lib: Add per-user packet pools

The IRMd will now check the user UID and GID for privileged access,
avoiding unprivileged users being able to disrupt all IPC (e.g. by
shm_open the single pool and corrupting its metadata).

Non-privileged users are now limited to a PUP (per-user pool) for
sending/receiving packets. It is still created by the IRMd, but owned
by the user (uid) with 600 permissions. It does not add additional
copies for local IPC between their own processes (i.e. over the local
IPCP), but packets between processes owned by a different user or
destined over the network (other IPCPs) will incur a copy when
crossing the PUP / PUP or the PUP / GSPP boundary.

Privileged users and users in the ouroboros group still have direct
access to the GSPP (globally shared private pool) for packet transfer
that will avoid additional copies when processing packets between
processes owned by different users and to the network.

This aligns the security model with UNIX trust domains defined by UID
and GID by leveraging file permission on the pools in shared memory.

┌─────────────────────────────────────────────────────────────┐
│ Source Pool    │ Dest Pool      │ Operation    │ Copies     │
├─────────────────────────────────────────────────────────────┤
│ GSPP           │ GSPP           │ Zero-copy    │ 0          │
│ PUP.uid        │ PUP.uid        │ Zero-copy    │ 0          │
│ PUP.uid1       │ PUP.uid2       │ memcpy()     │ 1          │
│ PUP.uid        │ GSPP           │ memcpy()     │ 1          │
│ GSPP           │ PUP.uid        │ memcpy()     │ 1          │
└─────────────────────────────────────────────────────────────┘

This also renames the struct ai ("application instance") in dev.c to
struct proc (process).

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

9 files changed, 295 insertions, 31 deletions

diff --git a/src/irmd/reg/flow.c b/src/irmd/reg/flow.c
index 02dc9c99..52b03e61 100644
--- a/src/irmd/reg/flow.c
+++ b/src/irmd/reg/flow.c
@@ -178,6 +178,7 @@ int reg_flow_update(struct reg_flow *  flow,
         }
 
         flow->info.state = info->state;
+        flow->info.uid   = info->uid;
 
         *info = flow->info;
 
