Repository: rust-lang/rust
File: library/std/src/env.rs (Rust)

Code before:
/// # Platform-specific behavior
///
/// If the executable was invoked through a symbolic link, some platforms will
/// return the path of the symbolic link and other platforms will return the
/// path of the symbolic link’s target.
///
/// If the executable is renamed while it is running, platforms may return the
/// path at the time it was loaded instead of the new path.
///
/// # Errors
///
/// Acquiring the path of the current executable is a platform-specific operation
/// that can fail for a good number of reasons. Some errors can include, but not
/// be limited to, filesystem operations failing or general syscall failures.
///
/// # Security
///
/// The output of this function must be treated with care to avoid security
/// vulnerabilities, particularly in processes that run with privileges higher
/// than the user, such as setuid or setgid programs.
///
/// On some Unix platforms, the result is derived from `argv[0]` and `$PATH`,
/// which can be set arbitrarily by the user who invokes the program.
///
/// On Linux, an attacker who can create hardlinks to the executable may be
/// able to cause this function to return an attacker-controlled path.
///
/// # Examples
///
/// ```
/// use std::env;
///
/// match env::current_exe() {
///     Ok(exe_path) => println!("Path of this executable is: {}",
///                              exe_path.display()),
///     Err(e) => println!("failed to get current exe path: {e}"),
/// };
/// ```
#[stable(feature = "env", since = "1.0.0")]
pub fn current_exe() -> io::Result<PathBuf> {
    os_imp::current_exe()
}

/// An iterator over the arguments of a process, yielding a [`String`] value for
/// each argument.
///
/// This struct is created by [`env::args()`]. See its documentation
/// for more.
///
/// The first element is traditionally the path of the executable, but it can be
/// set to arbitrary text, and might not even exist. This means this property

Review comment (suggestion):
We could potentially say here that on modern Linux this should not normally be possible unless they can also write to the file, unless they changed `fs.protected_hardlinks`, but that seems probably too much detail.

Code after:
/// # Platform-specific behavior
///
/// If the executable was invoked through a symbolic link, some platforms will
/// return the path of the symbolic link and other platforms will return the
/// path of the symbolic link’s target.
///
/// If the executable is renamed while it is running, platforms may return the
/// path at the time it was loaded instead of the new path.
///
/// # Errors
///
/// Acquiring the path of the current executable is a platform-specific operation
/// that can fail for a good number of reasons. Some errors can include, but not
/// be limited to, filesystem operations failing or general syscall failures.
///
/// # Security
///
/// The output of this function must be treated with care to avoid security
/// vulnerabilities, particularly in processes that run with privileges higher
/// than the user, such as setuid or setgid programs.
///
/// For example, on some Unix platforms, the result is calculated by
/// searching `$PATH` for an executable matching `argv[0]`, but both the
/// environment and arguments can be be set arbitrarily by the user who
/// invokes the program.
///
/// On Linux, if `fs.secure_hardlinks` is not set, an attacker who can
/// create hardlinks to the executable may be able to cause this function
/// to return an attacker-controlled path, which they later replace with
/// a different program.
///
/// This list of illustrative example attacks is not exhaustive.
///
/// # Examples
///
/// ```
/// use std::env;
///
/// match env::current_exe() {
///     Ok(exe_path) => println!("Path of this executable is: {}",
///                              exe_path.display()),
///     Err(e) => println!("failed to get current exe path: {e}"),
/// };
/// ```
#[stable(feature = "env", since = "1.0.0")]
pub fn current_exe() -> io::Result<PathBuf> {
    os_imp::current_exe()
}

/// An iterator over the arguments of a process, yielding a [`String`] value for
/// each argument.