test(fspy): cover execveat and fexecve interception

These two exec entry points name their program by file descriptor and
had no coverage — the use-after-free fixed in the previous commit lived
in execveat's resolved-path handling and was only ever found by reading
the code.

The interposer reports a program's path while resolving it, before the
program is opened, so a missing program still produces the access and no
executable needs to be staged. execveat passes a dirfd plus a relative
pathname — the resolve-and-copy lane that dangled — and asserts the
joined absolute path is captured. fexecve names its program only as
/proc/self/fd/N (which the client does not report), so the test points
it at a shebang script whose interpreter is reported instead, proving
the fd was resolved. Both execs fail as intended and the child exits
cleanly.

Linux-gnu only: the interfaces do not exist on macOS, and musl uses the
seccomp backend with an empty preload. execveat goes through the libc
symbol so the interposer runs, rather than nix's raw SYS_execveat.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wan9chi

crates/fspy/tests/exec_fd.rs

@@ -0,0 +1,108 @@
+//! Tests for the exec entry points that name their program by file
+//! descriptor: `execveat` (directory fd plus relative pathname) and
+//! `fexecve` (program fd). Under test are the preload library's interposers
+//! for them, which had no coverage at all — a use-after-free in `execveat`'s
+//! resolved-path handling was only ever found by reading the code.
+//!
+//! The interposer reports a program's path while *resolving* it, before the
+//! program is opened, so a program that does not exist still produces the
+//! path access — no real executable needs to be staged. The exec then fails,
+//! the child returns from the closure, and the harness sees a clean exit.
+//!
+//! Scope: these interfaces do not exist on macOS, and on musl the preload is
+//! empty (the seccomp backend traces syscalls instead), so the tests cover
+//! the gnu preload lane only. `execveat` must be reached through the libc
+//! symbol — a raw `SYS_execveat` syscall (what `nix::unistd::execveat` emits)
+//! would bypass the interposer under test.
+#![cfg(all(target_os = "linux", not(target_env = "musl")))]
+
+use std::path::Path;
+
+use fspy::AccessMode;
+use test_log::test;
+
+use crate::test_utils::assert_contains;
+
+mod test_utils;
+
+#[test(tokio::test)]
+async fn execveat_resolves_and_captures_the_relative_pathname() -> anyhow::Result<()> {
+    let tmp_dir = tempfile::tempdir()?;
+    let dir = std::fs::canonicalize(tmp_dir.path())?;
+    // The resolved path the interposer should report: the directory fd's path
+    // joined with the relative pathname. The file need not exist — it is
+    // reported during resolution, before it is opened.
+    let expected = dir.join("ghost-program");
+
+    let accesses = track_fn!(dir.to_str().unwrap().to_owned(), |dir: String| {
+        use std::os::fd::AsRawFd as _;
+
+        let dirfd = nix::fcntl::open(
+            dir.as_str(),
+            nix::fcntl::OFlag::O_RDONLY | nix::fcntl::OFlag::O_DIRECTORY,
+            nix::sys::stat::Mode::empty(),
+        )
+        .expect("failed to open the directory fd");
+
+        // dirfd + relative pathname: the lane where the interposer resolves
+        // the directory and copies the joined path — the copy that used to
+        // dangle. Through the libc symbol so the interposer runs; expected to
+        // fail with ENOENT, which is fine — the access is already reported.
+        let args: [*mut libc::c_char; 2] =
+            [c"ghost-program".as_ptr().cast_mut(), core::ptr::null_mut()];
+        let env: [*mut libc::c_char; 1] = [core::ptr::null_mut()];
+        // SAFETY: dirfd is a valid directory fd; the argument and environment
+        // arrays are NULL-terminated arrays of valid NUL-terminated strings,
+        // alive across the call. execveat does not mutate them.
+        let ret = unsafe {
+            libc::execveat(
+                dirfd.as_raw_fd(),
+                c"ghost-program".as_ptr(),
+                args.as_ptr(),
+                env.as_ptr(),
+                0,
+            )
+        };
+        // execveat only returns on failure; the child exits cleanly here so
+        // the harness's success assertion holds.
+        assert_eq!(ret, -1, "execveat unexpectedly succeeded on a missing program");
+    })
+    .await?;
+
+    assert_contains(&accesses, &expected, AccessMode::READ);
+    Ok(())
+}
+
+#[test(tokio::test)]
+async fn fexecve_resolves_through_the_program_fd() -> anyhow::Result<()> {
+    let tmp_dir = tempfile::tempdir()?;
+    let dir = std::fs::canonicalize(tmp_dir.path())?;
+    // A shebang script whose interpreter does not exist. `fexecve` names the
+    // program only as `/proc/self/fd/N` (which the client deliberately does
+    // not report), but resolving the script reads its `#!` line and reports
+    // the interpreter path — a non-`/proc` path that is reported and is the
+    // observable proof the fexecve interposer ran and resolved the fd.
+    let interpreter = Path::new("/fspy-exec-fd-missing-interpreter");
+    let script = dir.join("script");
+    std::fs::write(&script, format!("#!{}\n", interpreter.display()))?;
+
+    let accesses = track_fn!(script.to_str().unwrap().to_owned(), |script: String| {
+        let program_fd = nix::fcntl::open(
+            script.as_str(),
+            nix::fcntl::OFlag::O_RDONLY,
+            nix::sys::stat::Mode::empty(),
+        )
+        .expect("failed to open the script fd");
+
+        // nix's fexecve goes through the libc symbol, so the interposer runs.
+        // It fails because the interpreter is missing; the child exits
+        // cleanly afterwards.
+        let err = nix::unistd::fexecve(program_fd, &[c"script"], &[c"X=1"])
+            .expect_err("fexecve unexpectedly succeeded");
+        assert_eq!(err, nix::Error::ENOENT, "unexpected fexecve error: {err}");
+    })
+    .await?;
+
+    assert_contains(&accesses, interpreter, AccessMode::READ);
+    Ok(())
+}