feat(sigsafe): resolve current directory

Co-authored-by: GPT-5 Codex <codex@openai.com>

Author: wan9chi

Cargo.lock

@@ -6,16 +6,13 @@ use std::{
     path::PathBuf,
 };
 
+use allocator_api2::{alloc::Allocator, vec::Vec};
 use bstr::{BStr, ByteSlice};
 use fspy_shared::ipc::AccessMode;
 use libc::{c_char, c_int};
-use nix::unistd::getcwd;
 
 #[cfg(target_os = "linux")]
 fn get_fd_path(fd: RawFd) -> nix::Result<Option<PathBuf>> {
-    if fd == libc::AT_FDCWD {
-        return Ok(Some(getcwd()?));
-    }
     match nix::fcntl::readlink(CString::new(format!("/proc/self/fd/{fd}")).unwrap().as_c_str()) {
         Ok(path) => Ok(Some(path.into())),
         Err(nix::Error::EBADF | nix::Error::ENOENT) => Ok(None), // invalid fd or no such file (Most likely a stdio fd)
@@ -25,9 +22,6 @@ fn get_fd_path(fd: RawFd) -> nix::Result<Option<PathBuf>> {
 
 #[cfg(target_os = "macos")]
 fn get_fd_path(fd: RawFd) -> nix::Result<Option<PathBuf>> {
-    if fd == libc::AT_FDCWD {
-        return Ok(Some(getcwd()?));
-    }
     let mut path = std::path::PathBuf::new();
     match nix::fcntl::fcntl(
         // SAFETY: fd is a valid file descriptor provided by the caller, and the borrow does not outlive this function call
@@ -40,6 +34,12 @@ fn get_fd_path(fd: RawFd) -> nix::Result<Option<PathBuf>> {
     }
 }
 
+fn getcwd<A: Allocator>(allocator: A) -> nix::Result<Vec<u8, A>> {
+    let bytes = sigsafe_alloc::fs::getcwd(allocator)
+        .map_err(|errno| nix::errno::Errno::from_raw(errno.raw_os_error()))?
+        .into_bytes();
+    Ok(bytes)
+}
 pub trait ToAbsolutePath {
     unsafe fn to_absolute_path<R, F: FnOnce(Option<&BStr>) -> nix::Result<R>>(
         self,
@@ -53,8 +53,14 @@ impl ToAbsolutePath for Fd {
         self,
         f: F,
     ) -> nix::Result<R> {
+        if self.0 == libc::AT_FDCWD {
+            let arena = sigsafe_alloc::arena();
+            let path = getcwd(&arena)?;
+            return f(Some(path.as_slice().as_bstr()));
+        }
+
         let path = get_fd_path(self.0)?;
-        f(path.as_ref().map(|p| p.as_os_str().as_bytes().as_bstr()))
+        f(path.as_ref().map(|path| path.as_os_str().as_bytes().as_bstr()))
     }
 }
 
@@ -70,6 +76,16 @@ impl ToAbsolutePath for PathAt {
 
         if pathname.first().copied() == Some(b'/') {
             f(pathname.into())
+        } else if self.0 == libc::AT_FDCWD {
+            let arena = sigsafe_alloc::arena();
+            let mut abs_path = getcwd(&arena)?;
+            if !pathname.is_empty() {
+                if !abs_path.ends_with(b"/") {
+                    abs_path.push(b'/');
+                }
+                abs_path.extend_from_slice(pathname);
+            }
+            f(Some(abs_path.as_slice().as_bstr()))
         } else {
             let Some(mut abs_path) = get_fd_path(self.0)? else {
                 return f(None);

crates/fspy_preload_unix/src/client/convert.rs

@@ -8,7 +8,10 @@ publish = false
 doctest = false
 
 [target.'cfg(unix)'.dependencies]
-rustix = { workspace = true }
+rustix = { workspace = true, features = ["fs"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+libc = { workspace = true }
 
 # On Linux the page size is probed from the kernel directly (see param.rs);
 # rustix's `param` is only needed where sysconf is the platform interface.
@@ -19,6 +22,7 @@ rustix = { workspace = true, features = ["param"] }
 # item to reference; `runtime` is the module that has one.
 [target.'cfg(target_os = "linux")'.dependencies]
 rustix = { workspace = true, features = ["runtime"] }
+syscalls = { workspace = true }
 
 # Cross-validates the page-size probe against rustix's auxv-based answer.
 [target.'cfg(target_os = "linux")'.dev-dependencies]

crates/sigsafe/Cargo.toml

@@ -29,6 +29,7 @@ rustix can be built with a libc backend instead of raw syscalls, and anything in
 Functions whose rustix implementation already meets the rules are re-exposed as-is; being listed in a module here is what marks a call as allowed, and the backend check above is what keeps that true.
 
