fix(fspy): improve seccomp_unotify ipc

[branchseer]

Fix seccomp filter IPC and add static executable support

This PR improves the seccomp filter IPC mechanism by using path-based Unix domain sockets instead of directly passing file descriptors. This approach is consistent with #234 and eliminates the need for pre-exec handling.

Key changes:

• Replace direct fd passing with Unix domain socket communication
• Fix handling of path overflow in CStrPtr by returning a boolean success indicator
• Add support for tracking static executables with tests
• Add a test binary crate that can be included as a static binary for testing
• Implement proper handling of the open syscall on x86_64 architecture
• Enable typeaware linting test on Linux

The PR also includes various code improvements and cleanup, such as better error handling and more robust syscall tracking.

[branchseer]

• feat(fspy): improve tracking static executables using seccomp_unotify #258
• fix(fspy): improve seccomp_unotify ipc #255 👈 (View in Graphite)
• test: add test for type-aware linting #253
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[Copilot]

Pull Request Overview

This PR improves the seccomp filter IPC mechanism by replacing direct file descriptor passing with Unix domain socket path-based communication, resolving deadlock issues and adding support for static executable tracking.

Key Changes:

• Replaced FD inheritance with Unix socket path passing for seccomp_unotify IPC
• Added test infrastructure for static executables including a test binary crate
• Implemented handling of the open syscall for x86_64 architecture

Reviewed Changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/cli/snap-tests/oxlint-typeaware/steps.json	Enabled typeaware linting test on Linux by removing platform restriction
crates/fspy_test_bin/src/main.rs	Added test binary for static executable testing with file operation actions
crates/fspy_test_bin/Cargo.toml	Created cargo configuration for test binary crate
crates/fspy_shared_unix/src/spawn/linux/mod.rs	Moved elf module to library root for shared access
crates/fspy_shared_unix/src/lib.rs	Exposed elf utility for verifying static executables
crates/fspy_seccomp_unotify/tests/arg_types.rs	Updated tests to handle optional path reads and new supervisor API
crates/fspy_seccomp_unotify/src/target.rs	Changed from direct FD passing to Unix socket connection
crates/fspy_seccomp_unotify/src/supervisor/mod.rs	Replaced FD pair with Unix domain socket listener for IPC
crates/fspy_seccomp_unotify/src/supervisor/handler/mod.rs	Enhanced macro to support conditional compilation attributes
crates/fspy_seccomp_unotify/src/supervisor/handler/arg.rs	Modified CStrPtr reading to return success status instead of error on overflow
crates/fspy_seccomp_unotify/src/payload/mod.rs	Changed payload from RawFd to socket path bytes
crates/fspy_seccomp_unotify/Cargo.toml	Added dependencies for socket handling and async operations
crates/fspy/tests/test_utils.rs	Improved assertion with detailed error message on failure
crates/fspy/tests/static_executable.rs	Added comprehensive tests for tracking static executables
crates/fspy/src/unix/syscall_handler/mod.rs	Added x86_64 open syscall handler and refactored path handling
crates/fspy/src/unix/mod.rs	Updated to use new supervisor API without pre_exec
crates/fspy/Cargo.toml	Added platform-specific test binary dependencies
.github/workflows/ci.yml	Added musl target for building static test binaries
.devcontainer/devcontainer.json	Simplified devcontainer setup by removing mise dependency

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[branchseer]

Merge activity

• Oct 25, 9:03 AM UTC: @branchseer merged this pull request with Graphite.