about summary refs log tree commit diff stats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* extract a helperKartik K. Agaram2022-03-061-1/+5
| | | | | | I'm starting to get quite indisciplined about where I introduce global bindings. Seems reasonable since any modules in Teliva will come from within the framework.
* a simple hack to make caller apparentKartik K. Agaram2022-03-052-6/+8
| | | | | | | | | | | | | | | | | | | | Teliva isn't yet smart enough to know the caller of an indirect function where the function being called goes through a local variable. I'd expected fixing this to be a long death march. However, there's a shockingly easy fix: just make every indirect call go through an additional direct function call. My policy for zet.tlv was that function 'main' could open any file. This stopped working since I introduced spawn_main. But with this commit it's working again. I can also drop all my special-casing of 'main' since it's now a regular Lua call. We still can't rely on the caller of an indirect call. That affects start_reading and start_writing, which really need to be part of the framework.
* new API for file operationsKartik K. Agaram2022-03-052-1/+12
| | | | | | | | | | | | | | | | | | | | | File operations now always return a channel (or nil on error or permission denied). When start_reading() from a filename, you can repeatedly :recv() from the channel it returns. When :recv() returns nil, you're at the end of the file. Stop. When you start_writing() to a filename, you can repeatedly :send() to the channel it returns. When you're done writing, :close() the channel. Writes to the file won't be externally visible until you do. To make this work I'm now always starting up the scheduler, so I need to fix sieve.tlv. Transparently running the scheduler is an abstraction, and whenever I create an abstraction I always worry about how it might fail. There's a hopefully-clear error when you read past end of a file.
* some dead codeKartik K. Agaram2022-03-051-59/+0
|
* reliably exit on confirmationKartik K. Agaram2022-03-051-1/+5
| | | | | | | Until now you had to press ctrl-x twice in rapid succession to exit if an app turned on non-blocking keyboard with nodelay(true). This became particularly noticeable after the previous change to anagrams.tlv, which could no longer exit.
* fixup! no further confirmation once editing commencesKartik K. Agaram2022-03-051-0/+1
|
* anagrams.tlv: slightly more responsiveKartik K. Agaram2022-03-051-0/+20
| | | | | | | Now we cancel screen-painting if any key is pressed. However it looks like just computing the list of anagrams can take a long time.
* include caller in sandboxing messagesKartik K. Agaram2022-03-041-1/+1
|
* simplify permissions model for file operationsKartik K. Agaram2022-03-032-5/+5
| | | | | We don't care to distinguish modes like "rw" or "a+". An app is permitted to perform either just reads or both reads and writes.
* clearer copy for confirmation dialogKartik K. Agaram2022-03-031-1/+1
|
* more unobtrusive skip messageKartik K. Agaram2022-03-031-1/+1
| | | | In particular, the periods looked like passing tests.
* no further confirmation once editing commencesKartik K. Agaram2022-03-031-1/+3
|
* ask for confirmation on _any_ teliva shortcutKartik K. Agaram2022-03-031-22/+33
| | | | | This feels more intrusive. Let's see how we like it. Will I start having ctrl-x ctrl-x in my muscle memory?
* experiment: drop -WshadowKartik K. Agaram2022-03-033-5/+5
| | | | | I'm totally fine with lexical scope in other languages. Why does it feel like such a big deal in C?
* always ask for confirmation on exitKartik K. Agaram2022-03-011-2/+18
| | | | | Let's see if we can live with this rather than some way to let apps indicate if they want confirmation or not..
* always run unit tests for channels and tasksKartik K. Agaram2022-02-261-216/+210
|
* import https://github.com/majek/lua-channelsKartik K. Agaram2022-02-262-0/+634
| | | | Also a little test program to demo channels in action.
* duplicate keypress on failing testKartik K. Agaram2022-02-261-1/+0
|
* delete curses primitives to read whole linesKartik K. Agaram2022-02-212-77/+7
| | | | | | | | They make it seem like you can use them to create simple REPL apps, but you can't, because standard Teliva shortcuts won't work. I _could_ make them work by emulating them using getch(), but that feels like an unnecessary abstraction for now.
* stop letting apps change directoryKartik K. Agaram2022-02-201-2/+2
| | | | | | | | | | | | | | I introduced this ability when I packaged up the lfs directory, but it can enable apps to circumvent sandboxing rules in some situations. If you can socially engineer someone to allow reading a file called 'passwd' in the current directory, you can now change directory to /etc and read something sensitive. Protecting against stuff like this gets subtle. It's easy for people to create policies that aren't robust to changing directories. Requiring absolute paths is also pretty unfriendly. So the whole notion of current directory is perhaps implicit state that is confusing to manage. Fix it in the context of a single session.
* bring back pcall and xpcallKartik K. Agaram2022-02-181-0/+24
| | | | They aren't evaluating strings after all.