 - `mm` — anonymous memory mappings: `mmap_anonymous`, `munmap`.
+- `fs` — caller-buffer filesystem operations: `getcwd`.
 - `param` — `page_size`.
 
 Allocation without malloc lives in [`sigsafe_alloc`](../sigsafe_alloc).

crates/sigsafe/README.md

@@ -0,0 +1,146 @@
+use core::{ffi::c_char, marker::PhantomData, num::NonZeroUsize, ptr::NonNull, slice};
+
+/// Marks a [`CStr`] whose length is not known.
+#[derive(Clone, Copy)]
+pub struct Thin {
+    _private: (),
+}
+
+/// Marks a [`CStr`] that retains its length, including the terminating NUL.
+#[derive(Clone, Copy)]
+pub struct Fat {
+    len_with_nul: NonZeroUsize,
+}
+
+/// A borrowed NUL-terminated string.
+///
+/// [`CStr<'_, Thin>`] stores only the string pointer, while
+/// [`CStr<'_, Fat>`] also stores the length including the terminating NUL.
+#[derive(Clone, Copy)]
+pub struct CStr<'a, R> {
+    ptr: NonNull<c_char>,
+    repr: R,
+    lifetime: PhantomData<&'a c_char>,
+}
+
+impl<R> CStr<'_, R> {
+    /// Returns a pointer to the first byte of this C string.
+    #[must_use]
+    pub const fn as_ptr(&self) -> *const c_char {
+        self.ptr.as_ptr()
+    }
+
+    #[doc(hidden)]
+    #[must_use]
+    pub fn into_repr(self) -> R {
+        self.repr
+    }
+}
+
+impl Fat {
+    #[doc(hidden)]
+    #[must_use]
+    pub const fn len_with_nul(self) -> usize {
+        self.len_with_nul.get()
+    }
+}
+
+impl<'a> CStr<'a, Thin> {
+    /// Creates a thin C string view without finding its length.
+    ///
+    /// # Safety
+    ///
+    /// `ptr` must be non-null and point to an immutable NUL-terminated string
+    /// that remains valid for the lifetime of the returned view.
+    #[must_use]
+    pub const unsafe fn from_ptr(ptr: *const c_char) -> Self {
+        Self {
+            // SAFETY: upheld by the caller.
+            ptr: unsafe { NonNull::new_unchecked(ptr.cast_mut()) },
+            repr: Thin { _private: () },
+            lifetime: PhantomData,
+        }
+    }
+
+    /// Counts through the terminating NUL and returns a length-retaining view.
+    #[must_use]
+    pub fn count(self) -> CStr<'a, Fat> {
+        let mut count = 0;
+        // Volatile reads prevent this loop from being replaced with a libc
+        // `strlen` call, which is forbidden by `sigsafe` on Linux.
+        // SAFETY: `CStr<Thin>` points to a NUL-terminated string.
+        while unsafe { self.as_ptr().add(count).read_volatile() } != 0 {
+            count += 1;
+        }
+
+        CStr {
+            ptr: self.ptr,
+            repr: Fat {
+                // SAFETY: the count includes at least the terminating NUL.
+                len_with_nul: unsafe { NonZeroUsize::new_unchecked(count + 1) },
+            },
+            lifetime: PhantomData,
+        }
+    }
+}
+
+impl<'a> CStr<'a, Fat> {
+    /// Creates a length-retaining C string from bytes without validation.
+    ///
+    /// # Safety
+    ///
+    /// `bytes` must end with exactly one NUL byte and contain no other NUL
+    /// bytes.
+    #[must_use]
+    pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &'a [u8]) -> Self {
+        Self {
+            // SAFETY: a valid C string is nonempty, so its pointer is non-null.
+            ptr: unsafe { NonNull::new_unchecked(bytes.as_ptr().cast::<c_char>().cast_mut()) },
+            repr: Fat {
+                // SAFETY: a valid C string contains at least its terminating NUL.
+                len_with_nul: unsafe { NonZeroUsize::new_unchecked(bytes.len()) },
+            },
+            lifetime: PhantomData,
+        }
+    }
+
+    /// Returns the string's bytes, including the terminating NUL.
+    #[must_use]
+    pub const fn as_bytes_with_nul(&self) -> &'a [u8] {
+        // SAFETY: this view carries the exact initialized C string length.
+        unsafe { slice::from_raw_parts(self.ptr.as_ptr().cast(), self.len_with_nul()) }
+    }
+
+    /// Returns the number of bytes including the terminating NUL.
+    #[must_use]
+    pub const fn len_with_nul(&self) -> usize {
+        self.repr.len_with_nul()
+    }
+
+    #[cfg(target_os = "macos")]
+    pub(crate) const fn as_core_c_str(&self) -> &core::ffi::CStr {
+        // SAFETY: `CStr<Fat>` maintains the same byte invariant.
+        unsafe { core::ffi::CStr::from_bytes_with_nul_unchecked(self.as_bytes_with_nul()) }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use core::mem::size_of;
+
+    use super::{CStr, Fat, Thin};
+
+    #[test]
+    fn representations_retain_the_expected_metadata() {
+        // SAFETY: the input contains one trailing NUL.
+        let fat = unsafe { CStr::<Fat>::from_bytes_with_nul_unchecked(b"abc\0") };
+        // SAFETY: the input contains one trailing NUL.
+        let counted = unsafe { CStr::<Thin>::from_ptr(c"abc".as_ptr()) }.count();
+
+        assert_eq!(size_of::<CStr<'_, Thin>>(), size_of::<*const u8>());
+        assert_eq!(size_of::<CStr<'_, Fat>>(), size_of::<(*const u8, usize)>());
+        assert_eq!(fat.len_with_nul(), 4);
+        assert_eq!(fat.as_bytes_with_nul(), b"abc\0");
+        assert_eq!(counted.as_bytes_with_nul(), fat.as_bytes_with_nul());
+    }
+}

