procd/trace, branch master

build: add the trace2seccomp profile generator, drop the utrace target

2026-08-21T04:31:44Z

Replace the C utrace binary and its LD_PRELOAD trace helper with trace2seccomp, a ucode tool that turns a ujail seccomp trace into an OCI seccomp profile. The old preload approach only worked for dynamically linked binaries and required a private libpreload; the new tracer in ujail (-m trace) handles static binaries and reports per-phase syscall sets, so the generator can work purely from its NDJSON output. Dispatched by argv[0]: invoked as utrace or seccomp-trace it runs a program under `ujail -m trace` and emits an application-phase allow-list, matching the classic policy-generation window. Invoked as trace2seccomp it converts a previously captured NDJSON trace, optionally merging all phases or emitting a two-phase pre/post dynamic-linker profile. The CMake UTRACE_SUPPORT target now installs the script instead of building the dropped utrace and preload-trace artefacts. Signed-off-by: Daniel Golle

jail: apply OCI seccomp filters via ptrace syscall injection

2026-08-21T04:30:22Z

Arm the compiled cBPF profile by injecting prctl(NO_NEW_PRIVS) and seccomp(SET_MODE_FILTER) into the freshly-execve'd workload over ptrace. The child does PTRACE_TRACEME before its final execve; the parent catches the post-execve stop, drives the two syscalls via a temporary trap at the program counter, restores registers and code, then detaches. This installs the filter for static binaries too, closing the gap left by the dropped LD_PRELOAD installer (preload.c, seccomp.c and the shared library are removed). A dynamic binary needs extra loader and libc pre-main syscalls. They are granted once in a phase-1 app + linker_base filter, then revoked with deny deltas at the entry and main boundaries (located via AT_BASE/auxv and ELF marker addresses), each delta reverting to the profile default. Static and Go-style binaries collapse to fewer phases. NOTIFY or flag profiles still go in-process; audit and complain modes reuse the same staging to log denials. Signed-off-by: Daniel Golle

jail/seccomp: add support for loongarch64

2024-12-22T16:04:11Z

Add support for loongarch64 in utrace and ujail. Signed-off-by: Weijie Gao

trace: use standard POSIX header for basename()

2024-03-30T21:30:41Z

The musl libc only implements POSIX basename() but provided a GNU header kludge in , which was removed in musl 1.2.5 [1]. Use the standard header to avoid compilation errors like: trace/trace.c: In function 'main': trace/trace.c:435:64: error: implicit declaration of function 'basename'; did you mean 'rename'? [-Werror=implicit-function-declaration] 435 | if (asprintf(&json, "/tmp/%s.%u.json", basename(*argv), child) < 0) | ^~~~~~~~ | rename cc1: all warnings being treated as errors Link 1: https://git.musl-libc.org/cgit/musl/log/?qt=grep&q=basename Signed-off-by: Tony Ambardar

utrace: fix memory leak

2022-06-27T09:52:10Z

Fixes following memory leak: 14 bytes in 1 blocks are definitely lost in loss record 1 of 5 at 0x4079514: malloc (vg_replace_malloc.c:309) by 0x4049A04: vasprintf (vasprintf.c:13) by 0x4046354: asprintf (asprintf.c:10) by 0x80491A9: main (in /root/utrace) 134 bytes in 1 blocks are definitely lost in loss record 3 of 5 at 0x4079514: malloc (vg_replace_malloc.c:309) by 0x4049A04: vasprintf (vasprintf.c:13) by 0x4046354: asprintf (asprintf.c:10) by 0x8049208: main (in /root/utrace) Signed-off-by: Junnan Xu Reviewed-by: Rui Salvaterra

trace: don't leak file descriptor in error path

2021-09-15T20:43:16Z

Coverity CID: 1491022 Resource leak Signed-off-by: Daniel Golle

trace: preload: avoid NULL-dereference here as well

2021-08-30T23:46:59Z

Fix potential NULL-pointer derefence in trace/preload.c similar to how it was fixed in jail/preload.c by commit b824a89 ("jail: preload: avoid NULL-dereference in case things go wrong"). Coverity CID: 1446096 Dereference after null check Signed-off-by: Daniel Golle

trace: fix potential use-after-free occurence

2021-08-30T21:15:10Z

char* tmp is used in the fprintf function altough it is already freed. Fixes: e5b38fd1 ("trace: free memory allocated by blobmsg_format_json_indent()") Signed-off-by: Nick Hainke

trace: free memory allocated by blobmsg_format_json_indent()

2021-08-30T19:30:43Z

Only one out of two occurances have been addressed previously. Close the other one now. Coverity CID: 1446205 Fixes: 51f1cd23 ("trace: free string returned by blobmsg_format_json_indent()") Signed-off-by: Daniel Golle

trace: handle open() return value and make sure string is terminated

2021-08-24T17:32:01Z

Coverity CID: 1446154 Argument cannot be negative Signed-off-by: Daniel Golle