fspy does not record file accesses of static programs on kernels without process_vm_readv
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 68/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- linux, rust
调研方向
Start by reading crates/fspy_seccomp_unotify/src/supervisor/handler/arg.rs:47 and the error handling in crates/fspy_seccomp_unotify/src/supervisor/mod.rs:121. Reproduce with cargo test -p fspy --test static_executable on a kernel where process_vm_readv returns ENOSYS, then add or verify fallback behavior for /proc/<pid>/mem and incomplete tracking. Done means static-program file accesses are recorded on affected kernels and the cache does not retain incomplete results.
由索引模型根据 Issue 内容生成。
描述
Problem
Some Linux kernels do not have the process_vm_readv system call. On these kernels, fspy does not record the file accesses of static programs. The task shows no error.
If you change a file that a static program read, the cache does not detect the change. Then the vp run command uses the old cached output.
On musl builds, fspy uses seccomp for all programs, so this problem affects every tracked program (not tested).
Affected kernels
The CONFIG_CROSS_MEMORY_ATTACH kernel option adds the process_vm_readv system call. The following kernels do not set this option:
- Kata Containers guest kernels. Kata builds these kernels from a configuration that has all options off. Then Kata adds only the options that it needs.
- The default kernel of Apple
container. This kernel is the Kata 3.32.0 kernelvmlinux-6.18.35-197. The/proc/config.gzfile of this kernel shows# CONFIG_CROSS_MEMORY_ATTACH is not set.
The default value of this option is y. Most distribution kernels set it.
Cause
For static programs, fspy intercepts system calls with seccomp. The supervisor process then reads each path argument from the memory of the program.
- The supervisor reads the memory only with the
process_vm_readvsystem call (crates/fspy_seccomp_unotify/src/supervisor/handler/arg.rs:47). - On the affected kernels, the
process_vm_readvsystem call fails with theENOSYSerror. - The supervisor ignores the error and lets the intercepted system call continue (
crates/fspy_seccomp_unotify/src/supervisor/mod.rs:121). - fspy does not record the access.
Steps to reproduce
- Start a Fedora virtual machine (VM) with Apple
containerand its default kernel. - In the VM, check out commit
b182c9be. - Run
cargo test -p fspy --test static_executable.
Result: 9 of 10 tests fail. Only the readdir test passes, because that test does not read the memory of the program. In each failed test, fspy records only the execution of the test program:
Expected accesses to /hello to match, as (actual, expected): [].
All accesses: [Read(".../fspy-test-bin"), Read(".../fspy-test-bin")]
I also tested a child process in the same VM:
- The
process_vm_readvsystem call fails with theENOSYSerror. - A read of the
/proc/<pid>/memfile at the same address returns the correct data.
Possible fixes
- If the
process_vm_readvsystem call fails with theENOSYSerror, read the/proc/<pid>/memfile with thepreadsystem call. This file does not need the kernel option. Reads of this file use the same permission check as theprocess_vm_readvsystem call. I have not tested this fix in fspy. - If the supervisor cannot read an access, do not cache the task. vite-task already does this with the
TrackingIncompletereason when the access channel is full. This fix also covers other read errors, such as permission errors.
- 主要语言
- Rust
- 星标
- 478
- 派生
- 48
- 平均合并
- 1 天 3 小时
- 30 天内合并 PR
- 72
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
voidzero-dev/vite-task 的其他 Issue
-
难度 4/5 3-5 天 新手友好度 45/100
voidzero-dev/vite-task#860 ·
维护者通常 1 天内回复
-
Concurrent cache hits for the same task fail to restore outputs with "File exists (os error 17)"未关闭
难度 4/5 3-5 天 新手友好度 48/100
voidzero-dev/vite-task#846 ·
维护者通常 1 天内回复
-
Windows: automatic filesystem tracking makes Git/MSYS sh.exe fail with MapViewOfFileEx error 487未关闭
难度 5/5 一周以上 新手友好度 18/100
voidzero-dev/vite-task#830 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
voidzero-dev/vite-task#822 · 1 条评论 · 2 个 reaction ·
维护者通常 1 天内回复
-
Let tools mark cache directories with CACHEDIR.TAG可能已有人在做 @lifeiscontent 于 16 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 35/100
voidzero-dev/vite-task#793 ·
维护者通常 1 天内回复
查看 voidzero-dev/vite-task 的全部 Issue
相似的 Issue
-
documentation
难度 2/5 1-3 小时 新手友好度 78/100
charles-hood/DiagramCraft#73 ·
-
难度 1/5 1-3 小时 新手友好度 78/100
ontologyportal/sigma-rs#200 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
chipsalliance/caliptra-sw#4311 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
`image_generation`: `max_retries` is ignored for OpenAI-compatible providers (always 2 retries)可能已有人在做 @ericz7900 今天认领。 未关闭llm translation
难度 2/5 1-3 小时 新手友好度 77/100
维护者通常 1 天内回复