crates/sigsafe/src/c_str.rs

@@ -0,0 +1,22 @@
+use core::{mem::MaybeUninit, slice};
+
+use crate::{CStr, Errno, Fat, Result};
+
+// Linux UAPI `PATH_MAX`.
+pub(super) const PATH_MAX: usize = 4096;
+
+pub(super) fn getcwd(buf: &mut [MaybeUninit<u8>]) -> Result<CStr<'_, Fat>> {
+    // rustix exposes only an allocating `getcwd`, so use the raw syscall for
+    // caller-owned storage.
+    // SAFETY: `buf` is writable for exactly `buf.len()` bytes. The syscall
+    // writes no more than that and returns the initialized length including
+    // its terminating NUL.
+    let initialized =
+        unsafe { syscalls::syscall2(syscalls::Sysno::getcwd, buf.as_mut_ptr().addr(), buf.len()) }
+            .map_err(|errno| Errno::from_raw_os_error(errno.into_raw()))?;
+
+    // SAFETY: the syscall initialized this prefix through its terminating NUL.
+    let bytes = unsafe { slice::from_raw_parts(buf.as_ptr().cast(), initialized) };
+    // SAFETY: the syscall returned one NUL-terminated pathname.
+    Ok(unsafe { CStr::from_bytes_with_nul_unchecked(bytes) })
+}