diff --git a/src/irmd/reg/pool.c b/src/irmd/reg/pool.c
new file mode 100644
index 00000000..fd983db8
--- /dev/null
+++ b/src/irmd/reg/pool.c
@@ -0,0 +1,101 @@
+/*
+ * Ouroboros - Copyright (C) 2016 - 2026
+ *
+ * The IPC Resource Manager - Registry - Per-User Pools
+ *
+ *    Dimitri Staessens <dimitri@ouroboros.rocks>
+ *    Sander Vrijders   <sander@ouroboros.rocks>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., http://www.fsf.org/about/contact/.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#define OUROBOROS_PREFIX "reg/pool"
+
+#include <ouroboros/logs.h>
+#include <ouroboros/ssm_pool.h>
+
+#include "pool.h"
+
+#include <assert.h>
+#include <stdlib.h>
+
+struct reg_pool * reg_pool_create(uid_t uid,
+                                  gid_t gid)
+{
+        struct reg_pool * pool;
+
+        pool = malloc(sizeof(*pool));
+        if (pool == NULL) {
+                log_err("Failed to malloc pool.");
+                goto fail_malloc;
+        }
+
+        pool->ssm = ssm_pool_create(uid, gid);
+        if (pool->ssm == NULL) {
+                log_err("Failed to create PUP for uid %d.", uid);
+                goto fail_ssm;
+        }
+
+        list_head_init(&pool->next);
+        pool->uid      = uid;
+        pool->gid      = gid;
+        pool->refcount = 1;
+
+        log_dbg("Created PUP for uid %d gid %d.", uid, gid);
+
+        return pool;
+
+ fail_ssm:
+        free(pool);
+ fail_malloc:
+        return NULL;
+}
+
+void reg_pool_destroy(struct reg_pool * pool)
+{
+        assert(pool != NULL);
+        assert(pool->refcount == 0);
+
+        log_dbg("Destroying PUP for uid %d.", pool->uid);
+
+        ssm_pool_destroy(pool->ssm);
+
+        assert(list_is_empty(&pool->next));
+
+        free(pool);
+}
+
+void reg_pool_ref(struct reg_pool * pool)
+{
+        assert(pool != NULL);
+        assert(pool->refcount > 0);
+
+        pool->refcount++;
+
+        log_dbg("PUP uid %d refcount++ -> %zu.", pool->uid, pool->refcount);
+}
+
+int reg_pool_unref(struct reg_pool * pool)
+{
+        assert(pool != NULL);
+        assert(pool->refcount > 0);
+
+        pool->refcount--;
+
+        log_dbg("PUP uid %d refcount-- -> %zu.", pool->uid, pool->refcount);
+
+        return pool->refcount == 0 ? 0 : 1;
+}
diff --git a/src/irmd/reg/pool.h b/src/irmd/reg/pool.h
new file mode 100644
index 00000000..576f491c
--- /dev/null
+++ b/src/irmd/reg/pool.h
@@ -0,0 +1,48 @@
+/*
+ * Ouroboros - Copyright (C) 2016 - 2026
+ *
+ * The IPC Resource Manager - Registry - Per-User Pools
+ *
+ *    Dimitri Staessens <dimitri@ouroboros.rocks>
+ *    Sander Vrijders   <sander@ouroboros.rocks>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., http://www.fsf.org/about/contact/.
+ */
+
+#ifndef OUROBOROS_IRMD_REG_POOL_H
+#define OUROBOROS_IRMD_REG_POOL_H
+
+#include <ouroboros/list.h>
+#include <ouroboros/ssm_pool.h>
+
+#include <sys/types.h>
+
+struct reg_pool {
+        struct list_head    next;
+        uid_t               uid;
+        gid_t               gid;
+        size_t              refcount;
+        struct ssm_pool *   ssm;
+};
+
+struct reg_pool * reg_pool_create(uid_t uid,
+                                  gid_t gid);
+
+void              reg_pool_destroy(struct reg_pool * pool);
+
+void              reg_pool_ref(struct reg_pool * pool);
+
+int               reg_pool_unref(struct reg_pool * pool);
+
+#endif /* OUROBOROS_IRMD_REG_POOL_H */
diff --git a/src/irmd/reg/proc.c b/src/irmd/reg/proc.c
index 541731b2..b97dcf2d 100644
--- a/src/irmd/reg/proc.c
+++ b/src/irmd/reg/proc.c
@@ -25,6 +25,7 @@
 #define OUROBOROS_PREFIX "reg/proc"
 
 #include <ouroboros/logs.h>
+#include <ouroboros/utils.h>
 
 #include "proc.h"
 
@@ -75,6 +76,8 @@ struct reg_proc * reg_proc_create(const struct proc_info * info)
                 goto fail_malloc;
         }
 
+        memset(proc, 0, sizeof(*proc));
+
         proc->set = ssm_flow_set_create(info->pid);
         if (proc->set == NULL) {
                 log_err("Failed to create flow set for %d.", info->pid);
@@ -181,3 +184,10 @@ bool reg_proc_has_name(const struct reg_proc * proc,
 {
         return __reg_proc_get_name(proc, name) != NULL;
 }
+
+bool reg_proc_is_privileged(const struct reg_proc * proc)
+{
+        assert(proc != NULL);
+
+        return is_ouroboros_member_uid(proc->info.uid);
+}
diff --git a/src/irmd/reg/proc.h b/src/irmd/reg/proc.h
index a790e5c9..be4c1161 100644
--- a/src/irmd/reg/proc.h
+++ b/src/irmd/reg/proc.h
@@ -53,4 +53,6 @@ void              reg_proc_del_name(struct reg_proc * proc,
 bool              reg_proc_has_name(const struct reg_proc * proc,
                                     const char *            name);
 
