Skip to content

feat(sigsafe): iterate process arguments and environment - #625

Merged
wan9chi merged 1 commit into
feat/sigsafe-cstr-bytesfrom
feat/sigsafe-process-env
Aug 10, 2026
Merged

feat(sigsafe): iterate process arguments and environment#625
wan9chi merged 1 commit into
feat/sigsafe-cstr-bytesfrom
feat/sigsafe-process-env

Conversation

@wan9chi

@wan9chi wan9chi commented Aug 10, 2026

Copy link
Copy Markdown
Member

Motivation

Low-level fspy code needs allocation-free access to the current process arguments and environment. On Linux, that access must also avoid libc so it remains suitable for injected and signal-sensitive code.

This adds a shared current() API that snapshots argument and environment bounds together. Linux obtains both ranges from one /proc/self/stat read and iterates their memory directly. macOS exposes direct thin iterators backed by _NSGetArgv and _NSGetEnviron, then builds the portable fat current() view only from those thin APIs.

The Unix preload ctor obtains one Current snapshot and passes current.envs() through Client::from_env to decode_payload_from_env. The payload helper retains its existing name while accepting the environment iterator explicitly, so payload initialization avoids std::env. Exec wrappers retain their existing environment inheritance and PATH behavior.


Stack created with GitHub Stacks CLIGive Feedback 💬

@socket-security

socket-security Bot commented Aug 10, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcargo/​atoi@​3.1.010010093100100

View full report

@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

fspy benchmark

linux

dynamic/launch             change  +2.60%  [ -2.48% ..  +8.99%]  overhead   +51.23%
dynamic/access             change  +0.45%  [-13.39% ..  +9.25%]  overhead    +5.78%
dynamic/access-relative    change  -0.38%  [ -7.01% ..  +8.36%]  overhead   +51.56%
static/launch              change  +1.06%  [ -6.36% ..  +8.88%]  overhead  +156.53%
static/access              change  +1.17%  [ -4.23% .. +13.96%]  overhead  +721.29%
static/access-relative     change  +0.05%  [ -4.44% ..  +4.98%]  overhead +1039.80%

macos

dynamic/launch             change  -0.07%  [ -3.42% ..  +3.91%]  overhead  +230.41%
dynamic/access             change  -0.35%  [ -4.04% ..  +4.69%]  overhead    +6.57%
dynamic/access-relative    change  -0.11%  [ -1.64% ..  +2.55%]  overhead  +232.52%

windows

dynamic/launch             change  +0.22%  [ -1.94% ..  +1.64%]  overhead   +26.97%
dynamic/access             change  +0.00%  [ -0.73% ..  +1.12%]  overhead    +1.14%
dynamic/access-relative    change  +0.22%  [ -0.73% ..  +2.51%]  overhead    +1.67%

@wan9chi
wan9chi force-pushed the feat/sigsafe-process-env branch from 1a173a3 to 873df3b Compare August 10, 2026 04:50
@wan9chi
wan9chi force-pushed the feat/sigsafe-process-env branch 7 times, most recently from 21f7ece to 9473edf Compare August 10, 2026 08:47
@wan9chi
wan9chi marked this pull request as ready for review August 10, 2026 08:51
Co-authored-by: GPT-5 Codex <codex@openai.com>
@wan9chi
wan9chi force-pushed the feat/sigsafe-process-env branch from 9473edf to 00deef2 Compare August 10, 2026 08:55
@wan9chi
wan9chi merged commit a4a5621 into main Aug 10, 2026
19 of 32 checks passed
@wan9chi
wan9chi deleted the feat/sigsafe-process-env branch August 10, 2026 09:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant