setpgid forms a real unit, kill(-n) reaches it, and a spawn can chdir

Three calls a shell runner makes, each of which used to succeed and change
nothing a caller could observe --- which is the failure shape this port names in
okm_opt.h and had three more instances of.

`setpgid(0, 0)' answered 0 and formed nothing. True in a world with no groups, so
it was not a lie; it was also not a unit, and the caller's next act ---
`kill(-pid)' --- found nothing to kill. It is now `kal_process_job_enter'.

`kill(-n)' answered ESRCH while a unit existed. It now names the unit: the one
this program formed, or the one a start formed for a child. ⚠️ THE UNIT IS KEPT
PAST THE WAIT, and that is the case a unit is used FOR --- a shell exits at once
and the work it backgrounded is what a timeout has to reach. Clearing it on the
wait made this answer ESRCH a fraction of a second before every caller that
wants it; measured, the background work survived.

`posix_spawn_file_actions_addchdir_np' was refused along with everything this
file could not express. openkal 0.11 gives a spawn a second directory, so both
chdir actions are now answered.

⚠️ `POSIX_SPAWN_SETPGROUP' is honoured only in the form this port can mean: a
zero group asks for a unit of the program's own, which is exactly
`kal_spawn.job'. A NAMED group stays refused --- openkal cannot put a program into
somebody else's unit, and turning that request into a different one quietly is
the defect above with a fourth instance.

⚠️⚠️ AND ONE IDIOM REMAINS OUT OF REACH, WHICH IS RECORDED AND NOT APPROXIMATED.
`fork(); setpgid(0, 0); exec…' forms a unit led by the program the COPY starts,
whose identity the original never learns --- so the original's `kill(-pid)' names
a group that is not the one that exists. Closing it needs the copy and its parent
to agree on a name before either exists, which nothing here can arrange.
`posix_spawn' with the attribute above is the form that works, and it is what the
consumer moved to.

Author: Sunrisepeak

port/src/okm_opt.h

@@ -170,6 +170,8 @@ static inline int okm_fs_list_next(struct kal_dir, kal_uintptr*, char*, kal_uint
 #if OKM_HAS_PROCESS
 
 #define okm_process_spawn     kal_process_spawn
+#define okm_process_job_enter kal_process_job_enter
+#define okm_process_job_terminate kal_process_job_terminate
 #define okm_process_wait      kal_process_wait
 #define okm_process_terminate kal_process_terminate
 #define okm_process_close     kal_process_close
@@ -208,6 +210,8 @@ static inline int okm_process_spawn(const struct kal_spawn*, const char*, kal_ui
 static inline int okm_process_wait(struct kal_process, int*,
                                    int*) { return kal_err_not_supported; }
 static inline int okm_process_terminate(struct kal_process) { return kal_err_not_supported; }
+static inline int okm_process_job_enter(struct kal_job*) { return kal_err_not_supported; }
+static inline int okm_process_job_terminate(struct kal_job) { return kal_err_not_supported; }
 static inline void okm_process_close(struct kal_process) {}
 
 #endif  /* OKM_HAS_PROCESS */

port/src/okm_spawn.c

@@ -78,6 +78,7 @@
 #define OKM_SPAWN_MAX_OPEN 8
 
 int __okm_child_record(struct kal_process h);
+int __okm_child_record_job(struct kal_process h, struct kal_job j);
 
 static size_t slen(const char* s) { size_t n = 0; while (s && s[n]) n++; return n; }
 
@@ -417,6 +418,11 @@ int __okm_spawn_common(pid_t* restrict res, const char* restrict path,
 	struct kal_file opened[OKM_SPAWN_MAX_OPEN];
 	int opened_n = 0;
 