crates/sigsafe/src/fs/linux.rs

@@ -0,0 +1,102 @@
+use core::{mem::MaybeUninit, slice};
+
+use rustix::{
+    fd::{AsFd as _, AsRawFd as _, BorrowedFd, FromRawFd as _, OwnedFd},
+    fs::{Mode, OFlags, fstat, stat},
+};
+
+use crate::{CStr, Errno, Fat, Result, Thin};
+
+pub(super) const PATH_MAX: usize = libc::PATH_MAX as usize;
+
+#[expect(clippy::needless_pass_by_value, reason = "CStr is a borrowed value type")]
+fn open<R>(path: CStr<'_, R>, flags: OFlags, mode: Mode) -> Result<OwnedFd> {
+    // SAFETY: `path` is NUL-terminated for the call. Variadic arguments use
+    // their promoted C types.
+    let fd = unsafe {
+        libc::open(path.as_ptr(), flags.bits().cast_signed(), libc::c_uint::from(mode.bits()))
+    };
+    if fd == -1 {
+        // SAFETY: libSystem stored this call's error before returning -1.
+        return Err(Errno::from_raw_os_error(unsafe { *libc::__error() }));
+    }
+
+    // SAFETY: ownership of the newly opened descriptor transfers here.
+    Ok(unsafe { OwnedFd::from_raw_fd(fd) })
+}
+
+fn fcntl_getpath<'buf>(
+    fd: BorrowedFd<'_>,
+    buf: &'buf mut [MaybeUninit<u8>; PATH_MAX],
+) -> Result<CStr<'buf, Thin>> {
+    // SAFETY: `fd` remains borrowed and `buf` has the `MAXPATHLEN` storage
+    // required by `F_GETPATH`.
+    let result = unsafe {
+        libc::fcntl(fd.as_raw_fd(), libc::F_GETPATH, buf.as_mut_ptr().cast::<libc::c_char>())
+    };
+    if result == -1 {
+        // SAFETY: libSystem stored this call's error before returning -1.
+        return Err(Errno::from_raw_os_error(unsafe { *libc::__error() }));
+    }
+
+    // SAFETY: `F_GETPATH` wrote a NUL-terminated pathname into `buf`.
+    Ok(unsafe { CStr::from_ptr(buf.as_ptr().cast()) })
+}
+
+pub(super) fn getcwd(buf: &mut [MaybeUninit<u8>]) -> Result<CStr<'_, Fat>> {
+    if buf.len() < PATH_MAX {
+        return getcwd_small(buf);
+    }
+
+    getcwd_full(buf)
+}
+
+// Keep the `PATH_MAX` scratch storage in a separate stack frame so the
+// large-buffer path does not reserve it. `inline(never)` preserves that
+// conditional stack allocation after optimization.
+#[inline(never)]
+fn getcwd_small(buf: &mut [MaybeUninit<u8>]) -> Result<CStr<'_, Fat>> {
+    let mut scratch = [MaybeUninit::uninit(); PATH_MAX];
+    let initialized = getcwd_full(&mut scratch)?.len_with_nul();
+    if initialized > buf.len() {
+        return Err(Errno::RANGE);
+    }
+
+    buf[..initialized].copy_from_slice(&scratch[..initialized]);
+    // SAFETY: `getcwd_full` initialized this copied C string prefix.
+    let bytes = unsafe { slice::from_raw_parts(buf.as_ptr().cast(), initialized) };
+    // SAFETY: upheld by the initialized prefix above.
+    Ok(unsafe { CStr::from_bytes_with_nul_unchecked(bytes) })
+}
+
+/// The allocation-free fast path from Apple's [`getcwd`]: obtain the path
+/// of an open `.` descriptor, then verify that it still names `.`.
+///
+/// [`getcwd`]: https://github.com/apple-oss-distributions/Libc/blob/Libc-1752.120.2/gen/FreeBSD/getcwd.c#L62-L138
+fn getcwd_full(buf: &mut [MaybeUninit<u8>]) -> Result<CStr<'_, Fat>> {
+    let Some(buf) = buf.first_chunk_mut::<PATH_MAX>() else {
+        return Err(Errno::RANGE);
+    };
+
+    // SAFETY: the byte string contains one trailing NUL.
+    let dot_path = unsafe { CStr::<Fat>::from_bytes_with_nul_unchecked(b".\0") };
+    let fd = open(dot_path, OFlags::RDONLY | OFlags::CLOEXEC, Mode::empty())?;
+    let dot = fstat(&fd)?;
+    if dot.st_dev == 0 || dot.st_ino == 0 {
+        return Err(Errno::INVAL);
+    }
+
+    let path = fcntl_getpath(fd.as_fd(), buf)?;
+    drop(fd);
+
+    // `F_GETPATH` returns no length, so `getcwd` counts the result just as
+    // libSystem's scratch-buffer path does before checking and copying it.
+    let path = path.count();
+
+    let pointed_to = stat(path.as_core_c_str())?;
+    if dot.st_dev != pointed_to.st_dev || dot.st_ino != pointed_to.st_ino {
+        return Err(Errno::INVAL);
+    }
+
+    Ok(path)
+}