refactor(fspy): replace seccomp unotify with filtered ptrace

[wan9chi]

Motivation

Static Linux binaries and musl builds currently use seccomp user notification for direct-syscall tracking. That path requires a notification file descriptor, descriptor handoff, and a userspace request/continue round trip for every selected syscall. Seccomp-filtered ptrace keeps the filter selective while replacing the notification-fd handoff with a process-tree tracer.

Changes

• replace the fspy_seccomp_unotify crate with fspy_seccomp_ptrace
• install a selective SECCOMP_RET_TRACE filter and follow fork, clone, exec, signal, and exit events with ptrace
• preserve direct-syscall tracking for static and musl binaries
• use the published seccompiler release instead of the user-notification fork
• add regression coverage for fork following, signal forwarding, and static children of dynamic parents
• report end-to-end wall-time changes for benchmark access workloads alongside median open-batch latency
• update public documentation and the changelog

[wan9chi]

• refactor(fspy): replace seccomp unotify with filtered ptrace #575 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​seccompiler@​0.5.0

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +1.83%  [ -5.67% ..  +9.71%]  overhead   +48.83%
dynamic/access             change  -0.18%  [ -8.84% ..  +1.10%]  overhead   +52.47%
dynamic/access-wall        change  -2.18%  [ -8.76% ..  +3.42%]  overhead   +58.82%
static/launch              change +20.48%  [+11.23% .. +29.78%]  overhead  +200.34%
static/access              change +11.49%  [ +8.05% .. +13.83%]  overhead  +938.00%
static/access-wall         change +12.24%  [ +2.22% .. +23.98%]  overhead  +833.95%

macos

dynamic/launch             change  -1.29%  [ -6.62% ..  +5.91%]  overhead  +214.69%
dynamic/access             change  +1.16%  [-12.71% .. +42.37%]  overhead   +24.33%
dynamic/access-wall        change  +0.46%  [-14.37% .. +18.73%]  overhead   +79.58%

windows

dynamic/launch             change  +0.20%  [ -7.08% ..  +6.75%]  overhead   +31.22%
dynamic/access             change  +0.00%  [ -0.69% ..  +0.53%]  overhead    +9.06%
dynamic/access-wall        change  -0.72%  [ -3.85% ..  +4.04%]  overhead   +14.21%