fix(memory): grant the eBPF capabilities to a copy of the runner

With memtrack bundled, `setcap` targeted the runner binary itself, so every
`codspeed` invocation ran in glibc's secure-execution mode: `LD_*`, `TMPDIR`
and similar variables were stripped before the runner could forward them to
the benchmark, in every mode.

Grant the capabilities to a copy of the binary in `~/.cache`, keyed by its ELF
build id, and run `codspeed memtrack` from it. The copy is installed in one
sudo call, since `~/.cache` can be root-owned, and copies of other builds are
pruned once they are a day old. The runner keeps the user's environment and no
longer holds the eBPF capabilities itself.

The memtrack benchmarks call `codspeed memtrack` from PATH, so CI grants that
binary its capabilities directly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: moha-bekh

.github/workflows/ci.yml

@@ -216,9 +216,10 @@ jobs:
 
       # The benchmarked command is memtrack, a subcommand of the runner binary,
       # which needs file capabilities to load its eBPF programs even though the
-      # runner measures walltime.
+      # runner measures walltime. `setup --mode memory` would grant them to a
+      # private copy, not to the binary the benchmarks call.
       - name: Grant memtrack file capabilities
-        run: codspeed setup --mode memory
+        run: sudo setcap cap_dac_read_search,cap_sys_admin,cap_perfmon,cap_bpf,cap_sys_resource+ep "$(which codspeed)"
 
       # The write benchmarks overwrite these files every round; creating them
       # inside a measured round would time one-off disk allocation.

src/cli/mod.rs

@@ -146,7 +146,12 @@ impl InternalCommands {
     /// Build a [`CommandBuilder`] that re-execs the current binary into this
     /// internal subcommand. Each variant owns its own arg layout.
     pub fn get_command_builder(&self) -> Result<CommandBuilder> {
-        let mut builder = CommandBuilder::new(self_exe()?);
+        Ok(self.command_builder_for(self_exe()?))
+    }
+
+    /// Same as [`Self::get_command_builder`], re-executing `program` instead.
+    pub fn command_builder_for(&self, program: PathBuf) -> CommandBuilder {
+        let mut builder = CommandBuilder::new(program);
         match self {
             InternalCommands::Samply(args) => {
                 builder.arg("samply");
@@ -162,7 +167,7 @@ impl InternalCommands {
                 builder.args(args.args.iter().cloned());
             }
         }
-        Ok(builder)
+        builder
     }
 
     pub fn get_shell_command(&self) -> Result<String> {

src/executor/memory/executor.rs

@@ -33,7 +33,7 @@ use std::rc::Rc;
 use tempfile::NamedTempFile;
 use tokio::time::{Duration, timeout};
 
-use super::setup::{ensure_memtrack_capabilities, has_memtrack_capabilities};
+use super::setup::{ensure_memtrack_capabilities, has_memtrack_capabilities, memtrack_program};
 
 pub struct MemoryExecutor;
 
@@ -61,8 +61,8 @@ impl MemoryExecutor {
         let bench_command = get_bench_command(&execution_context.config)?;
         let (bench_command, env_file) = prefix_command_with_env(&bench_command, &extra_env)?;
 
-        let mut cmd_builder =
-            InternalCommands::Memtrack(MemtrackArgs { args: vec![] }).get_command_builder()?;
+        let mut cmd_builder = InternalCommands::Memtrack(MemtrackArgs { args: vec![] })
+            .command_builder_for(memtrack_program()?);
         if execution_context.config.memory_track_physical {
             cmd_builder.env("CODSPEED_MEMTRACK_TRACK_PHYSICAL", "1");
         }

src/executor/memory/setup.rs

@@ -3,7 +3,9 @@ use crate::executor::helpers::capabilities::binary_has_capabilities;
 use crate::executor::helpers::run_with_sudo::{is_root_user, run_with_sudo};
 use crate::prelude::*;
 use caps::Capability;
-use std::path::PathBuf;
+use object::Object;
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
 
 const MEMTRACK_REQUIRED_CAPS: &[Capability] = &[
     Capability::CAP_DAC_READ_SEARCH,
@@ -31,11 +33,43 @@ pub(crate) fn memtrack_setcap_spec() -> String {
     format!("{caps}+ep")
 }
 
