From a86aa076b0d78d5a027bf2a401e6f000af29d98d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Fri, 10 Jul 2026 12:12:56 +0200 Subject: [PATCH] kata-sys-util: run OCI hooks by their absolute path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hooks were spawned by PATH-searching `args[0]`. After `env_clear()` a bare argv[0] only resolves against the compiled-in default PATH (/bin:/usr/bin), so a hook binary living elsewhere - e.g. a composable-image extension under /run/kata-extensions//bin - failed to start with ENOENT. Execute the hook's `path` instead (an absolute path, already validated in `new`), passing `args` as argv with argv[0] = args[0]. This matches OCI runtime-spec semantics and lets hooks run from any location. Signed-off-by: Fabiano Fidêncio Assisted-by: Cursor --- src/libs/kata-sys-util/src/hooks.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/libs/kata-sys-util/src/hooks.rs b/src/libs/kata-sys-util/src/hooks.rs index fd1a65e301..73dab136cd 100644 --- a/src/libs/kata-sys-util/src/hooks.rs +++ b/src/libs/kata-sys-util/src/hooks.rs @@ -250,9 +250,15 @@ impl<'a> HookExecutor<'a> { /// Spawn the subprocess, optionally feeding `state` to its stdin. fn spawn(&self, state: Option<&runtime_spec::State>) -> Result { - let mut exec = Exec::cmd(&self.args[0]) + // Execute the hook's `path` (an absolute path, validated in `new`) directly. + // Using `args[0]` as the command would PATH-search a bare program name, which + // only resolves when the binary lives in the compiled-in default PATH + // (/bin:/usr/bin) after `env_clear()` - so hooks outside it (e.g. a composable + // image extension under /run/kata-extensions//bin) fail with ENOENT. + // OCI semantics: run `path`, with `args` as argv (argv[0] = args[0]). + let mut exec = Exec::cmd(&self.executable) .args(&self.args[1..]) - .arg0(&self.executable) + .arg0(&self.args[0]) .env_clear() .env_extend( self.envs