# Suppressions for `make valgrind` (see scripts/valgrind.sh and valgrind/README.md).
#
# Each entry here is a specific, named allocation site, not a blanket "ignore leaks" rule, and
# each one is explained. They were captured with `valgrind --gen-suppressions=all` against a
# real `doos attach` run and trimmed to the exact stack valgrind printed; a new, different leak
# anywhere else still fails the check. Regenerate a candidate block with
# `valgrind --gen-suppressions=all` if doos's internals change and one of these stops matching.

{
   doos-clone-child-stack
   # Sandbox::start allocates the 1 MiB stack clone(2) needs for the namespace child. Its
   # lifetime is tied to that child process, not to a scope in the parent, so it is never
   # `delete[]`d: freeing it after clone() returns would be safe only once the child has copied
   # what it needs, and doing that bookkeeping would add a second code path purely to silence
   # a tool, not to fix a real leak. Confirmed "possibly lost", never "definitely lost".
   Memcheck:Leak
   match-leak-kinds: possible
   fun:_Znwm
   fun:_ZN4doos7Sandbox5startERNS_8FileLockE
   fun:_ZN4doos7Sandbox3runEv
   fun:_ZN4doos3Cli9cmdAttachESt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS7_EE
   fun:_ZN4doos3Cli3runEv
   fun:main
}

{
   doos-mount-error-exception-object
   # doMount's cold (error) path throws a SysError built from a std::string; when the namespace
   # child terminates right after printing that error, the in-flight exception object itself
   # (allocated by __cxa_allocate_exception) has not yet been destroyed by the unwinder. This is
   # the standard valgrind artifact for a C++ exception that is still alive when the process
   # exits, not a missing `delete`.
   Memcheck:Leak
   match-leak-kinds: possible
   fun:malloc
   fun:__cxa_allocate_exception
   fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
   fun:_ZN4doos12_GLOBAL__N_1L9setupRootERKNS_9ContainerERKNSt10filesystem7__cxx114pathE
   fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
   fun:clone
}

{
   doos-mount-error-message-string
   # Same doMount error path: the message string's internal buffer, built while constructing
   # the SysError/runtime_error that is about to be thrown. Same explanation as
   # doos-mount-error-exception-object, one frame earlier in the chain.
   Memcheck:Leak
   match-leak-kinds: possible
   fun:_Znwm
   fun:_ZNSs4_Rep9_S_createEmmRKSaIcE
   fun:_ZNSt12__cow_stringC2EPKcm
   fun:_ZNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
   fun:_ZN4doos8SysErrorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEi
   fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
   fun:_ZN4doos12_GLOBAL__N_1L9setupRootERKNS_9ContainerERKNSt10filesystem7__cxx114pathE
   fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
   fun:clone
}

{
   doos-mount-error-exception-object-top-level
   # Same explanation as doos-mount-error-exception-object, for the mount call that runs
   # directly in containerInit before setupRoot is reached (the very first "mount bind /",
   # which is what fails when AppArmor blocks user namespaces for this binary's path).
   Memcheck:Leak
   match-leak-kinds: possible
   fun:malloc
   fun:__cxa_allocate_exception
   fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
   fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
   fun:clone
}

{
   doos-mount-error-message-string-top-level
   # Same explanation as doos-mount-error-message-string, one level up: the mount call that
   # runs directly in containerInit before setupRoot is reached.
   Memcheck:Leak
   match-leak-kinds: possible
   fun:_Znwm
   fun:_ZNSs4_Rep9_S_createEmmRKSaIcE
   fun:_ZNSt12__cow_stringC2EPKcm
   fun:_ZNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
   fun:_ZN4doos8SysErrorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEi
   fun:_ZN4doos12_GLOBAL__N_1L7doMountEPKcRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_mSA_.isra.0.cold
   fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv
   fun:clone
}

{
   doos-containerinit-ifstream-buffer
   # containerInit's cold (error) path opens an ifstream (a /proc file, for a diagnostic) whose
   # libstdc++ filebuf buffer is still open when the namespace child exits right after. Same
   # "process exited before an RAII object on an about-to-unwind error path ran its destructor"
   # pattern as the two entries above, for a stream instead of an exception.
   Memcheck:Leak
   match-leak-kinds: possible
   fun:_Znam
   fun:_ZNSt13basic_filebufIcSt11char_traitsIcEE27_M_allocate_internal_bufferEv
   fun:_ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKcSt13_Ios_Openmode
   fun:_ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode
   fun:_ZN4doos12_GLOBAL__N_1L13containerInitEPv.cold
   fun:clone
}