From 79bf275e5a4f7ef9e0fd0310ad1dcd0966e92728 Mon Sep 17 00:00:00 2001
From: localai-org-maint-bot
 <306269227+localai-org-maint-bot@users.noreply.github.com>
Date: Sun, 13 Sep 2026 15:06:42 +0000
Subject: [PATCH] fix(system): document trusted procfs reads

Scope G304 annotations to paths built from the fixed procfs root,
integer process IDs, and kernel directory entries. These reads accept
no user-controlled path components.

Assisted-by: Codex:GPT-6 gosec
---
 pkg/xsysinfo/process_vram_linux.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkg/xsysinfo/process_vram_linux.go b/pkg/xsysinfo/process_vram_linux.go
index cdb901762..3dd0a59a9 100644
--- a/pkg/xsysinfo/process_vram_linux.go
+++ b/pkg/xsysinfo/process_vram_linux.go
@@ -55,6 +55,9 @@ func processVRAM(procRoot string, pid int) (uint64, bool) {
 				}
 				continue
 			}
+			// #nosec G304 -- procRoot is /proc in production (a temp dir in tests);
+			// base adds an integer PID, and fd.Name comes from os.ReadDir.
+			// The kernel supplies these path components, not request input.
 			data, err := os.ReadFile(filepath.Join(base, "fdinfo", fd.Name()))
 			if err != nil {
 				return 0, false
@@ -75,6 +78,9 @@ func processVRAM(procRoot string, pid int) (uint64, bool) {
 			return 0, false
 		}
 		for _, task := range tasks {
+			// #nosec G304 -- procRoot is /proc in production (a temp dir in tests);
+			// base adds an integer PID, and task.Name comes from os.ReadDir.
+			// The kernel supplies these path components, not request input.
 			data, err := os.ReadFile(filepath.Join(base, "task", task.Name(), "children"))
 			if err != nil {
 				return 0, false