hakurei, branch v0.1.1low-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/?h=v0.1.12025-07-08T20:42:31Zrelease: 0.1.12025-07-08T20:42:31ZOphestracat@gensokyo.uk2025-07-08T20:42:31Zurn:sha1:6ba19a7ba5c36a4276dceeab9a5d158c5d9738a0
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: add arm64 constants2025-07-08T20:36:35ZOphestracat@gensokyo.uk2025-07-08T19:45:54Zurn:sha1:749a2779f5ba8b2c575d1459db04c9209d914627
Most of these are differences in qemu.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: verify seccomp on all test cases2025-07-08T19:21:35ZOphestracat@gensokyo.uk2025-07-08T18:47:16Zurn:sha1:e574042d765f135814c5afabaf24cb7109fab175
This change also makes seccomp hashes cross-platform.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox: guard on testtool tag2025-07-07T11:11:29ZOphestracat@gensokyo.uk2025-07-07T11:11:29Zurn:sha1:2b44493e8a255b40a9809208f5c751ca7c539027
This tool should not show up when building hakurei normally.
Signed-off-by: Ophestra <cat@gensokyo.uk>
test/sandbox/seccomp: remove uselib2025-07-07T06:28:55ZOphestracat@gensokyo.uk2025-07-07T06:28:55Zurn:sha1:c30dd4e630005fa6f2409d3a3c2400d512c52042
This syscall is not wired on all platforms. This test barely does anything anyway and seccomp is covered by the privileged test instrumentation.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container/seccomp: add arm64 constants2025-07-07T05:58:03ZOphestracat@gensokyo.uk2025-07-07T05:58:03Zurn:sha1:d90da1c8f5dacbd5b84195ce335a234b41a30aea
Signed-off-by: Ophestra <cat@gensokyo.uk>
container/seccomp: move bpf hashes2025-07-07T05:41:47ZOphestracat@gensokyo.uk2025-07-07T05:41:47Zurn:sha1:5853d7700ff606974fd801f143e7b9d55f3fc253
Filter programs are different across platforms. This representation is also much more readable.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container/init: fix prctl call2025-07-07T05:06:14ZOphestracat@gensokyo.uk2025-07-07T05:06:14Zurn:sha1:d5c7523726550898b13500f8a169cf13cdc42e7a
This is a very silly typo. Luckily has no effect due to an upper layer doing PR_SET_NO_NEW_PRIVS already.
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: move capset implementation2025-07-07T04:47:13ZOphestracat@gensokyo.uk2025-07-07T04:47:05Zurn:sha1:ddfcc51b913a70da48102f64e18b34579dc3611c
Signed-off-by: Ophestra <cat@gensokyo.uk>
container: move syscall constants2025-07-07T04:23:01ZOphestracat@gensokyo.uk2025-07-07T04:23:01Zurn:sha1:8ebedbd88ae2cf0da1c787fa456455065b7dc3a2
These aren't missing from all targets.
Signed-off-by: Ophestra <cat@gensokyo.uk>