Method handleOpen

cmd/run/engine/process/handle.go:110–155

handleOpen handles the open(2) and openat(2) syscalls. We do this in order to inject the ephemeral CA certificate into the system root CA store so that we can intercept outgoing TLS requests later.

(n *seccomp.Notif, dirfd int, pathAddr uintptr, flags int, mode int)

// to inject the ephemeral CA certificate into the system root CA store so that
// we can intercept outgoing TLS requests later.
func (p *Process) handleOpen(n *seccomp.Notif, dirfd int, pathAddr uintptr, flags int, mode int) error {
	if flags&unix.O_WRONLY != 0 {
		return n.Skip()
	}

	path, errno, err := p.resolvePath(n, dirfd, pathAddr)
	if err != nil {
		return fmt.Errorf("resolve path: %w", err)
	}
	if errno != 0 {
		return n.Return(0, errno)
	}
	if !tls.Enabled || !tls.IsKnownPath(path) {
		return n.Skip()
	}

	slog.Debug("handling TLS CA cert file open", "path", path)

	ephemeralPEM := tls.GetEphemeralCAPEM()

	orig, err := os.ReadFile(path)
	if err != nil {
		return n.Skip()
	}

	ret, err := unix.MemfdCreate("subtrace_override:"+path, unix.FD_CLOEXEC)
	if err != nil {
		return fmt.Errorf("inject ephemeral CA: memfd_create: %w", err)
	}

	memfd := fd.NewFD(ret)
	defer memfd.DecRef()
	defer unix.Close(memfd.FD())

	if _, err := unix.Write(memfd.FD(), append(orig, ephemeralPEM...)); err != nil {
		return fmt.Errorf("inject ephemeral CA: write: %w", err)
	}
	if _, _, errno := unix.Syscall(unix.SYS_LSEEK, uintptr(memfd.FD()), 0, 0); errno != 0 {
		return fmt.Errorf("inject ephemeral CA: lseek: %w", err)
	}

	if _, err := n.AddFD(memfd, flags&unix.O_CLOEXEC); err != nil { // we don't care about the fd value
		return fmt.Errorf("addfd: %w", err)
	}
	return nil
}

func fdcwd() uintptr {
	x := unix.AT_FDCWD