boot: Allow unprivileged users to boot Subhurds.

Previously, boot handed privileged kernel ports to Subhurds.  This
made boot unusable for unprivileged users, and allowed Subhurds to
wreak havoc on the whole system.  Fix this by handing out pseudo ports
instead of the privileged ports.

* NEWS: Update.
* boot/Makefile (MIGSTUBS): Build stubs for the new kernel interfaces.
(MIGSFLAGS): Include mutation file.
(HURDLIBS): Link against libihash.
* boot/boot.c (privileged, want_privileged): New variables.
(pseudo_privileged_host_port): New variable.
(pseudo_pset, pseudo_kernel): Likewise.
(task_notification_port): Likewise.
(dead_task_notification_port): Likewise.
(boot_demuxer): Handle new protocols.
(OPT_PRIVILEGED): New macro.
(options): Add flag '--privileged' to enable the old mode.
(parse_opt): Handle new flag.
(allocate_pseudo_ports): New function.
(main): Handle new flag.  If not running privileged, allocate more
pseudo ports to hand out in place of privileged kernel ports, create a
task namespace, and a task that the Subhurd can frob instead of the
real kernel task.
(do_mach_notify_dead_name): Handle dying tasks.
(S_vm_set_default_memory_manager): New function.
(S_host_reboot): Likewise.
(S_host_processor_set_priv): Likewise.
(S_register_new_task_notification): Likewise.
(task_ihash_cleanup): Likewise.
(task_ihash): New variable.
(task_died): New function.
(S_mach_notify_new_task): Likewise.
(S_processor_set_tasks): Likewise.
* boot/mig-decls.h: New file.
* boot/mig-mutate.h: Likewise.

1 files changed, 5 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index e9c4cb5c..486cb2d5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,8 @@
+Version 0.9 (2016-11-XX)
+
+The 'boot' program can now be run as unprivileged user, allowing any
+user to create unprivileged Subhurds.
+
 Version 0.8 (2016-05-18)
 
 The netfs library is using the lockless reference-counting primitives