+bool              reg_proc_is_privileged(const struct reg_proc * proc);
+
 #endif /* OUROBOROS_IRMD_REG_PROC_H */
diff --git a/src/irmd/reg/reg.c b/src/irmd/reg/reg.c
index fd8285be..e89b492b 100644
--- a/src/irmd/reg/reg.c
+++ b/src/irmd/reg/reg.c
@@ -35,6 +35,7 @@ The IPC Resource Manager - Registry
 #include "flow.h"
 #include "ipcp.h"
 #include "name.h"
+#include "pool.h"
 #include "proc.h"
 #include "prog.h"
 
@@ -57,6 +58,9 @@ struct {
         struct list_head     names;     /* registered names known     */
         size_t               n_names;   /* number of names            */
 
+        struct list_head     pools;     /* per-user pools             */
+        size_t               n_pools;   /* number of pools            */
+
         struct list_head     procs;     /* processes                  */
         size_t               n_procs;   /* number of processes        */
 
@@ -235,6 +239,20 @@ static struct list_head * __reg_after_name(const char * name)
         return p;
 }
 
+static struct reg_pool * __reg_get_pool(uid_t uid)
+{
+        struct list_head * p;
+
+        list_for_each(p, &reg.pools) {
+                struct reg_pool * entry;
+                entry = list_entry(p, struct reg_pool, next);
+                if (entry->uid == uid)
+                        return entry;
+        }
+
+        return NULL;
+}
+
 static struct reg_proc * __reg_get_proc(pid_t pid)
 {
         struct list_head * p;
@@ -540,6 +558,7 @@ int reg_init(void)
         list_head_init(&reg.flows);
         list_head_init(&reg.ipcps);
         list_head_init(&reg.names);
+        list_head_init(&reg.pools);
         list_head_init(&reg.procs);
         list_head_init(&reg.progs);
         list_head_init(&reg.spawned);
@@ -589,6 +608,15 @@ void reg_clear(void)
                 reg.n_procs--;
         }
 
+        list_for_each_safe(p, h, &reg.pools) {
+                struct reg_pool * entry;
+                entry = list_entry(p, struct reg_pool, next);
+                list_del(&entry->next);
+                entry->refcount = 0; /* Force destroy during cleanup */
+                reg_pool_destroy(entry);
+                reg.n_pools--;
+        }
+
         list_for_each_safe(p, h, &reg.flows) {
                 struct reg_flow * entry;
                 entry = list_entry(p, struct reg_flow, next);
@@ -621,6 +649,7 @@ void reg_fini(void)
         assert(list_is_empty(&reg.spawned));
         assert(list_is_empty(&reg.progs));
         assert(list_is_empty(&reg.procs));
+        assert(list_is_empty(&reg.pools));
         assert(list_is_empty(&reg.names));
         assert(list_is_empty(&reg.ipcps));
         assert(list_is_empty(&reg.flows));
@@ -628,6 +657,7 @@ void reg_fini(void)
         assert(reg.n_spawned == 0);
         assert(reg.n_progs == 0);
         assert(reg.n_procs == 0);
+        assert(reg.n_pools == 0);
         assert(reg.n_names == 0);
         assert(reg.n_ipcps == 0);
         assert(reg.n_flows == 0);
@@ -1090,6 +1120,35 @@ int reg_list_names(name_info_msg_t *** names)
         return -ENOMEM;
 }
 
+int reg_prepare_pool(uid_t uid,
+                     gid_t gid)
+{
+        struct reg_pool * pool;
+
+        if (is_ouroboros_member_uid(uid))
+                return 0;
+
+        pthread_mutex_lock(&reg.mtx);
+
+        pool = __reg_get_pool(uid);
+        if (pool == NULL) {
+                pool = reg_pool_create(uid, gid);
+                if (pool == NULL) {
+                        log_err("Failed to create pool for uid %d.", uid);
+                        pthread_mutex_unlock(&reg.mtx);
+                        return -1;
+                }
+                list_add(&pool->next, &reg.pools);
+                reg.n_pools++;
+        }
+
+        reg_pool_ref(pool);
+
+        pthread_mutex_unlock(&reg.mtx);
+
+        return 0;
+}
+
 int reg_create_proc(const struct proc_info * info)
 {
         struct reg_proc * proc;
@@ -1100,13 +1159,13 @@ int reg_create_proc(const struct proc_info * info)
 
