From 01d229fa5ca89f54702344a369d2a8d81484630c Mon Sep 17 00:00:00 2001
From: Red Bear OS <build@redbearos.org>
Date: Sat, 18 Jul 2026 16:34:43 +0900
Subject: [PATCH] redox-rt: make filetable refresh non-fatal (fall back to
 lseek)

The dup2('refresh') added for O_CLOEXEC/stale-fd correctness fails for some
exec'd children (observed: a uid-dropped, namespace-restricted login shell)
and propagated as a spawn ENOENT. Fall back to the plain lseek when the
refresh syscall errors so process startup always succeeds; the refresh
still applies wherever the kernel permits it. Prevents any spawn
regression while the refresh path is stabilized for restricted children.
---
 redox-rt/src/sys.rs | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/redox-rt/src/sys.rs b/redox-rt/src/sys.rs
index a536e73c98..acabed309b 100644
--- a/redox-rt/src/sys.rs
+++ b/redox-rt/src/sys.rs
@@ -974,7 +974,7 @@ impl FdTbl {
         // creation"). A plain lseek did not force the underlying scheme to
         // re-materialize the current descriptor set.
         let buf = b"refresh";
-        unsafe {
+        let refreshed = unsafe {
             syscall::syscall4(
                 syscall::SYS_DUP2,
                 files_reader_fd,
@@ -982,7 +982,14 @@ impl FdTbl {
                 buf.as_ptr() as usize,
                 buf.len(),
             )
-        }?;
+        };
+        // If the kernel cannot refresh this filetable here (e.g. permission or
+        // context constraints for a uid-dropped / namespace-restricted exec),
+        // fall back to the plain lseek so process startup still succeeds —
+        // NON-FATAL so we never break spawn while the refresh path is stabilized.
+        if refreshed.is_err() {
+            let _ = filetable_fd.lseek(0, syscall::flag::SEEK_SET);
+        }
 
         fdtbl.resize(Self::DEFAULT_CAPACITY);