[zion] Enforce cap transmit permissions in more places.

zion/lib/message_queue.cpp

@@ -20,10 +20,17 @@ z_err_t UnboundedMessageQueue::PushBack(uint64_t num_bytes, const void* bytes,
 
   for (uint64_t i = 0; i < num_caps; i++) {
     // FIXME: This would feel safer closer to the relevant syscall.
-    auto cap = gScheduler->CurrentProcess().ReleaseCapability(caps[i]);
+    // FIXME: Race conditions on get->check->release here. Would be better to
+    // have that as a single call on the process. (This pattern repeats other
+    // places too).
+    auto cap = gScheduler->CurrentProcess().GetCapability(caps[i]);
     if (!cap) {
       return glcr::CAP_NOT_FOUND;
     }
+    if (!cap->HasPermissions(kZionPerm_Transmit)) {
+      return glcr::CAP_PERMISSION_DENIED;
+    }
+    cap = gScheduler->CurrentProcess().ReleaseCapability(caps[i]);
     message->caps.PushBack(cap);
   }
 
@@ -109,10 +116,14 @@ glcr::ErrorCode SingleMessageQueue::PushBack(uint64_t num_bytes,
 
   for (uint64_t i = 0; i < num_caps; i++) {
     // FIXME: This would feel safer closer to the relevant syscall.
-    auto cap = gScheduler->CurrentProcess().ReleaseCapability(caps[i]);
+    auto cap = gScheduler->CurrentProcess().GetCapability(caps[i]);
     if (!cap) {
       return glcr::CAP_NOT_FOUND;
     }
+    if (!cap->HasPermissions(kZionPerm_Transmit)) {
+      return glcr::CAP_PERMISSION_DENIED;
+    }
+    cap = gScheduler->CurrentProcess().ReleaseCapability(caps[i]);
     caps_.PushBack(cap);
   }
 

zion/object/address_space.h

@@ -37,7 +37,9 @@ class AddressSpace : public KernelObject {
  public:
   uint64_t TypeTag() override { return KernelObject::ADDRESS_SPACE; }
 
-  static uint64_t DefaultPermissions() { return kZionPerm_Write; }
+  static uint64_t DefaultPermissions() {
+    return kZionPerm_Write | kZionPerm_Transmit;
+  }
 
   enum MemoryType {
     UNSPECIFIED,

zion/object/channel.h

@@ -22,7 +22,8 @@ class Channel : public IpcObject {
  public:
   uint64_t TypeTag() override { return KernelObject::CHANNEL; }
   static uint64_t DefaultPermissions() {
-    return kZionPerm_Read | kZionPerm_Write | kZionPerm_Duplicate;
+    return kZionPerm_Read | kZionPerm_Write | kZionPerm_Duplicate |
+           kZionPerm_Transmit;
   }
 
   static glcr::Pair<glcr::RefPtr<Channel>, glcr::RefPtr<Channel>>

zion/object/endpoint.h

@@ -21,7 +21,8 @@ class Endpoint : public IpcObject {
  public:
   uint64_t TypeTag() override { return KernelObject::ENDPOINT; }
   static uint64_t DefaultPermissions() {
-    return kZionPerm_Read | kZionPerm_Write | kZionPerm_Duplicate;
+    return kZionPerm_Read | kZionPerm_Write | kZionPerm_Duplicate |
+           kZionPerm_Transmit;
   }
 
   static glcr::RefPtr<Endpoint> Create();

zion/object/memory_object.h

@@ -23,7 +23,8 @@ class MemoryObject : public KernelObject {
  public:
   uint64_t TypeTag() override { return KernelObject::MEMORY_OBJECT; }
   static uint64_t DefaultPermissions() {
-    return kZionPerm_Write | kZionPerm_Read | kZionPerm_Duplicate;
+    return kZionPerm_Write | kZionPerm_Read | kZionPerm_Duplicate |
+           kZionPerm_Transmit;
   }
 
   MemoryObject(uint64_t size);

zion/object/process.h

@@ -24,7 +24,7 @@ class Process : public KernelObject {
   uint64_t TypeTag() override { return KernelObject::PROCESS; }
   static uint64_t DefaultPermissions() {
     return kZionPerm_Write | kZionPerm_Read | kZionPerm_SpawnThread |
-           kZionPerm_SpawnProcess | kZionPerm_Duplicate;
+           kZionPerm_SpawnProcess | kZionPerm_Duplicate | kZionPerm_Transmit;
   }
 
   enum State {

zion/syscall/ipc.cpp

@@ -105,7 +105,7 @@ glcr::ErrorCode EndpointSend(ZEndpointSendReq* req) {
   auto reply_port = ReplyPort::Create();
   *req->reply_port_cap = proc.AddNewCapability(reply_port, kZionPerm_Read);
   uint64_t reply_port_cap_to_send =
-      proc.AddNewCapability(reply_port, kZionPerm_Write);
+      proc.AddNewCapability(reply_port, kZionPerm_Write | kZionPerm_Transmit);
   return endpoint->Send(req->num_bytes, req->data, 1, &reply_port_cap_to_send);
 }