         if (__reg_get_proc(info->pid) != NULL) {
                 log_err("Process %d already exists.", info->pid);
-                goto fail_proc;
+                goto fail;
         }
 
         proc = reg_proc_create(info);
         if (proc == NULL) {
                 log_err("Failed to create process %d.", info->pid);
-                goto fail_proc;
+                goto fail;
         }
 
         __reg_proc_update_names(proc);
@@ -1121,7 +1180,7 @@ int reg_create_proc(const struct proc_info * info)
 
         return 0;
 
- fail_proc:
+ fail:
         pthread_mutex_unlock(&reg.mtx);
         return -1;
 }
@@ -1129,6 +1188,7 @@ int reg_create_proc(const struct proc_info * info)
 int reg_destroy_proc(pid_t pid)
 {
         struct reg_proc *  proc;
+        struct reg_pool *  pool = NULL;
         struct pid_entry * spawn;
         struct reg_ipcp *  ipcp;
 
@@ -1136,11 +1196,18 @@ int reg_destroy_proc(pid_t pid)
 
         proc = __reg_get_proc(pid);
         if (proc != NULL) {
+                if (!is_ouroboros_member_uid(proc->info.uid))
+                        pool = __reg_get_pool(proc->info.uid);
                 list_del(&proc->next);
                 reg.n_procs--;
                 reg_proc_destroy(proc);
                 __reg_del_proc_from_names(pid);
                 __reg_cancel_flows_for_proc(pid);
+                if (pool != NULL && reg_pool_unref(pool) == 0) {
+                        list_del(&pool->next);
+                        reg.n_pools--;
+                        reg_pool_destroy(pool);
+                }
         }
 
         spawn = __reg_get_spawned(pid);
@@ -1175,6 +1242,38 @@ bool reg_has_proc(pid_t pid)
         return ret;
 }
 
+bool reg_is_proc_privileged(pid_t pid)
+{
+        struct reg_proc * proc;
+        bool              ret = false;
+
+        pthread_mutex_lock(&reg.mtx);
+
+        proc = __reg_get_proc(pid);
+        if (proc != NULL)
+                ret = reg_proc_is_privileged(proc);
+
+        pthread_mutex_unlock(&reg.mtx);
+
+        return ret;
+}
+
+uid_t reg_get_proc_uid(pid_t pid)
+{
+        struct reg_proc * proc;
+        uid_t             ret = 0;
+
+        pthread_mutex_lock(&reg.mtx);
+
+        proc = __reg_get_proc(pid);
+        if (proc != NULL && !is_ouroboros_member_uid(proc->info.uid))
+                ret = proc->info.uid;
+
+        pthread_mutex_unlock(&reg.mtx);
+
+        return ret;
+}
+
 void reg_kill_all_proc(int signal)
 {
         pthread_mutex_lock(&reg.mtx);
diff --git a/src/irmd/reg/reg.h b/src/irmd/reg/reg.h
index 7728c80f..77264fde 100644
--- a/src/irmd/reg/reg.h
+++ b/src/irmd/reg/reg.h
@@ -31,6 +31,8 @@
 #include <ouroboros/time.h>
 #include <ouroboros/utils.h>
 
+#include "pool.h"
+
 int   reg_init(void);
 
 void  reg_clear(void);
@@ -50,6 +52,13 @@ int   reg_destroy_proc(pid_t pid);
 
 bool  reg_has_proc(pid_t pid);
 
