redo boot around an explicit system volume and fixed kernel/HAL images, redo volumes and filesystem paths around capabilities instead of drive numbers and kernel CWD state, add a capability/security model with derived and revocable handles and security contexts, add port IPC and rssrv to manage the userspace resource namespace and publish the system volume, move process, dll and path loading to userspace and add process builder syscalls, init now supervises rssrv and the session process, redo the syscall ABI around request structs and four arguments, add a volume manager and proper partition arrival/removal handling so FAT and NTFS mount dynamically, clean up the HAL/DDK boundary so drivers don't depend on HAL internals, save fpu state properly now, the serial driver doesn't hang on a missing port, fix AHCI startup races, fix timeout accounting, fix shared mmap writeback, more smoke tests

code/public/ntlite/security.h

@@ -0,0 +1,66 @@
+// Public nt-lite security context and privilege declarations.
+
+#pragma once
+
+#include <stdint.h>
+#include <ntlite/handle.h>
+#include <ntlite/status.h>
+
+typedef uint32_t SYS_PRIVILEGES;
+typedef uint32_t SYS_SERVICE_CLAIMS;
+
+// Ambient privileges are reserved for kernel-mediated authority that is not represented by an object capability yet.
+#define SYS_PRIV_PROCESS_OPEN_ANY          0x00000001u
+#define SYS_PRIV_PROCESS_ENUMERATE         0x00000002u
+#define SYS_PRIV_THREAD_ENUMERATE_ANY      0x00000004u
+#define SYS_PRIV_KERNEL_DIAGNOSTICS        0x00000008u
+#define SYS_PRIV_GLOBAL_INPUT              0x00000010u
+#define SYS_PRIV_AUDIO_ACCESS              0x00000020u
+#define SYS_PRIV_AUDIO_MASTER_CONTROL      0x00000040u
+#define SYS_PRIV_CONSOLE_ACCESS            0x00000080u
+#define SYS_PRIV_DISPLAY_ACCESS            0x00000100u
+#define SYS_PRIV_DEBUG_OUTPUT              0x00000200u
+#define SYS_PRIV_SYSTEM_SERVICE_REGISTER   0x00000400u
+#define SYS_PRIV_RAW_STORAGE               0x00000800u
+#define SYS_PRIV_FILESYSTEM_PROVIDER       0x00001000u
+#define SYS_PRIV_NETWORK_ACCESS            0x00002000u
+// Allows publication into the legacy global named-queue registry; opening an explicitly published queue stays public.
+#define SYS_PRIV_NAMED_QUEUE_PUBLISH       0x00004000u
+#define SYS_PRIV_ALL                       0x00007FFFu
+
+// Service claims constrain which well-known service identities a privileged context may register.
+#define SYS_SERVICE_CLAIM_RESOURCE         0x00000001u
+#define SYS_SERVICE_CLAIM_ALL              SYS_SERVICE_CLAIM_RESOURCE
+
+// Security-context-specific capability rights.
+#define SYS_SECURITY_CONTEXT_RIGHT_DERIVE  0x00000100u
+#define SYS_SECURITY_CONTEXT_RIGHT_ASSIGN  0x00000200u
+
+// Zero is a per-API sentinel meaning the calling process's current security context.
+#define SYS_SECURITY_CONTEXT_CURRENT SYS_HANDLE_INVALID
+
+typedef struct SYS_SECURITY_CONTEXT_INFO {
+    uint32_t Size;
+    uint32_t SecurityId;
+    SYS_PRIVILEGES EffectivePrivileges;
+    SYS_PRIVILEGES DelegablePrivileges;
+    SYS_SERVICE_CLAIMS ServiceClaims;
+    SYS_SERVICE_CLAIMS DelegableServiceClaims;
+    uint32_t Flags;
+} SYS_SECURITY_CONTEXT_INFO;
+
+typedef struct SYS_DERIVE_SECURITY_CONTEXT_REQUEST {
+    uint32_t Size;
+    SYS_HANDLE SourceContext;
+    SYS_PRIVILEGES EffectivePrivileges;
+    SYS_PRIVILEGES DelegablePrivileges;
+    SYS_SERVICE_CLAIMS ServiceClaims;
+    SYS_SERVICE_CLAIMS DelegableServiceClaims;
+    uint32_t Flags;
+    SYS_HANDLE* ContextHandleOut;
+} SYS_DERIVE_SECURITY_CONTEXT_REQUEST;
+
+#define SYS_SECURITY_CONTEXT_FLAG_NONE 0u
+
+KSTATUS SysDeriveSecurityContext(const SYS_DERIVE_SECURITY_CONTEXT_REQUEST* request);
+KSTATUS SysQuerySecurityContext(SYS_HANDLE contextHandle, SYS_SECURITY_CONTEXT_INFO* infoOut);