feat(starry-kernel): add unshare, procfs namespace files, and claw-code tests

.github/workflows/ci.yml

@@ -675,6 +675,8 @@ jobs:
       main_pr_only: ${{ matrix.main_pr_only }}
       fetch_depth: ${{ matrix.fetch_depth == 'full' && '0' || '1' }}
       timeout_minutes: ${{ matrix.timeout_minutes || 360 }}
+    secrets:
+      CLAW_API_KEY: ${{ secrets.CLAW_API_KEY }}
 
   publish_base_container:
     name: Publish base container image

.github/workflows/reusable-command.yml

@@ -52,6 +52,9 @@ on:
         required: false
         type: number
         default: 360
+    secrets:
+      CLAW_API_KEY:
+        required: false
 jobs:
   run_host:
     if: >-
@@ -81,6 +84,7 @@ jobs:
       - name: Run command
         env:
           STARRY_APK_REGION: ${{ inputs.apk_region }}
+          CLAW_API_KEY: ${{ secrets.CLAW_API_KEY }}
         run: ${{ inputs.command }}
 
   run_container:
@@ -152,4 +156,5 @@ jobs:
       - name: Run command
         env:
           STARRY_APK_REGION: ${{ inputs.apk_region }}
+          CLAW_API_KEY: ${{ secrets.CLAW_API_KEY }}
         run: ${{ inputs.command }}

apps/starry/claw-code/build-x86_64-unknown-none.toml

@@ -0,0 +1,14 @@
+target = "x86_64-unknown-none"
+env = {}
+log = "Warn"
+features = [
+  "ax-hal/x86-pc",
+  "qemu",
+  "ax-driver/plat-static",
+  "ax-driver/virtio-blk",
+  "ax-driver/virtio-net",
+  "ax-driver/virtio-gpu",
+  "ax-driver/virtio-input",
+  "ax-driver/virtio-socket",
+]
+plat_dyn = false

apps/starry/claw-code/prebuild.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CLAW_REPO="https://github.com/MuZhao2333/claw-code"
+CACHE_DIR="${CLAW_CACHE_DIR:-${HOME}/.cache/claw-code-build}"
+CLAW_SRC="$CACHE_DIR/repo"
+TARGET="x86_64-unknown-linux-musl"
+CLAW_BIN="$CACHE_DIR/claw"
+
+WORKSPACE="${STARRY_WORKSPACE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)}"
+ROOTFS_DIR="$WORKSPACE/tmp/axbuild/rootfs"
+OVERLAY="${STARRY_OVERLAY_DIR:-$WORKSPACE/tmp/axbuild/starry-app/claw-code/overlay}"
+
+echo "=== 1. Build claw from source ==="
+if [ -f "$CLAW_BIN" ]; then
+    echo "claw binary cached at $CLAW_BIN"
+else
+    mkdir -p "$CACHE_DIR"
+    rustup target add "$TARGET" 2>/dev/null || true
+    if [ ! -d "$CLAW_SRC" ]; then
+        echo "Cloning $CLAW_REPO ..."
+        git clone --depth 1 "$CLAW_REPO" "$CLAW_SRC"
+    fi
+    echo "Building claw for $TARGET (this may take a while)..."
+    (
+        cd "$CLAW_SRC/rust"
+        cargo build --workspace --release --target "$TARGET" --target-dir "$CACHE_DIR/target"
+    )
+    cp "$CACHE_DIR/target/$TARGET/release/claw" "$CLAW_BIN"
+    chmod +x "$CLAW_BIN"
+    echo "claw binary built: $CLAW_BIN"
+fi
+
+echo "=== 2. Prepare rootfs ==="
+# The app framework may have created rootfs-x86_64-claw-code.img via fs::copy,
+# which can leave a stale lock preventing QEMU from opening it.  Delete the
+# target first, then copy the base alpine image afresh.
+ALPINE_IMG="$ROOTFS_DIR/rootfs-x86_64-alpine.img"
+CLAW_IMG="$ROOTFS_DIR/rootfs-x86_64-claw-code.img"
+rm -f "$CLAW_IMG"
+cp "$ALPINE_IMG" "$CLAW_IMG"
+
+echo "=== 3. Inject claw into rootfs ==="
+inject_claw() {
+    local img="$1"
+    echo "  injecting into $img ..."
+    debugfs -w "$img" -R "rm /usr/bin/claw" 2>/dev/null || true
+    debugfs -w "$img" -R "write $CLAW_BIN /usr/bin/claw"
+    debugfs -w "$img" -R "sif /usr/bin/claw mode 0100755"
+}
+inject_claw "$ALPINE_IMG"
+inject_claw "$CLAW_IMG"
+
+echo "Injected claw into rootfs"
+
+# Place a marker so the overlay is never empty (app framework requires it).
+mkdir -p "$OVERLAY"
+touch "${OVERLAY}/.claw-injected"