* 'doc:blurb': a place to briefly describe an appKartik K. Agaram2022-02-171-1/+10
| | | | | | This is for what the app does, as opposed to 'doc:main', which is also intended to include commentary about the internal organization of the app.
* disable non-portable ASan flagsKartik K. Agaram2022-02-161-2/+2
|
* zet.tlv: some more editor shortcutsKartik K. Agaram2022-02-121-2/+2
|
* stop aborting if audit log fills upKartik K. Agaram2022-02-121-10/+32
| | | | | | | | | | | | When I started logging getch() events (which are just to help the reader orient on the log), this suddenly became more urgent. Now the log is larger, and it's also a circular buffer that rolls back to the start when it fills up. The next failure mode will be if we see the buffer filled up with just getch() calls, reducing visibility over real file and network operations. In which case we'll need to start coalescing getch() events.
* fix build on Mac OSKartik K. Agaram2022-02-102-0/+3
|
* hacky support for caller main in file permissionsKartik K. Agaram2022-02-101-0/+2
|
* fixup! clean up top-level Makefile targetsKartik K. Agaram2022-02-101-0/+1
|
* standardize key order in .tlv filesKartik K. Agaram2022-02-091-20/+38
| | | | This will eliminate some spurious git diffs I keep having to clean up.
* typoKartik K. Agaram2022-02-081-1/+1
|
* move most Teliva menus to the rightKartik K. Agaram2022-02-072-6/+8
| | | | | | | | | | The problem I'm running into is that apps might want to perform their own editing. So I can't take up prime estate like the ctrl-e hotkey or a menu name of 'edit'. I'm still prioritizing rendering Teliva's edit and permissions menu. If the window is too narrow the app's settings will be overwritten and Teliva's hotkeys will be preferentially displayed. Seems safer.
* some more dead codeKartik K. Agaram2022-02-061-23/+0
|
* in fact, loadlib.c is all dead code nowKartik K. Agaram2022-02-062-299/+1
| | | | Now we can be sure apps can't call `require`.
* now all our supported platforms are POSIXKartik K. Agaram2022-02-062-14/+5
|
* drop all support for loading dynamic librariesKartik K. Agaram2022-02-062-338/+7
|
* drop module 'package'Kartik K. Agaram2022-02-064-49/+0
| | | | | | | Just like with `require`, we don't we don't know how to sandbox it. (Though we still have `require` because standard libraries outside apps need it. I need to make sure apps can't invoke `require`..)
* drop some more untested platformsKartik K. Agaram2022-02-061-16/+1
|
* drop USE_LINUX and similar definesKartik K. Agaram2022-02-062-15/+4
| | | | | How many levels of macros do we need. Also stop lying that we're using Linux in BSD.
* drop MinGWKartik K. Agaram2022-02-061-6/+1
| | | | | | | | I've never tested with it, and it is likely broken after all my changes to base Lua 5.1. Might as well be transparent about that. If you care about this platform, please let me know: http://akkartik.name/contact
* unused #defineKartik K. Agaram2022-02-061-1/+0
|
* don't perturb cursor when drawing menuKartik K. Agaram2022-02-041-0/+3
|
* fix a couple of warningsKartik K. Agaram2022-02-031-0/+3
| | | | | It's not clear to me where my Linux gets strlcpy and strlcat from ¯\_(ツ)_/¯
* prose typos and editsKartik K. Agaram2022-02-031-3/+2
|
* fix a bug in kiloKartik K. Agaram2022-02-031-1/+1
| | | | Submitted upstream at https://github.com/antirez/kilo/pull/81.
* drop io.lines()Kartik K. Agaram2022-02-021-27/+1
| | | | | | | | | | | | | | | | | I'd already dropped the variant without a filename. But even the variant with a filename is very easy to use in a way that is confusing to use in the presence of sandboxing: * call io.lines() * Sandboxing saves an error, io.lines() returns nil * Caller (usually a loop) raises an error. * We show the error and not the sandboxing failure. * Worse, there's no way to adjust permissions from within Teliva, because we can't ever get to that menu while there's an error. Best solution I can come up with: encourage a separate step for translating filename to file handle. That way it's more obvious that we need to check for errors.
* tweak an entry in the audit logKartik K. Agaram2022-02-021-1/+1
|
* sandbox: no way to run arbitrary Lua code stringsKartik K. Agaram2022-02-021-96/+0
|
* include keys typed into audit logKartik K. Agaram2022-02-013-0/+18
| | | | | This will help people cross-correlate when the app performs specific calls.
* file permissions: decide based on calling functionKartik K. Agaram2022-02-014-15/+30
|
* copy realpath() from FreeBSD repoKartik K. Agaram2022-01-302-1/+245
| | | | | To sandbox apps robustly, we're going to need to always work with canonical absolute paths.
generated by cgit-pink 1.4.1-2-gfad0 (git 2.36.2.497.gbbea4dcf42) at 2024-12-02 00:30:50 +0000