+	/* The directory the program is to run in, if a file action named one. It is
+	 * this call's and is released with the opened files below. */
+	struct kal_dir where;
+	int where_held = 0;
+
 	/* Resolving a file action's name needs one of these and it is four kilobytes.
 	 * Static, under this file's lock, for the same reason the argument vectors
 	 * above are: a second one on the stack would double the frame of a function
@@ -485,8 +491,33 @@ int __okm_spawn_common(pid_t* restrict res, const char* restrict path,
 				if (op->fd > 2) break;
 				refused = ENOSYS;
 				break;
-			case FDOP_CHDIR:
-			case FDOP_FCHDIR:
+			/* ⭐⭐ ANSWERED SINCE 0.12, BECAUSE openkal 0.11 GAVE A SPAWN A SECOND
+			 * DIRECTORY. Both of these say the same thing --- run the program
+			 * HERE --- and until there was a place to put it they were refused
+			 * along with everything else this file could not express. */
+			case FDOP_CHDIR: {
+				struct okm_at cat;
+				const int r = okm_resolve(AT_FDCWD, op->path, &cat, 0);
+				if (r) { refused = (int)-r; break; }
+				struct kal_dir d;
+				const int e = okm_fs_open_dir(cat.base, cat.rel, slen(cat.rel), &d);
+				if (e != kal_ok) { refused = okm_errno(e); break; }
+				if (where_held) okm_fs_close_dir(where);
+				where = d; where_held = 1;
+				break;
+			}
+			case FDOP_FCHDIR: {
+				struct okm_desc* dd = okm_desc_of(op->fd);
+				if (!dd || dd->kind != OKM_DIR) { refused = EBADF; break; }
+				/* A directory of this program's own, opened again so that the
+				 * spawn holds one the caller cannot close underneath it. */
+				struct kal_dir d;
+				const int e = okm_fs_open_dir(dd->dir, ".", 1, &d);
+				if (e != kal_ok) { refused = okm_errno(e); break; }
+				if (where_held) okm_fs_close_dir(where);
+				where = d; where_held = 1;
+				break;
+			}
 			default:
 				/* An action openkal cannot express. Performing the spawn
 				 * without it would start the program in a state the caller did
@@ -512,6 +543,7 @@ int __okm_spawn_common(pid_t* restrict res, const char* restrict path,
 
 	if (refused) {
 		for (int i = 0; i < opened_n; i++) okm_fs_close_file(opened[i]);
+		if (where_held) okm_fs_close_dir(where);
 		okm_unlock();
 		return refused;
 	}
@@ -534,7 +566,8 @@ int __okm_spawn_common(pid_t* restrict res, const char* restrict path,
 	 * else entirely. Passing it now closes that, and it closes the `fork' route
 	 * as well: a copy that chdir'd has its own `okm_cwd_dir', and the `execve'
 	 * it then performs reaches this line. */
-	int e = start_program(bound, want_unit, okm_cwd_dir, &at, a_ptr, a_len, argc,
+	int e = start_program(bound, want_unit, where_held ? where : okm_cwd_dir,
+	                      &at, a_ptr, a_len, argc,
 	                      e_ptr, e_len, envc, &streams, &child);
 
 	/* ⭐ THE ONE ENVIRONMENT THAT SPELLS A PROGRAM WITH A SUFFIX IS ANSWERED
@@ -563,11 +596,12 @@ int __okm_spawn_common(pid_t* restrict res, const char* restrict path,
 	 * from a file, and openkal-musl asks the specification to say so for streams
 	 * in general rather than for one of them. */
 	for (int i = 0; i < opened_n; i++) okm_fs_close_file(opened[i]);
+	if (where_held) okm_fs_close_dir(where);
 
 	okm_unlock();
 	if (e != kal_ok) return okm_errno(e);
 
-	const int pid = __okm_child_record(child);
+	const int pid = __okm_child_record_job(child, unit);
 	if (pid < 0) { okm_process_close(child); return EAGAIN; }
 	*res = (pid_t)pid;
 	return 0;

port/src/okm_syscall.c

@@ -562,7 +562,15 @@ static void to_timespec(kal_duration ns, struct timespec* ts)
  * others --- which is the kind of program that meets it --- and because each
  * entry is three words. */
 #define OKM_MAX_CHILD 256
-static struct { int used; int pid; struct kal_process h; } g_child[OKM_MAX_CHILD];
+/* ⭐ AND THE UNIT THAT START FORMED, WHICH IS THE ONLY PLACE IT CAN LIVE.
+ * A caller ends a group by naming a negative identifier; openkal names a unit by
+ * a handle whose meaning is the implementation's. The two are related here and
+ * nowhere else --- openkal deliberately offers no way to recover a unit from a
+ * program, because an implementation that had to keep a table to answer that
+ * would be the defect clause 7.1 describes. This library is not an
+ * implementation of openkal; keeping what it was GIVEN is bookkeeping, not
+ * recovery. */
+static struct { int used; int pid; struct kal_process h; struct kal_job job; int has_job; } g_child[OKM_MAX_CHILD];
 static int g_next_pid = 1000;
 