apps/starry/claw-code/qemu-x86_64.toml

@@ -0,0 +1,35 @@
+timeout = 0
+shell_prefix = "root@starry:"
+uefi = false
+to_bin = false
+success_regex = []
+fail_regex = []
+
+args = [
+  "-nographic",
+  "-m", "512M",
+  "-device", "virtio-blk-pci,drive=disk0",
+  "-drive", "id=disk0,if=none,format=raw,file=${workspace}/tmp/axbuild/rootfs/rootfs-x86_64-claw-code.img,file.locking=off",
+  "-device", "virtio-net-pci,netdev=net0",
+  "-netdev", "user,id=net0",
+  "-snapshot",
+]
+
+shell_init_cmd = """
+export HOME=/root
+export USER=root
+export SHELL=/bin/sh
+export TERM=xterm-256color
+export PATH=/usr/local/bin:/usr/bin:/bin:/sbin
+cat <<'STARRY_CLAW_USAGE'
+
+StarryOS Claw interactive shell is ready.
+
+常用命令:
+  claw
+
+退出 QEMU:
+  Ctrl-a x
+
+STARRY_CLAW_USAGE
+"""

os/StarryOS/axnsproxy/src/user.rs

@@ -14,30 +14,42 @@ pub static ROOT_USER_NS: spin::LazyLock<Arc<SpinNoIrq<UserNamespace>>> =
 /// `owner_uid` is the effective UID of the process that created the
 /// namespace (0 for the root namespace).
 ///
-/// When `is_root` is false (child namespace without configured mappings),
-/// all UIDs/GIDs are reported as `nobody` (65534), matching Linux default
-/// behaviour for unconfigured user namespaces.
+/// When neither `uid_mapped` nor `gid_mapped` is true (child namespace
+/// without configured mappings), all UIDs/GIDs are reported as `nobody`
+/// (65534), matching Linux default behaviour for unconfigured user
+/// namespaces.  Writing uid_map sets `uid_mapped`, writing gid_map sets
+/// `gid_mapped`, so the two sides are independent — a half-configured
+/// namespace correctly returns 65534 for the unmapped side.
 pub struct UserNamespace {
     /// Effective UID of the namespace creator (0 for root namespace).
     pub owner_uid: u32,
-    /// Whether this is the initial root user namespace.  false for
-    /// namespaces created via unshare / clone(CLONE_NEWUSER) that
-    /// have not yet had uid_map / gid_map configured.
+    /// Whether this is the initial root user namespace or a child
+    /// namespace that had both uid_map and gid_map configured.  Kept
+    /// for compatibility; new code should use `uid_mapped` /
+    /// `gid_mapped` for per-side overflow control.
     pub is_root: bool,
+    /// Whether uid_map has been written — lifts UID-side overflow.
+    pub uid_mapped: bool,
+    /// Whether gid_map has been written — lifts GID-side overflow.
+    pub gid_mapped: bool,
 }
 
 impl UserNamespace {
     pub fn new_root() -> Self {
         Self {
             owner_uid: 0,
             is_root: true,
+            uid_mapped: true,
+            gid_mapped: true,
         }
     }
 
     pub fn clone_ns(&self) -> Self {
         Self {
             owner_uid: self.owner_uid,
             is_root: false,
+            uid_mapped: false,
+            gid_mapped: false,
         }
     }
 }

