Skip to content
Open-Source Registry

cargo / execsurface-observe

execsurface-observe 0.1.0-alpha.6

processes
468
operations
9.1K
packages
18
compiler runs
14
connections
1
job time
11s
capture
107 KB
records
15K
bytes / record
7.0

Linux metadata-only observer for AETHER X ExecSurface

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured
8 detections

Build behaviourcompiled and nothing more

265 downloads · source · cargo

Release 0.1.0-alpha.6 run ecbf7560-dd92-46a7-8637-8ca7acf1f6d5 · built 2026-10-08

Artifact

file · retained · product
2
ChecksDetections
Build behavior
✓ Network activity—
✓ Sensitive data access and transfer—
▲ Cross-process access—
✓ Build file changes—
✓ Build script activity—
✓ Data flow analysis—
✓ Filesystem writes—
✓ Context collection—
Supply chain
✓ Known vulnerabilities—
✓ Build-time dependency advisories—
✓ Dependency advisories—
✓ Declared and observed dependencies—
✓ Dependency and toolchain versions—
Pipeline
✓ Pipeline coverage—

Detections

8
  • Process read another process's memory or registers
    execsurface_observe-9da18a625ea97e9e
    via process_vm/proc-mem — read ×1
    medium
  • Process read another process's memory or registers
    m11_shared_fd_ambiguity-08b3a0b624fb28c1
    via process_vm/proc-mem — read ×1
    medium
  • Process read another process's memory or registers
    m12_adversarial-bbe5d82043dc4247
    via process_vm/proc-mem — read ×5
    medium
  • Process read another process's memory or registers
    merge_authorization_hardlink-77664a00f1454d6d
    via process_vm/proc-mem — read ×1
    medium
  • Process read another process's memory or registers
    ptrace_linux-562bb9d3eb08acb8
    via process_vm/proc-mem — read ×1
    medium
  • Process read another process's memory or registers
    r2_fd_state_machine-3f6aff05ae42ea89
    via process_vm/proc-mem — read ×1
    medium
  • Process read another process's memory or registers
    r3_object_identity-c79d9e022f62cda4
    via process_vm/proc-mem — read ×1
    medium
  • Process read another process's memory or registers
    stage2_external_falsification-146fa602bfe7da14
    via process_vm/proc-mem — read ×1
    medium

Detection

medium

Process read another process's memory or registers

subject execsurface_observe-9da18a625ea97e9e

via process_vm/proc-mem — read ×1

actor: execsurface_observe-9da18a625ea97e9e (pid 3037) — /home/runner/work/execsurface/execsurface/target/release/deps/execsurface_observe-9da18a625ea97e9e

target: dash (pid 3038) — /bin/sh -c printf bridge > /tmp/execsurface-p8-a3-report-live-target-3003-0

  1. rustup2728
  2. cargo2922
  3. execsurface_observe-9da18a625ea97e9e3037at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject m11_shared_fd_ambiguity-08b3a0b624fb28c1

via process_vm/proc-mem — read ×1

actor: m11_shared_fd_ambiguity-08b3a0b624fb28c1 (pid 3053) — /home/runner/work/execsurface/execsurface/target/release/deps/m11_shared_fd_ambiguity-08b3a0b624fb28c1

target: execsurface_fixture-ebb3d0f5bbac611f (pid 3046) — /home/runner/work/execsurface/execsurface/target/release/execsurface-fixture thread-read /tmp/execsurface-m11-shared-fd-3040-fixture.txt 4

  1. rustup2728
  2. cargo2922
  3. m11_shared_fd_ambiguity-08b3a0b624fb28c13053at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject m12_adversarial-bbe5d82043dc4247

via process_vm/proc-mem — read ×5

actor: m12_adversarial-bbe5d82043dc4247 (pid 3068) — /home/runner/work/execsurface/execsurface/target/release/deps/m12_adversarial-bbe5d82043dc4247

target: cat (pid 3074) — cat -- /tmp/execsurface-m12-failed-open-3065/definitely-missing-input

  1. rustup2728
  2. cargo2922
  3. m12_adversarial-bbe5d82043dc42473068at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject merge_authorization_hardlink-77664a00f1454d6d

via process_vm/proc-mem — read ×1

actor: merge_authorization_hardlink-77664a00f1454d6d (pid 3079) — /home/runner/work/execsurface/execsurface/target/release/deps/merge_authorization_hardlink-77664a00f1454d6d

target: dash (pid 3082) — /bin/sh -c ln '/tmp/execsurface-hardlink-boundary-failed-3077-1/source.bin' '/tmp/execsurface-hardlink-boundary-failed-3077-1/alias.bin'