 /* ⭐ WHAT THIS PROGRAM ANSWERS WHEN ASKED WHO IT IS.
@@ -578,6 +586,15 @@ static int g_next_pid = 1000;
  * `fork' returned it. */
 static int g_self_pid = 1;
 
+/* The unit this program formed, if it did. ⚠️ KEPT BECAUSE THE NUMBER A CALLER
+ * WILL LATER USE IS NOT THE HANDLE: `kill(-n)' names a group by a POSIX
+ * identifier, and openkal's unit is a handle whose meaning belongs to the
+ * implementation. One per program, which is what one `setpgid(0, 0)' forms, so
+ * this is a word and not a table --- and a copy made by `fork' carries it, which
+ * is what lets a copy form the unit and its parent end it. */
+static struct kal_job g_job;
+static int            g_job_held;
+
 void __okm_set_self_pid(int pid) { g_self_pid = pid; }
 
 /* Takes an entry and settles its identifier WITHOUT a resource to put in it.
@@ -598,6 +615,8 @@ int __okm_child_reserve(int* pid_out)
 		g_child[i].used = 1;
 		g_child[i].pid = ++g_next_pid;
 		g_child[i].h = (struct kal_process){ 0 };
+		g_child[i].job = (struct kal_job){ 0 };
+		g_child[i].has_job = 0;
 		if (pid_out) *pid_out = g_child[i].pid;
 		return i;
 	}
@@ -609,22 +628,50 @@ void __okm_child_commit(int slot, struct kal_process h)
 	if (slot >= 0 && slot < OKM_MAX_CHILD) g_child[slot].h = h;
 }
 
+/* The unit a start formed for this child, recorded so that a later `kill(-n)'
+ * can name it. Separate from the commit above because a start forms a unit only
+ * when the caller asked for one. */
+void __okm_child_job(int slot, struct kal_job j)
+{
+	if (slot >= 0 && slot < OKM_MAX_CHILD && j.h != 0) {
+		g_child[slot].job = j;
+		g_child[slot].has_job = 1;
+	}
+}
+
 void __okm_child_release(int slot)
 {
+	/* ⚠️ THE UNIT IS NOT RELEASED WITH THE PROGRAM, AND THAT IS THE POINT OF IT.
+	 * A group outlives the program that formed it for exactly as long as it has
+	 * members --- which is the case a caller uses a unit FOR: the shell exits
+	 * immediately and the work it put in the background is what a timeout has to
+	 * reach. Clearing this on the wait made `kill(-n)' answer ESRCH the moment
+	 * the shell was reaped, which is a fraction of a second before every caller
+	 * that wants it. Measured: the background work survived.
+	 *
+	 * The slot is free for a new program; the number and its unit stay until
+	 * that slot is taken again. */
 	if (slot >= 0 && slot < OKM_MAX_CHILD) g_child[slot].used = 0;
 }
 
-int __okm_child_record(struct kal_process h)
+int __okm_child_record_job(struct kal_process h, struct kal_job j)
 {
 	okm_lock();
 	int pid = 0;
 	const int slot = __okm_child_reserve(&pid);
 	if (slot < 0) { okm_unlock(); return -EAGAIN; }
 	__okm_child_commit(slot, h);
+	__okm_child_job(slot, j);
 	okm_unlock();
 	return pid;
 }
 
+int __okm_child_record(struct kal_process h)
+{
+	const struct kal_job none = { 0 };
+	return __okm_child_record_job(h, none);
+}
+
 /* ⚠️ A COPY OF THE CALLING IMAGE INHERITS THIS TABLE AND MUST NOT KEEP IT.
  *
  * The entries name programs the ORIGINAL started, and POSIX is explicit that a
@@ -648,6 +695,15 @@ static int child_index(int pid)
 	return -1;
 }
 
