If a user is missing from /etc/shadow, we used to just allow anyone to
authenticate as that user without a password.
With this patch, authentication will instead always fail.
Now that we've moved to atomic replacement of these files when altering
them, we don't need to keep them open for the lifetime of Core::Account
so just simplify this and close them when they are not needed.
Before this patch, we had a nasty race condition when changing a user's
password: there was a time window between truncating /etc/shadow and
writing out its new contents, where you could simply "su" to root
without using a password.
Instead of writing directly to /etc/passwd and /etc/shadow, we now
create temporary files in /etc and fill them with the new contents.
Those files are then atomically renamed to /etc/passwd and /etc/shadow.
Sadly, fixing this race requires giving the passwd program a lot more
privileges. This is something we can and should improve upon. :^)
Apparently memfd_create() is newish in glibc, and oss-fuzz
uses Ubuntu 16.04 as base for its docker images, which doens't
yet have memfd_create(). But, not to worry, it does have the syscall
define and that's all we really need :/
..and allow implicit creation of KResult and KResultOr from ErrnoCode.
This means that kernel functions that return those types can finally
do "return EINVAL;" and it will just work.
There's a handful of functions that still deal with signed integers
that should be converted to return KResults.
Moves Painter away from general affine transport support a bit, but
this scale factor business does feel like it's a bit different.
This is conceptually cleaner (everything should use logical coordinates
as much as possible), and it means the code in GUI::Painter() will work
without changes due to that, but the draw function implementations
overall get a bit murkier (draw_rect() becomes nicer though). Still,
feels like the right direction.
No behavior change.
Similar to LibC storing an assertion message before aborting, process
death by pledge violation now sets a "pledge_violation" key with the
respective pledge name as value in its coredump metadata, which the
CrashReporter will then show.
Without this, the oss-fuzz build says:
../Userland/Libraries/LibJS/AST.cpp:58:34: error: member access into incomplete type 'const std::type_info'
return demangle(typeid(*this).name()).substring(4);
^
The randomness is taken from arc4random() which is independent from srand/rand/rand_r,
so there's no need to call srand(). At best, it confuses the reader to think that
there would eventually be a call to rand().
This apparently was a workaround for escape sequences in GML at some
point (see #4937), but it now literally inserts "\n" and no newline, as
the backslash itself is escaped.
Bitmap::load_from_file("foo.png", 2) will now look for "foo-2x.png" and
try load that as a bitmap with scale factor 2 if it exists. If it
doesn't, it falls back to the 1x bitmap as normal.
Only places that know that they'll draw the bitmap to a 2x painter
should pass "2" for the second argument.
Use this new API in WindowServer for loading window buttons and
cursors.
As a testing aid, ctrl-shift-super-i can force HighDPI icons off in
HighDPI mode. Toggling between low-res and high-res icons makes it easy
to see if the high-res version of an icon looks right: It should look
like the low-res version, just less jaggy.
We'll likely have to grow a better API for loading scaled resources, but
for now this suffices.
Things to check:
- `chres 640 480` followed by `chres 640 480 2` followed by
`chres 640 480`
- window buttons in window context menu (in task bar and on title bar)
still have low-res icons
- ctrl-shift-super-i in high-res mode toggles sharpness of window
buttons and of arrow cursorf
- arrow cursor hotspot is still where you'd expect
Gfx::Bitmap can now store its scale factor. Normally it's 1, but
in high dpi mode it can be 2.
If a Bitmap with a scale factor of 2 is blitted to a Painter with
scale factor of 2, the pixels can be copied over without any resampling.
(When blitting a Bitmap with a scale factor of 1 to a Painter with scale
factor of 2, the Bitmap is painted at twice its width and height at
paint time. Blitting a Bitmap with a scale factor of 2 to a Painter with
scale factor 1 is not supported.)
