zet.tlv: switch file writes to new API

The interface for apps looks much nicer now, see 'main' in zet.tlv.
However there are some open issues:

- It can still be confusing to the computer owner that an app tries to
  write to some temporary file that isn't mentioned anywhere.

- File renames can fail if /tmp is on a different volume.

- What happens if an app overrides start_writing()? The computer owner
  may think they've audited the caller of start_writing and give it
  blanket file permissions. Teliva tunnels through start_writing when
  computing the caller. If the app can control what start_writing does,
  the app could be performing arbitrary malicious file operations.

  Right now things actually seem perfectly secure. Overriding
  start_writing has no effect. Our approach for loading .tlv files (in
  reverse chronological order, preventing older versions from overriding
  newer ones) has the accidentally _great_ property that Teliva apps can
  never override system definitions.

  So we have a new reason to put standard libraries in a .lua file: if
  we need to prevent apps from overriding it.

  This feels like something that needs an automated test, both to make
  sure I'm running the right experiment and to ensure I don't
  accidentally cause a regression in the future. I can totally imagine a
  future rewrite that tried a different approach than
  reverse-chronological.

1 files changed, 2 insertions, 0 deletions

diff --git a/src/teliva.h b/src/teliva.h
index db2138d..e322aa3 100644
--- a/src/teliva.h
+++ b/src/teliva.h
@@ -168,6 +168,8 @@ extern void assign_call_graph_depth_to_name(lua_State* L, int depth, const char*
 extern char* get_caller(lua_State* L);
 extern void save_caller(lua_State* L, const char* name, int call_graph_depth);
 extern void draw_callers_of_current_definition(lua_State* L);
+extern char* get_caller_of_caller(lua_State* L);
+
 extern void append_to_audit_log(lua_State* L, const char* buffer);
 
 /* Standard UI elements */