Add privileged folder operations, scripts, and tuning

WH
23d ago
+11044-470

Summary

Adds the folder, script and tuning slice of the superuser runtime redesign. Configured folders resolve through the authoritative configuration, privileged folder work (writeability, conflict discovery, ignore-list read and write) runs bounded and symlink-safe inside one operation-scoped root helper session, sync-completion scripts run under the selected execution identity with atomic admission and teardown, and optional ionice and inotify tuning stays best effort. PR stacked on PR #6; Root Mode UI stays hidden and Normal Mode keeps the app-UID backend.

Validation

  • Focused suites and the full debug unit-test variant (48 suites, 663 tests, 0 failures) pass, together with lintDebug, assembleDebug, :syncthing:buildNative and make all.
  • Android emulator evidence (API 36 arm64, /system/bin/sh): the ignore-list write over an existing .stignore fails closed when the staged descriptor is not handed to chmod/chown/chcon/ls (exit 8, member untouched) and succeeds with it, keeping the member's mode and SELinux context.
  • The I/O priority command is executed against a synthetic /proc/<pid>/stat entry: a matching start time tunes exactly -c 2 -n 7 -p <pid>, a reused identifier and an unreadable entry never reach ionice.
  • Physical-device root and SELinux qualification: NOT RUN.
  • Known limitations: the conflict scan bounds peak memory of one very large directory after enumeration, with the NUL-framed record remedy documented rather than implemented, and an actor holding the configured folder's parent entries can still win a rename race on the member inside that folder.

Stack

Base: codex/privileged-managed-state-and-backup-import (PR #6)
Head: codex/privileged-folder-scripts-and-tuning

PR contains one implementation commit.

Summary by cubic

Adds the folder, script, and tuning slice of the superuser runtime redesign. Configured folders now resolve exclusively through the authoritative configuration, privileged folder work (writeability probes, conflict discovery, ignore-list read and write) runs bounded and symlink-safe in one operation-scoped root helper session, sync-completion scripts run under the selected execution identity with atomic admission and teardown, and optional ionice and inotify tuning stays best effort. Root Mode UI remains hidden and Normal Mode keeps the app-UID backend. Stacked on PR #6.

Behavior changes

  • Folder operations accept only a folder identifier; the path is re-resolved from the authoritative config at operation time, so a stale or forged caller path can never select files.
  • Folder editors load the configured folder off the UI thread and drop late or stale results; a failed ignore-list save reports failure instead of success.
  • Completion announcements no longer wait on scripts: a non-zero exit or a dispatch that cannot start is reported while the announcement still runs.
  • The ignore-list write stages a file the helper itself creates and hands the opened descriptor to every external command that acts on it.

Validation

  • Full debug suite (48 suites, 663 tests) passes together with lintDebug, assembleDebug, :syncthing:buildNative, and make all; emulator evidence covers ignore-list fail-closed, exact ionice targeting, and descriptor handoff.
  • Physical-device root and SELinux qualification not run.