From e20197fdccc70f4225c1124231346b2209cb26e6 Mon Sep 17 00:00:00 2001
From: naiba <hi@nai.ba>
Date: Mon, 20 Jul 2026 17:03:37 +0000
Subject: [PATCH] fix(agentcompat): root proc resource reads

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
---
 .../agentcompat/internal/process/proc.go      | 30 +++++++++++++++----
 .../internal/workspace/listener.go            | 11 +++++--
 2 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/integration/agentcompat/internal/process/proc.go b/integration/agentcompat/internal/process/proc.go
index f028a247..356c57fc 100644
--- a/integration/agentcompat/internal/process/proc.go
+++ b/integration/agentcompat/internal/process/proc.go
@@ -15,8 +15,13 @@ import (
 )
 
 func readRSSBytes(pid int) (uint64, error) {
-	path := filepath.Join("/proc", strconv.Itoa(pid), "status")
-	file, err := os.Open(path)
+	path := filepath.Join(strconv.Itoa(pid), "status")
+	procRoot, err := os.OpenRoot("/proc")
+	if err != nil {
+		return 0, err
+	}
+	defer procRoot.Close()
+	file, err := procRoot.Open(path)
 	if err != nil {
 		return 0, err
 	}
@@ -73,8 +78,13 @@ func descendantPIDs(rootPID int) ([]int, error) {
 }
 
 func readParentPID(pid int) (int, error) {
-	path := filepath.Join("/proc", strconv.Itoa(pid), "stat")
-	data, err := os.ReadFile(path)
+	path := filepath.Join(strconv.Itoa(pid), "stat")
+	procRoot, err := os.OpenRoot("/proc")
+	if err != nil {
+		return 0, err
+	}
+	defer procRoot.Close()
+	data, err := procRoot.ReadFile(path)
 	if err != nil {
 		return 0, err
 	}
@@ -130,8 +140,16 @@ func parseSocketInode(target string) (uint64, bool) {
 }
 
 func listeningSocketInodes(pid int, protocol string) (map[uint64]struct{}, error) {
-	path := filepath.Join("/proc", strconv.Itoa(pid), "net", protocol)
-	file, err := os.Open(path)
+	if protocol != "tcp" && protocol != "tcp6" {
+		return nil, errors.New("unsupported proc network protocol")
+	}
+	path := filepath.Join(strconv.Itoa(pid), "net", protocol)
+	procRoot, err := os.OpenRoot("/proc")
+	if err != nil {
+		return nil, err
+	}
+	defer procRoot.Close()
+	file, err := procRoot.Open(path)
 	if err != nil {
 		return nil, err
 	}
diff --git a/integration/agentcompat/internal/workspace/listener.go b/integration/agentcompat/internal/workspace/listener.go
index fd5d755c..6c634627 100644
--- a/integration/agentcompat/internal/workspace/listener.go
+++ b/integration/agentcompat/internal/workspace/listener.go
@@ -67,10 +67,15 @@ func socketInode(file *os.File) (uint64, error) {
 }
 
 func listenerInodePresent(inode uint64) (bool, error) {
-	for _, path := range []string{"/proc/self/net/tcp", "/proc/self/net/tcp6"} {
-		file, err := os.Open(path)
+	procNet, err := os.OpenRoot("/proc/self/net")
+	if err != nil {
+		return false, fmt.Errorf("open listener tables: %w", err)
+	}
+	defer procNet.Close()
+	for _, name := range []string{"tcp", "tcp6"} {
+		file, err := procNet.Open(name)
 		if err != nil {
-			return false, fmt.Errorf("open listener table %s: %w", path, err)
+			return false, fmt.Errorf("open listener table %s: %w", name, err)
 		}
 		scanner := bufio.NewScanner(file)
 		for scanner.Scan() {