// Test-only process guard. The compiler can read static inputs but cannot execute a child program.
#define _GNU_SOURCE
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <stddef.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>

__attribute__((constructor)) static void forbidExecution(void) {
  struct sock_filter instructions[] = {
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_execve, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_execveat, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
  };
  struct sock_fprog program = {sizeof(instructions) / sizeof(instructions[0]), instructions};
  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) || prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &program))
    _exit(98);
}

#include <spawn.h>
pid_t fork(void) { _exit(99); }
pid_t vfork(void) { _exit(99); }
int posix_spawn(pid_t *pid, const char *path, const posix_spawn_file_actions_t *actions,
    const posix_spawnattr_t *attributes, char *const arguments[], char *const environment[]) { _exit(99); }
int posix_spawnp(pid_t *pid, const char *path, const posix_spawn_file_actions_t *actions,
    const posix_spawnattr_t *attributes, char *const arguments[], char *const environment[]) { _exit(99); }

#include <dlfcn.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
static void rejectHistory(const char *path) {
  const char *forbidden[] = {"results_comparison.csv", "results_ablation.csv", "fast.json",
      "selection-frozen.json", "latency.json", ".trace"};
  for (size_t i = 0; i < sizeof(forbidden) / sizeof(forbidden[0]); ++i)
    if (strstr(path, forbidden[i])) _exit(97);
}
#define AUDIT_OPEN(name) \
int name(const char *path, int flags, ...) { \
  rejectHistory(path); \
  mode_t mode = 0; \
  if (flags & O_CREAT) { va_list arguments; va_start(arguments, flags); mode = va_arg(arguments, int); va_end(arguments); } \
  int (*original)(const char *, int, ...) = dlsym(RTLD_NEXT, #name); \
  return original(path, flags, mode); \
}
AUDIT_OPEN(open)
AUDIT_OPEN(open64)
#define AUDIT_FOPEN(name) \
FILE *name(const char *path, const char *mode) { \
  rejectHistory(path); \
  FILE *(*original)(const char *, const char *) = dlsym(RTLD_NEXT, #name); \
  return original(path, mode); \
}
AUDIT_FOPEN(fopen)
AUDIT_FOPEN(fopen64)