+bool  reg_is_proc_privileged(pid_t pid);
+
+int   reg_prepare_pool(uid_t uid,
+                       gid_t gid);
+
+uid_t reg_get_proc_uid(pid_t pid);
+
 void  reg_kill_all_proc(int signal);
 
 pid_t reg_get_dead_proc(void);
diff --git a/src/irmd/reg/tests/proc_test.c b/src/irmd/reg/tests/proc_test.c
index d53f18ec..c4e689f0 100644
--- a/src/irmd/reg/tests/proc_test.c
+++ b/src/irmd/reg/tests/proc_test.c
@@ -27,13 +27,17 @@
 #define TEST_PID  65534
 #define TEST_PROG "usr/bin/testprog"
 
+#define TEST_PROC {           \
+        .pid = TEST_PID,      \
+        .prog = TEST_PROG,    \
+        .uid = getuid(),      \
+        .gid = getgid()       \
+}
+
 static int test_reg_proc_create_destroy(void)
 {
         struct reg_proc * proc;
-        struct proc_info  info = {
-                .pid =  TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info  info = TEST_PROC;
 
         TEST_START();
 
@@ -56,10 +60,7 @@ static int test_reg_proc_create_destroy(void)
 static int test_reg_proc_add_name(void)
 {
         struct reg_proc * proc;
-        struct proc_info  info = {
-                .pid  = TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info  info = TEST_PROC;
 
         char * name = "testname";
 
diff --git a/src/irmd/reg/tests/reg_test.c b/src/irmd/reg/tests/reg_test.c
index 07d0a198..f7a4de8e 100644
--- a/src/irmd/reg/tests/reg_test.c
+++ b/src/irmd/reg/tests/reg_test.c
@@ -21,6 +21,8 @@
  */
 
 
+#include "../pool.c"
+#undef OUROBOROS_PREFIX
 #include "../reg.c"
 
 #include <test/test.h>
@@ -35,6 +37,12 @@
 #define TEST_DATA     "testpbufdata"
 #define TEST_DATA2    "testpbufdata2"
 #define TEST_LAYER    "testlayer"
+#define TEST_PROC_INFO {      \
+        .pid = TEST_PID,      \
+        .prog = TEST_PROG,    \
+        .uid = 0,             \
+        .gid = 0              \
+}
 #define REG_TEST_FAIL() \
         do { TEST_FAIL(); reg_clear(); return TEST_RC_FAIL;} while(0)
 
@@ -852,10 +860,7 @@ static int test_reg_name(void)
 
 static int test_reg_create_proc(void)
 {
-        struct proc_info info = {
-                .pid =  TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info info = TEST_PROC_INFO;
 
         TEST_START();
 
@@ -1011,10 +1016,7 @@ static int test_reg_prog(void)
 
 static int test_bind_proc(void)
 {
-        struct proc_info pinfo = {
-                .pid =  TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info pinfo = TEST_PROC_INFO;
 
         struct name_info ninfo = {
                 .name   = TEST_NAME,
@@ -1167,10 +1169,7 @@ static int test_inherit_prog(void)
                 .name = TEST_PROG
         };
 
-        struct proc_info procinfo = {
-                .pid  = TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info procinfo = TEST_PROC_INFO;
 
         char * exec[] = { TEST_PROG, NULL};
 
@@ -1308,10 +1307,7 @@ static void * test_call_flow_accept(void * o)
         struct timespec timeo = TIMESPEC_INIT_MS(10);
         buffer_t        pbuf = BUF_INIT;
 
-        struct proc_info pinfo = {
-                .pid =  TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info pinfo = TEST_PROC_INFO;
 
         struct flow_info info = {
                 .n_pid = pinfo.pid,
@@ -1663,10 +1659,7 @@ static int test_wait_proc_success(void)
         struct timespec  abstime;
         struct timespec  timeo = TIMESPEC_INIT_S(10);
         pthread_t        thr;
-        struct proc_info info = {
-                .pid  = TEST_PID,
-                .prog = TEST_PROG
-        };
+        struct proc_info info = TEST_PROC_INFO;
 
         TEST_START();