research(fspy): evaluate SIGSYS interception

[wan9chi]

Motivation

fspy currently chooses LD_PRELOAD for dynamic libc executables and seccomp user notification for static or non-libc executables. That leaves direct syscalls invisible in dynamic processes and makes static tracing expensive or unavailable when another seccomp listener already exists.

This draft records feasibility research for an in-process SECCOMP_RET_TRAP backend. It includes controlled prototypes for SIGSYS interception, signal virtualization, temporary post-exec ptrace injection, a static-host/userland-loader fallback, frontend compatibility including esbuild 0.28.1 and Vitest browser mode, and a freestanding Rust handler blob with a lock-free fixed-capacity allocator.

Scope

This is research code, not a production backend. The current ptrace bridge supports default Vitest browser mode but not Playwright chromiumSandbox: true; Chromium loses its namespace-zygote boot handshake at that exec boundary. The decision memo recommends selecting the static-host loader before that exec. Remaining production work includes complete per-thread signal virtualization, lossless async-signal-safe event recording, mapping protection, native AArch64 execution of the Rust artifact, and validation of sandboxed Chromium through the userland-loader fallback.

[wan9chi]

• research(fspy): evaluate SIGSYS interception #581 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

fspy benchmark

linux

dynamic/launch             change  -3.66%  [-10.41% ..  +3.48%]  overhead   +50.86%
dynamic/access             change +106.41%  [+78.69% .. +121.39%]  overhead  +210.77%
static/launch              change  -2.44%  [-11.12% ..  +5.88%]  overhead  +153.73%
static/access              change -67.63%  [-72.68% .. -63.83%]  overhead  +200.50%

macos

dynamic/launch             change  -0.16%  [ -5.01% ..  +5.68%]  overhead  +215.04%
dynamic/access             change  -0.28%  [-12.80% .. +12.03%]  overhead   +17.53%

windows

dynamic/launch             change  +0.16%  [ -1.98% ..  +3.17%]  overhead   +30.80%
dynamic/access             change  -0.18%  [ -1.39% ..  +0.86%]  overhead    +8.58%