Harden Linux process/OS metadata reporting

Follow-ups from the Linux backend soundness audit:

- Decode the waitpid(2)-style status word from /proc/<pid>/stat into a
  real exit code in Process::state(): normal exits report the exit(3)
  code, signal deaths report the negated signal number. Previously the
  raw status word leaked through (exit(3) surfaced as Dead(768)).
- Derive OsInfo.arch and ProcessInfo::{sys_arch,proc_arch} from the
  compile target (x86_64/x86/aarch64) instead of hardcoding x86-64, and
  make the process module list callback emit the same arch field that
  module_by_address keys on.
- Replace OS kernel-module handles (indices into a name-sorted snapshot
  that shift on module load/unload) with a stable hash of the module
  name (std DefaultHasher, fixed-seeded), resolved against the live
  snapshot.
- Report the real process state in process_info_by_pid via the shared
  process_state() helper instead of hardcoding Alive.

Author: killerra

src/linux/mod.rs

@@ -8,12 +8,61 @@ use procfs::KernelModule;
 
 use itertools::Itertools;
 
+use std::collections::hash_map::DefaultHasher;
+use std::hash::{Hash, Hasher};
+
 pub mod mem;
 use mem::ProcessVirtualMemory;
 
 pub mod process;
+use process::process_state;
 pub use process::LinuxProcess;
 
+/// Architecture of the host the backend is running on.
+///
+/// memflow-native works through native syscalls, so the inspected processes always run
+/// under the same kernel/ISA as this build. We therefore report the compile target's
+/// architecture rather than assuming x86-64. 32-bit processes running under a 64-bit
+/// kernel are still reported as 64-bit here; distinguishing them would require sniffing
+/// the ELF class of `/proc/<pid>/exe`.
+fn host_arch() -> ArchitectureIdent {
+    #[cfg(target_arch = "x86_64")]
+    {
+        ArchitectureIdent::X86(64, false)
+    }
+    #[cfg(target_arch = "x86")]
+    {
+        ArchitectureIdent::X86(32, false)
+    }
+    #[cfg(target_arch = "aarch64")]
+    {
+        // Page size is read at runtime; only 4k is currently supported by memflow.
+        let page_size = unsafe { libc::sysconf(libc::_SC_PAGESIZE) };
+        ArchitectureIdent::AArch64(if page_size > 0 {
+            page_size as usize
+        } else {
+            0x1000
+        })
+    }
+    #[cfg(not(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64")))]
+    {
+        ArchitectureIdent::Unknown(0)
+    }
+}
+
+/// Stable, ordering-independent handle for a kernel module, derived from its name.
+/// `procfs::KernelModule` exposes no kernel address we could reuse, so hashing the name
+/// keeps the handle valid across module load/unload churn (unlike a list index).
+///
+/// `DefaultHasher` is fixed-seeded (unlike the randomized `RandomState` behind
+/// `HashMap`), so the handle is consistent across the two lookups within a process run,
+/// which is all this handle needs.
+fn module_handle(name: &str) -> Address {
+    let mut hasher = DefaultHasher::new();
+    name.hash(&mut hasher);
+    Address::from(hasher.finish())
+}
+
 pub struct LinuxOs {
     info: OsInfo,
 }
@@ -46,7 +95,7 @@ impl Default for LinuxOs {
         let info = OsInfo {
             base: Address::NULL,
             size: 0,
-            arch: ArchitectureIdent::X86(64, false),
+            arch: host_arch(),
         };
 
         Self { info }
@@ -108,15 +157,17 @@ impl Os for LinuxOs {
 
         let path = path.into();
 
+        let arch = host_arch();
+
         Ok(ProcessInfo {
             address: (proc.pid() as umem).into(),
             pid,
             command_line,
             path,
             name,
-            sys_arch: ArchitectureIdent::X86(64, false),
-            proc_arch: ArchitectureIdent::X86(64, false),
-            state: ProcessState::Alive,
+            sys_arch: arch,
+            proc_arch: arch,
+            state: process_state(pid as pid_t),
             // dtb is not known/used here
             dtb1: Address::invalid(),
             dtb2: Address::invalid(),
@@ -145,8 +196,9 @@ impl Os for LinuxOs {
     fn module_address_list_callback(&mut self, mut callback: AddressCallback) -> Result<()> {
         let modules = self.kernel_modules_sorted()?;
 
-        (0..modules.len())
-            .map(Address::from)
+        modules
+            .iter()
+            .map(|km| module_handle(&km.name))
             .take_while(|a| callback.call(*a))
             .for_each(|_| {});
 
