copies[orig] = copy
             for orig_key, orig_value in next, orig, nil do
                 copy[deepCopy(orig_key, copies)] = deepCopy(orig_value, copies)
             end
             setmetatable(copy, deepCopy(getmetatable(orig), copies))
         end
     else
         copy = orig
     end
     return copy
 end
 
 -- Recursively build sandbox from whitelist
 local function buildSandboxFromWhitelist(whitelist, sourceEnv, orbitInstance, path)
     path = path or ""
     local sandbox = {}
 
     for key, value in pairs(whitelist) do
         local fullPath = path == "" and key or (path .. "." .. key)
         local sourceValue = sourceEnv[key]
 
         if value == true then
             -- Whitelisted - copy directly from source
             if sourceValue ~= nil then
                 if type(sourceValue) == "table" then
                     sandbox[key] = deepCopy(sourceValue)
                 else
                     sandbox[key] = sourceValue
                 end
             end
         elseif type(value) == "string" then
             -- Permission-controlled function
             if type(sourceValue) == "function" then
                 local priv = private[orbitInstance]
                 priv.reals[fullPath] = sourceValue
                 priv.map[fullPath] = value
                 sandbox[key] = createStub(orbitInstance, fullPath, sourceValue)
             elseif sourceValue ~= nil then
                 sandbox[key] = sourceValue
             end
         elseif type(value) == "table" then
             -- Nested table - recurse
             if type(sourceValue) == "table" then
                 sandbox[key] = buildSandboxFromWhitelist(value, sourceValue, orbitInstance, fullPath)
             else
                 -- Source doesn't have this table, create empty
                 sandbox[key] = buildSandboxFromWhitelist(value, {}, orbitInstance, fullPath)
             end
         end
         -- If value is false or nil, the function is blocked (not added to sandbox)
     end
 
     return sandbox
 end
 
 -- Create a new sandbox environment with OrbitManager from a manifest string
 function OrbitManager.newSandbox(manifestString, sandboxEnvPath)
     if type(manifestString) ~= "string" then
         error("OrbitManager.newSandbox: manifestString must be a string", 2)
     end
 
     sandboxEnvPath = sandboxEnvPath or "/home/b/Programming/LuajitOS/OS/sandboxEnv.lua"
 
     -- Load the manifest
     local manifestChunk, err = load(manifestString, "manifest", "t")
     if not manifestChunk then
         error("OrbitManager.newSandbox: Failed to parse manifest: " .. tostring(err), 2)
     end
 
     local success, manifestData = pcall(manifestChunk)
     if not success then
         error("OrbitManager.newSandbox: Failed to execute manifest: " .. tostring(manifestData), 2)
     end
 
     if type(manifestData) ~= "table" then
         error("OrbitManager.newSandbox: Manifest must return a table", 2)
     end
 
     -- Load the sandbox whitelist
     local whitelistChunk, err = loadfile(sandboxEnvPath)
     if not whitelistChunk then
         error("OrbitManager.newSandbox: Failed to load sandboxEnv.lua: " .. tostring(err), 2)
     end
 
     local whitelist = whitelistChunk()
     if type(whitelist) ~= "table" then
         error("OrbitManager.newSandbox: sandboxEnv.lua must return a table", 2)
     end
 
     -- Create an OrbitManager instance (without target_G for now)
     local instance = {}
 
     -- Initialize private storage
     private[instance] = {
         map = {},
         perms = {
             ["perms.fs"] = false,
             ["perms.os"] = false,
             ["perms.network"] = false,
             ["perms.modules"] = false,
         },
         reals = {},
         allowedPaths = {},
         allowedDomains = {},
         manifestData = {},
     }
 
     local priv = private[instance]
 
     -- Apply manifest data
     if manifestData.name then
         priv.manifestData.name = manifestData.name
     end
     if manifestData.dev then
         priv.manifestData.dev = manifestData.dev
     end
 
     if manifestData.perms then
         for perm, value in pairs(manifestData.perms) do
             local normalizedPerm = perm
             if not perm:match("^perms%.") then
                 normalizedPerm = "perms." .. perm
             end
             priv.perms[normalizedPerm] = value
         end
     end
 
     if manifestData.allowedPaths then
         priv.allowedPaths = manifestData.allowedPaths
     end
 
     if manifestData.allowedDomains then
         priv.allowedDomains = manifestData.allowedDomains
     end
 
     -- Build the sandbox from the whitelist
     local sandbox = buildSandboxFromWhitelist(whitelist, _G, instance, "")
 
     -- Add the _G self-reference
     sandbox._G = sandbox
 
     -- Add instance methods
     function instance:checkPathAllowed(path)
         local priv = private[self]
         if not priv.allowedPaths or #priv.allowedPaths == 0 then
             return false
         end
         for _, allowedPath in ipairs(priv.allowedPaths) do
             if matchWildcard(allowedPath, path) then
                 return true
             end
         end
         return false
     end
 
     function instance:checkDomainAllowed(domain)
         local priv = private[self]
         if not priv.allowedDomains or #priv.allowedDomains == 0 then
             return false
         end
         for _, allowedDomain in ipairs(priv.allowedDomains) do
             if matchWildcard(allowedDomain, domain) then
                 return true
             end
         end
         return false
     end
 
     function instance:canRun(funcPath, pathOrDomain)
         local priv = private[self]
         local permCategory = priv.map[funcPath]
         if not permCategory then
             return false, "Function not mapped to any permission category"
         end
         if not priv.perms[permCategory] then
             return false, "Permission " .. permCategory .. " not granted"
         end
         if pathOrDomain then
             if permCategory == "perms.fs" then
                 if not self:checkPathAllowed(pathOrDomain) then
                     return false, "Path not in allowedPaths"
                 end
             elseif permCategory == "perms.network" then
                 if not self:checkDomainAllowed(pathOrDomain) then
                     return false, "Domain not in allowedDomains"
                 end
             end
         end
         return true
     end
 
     function instance:grantPermission(permCategory)
         local priv = private[self]
         if not permCategory:match("^perms%.") then
             permCategory = "perms." .. permCategory
         end
         priv.perms[permCategory] = true
     end
 
     function instance:revokePermission(permCategory)
         local priv = private[self]
         if not permCategory:match("^perms%.") then
             permCategory = "perms." .. permCategory
         end
         priv.perms[permCategory] = false
     end
 
     function instance:addAllowedPath(path)
         local priv = private[self]
         table.insert(priv.allowedPaths, path)
     end
 
     function instance:addAllowedDomain(domain)
         local priv = private[self]
         table.insert(priv.allowedDomains, domain)
     end
 
     function instance:getManifestData()
         local priv = private[self]
         local copy = {}
         for k, v in pairs(priv.manifestData) do
             copy[k] = v
         end
         return copy
     end
 
     function instance:getSandbox()
         return sandbox
     end
 
     -- Protected metatable
     setmetatable(instance, {
         __index = function(t, k)
             if k == "map" or k == "perms" or k == "reals" or k == "manifestData" then
                 error("OrbitManager: Direct access to '" .. k .. "' is not allowed", 2)
             end
             return rawget(t, k)
         end,
         __newindex = function(t, k, v)
             if k == "map" or k == "perms" or k == "reals" or k == "manifestData" then
                 error("OrbitManager: Direct modification of '" .. k .. "' is not allowed", 2)
             end
             rawset(t, k, v)
         end,
         __metatable = false,
     })
 
     return instance, sandbox
 end
 
 return OrbitManager