A Bitmap with scale factor of 2 reports the same width() and height() as
one with scale factor 1. That's important because many places in the
codebase use a bitmap's width() and height() to layout Widgets, and all
widget coordinates are in logical coordinates as well, per
Documentation/HighDPI.md.
Bitmap grows physical_width() / physical_height() to access the actual
pixel size. Update a few callers that work with pixels to call this
instead.
Make Painter's constructor take its scale factor from the target bitmap
that's passed in, and update its various blit() methods to handle
blitting a 2x bitmap to a 2x painter. This allows removing some gnarly
code in Compositor. (In return, put some new gnarly code in
LibGfxScaleDemo to preserve behavior there.)
No intended behavior change.
This option was renamed from scaled to stretch in DisplaySettings in
699ba84, but since WindowServer receives a plain string and was not
updated, it wouldn't recognize the new renamed value as a valid option.
Turns out sending plain strings via IPC and only mapping them to enum
values on the receiving end is brittle, we should probably update
Desktop::set_wallpaper_mode() to use an enum as well at some point.
Fixes#5006.
There's no guarantee that the last executed command will have a zero
exit code, and so the shell exit code may or may not be zero, even if
all the tests pass.
Also changes the `test || echo fail && exit` to
`if not test { echo fail && exit }`, since that's nicer-looking.
This allows correct iteration over nested lists.
Also store values to variables without resolving them, to delay the
resolution step as much as possible (this helps with storing nested
lists in variables).
Quoting POSIX:
https://pubs.opengroup.org/onlinepubs/009695399/functions/tzset.html
The tzset() function also shall set the external variable daylight
to 0 if Daylight Savings Time conversions should never be applied
for the timezone in use; otherwise, non-zero.
We're already pretending to be in UTC+0 and setting timezone to 0
accordingly, we can also fake the absence of Daylight Savings Time.
Since tzset() itself pretends to succeed (it just sets timezone = 0 for
now), it seems unwise to leave tzname uninitialized. Since Serenity
already assumes UTC pretty much everywhere time is used, let's continue
that trend here. Quoting POSIX:
https://pubs.opengroup.org/onlinepubs/009695399/functions/tzset.html
The tzset() function shall use the value of the environment variable
TZ to set time conversion information used by ctime(), localtime(),
mktime(), and strftime(). If TZ is absent from the environment,
implementation-defined default timezone information shall be used.
So we still don't care about TZ at all, but the program doesn't need to
know! :^)
This matches what musl libc ("UTC") and glibc ("GMT") do, see:
- https://sourceware.org/git/?p=glibc.git;a=blob;f=time/tzset.c
- https://git.musl-libc.org/cgit/musl/tree/src/time/__tz.c
The FFC now supports both vertical and horizontal flex layout, based on
the flex-direction property. It's still extremely naive, but at least
now you can be naive in two directions! :^)
This implementation of flexbox is going to take a lot of work, but at
least now we've gotten started.
Just have all the timing functions return 0 for now.
We can now run the Shynet JS on https://linus.dev/ although the XHR
is rejected by our same-origin policy.
Since Web::Bindings::WindowObject inherits from JS::GlobalObject, it
cannot also inherit from Web::Bindings::EventTargetWrapper.
However, that's not actually necessary. Instead, we simply set the
Window object's prototype to the EventTargetPrototype, and add a little
extra branch in the impl_from() function that turns the JS "this" value
into a DOM::EventTarget*.
With this, you can now call window.addEventListener()! Very cool :^)
Fixes#4758.
Instead of each IDL interface wrapper having its own set of all the
attributes and functions, they are moved to the prototype. This matches
what we already do in LibJS.
Also, this should be spec compliant with the web as well, though there
may be *some* content out there that expects some things to be directly
on the wrapper since that's how things used to work in major browsers
a long time ago. But let's just not worry about that for now.
More work towards #4789
We now instantiate all the generated web API constructors and expose
them on the window object. We also set the generated prototypes on
instantiated wrappers.
Also, we should obviously find a way to generate this code. :^)