+/* The unit a program formed, which is looked up WITHOUT requiring the program to
+ * still be running --- see __okm_child_release. */
+static int job_index(int pid)
+{
+	for (int i = 0; i < OKM_MAX_CHILD; i++)
+		if (g_child[i].has_job && g_child[i].pid == pid) return i;
+	return -1;
+}
+
 /* --- what a signal aimed at this program means ------------------------------
  *
  * ⚠️⚠️ `abort' DID NOT END THE PROGRAM, AND WHAT ENDED IT WAS AN ILLEGAL
@@ -1824,6 +1880,31 @@ syscall_arg_t __okm_syscall(syscall_arg_t n, syscall_arg_t a1, syscall_arg_t a2,
 #ifdef SYS_kill
 	case SYS_kill: {
 		const int pid = (int)a1, sig = (int)a2;
+		/* ⭐⭐ A NEGATIVE IDENTIFIER NAMES A UNIT, AND THIS IS THE OTHER HALF OF
+		 * `setpgid(0, 0)' ABOVE.
+		 *
+		 * `kill(-n)' is how a caller ends a group, and the identifier it uses is
+		 * the one `setpgid' gave it --- either this program's, or a child's whose
+		 * copy formed the unit. Both reach the unit this library holds, because
+		 * a program forms at most one and a copy carries its parent's.
+		 *
+		 * ⚠️ WITHOUT THIS THE FORMING WOULD BE INVISIBLE. That is the shape of
+		 * the two defects before it: a call that succeeds and changes nothing
+		 * observable is worse than one that refuses, because the caller proceeds.
+		 * `kill(-n)' answered ESRCH here while the unit existed. */
+		if (pid < 0 && pid != -1) {
+			const int gi = job_index(-pid);
+			if (gi >= 0 && g_child[gi].has_job) {
+				if (sig == 0) return 0;
+				const int e = okm_process_job_terminate(g_child[gi].job);
+				return e == kal_ok ? 0 : -okm_errno(e);
+			}
+			if (g_job_held) {
+				if (sig == 0) return 0;
+				const int e = okm_process_job_terminate(g_job);
+				return e == kal_ok ? 0 : -okm_errno(e);
+			}
+		}
 		const int i = child_index(pid);
 		if (i >= 0) {
 			/* ⚠️ SIGNAL ZERO IS AN ENQUIRY AND USED TO TERMINATE THE CHILD.
@@ -2108,13 +2189,35 @@ syscall_arg_t __okm_syscall(syscall_arg_t n, syscall_arg_t a1, syscall_arg_t a2,
 	case SYS_getsid:
 		return (a1 == 0 || a1 == g_self_pid) ? g_self_pid : -ESRCH;
 
-	/* Naming this program, or naming nobody, asks for the arrangement that
-	 * already holds. Naming anything else asks for a group this environment
-	 * cannot name, which is EPERM rather than ENOSYS: the operation is here,
-	 * the group is not. */
+	/* ⭐⭐ A REAL GROUP SINCE 0.12, AND IT IS THE CALL A SHELL RUNNER MAKES.
+	 *
+	 * `setpgid(0, 0)' asks that THIS program lead a unit of its own, which
+	 * openkal 0.11 spells `kal_process_job_enter'. It used to answer 0 and form
+	 * nothing --- true in a world with no groups, since a program is then
+	 * trivially alone --- and the caller's next act, `kill(-pid)', found nothing
+	 * to kill.
+	 *
+	 * ⚠️ THE UNIT IS KEPT, BECAUSE THE NUMBER THE CALLER WILL USE IS NOT ENOUGH.
+	 * A caller ends a group by naming a negative identifier, and openkal's unit
+	 * is a handle whose meaning is the implementation's --- a process group's
+	 * identifier on one system, a job object on another. `g_job' is where this
+	 * library remembers which unit `setpgid' formed, so that `kill(-n)' below can
+	 * name it. One unit per program, which is what one `setpgid(0, 0)' forms.
+	 *
+	 * Naming another program's group is still refused: openkal cannot put a
+	 * program into a unit it does not lead, and EPERM says the operation is here
+	 * while the group is not. */
 	case SYS_setpgid:
-		if ((a1 == 0 || a1 == (syscall_arg_t)g_self_pid)
-		    && (a2 == 0 || a2 == (syscall_arg_t)g_self_pid)) return 0;
+		if (a1 != 0 && a1 != (syscall_arg_t)g_self_pid) return -EPERM;
+		if (a2 == 0 || a2 == (syscall_arg_t)g_self_pid) {
+			struct kal_job unit = { 0 };
+			const int e = okm_process_job_enter(&unit);
+			if (e == kal_ok) { g_job = unit; g_job_held = 1; return 0; }
+			/* An environment with no units leaves a program trivially alone in
+			 * one, which is what this used to assert unconditionally. */
+			if (e == kal_err_not_supported) return 0;
+			return -okm_errno(e);
+		}
 		return -EPERM;
 	case SYS_setsid:
 		return -EPERM;   /* already a process group leader; see above */