Repository navigation
fix(fspy): fail an exec of an empty path like the untraced call - #896
Merged
wan9chi merged 2 commits intoOct 26, 2026
Merged
Conversation
wan9chi
force-pushed
the
fix/fspy-exec-empty-path
branch
from
October 26, 2026 07:42
17018aa to
5719bbf
Compare
fspy benchmarklinuxmacoswindows |
wan9chi
force-pushed
the
fix/fspy-exec-empty-path
branch
from
October 26, 2026 07:59
5719bbf to
741989a
Compare
execve, execv, execl, execle and posix_spawn with an empty path aborted traced programs: shebang parsing reported the empty path as read, and making it absolute failed. Without fspy the call fails with ENOENT before the kernel looks anything up. `Exec::resolve` now fails an empty program with ENOENT first, so nothing is read or reported. execveat with an empty path and without AT_EMPTY_PATH resolved the path against dirfd and tried to run what dirfd refers to (EISDIR for AT_FDCWD). It now forwards to the real call, which fails with ENOENT. The test makes each call untraced and traced and compares the results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wan9chi
force-pushed
the
fix/fspy-exec-empty-path
branch
from
October 26, 2026 08:01
741989a to
f5eee7a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
An exec of an empty path fails with
ENOENTbefore the kernel looks anything up. Under fspy:""execve,execv,execl,execle,posix_spawnENOENT""as read, and making it absolute fails (Failed to get cwd)execvp,execlp,execvpe,posix_spawnpENOENTENOENT(the PATH search already rejects"")execveat(dirfd, "", …)withoutAT_EMPTY_PATH(Linux)ENOENT""againstdirfdand tries to run what it refers to:EISDIRforAT_FDCWD, with the directory reported as readChange
Exec::resolvefails an empty program withENOENTbefore anything else, asexecveand libc's PATH search do, so nothing is read or reported.execveatinterposer forwards an empty path withoutAT_EMPTY_PATHto the real call. WithAT_EMPTY_PATHit still resolvesdirfdas before.crates/fspy/tests/exec_empty_path.rsmakes every call untraced in the test process, then traced, and asserts the results are equal and that the working directory isn't reported. On musl, seccomp tracking still reports the directory an empty path is relative to, so that check is skipped there; the errno comparison still runs.🤖 Generated with Claude Code