@@ -161,7 +213,8 @@ impl Os for LinuxOs {
         let modules = self.kernel_modules_sorted()?;
 
         modules
-            .get(address.to_umem() as usize)
+            .iter()
+            .find(|km| module_handle(&km.name) == address)
             .map(|km| ModuleInfo {
                 address,
                 size: km.size as umem,

src/linux/process.rs

@@ -147,6 +147,41 @@ impl LinuxProcess {
     }
 }
 
+/// Decodes a waitpid(2)-style status word (as exposed in `/proc/<pid>/stat` field 52)
+/// into a memflow [`ExitCode`].
+///
+/// A normal exit reports its `exit(3)` code; a process killed by a signal reports the
+/// negated signal number so the two cases stay distinguishable.
+fn decode_exit_code(status: i32) -> i32 {
+    if status & 0x7f == 0 {
+        // WIFEXITED: low 7 bits clear -> exit code is in bits 8..16.
+        (status >> 8) & 0xff
+    } else {
+        // WIFSIGNALED: low 7 bits carry the terminating signal.
+        -(status & 0x7f)
+    }
+}
+
+/// Resolves the [`ProcessState`] of `pid` from `/proc/<pid>/stat`.
+///
+/// Zombie/dead states map to [`ProcessState::Dead`] (carrying the decoded exit code
+/// when the kernel exposes it); a vanished PID is treated as reaped (`Dead(0)`), and a
+/// stat that fails for any other reason (e.g. permissions) stays [`ProcessState::Unknown`].
+pub(crate) fn process_state(pid: pid_t) -> ProcessState {
+    match procfs::process::Process::new(pid).and_then(|p| p.stat()) {
+        Ok(stat) => match stat.state {
+            // Z = zombie (exited, unreaped), X/x = dead
+            'Z' | 'X' | 'x' => {
+                ProcessState::Dead(stat.exit_code.map(decode_exit_code).unwrap_or(0))
+            }
+            _ => ProcessState::Alive,
+        },
+        // /proc/<pid> vanished -> the process was reaped; exit code is no longer recoverable
+        Err(procfs::ProcError::NotFound(_)) => ProcessState::Dead(0),
+        Err(_) => ProcessState::Unknown,
+    }
+}
+
 cglue_impl_group!(LinuxProcess, ProcessInstance, {});
 cglue_impl_group!(LinuxProcess, IntoProcessInstance, {});
 
@@ -171,7 +206,9 @@ impl Process for LinuxProcess {
             .take_while(|map| {
                 callback.call(ModuleAddressInfo {
                     address: Address::from(map.address.0),
-                    arch: self.info.proc_arch,
+                    // Match `module_by_address`, which keys on `sys_arch`; the maps are
+                    // also filtered above by `sys_arch`.
+                    arch: self.info.sys_arch,
                 })
             })
             .for_each(|_| {});
@@ -264,16 +301,7 @@ impl Process for LinuxProcess {
 
     /// Retrieves the state of the process
     fn state(&mut self) -> ProcessState {
-        match procfs::process::Process::new(self.pid).and_then(|p| p.stat()) {
-            Ok(stat) => match stat.state {
-                // Z = zombie (exited, unreaped), X/x = dead
-                'Z' | 'X' | 'x' => ProcessState::Dead(stat.exit_code.unwrap_or(0)),
-                _ => ProcessState::Alive,
-            },
-            // /proc/<pid> vanished -> the process was reaped; exit code is no longer recoverable
-            Err(procfs::ProcError::NotFound(_)) => ProcessState::Dead(0),
-            Err(_) => ProcessState::Unknown,
-        }
+        process_state(self.pid)
     }
 
     /// Changes the dtb this process uses for memory translations.
@@ -393,3 +421,25 @@ impl MemoryView for LinuxProcess {
         self.virt_mem.metadata()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::decode_exit_code;
+
+    #[test]
+    fn normal_exit_decodes_to_exit_code() {
+        // exit(0) and exit(3) as reported by waitpid: code in bits 8..16.
+        assert_eq!(decode_exit_code(0x0000), 0);
+        assert_eq!(decode_exit_code(3 << 8), 3);
+        assert_eq!(decode_exit_code(255 << 8), 255);
+    }
+
+    #[test]
+    fn signalled_exit_decodes_to_negative_signal() {
+        // Killed by SIGKILL (9) / SIGSEGV (11): low 7 bits carry the signal.
+        assert_eq!(decode_exit_code(9), -9);
+        assert_eq!(decode_exit_code(11), -11);
+        // Core-dump flag (0x80) must not bleed into the signal number.
+        assert_eq!(decode_exit_code(11 | 0x80), -11);
+    }
+}