os/StarryOS/kernel/src/pseudofs/proc.rs

@@ -36,7 +36,7 @@ use crate::{
         SimpleFileOperation, SimpleFs, SpecialFsFile,
     },
     task::{
-        AsThread, ProcessData, TaskStat, get_process_data, get_task, processes, tasks,
+        AsThread, ProcessData, TaskStat, Thread, get_process_data, get_task, processes, tasks,
         tick_cpu_time,
     },
 };
@@ -762,6 +762,10 @@ impl SimpleDirOps for ThreadDir {
                 "comm",
                 "exe",
                 "fd",
+                "uid_map",
+                "gid_map",
+                "setgroups",
+                "cgroup",
                 "ns",
             ]
             .into_iter()
@@ -901,6 +905,131 @@ impl SimpleDirOps for ThreadDir {
                 }),
             )
             .into(),
+            "uid_map" => SimpleFile::new_regular(
+                fs,
+                RwFile::new(move |req| match req {
+                    SimpleFileOperation::Read => {
+                        let thr = task.as_thread();
+                        let cred = thr.cred();
+                        let content = if thr.uid_map_written() || cred.euid != 65534 {
+                            format!("         0  {:>10} 4294967295\n", cred.uid)
+                        } else {
+                            "\n".to_string()
+                        };
+                        Ok(Some(content.into_bytes()))
+                    }
+                    SimpleFileOperation::Write(data) => {
+                        let input =
+                            core::str::from_utf8(data).map_err(|_| VfsError::InvalidInput)?;
+                        // Linux uid_map format: <lower_uid> <upper_uid> <count>
+                        // Maps UIDs in the parent namespace (lower_uid..lower_uid+count)
+                        // to UIDs in this namespace (upper_uid..upper_uid+count).
+                        //
+                        // StarryOS simplified semantics: we do not maintain namespace
+                        // UID mappings; instead we directly set the thread's credentials
+                        // to the upper_uid value (the UID this namespace wants to see).
+                        // For the common `0 0 1` case (map root to root) this is correct.
+                        // For non-trivial mappings this is an intentional simplification
+                        // — StarryOS does not implement full user namespacing.
+                        let parts: Vec<&str> = input.split_whitespace().collect();
+                        if parts.len() >= 3 {
+                            let _mapped: u32 =
+                                parts[0].parse().map_err(|_| VfsError::InvalidInput)?;
+                            let orig: u32 = parts[1].parse().map_err(|_| VfsError::InvalidInput)?;
+                            let _count: u32 =
+                                parts[2].parse().map_err(|_| VfsError::InvalidInput)?;
+                            let thr = task.as_thread();
+                            let mut cred = (*thr.cred()).clone();
+                            cred.uid = orig;
+                            cred.euid = orig;
+                            cred.suid = orig;
+                            cred.fsuid = orig;
+                            Thread::set_cred(thr, cred);
+                            thr.set_uid_map_written(true);
+                            // Mark the user namespace as UID-mapped so
+                            // getuid/geteuid/getresuid return the mapped
+                            // value instead of 65534 (nobody).
+                            let proc_data = &thr.proc_data;
+                            let nsproxy = proc_data.nsproxy.lock();
+                            nsproxy.user_ns.lock().uid_mapped = true;
+                        }
+                        Ok(None)
+                    }
+                }),
+            )
+            .into(),
+            "gid_map" => SimpleFile::new_regular(
+                fs,
+                RwFile::new(move |req| match req {
+                    SimpleFileOperation::Read => {
+                        let thr = task.as_thread();
+                        let cred = thr.cred();
+                        let content = if thr.gid_map_written() || cred.egid != 65534 {
+                            format!("         0  {:>10} 4294967295\n", cred.gid)
+                        } else {
+                            "\n".to_string()
+                        };
+                        Ok(Some(content.into_bytes()))
+                    }
+                    SimpleFileOperation::Write(data) => {
+                        let input =
+                            core::str::from_utf8(data).map_err(|_| VfsError::InvalidInput)?;
+                        // Linux gid_map format: <lower_gid> <upper_gid> <count>
+                        // Same simplified semantics as uid_map above.
+                        //
+                        // StarryOS does not maintain namespace GID mappings;
+                        // it directly sets the thread's credentials to upper_gid.
+                        let parts: Vec<&str> = input.split_whitespace().collect();
+                        if parts.len() >= 3 {
+                            let _mapped: u32 =
+                                parts[0].parse().map_err(|_| VfsError::InvalidInput)?;
+                            let orig: u32 = parts[1].parse().map_err(|_| VfsError::InvalidInput)?;
+                            let _count: u32 =
+                                parts[2].parse().map_err(|_| VfsError::InvalidInput)?;
+                            let thr = task.as_thread();
+                            let mut cred = (*thr.cred()).clone();
+                            cred.gid = orig;
+                            cred.egid = orig;
+                            cred.sgid = orig;
+                            cred.fsgid = orig;
+                            Thread::set_cred(thr, cred);
+                            thr.set_gid_map_written(true);
+                            let proc_data = &thr.proc_data;
+                            let nsproxy = proc_data.nsproxy.lock();
+                            nsproxy.user_ns.lock().gid_mapped = true;
+                        }
+                        Ok(None)
+                    }
+                }),
+            )
+            .into(),
+            "setgroups" => SimpleFile::new_regular(
+                fs,
+                RwFile::new(move |req| match req {
+                    SimpleFileOperation::Read => {
+                        let thr = task.as_thread();
+                        let content = if thr.setgroups_deny() {
+                            "deny\n"
+                        } else {
+                            "allow\n"
+                        };
+                        Ok(Some(content.as_bytes().to_vec()))
+                    }
+                    SimpleFileOperation::Write(data) => {
+                        let input = core::str::from_utf8(data)
+                            .map_err(|_| VfsError::InvalidInput)?
+                            .trim();
+                        if input == "deny" {
+                            task.as_thread().set_setgroups_deny(true);
+                        } else if input == "allow" {
+                            task.as_thread().set_setgroups_deny(false);
+                        }
+                        Ok(None)
+                    }
+                }),
+            )
+            .into(),
+            "cgroup" => SimpleFile::new_regular(fs, move || Ok("0::/\n")).into(),
             "ns" => SimpleDir::new_maker(
                 fs.clone(),
                 Arc::new(NsDir {

os/StarryOS/kernel/src/syscall/fs/mount.rs

@@ -1,4 +1,4 @@
-use alloc::sync::Arc;
+use alloc::{string::String, sync::Arc};
 use core::ffi::{c_char, c_void};
 
 use ax_errno::{AxError, AxResult, LinuxError};
@@ -70,7 +70,11 @@ pub fn sys_mount(
 ) -> AxResult<isize> {
     let source = vm_load_string(source)?;
     let target = vm_load_string(target)?;
-    let fs_type = vm_load_string(fs_type)?;
+    let fs_type = if fs_type.is_null() {
+        String::new()
+    } else {
+        vm_load_string(fs_type)?
+    };
     debug!("sys_mount <= source: {source:?}, target: {target:?}, fs_type: {fs_type:?}");
 
     let propagation = flags & PROPAGATION_FLAGS;