  1. rustup2728
  2. cargo2922
  3. merge_authorization_hardlink-77664a00f1454d6d3079at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject ptrace_linux-562bb9d3eb08acb8

via process_vm/proc-mem — read ×1

actor: ptrace_linux-562bb9d3eb08acb8 (pid 3105) — /home/runner/work/execsurface/execsurface/target/release/deps/ptrace_linux-562bb9d3eb08acb8

target: execsurface_fixture-ebb3d0f5bbac611f (pid 3116) — /home/runner/work/execsurface/execsurface/target/release/execsurface-fixture fork-read /tmp/execsurface-m65-dup-fork-3084

  1. rustup2728
  2. cargo2922
  3. ptrace_linux-562bb9d3eb08acb83105at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject r2_fd_state_machine-3f6aff05ae42ea89

via process_vm/proc-mem — read ×1

actor: r2_fd_state_machine-3f6aff05ae42ea89 (pid 3123) — /home/runner/work/execsurface/execsurface/target/release/deps/r2_fd_state_machine-3f6aff05ae42ea89

target: execsurface_fixture-ebb3d0f5bbac611f (pid 3126) — /home/runner/work/execsurface/execsurface/target/release/execsurface-fixture stage2-dup3-untracked-write /tmp/execsurface-stage2-r2-dup3-3119-victim.txt

  1. rustup2728
  2. cargo2922
  3. r2_fd_state_machine-3f6aff05ae42ea893123at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject r3_object_identity-c79d9e022f62cda4

via process_vm/proc-mem — read ×1

actor: r3_object_identity-c79d9e022f62cda4 (pid 3140) — /home/runner/work/execsurface/execsurface/target/release/deps/r3_object_identity-c79d9e022f62cda4

target: execsurface_fixture-ebb3d0f5bbac611f (pid 3135) — /home/runner/work/execsurface/execsurface/target/release/execsurface-fixture stage2-symlink-truncate /tmp/execsurface-stage2-r3-hardlink-3129/workspace/alias

  1. rustup2728
  2. cargo2922
  3. r3_object_identity-c79d9e022f62cda43140at 04:27:56

witnessed · rule process-access

Detection

medium

Process read another process's memory or registers

subject stage2_external_falsification-146fa602bfe7da14

via process_vm/proc-mem — read ×1

actor: stage2_external_falsification-146fa602bfe7da14 (pid 3146) — /home/runner/work/execsurface/execsurface/target/release/deps/stage2_external_falsification-146fa602bfe7da14

target: execsurface_fixture-ebb3d0f5bbac611f (pid 3150) — /home/runner/work/execsurface/execsurface/target/release/execsurface-fixture stage2-symlink-truncate /tmp/execsurface-stage2-r1-symlink-3144/workspace/link

  1. rustup2728
  2. cargo2922
  3. stage2_external_falsification-146fa602bfe7da143146at 04:27:56

witnessed · rule process-access

Network

0 peers
    cargo fetched 990 files from static.crates.io

    Raw data

    capture
    107 KB
    records
    15,436
    bytes per record
    7.0

    Loading a sample of the capture

    Want to see more? E-mail us at hello@bitbison.io about your use case.

    Dependencies

    18 packages, 7 with a build script that ran, 0 doing more than compiling
    PackageVersionUsageBuild behaviour
    ld-linux-x86-64.so.2linkedsystem library
    libc direct0.2.190linkedbuild script
    libc.so.6linkedsystem library
    libgcc_s.so.1linkedsystem library
    libm.so.6linkedsystem library
    libmvec.so.1linkedsystem library
    proc-macro21.0.107buildtime_onlybuild script
    quote1.0.47buildtime_onlybuild script
    serde1.0.229unknownbuild script
    serde_core1.0.229unknownbuild script
    serde_derive1.0.229buildtime_onlyproc macro
    serde_json1.0.151unrelatedbuild script
    zmij1.0.23unrelatedbuild script
    execsurface-model direct0.1.0-alpha.6unknown
    itoa1.0.18unrelated
    memchr2.8.3unrelated
    syn3.0.6buildtime_only
    unicode-ident1.0.26buildtime_only

    1 of 1 jobs captured: build-test success · Generated 2026-10-08 · tarp 0.1.0+20261008010522-g7d82935f3902 · run ecbf7560-dd92-46a7-8637-8ca7acf1f6d5