-/// The binary that carries the eBPF capabilities: memtrack is a subcommand of
-/// this executable. Granted `+ep`, not inheritable, so a benchmark spawned from
-/// here does not receive them.
+/// The binary that carries the eBPF capabilities: a copy of this executable, so
+/// the runner itself never runs in glibc's secure-execution mode, which strips
+/// `LD_*` and similar variables from the environment benchmarks inherit.
+/// Granted `+ep`, not inheritable, so a benchmark spawned from it does not
+/// receive them.
 fn memtrack_path() -> Option<PathBuf> {
-    self_exe().ok()
+    static PATH: OnceLock<Option<PathBuf>> = OnceLock::new();
+    PATH.get_or_init(|| {
+        let build_id = build_id(&self_exe().ok()?)?;
+        Some(memtrack_cache_dir()?.join(build_id).join("codspeed"))
+    })
+    .clone()
+}
+
+fn memtrack_cache_dir() -> Option<PathBuf> {
+    let cache = std::env::var_os("XDG_CACHE_HOME")
+        .map(PathBuf::from)
+        .or_else(|| std::env::var_os("HOME").map(|home| PathBuf::from(home).join(".cache")))?;
+    Some(cache.join("codspeed").join("memtrack"))
+}
+
+/// Keys the copy, so a rebuild of the same version never runs a stale memtrack.
+fn build_id(exe: &Path) -> Option<String> {
+    let file = std::fs::File::open(exe).ok()?;
+    // SAFETY: a running executable cannot be written to (ETXTBSY).
+    let data = unsafe { memmap2::Mmap::map(&file) }.ok()?;
+    let id = object::File::parse(&*data).ok()?.build_id().ok()??;
+    Some(id.iter().map(|byte| format!("{byte:02x}")).collect())
+}
+
+/// The executable memtrack runs from: the copy once it holds the capabilities,
+/// this one otherwise (as root, or with a delegated BPF token).
+pub fn memtrack_program() -> Result<PathBuf> {
+    match memtrack_path() {
+        Some(path) if binary_has_capabilities(&path, memtrack_required_caps_mask()) => Ok(path),
+        _ => self_exe(),
+    }
 }
 
 /// Whether the installed memtrack binary already carries the required capabilities.
@@ -72,8 +106,24 @@ pub fn ensure_memtrack_capabilities() -> Result<()> {
         "Granting {MEMTRACK_COMMAND} the capabilities it needs as a one-time setup for the \
          memory instrument (requires sudo)."
     );
-    let setcap_args = [memtrack_setcap_spec(), path.to_string_lossy().into_owned()];
-    if let Err(e) = run_with_sudo("setcap", setcap_args) {
+    // Through sudo: `~/.cache` may be root-owned, samply writes there under sudo.
+    // Renamed into place so a concurrent run never execs a partial copy. Only
+    // copies older than a day are pruned: another build may be using a newer one.
+    let install_script = r#"set -e
+install -D -m 0755 "$1" "$2.tmp"
+setcap "$3" "$2.tmp"
+mv -f "$2.tmp" "$2"
+dir=$(dirname "$2")
+find "$(dirname "$dir")" -mindepth 1 -maxdepth 1 ! -path "$dir" -mmin +1440 -exec rm -rf {} +"#;
+    let install_args = [
+        "-c".to_owned(),
+        install_script.to_owned(),
+        "sh".to_owned(),
+        self_exe()?.to_string_lossy().into_owned(),
+        path.to_string_lossy().into_owned(),
+        memtrack_setcap_spec(),
+    ];
+    if let Err(e) = run_with_sudo("sh", install_args) {
         warn!(
             "Failed to grant capabilities to {MEMTRACK_COMMAND} ({e}). \
              Memory profiling will require running as root."