Skip to content

Commit 8c0c5e6

Browse files
committed
Revert HasSuccessfulAccess to use retVal==0 check instead of OKReturnStatus
The kilo-code-bot suggested changing the HasSuccessfulAccess condition from `e.retVal == 0 || p.SyscallType() == OpenFileType` to `p.OKReturnStatus(e.retVal)`, arguing that the former incorrectly treated all OpenFileType syscalls as successful. However, the original expression was correct: - For OpenFileType (open, openat, readlink): the outer condition on line 276-278 already filters to successful calls via `p.OKReturnStatus(e.retVal)`, which requires fd >= 0. The `|| p.SyscallType() == OpenFileType` clause is redundant, not wrong -- it simply ensures HasSuccessfulAccess=true for events that already passed the success filter. - For CheckFileType (stat, access, lstat): `e.retVal == 0` correctly marks only files that actually exist on disk. The replacement `p.OKReturnStatus(e.retVal)` also accepts ENOENT (-2) and ENOTDIR (-20), causing non-existent "ghost" paths to be marked as HasSuccessfulAccess=true. This broke the namespace package fix (da8eb2c): when Python probes for __init__.cpython-311.so, __init__.so, __init__.py in a directory that has none of them (namespace package), those ENOENT stat results created ghost children with HasSuccessfulAccess=true. The FileActivity() radix tree walk then marked the parent directory as IsSubdir and excluded it from the slim image. Since the ghost children don't exist on disk, neither the directory nor its contents were preserved, causing libraries to go missing.
1 parent 27c344b commit 8c0c5e6

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

pkg/monitor/ptrace/ptrace.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ func (app *App) processFileActivity(e *syscallEvent) {
286286
fsa.OpsAll++
287287
fsa.Pids[e.pid] = struct{}{}
288288
fsa.Syscalls[int(e.callNum)] = struct{}{}
289-
if p.OKReturnStatus(e.retVal) {
289+
if e.retVal == 0 || p.SyscallType() == OpenFileType {
290290
fsa.HasSuccessfulAccess = true
291291
}
292292

@@ -300,7 +300,7 @@ func (app *App) processFileActivity(e *syscallEvent) {
300300
fsa := &report.FSActivityInfo{
301301
OpsAll: 1,
302302
OpsCheckFile: 1,
303-
HasSuccessfulAccess: p.OKReturnStatus(e.retVal),
303+
HasSuccessfulAccess: e.retVal == 0 || p.SyscallType() == OpenFileType,
304304
Pids: map[int]struct{}{},
305305
Syscalls: map[int]struct{}{},
306306
}

0 commit comments

Comments
 (0)