kernel & runtime_loader: Don't load from non-packaged when "Disable user

add-ons" is set.

Confirmed to fix #14361. It is finally possible to un-brick an install
with a bad system library in non-packaged without having to use another
install to do so.

Change-Id: Iafea7821f02cb34e77c766b1f97d1c19206b1081
Reviewed-on: https://review.haiku-os.org/c/1452
Reviewed-by: Adrien Destugues <[email protected]>

headers/private/system/user_runtime.h

@@ -29,6 +29,7 @@ struct user_space_program_args {
 	char	**args;
 	char	**env;
 	mode_t	umask;	// (mode_t)-1 means not set
+	bool	disable_user_addons;
 };
 
 #endif	/* KERNEL_USER_RUNTIME_H_ */

src/system/kernel/team.cpp

@@ -43,6 +43,7 @@
 #include <port.h>
 #include <posix/realtime_sem.h>
 #include <posix/xsi_semaphore.h>
+#include <safemode.h>
 #include <sem.h>
 #include <syscall_process_info.h>
 #include <syscall_load_image.h>
@@ -151,6 +152,7 @@ static ProcessGroupHashTable sGroupHash;
 static spinlock sGroupHashLock = B_SPINLOCK_INITIALIZER;
 
 static Team* sKernelTeam = NULL;
+static bool sDisableUserAddOns = false;
 
 // A list of process groups of children of dying session leaders that need to
 // be signalled, if they have become orphaned and contain stopped processes.
@@ -1575,6 +1577,8 @@ team_create_thread_start_internal(void* args)
 		|| user_memcpy(&programArgs->error_token, &teamArgs->error_token,
 				sizeof(uint32)) < B_OK
 		|| user_memcpy(&programArgs->umask, &teamArgs->umask, sizeof(mode_t)) < B_OK
+		|| user_memcpy(&programArgs->disable_user_addons,
+			&sDisableUserAddOns, sizeof(bool)) < B_OK
 		|| user_memcpy(userArgs, teamArgs->flat_args,
 				teamArgs->flat_args_size) < B_OK) {
 		// the team deletion process will clean this mess
@@ -2835,6 +2839,10 @@ team_init(kernel_args* args)
 	// stick it in the team hash
 	sTeamHash.Insert(sKernelTeam);
 
+	// check safe mode settings
+	sDisableUserAddOns = get_safemode_boolean(B_SAFEMODE_DISABLE_USER_ADD_ONS,
+		false);
+
 	add_debugger_command_etc("team", &dump_team_info,
 		"Dump info about a particular team",
 		"[ <id> | <address> | <name> ]\n"

src/system/runtime_loader/runtime_loader.cpp

@@ -47,6 +47,29 @@ search_path_for_type(image_type type)
 {
 	const char *path = NULL;
 
+	// If "user add-ons" are disabled via safemode settings, we bypass the
+	// environment and defaults and return a different set of paths without
+	// the user or non-packaged ones.
+	if (gProgramArgs->disable_user_addons) {
+		switch (type) {
+			case B_APP_IMAGE:
+				return kGlobalBinDirectory
+					":" kSystemAppsDirectory
+					":" kSystemPreferencesDirectory;
+
+			case B_LIBRARY_IMAGE:
+				return kAppLocalLibDirectory
+					":" kSystemLibDirectory;
+
+			case B_ADD_ON_IMAGE:
+				return kAppLocalAddonsDirectory
+					":" kSystemAddonsDirectory;
+
+			default:
+				return NULL;
+		}
+	}
+
 	// TODO: The *PATH variables should not include the standard system paths.
 	// Instead those paths should always be used after the directories specified
 	// via the variables.