Function ensure_memtrack_capabilities

src/executor/memory/setup.rs:56–94

Grant memtrack the capabilities it needs to run without sudo. Best-effort and idempotent: a no-op when running as root or when the caps are already present. Otherwise runs `setcap` (a single sudo prompt) and re-verifies. Failures are surfaced as warnings rather than aborting, since the run-time privilege guard enforces the requirement and reports it clearly.

()

/// Failures are surfaced as warnings rather than aborting, since the run-time
/// privilege guard enforces the requirement and reports it clearly.
pub fn ensure_memtrack_capabilities() -> Result<()> {
    if is_root_user() {
        debug!("Running as root, memtrack does not need file capabilities");
        return Ok(());
    }

    let Some(path) = memtrack_path() else {
        warn!("Could not locate {MEMTRACK_COMMAND} to grant capabilities");
        return Ok(());
    };

    if binary_has_capabilities(&path, memtrack_required_caps_mask()) {
        debug!("{MEMTRACK_COMMAND} already has the required capabilities");
        return Ok(());
    }

    info!(
        "Granting {MEMTRACK_COMMAND} the capabilities it needs as a one-time setup for the \
         memory instrument (requires sudo)."
    );
    let setcap_args = [memtrack_setcap_spec(), path.to_string_lossy().into_owned()];
    if let Err(e) = run_with_sudo("setcap", setcap_args) {
        warn!(
            "Failed to grant capabilities to {MEMTRACK_COMMAND} ({e}). \
             Memory profiling will require running as root."
        );
        return Ok(());
    }

    if !binary_has_capabilities(&path, memtrack_required_caps_mask()) {
        warn!(
            "Capabilities did not stick on {}. The filesystem may not support file \
             capabilities (e.g. nosuid, overlayfs, NFS). Memory profiling will require running as root.",
            path.display()
        );
    }

    Ok(())
}

pub fn get_memtrack_status() -> ToolStatus {
    let tool_name = MEMTRACK_COMMAND.to_string();