Syscall rewriter: interface changes, no_std support, and hardening

litebox_packager/src/lib.rs

@@ -570,7 +570,15 @@ fn rewrite_elf(data: &[u8], path: &Path, verbose: bool) -> anyhow::Result<Vec<u8
     }
 
     match litebox_syscall_rewriter::hook_syscalls_in_elf(data, None) {
-        Ok(rewritten) => {
+        Ok((rewritten, skipped_addrs)) => {
+            if !skipped_addrs.is_empty() {
+                eprintln!(
+                    "  warning: {} has {} unpatchable syscall instruction(s) at {:?}",
+                    path.display(),
+                    skipped_addrs.len(),
+                    skipped_addrs,
+                );
+            }
             if verbose {
                 eprintln!("  {} (rewritten)", path.display());
             }
@@ -592,7 +600,7 @@ fn rewrite_elf(data: &[u8], path: &Path, verbose: bool) -> anyhow::Result<Vec<u8
             }
             Ok(data.to_vec())
         }
-        Err(litebox_syscall_rewriter::Error::UnsupportedObjectFile) => {
+        Err(litebox_syscall_rewriter::Error::UnsupportedObjectFile(_)) => {
             if verbose {
                 eprintln!(
                     "  warning: {} is not a supported ELF, including as-is",
@@ -610,6 +618,12 @@ fn rewrite_elf(data: &[u8], path: &Path, verbose: bool) -> anyhow::Result<Vec<u8
             }
             Ok(data.to_vec())
         }
+        Err(litebox_syscall_rewriter::Error::UnsupportedExecutable(_)) => {
+            anyhow::bail!(
+                "{} is a Bun-packaged executable and cannot be safely packaged without syscall rewriting",
+                path.display()
+            )
+        }
         Err(e) => Err(e).with_context(|| format!("failed to rewrite {}", path.display())),
     }
 }

litebox_runner_linux_userland/src/lib.rs

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-use anyhow::{Result, anyhow};
+use anyhow::{Context as _, Result, anyhow};
 use clap::Parser;
 use litebox::fs::{FileSystem as _, Mode};
 use litebox_platform_multiplex::Platform;
@@ -188,9 +188,17 @@ pub fn run(cli_args: CliArgs) -> Result<()> {
             .collect();
         let file = mmapped_file(&prog)?;
         let data = if cli_args.rewrite_syscalls {
-            litebox_syscall_rewriter::hook_syscalls_in_elf(file.data, None)
-                .unwrap()
-                .into()
+            let (rewritten, skipped_addrs) =
+                litebox_syscall_rewriter::hook_syscalls_in_elf(file.data, None)
+                    .with_context(|| format!("failed to rewrite {}", prog.display()))?;
+            if !skipped_addrs.is_empty() {
+                eprintln!(
+                    "warning: program has {} unpatchable syscall instruction(s) at {:?}",
+                    skipped_addrs.len(),
+                    skipped_addrs,
+                );
+            }
+            rewritten.into()
         } else {
             let data = file.data.into();
             cow_eligible_regions.push(file);

litebox_runner_optee_on_linux_userland/src/lib.rs

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-use anyhow::Result;
+use anyhow::{Context as _, Result};
 use clap::Parser;
 use litebox_common_optee::{TeeUuid, UteeEntryFunc, UteeParamOwned};
 use litebox_platform_multiplex::Platform;
@@ -65,19 +65,43 @@ pub enum InterceptionBackend {
 pub fn run(cli_args: CliArgs) -> Result<()> {
     let ldelf_data: Vec<u8> = {
         let ldelf = PathBuf::from(&cli_args.ldelf);
-        let data = std::fs::read(ldelf).unwrap();
+        let data =
+            std::fs::read(&ldelf).with_context(|| format!("failed to read {}", cli_args.ldelf))?;
         if cli_args.rewrite_syscalls {
-            litebox_syscall_rewriter::hook_syscalls_in_elf(&data, None).unwrap()
+            let (rewritten, skipped_addrs) =
+                litebox_syscall_rewriter::hook_syscalls_in_elf(&data, None)
+                    .with_context(|| format!("failed to rewrite {}", cli_args.ldelf))?;
+            if !skipped_addrs.is_empty() {
+                eprintln!(
+                    "warning: {} has {} unpatchable syscall instruction(s) at {:?}",
+                    cli_args.ldelf,
+                    skipped_addrs.len(),
+                    skipped_addrs,
+                );
+            }
+            rewritten
         } else {
             data
         }
     };
 
     let prog_data: Vec<u8> = {
         let prog = PathBuf::from(&cli_args.program);
-        let data = std::fs::read(prog).unwrap();
+        let data =
+            std::fs::read(&prog).with_context(|| format!("failed to read {}", cli_args.program))?;
         if cli_args.rewrite_syscalls {
-            litebox_syscall_rewriter::hook_syscalls_in_elf(&data, None).unwrap()
+            let (rewritten, skipped_addrs) =
+                litebox_syscall_rewriter::hook_syscalls_in_elf(&data, None)
+                    .with_context(|| format!("failed to rewrite {}", cli_args.program))?;
+            if !skipped_addrs.is_empty() {
+                eprintln!(
+                    "warning: {} has {} unpatchable syscall instruction(s) at {:?}",
+                    cli_args.program,
+                    skipped_addrs.len(),
+                    skipped_addrs,
+                );
+            }
+            rewritten
         } else {
             data
         }

litebox_syscall_rewriter/Cargo.toml

@@ -3,14 +3,25 @@ name = "litebox_syscall_rewriter"
 version = "0.1.0"
 edition = "2024"
 
+[features]
+default = ["std", "anyhow", "clap"]
+std = []
+anyhow = ["dep:anyhow"]
+clap = ["dep:clap"]
+
 [dependencies]
-anyhow = "1.0"
-clap = { version = "4.5.32", features = ["derive"] }
-iced-x86 = "1.21"
-memmap2 = "0.9"
-object = { version = "0.36.7", default-features = false, features = ["elf", "read", "std"] }
+iced-x86 = { version = "1.21", default-features = false, features = ["no_std", "decoder", "encoder", "instr_info"] }
+object = { version = "0.36.7", default-features = false, features = ["elf", "read_core"] }
 thiserror = { version = "2.0.6", default-features = false }
-zerocopy = { version = "0.8", features = ["derive"] }
+zerocopy = { version = "0.8", default-features = false, features = ["derive"] }
+
+# Binary-only dependencies
+anyhow = { version = "1.0", optional = true }
+clap = { version = "4.5.32", features = ["derive"], optional = true }
+
+[[bin]]
+name = "litebox_syscall_rewriter"
+required-features = ["std", "anyhow", "clap"]
 
 [lints]
 workspace = true