hakurei/helper/seccomp/export.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/helper/seccomp/export.go?h=develop2025-03-14T13:42:40Zseccomp: move out of helper2025-03-14T13:42:40ZOphestracat@gensokyo.uk2025-03-14T13:42:40Zurn:sha1:2647a71be1f287e50011a65653b9e9c806627899
Signed-off-by: Ophestra <cat@gensokyo.uk>
helper/seccomp: seccomp_load on negative fd2025-03-12T06:18:52ZOphestracat@gensokyo.uk2025-03-12T06:18:52Zurn:sha1:be16970e770554b3c2191da41eb9bd4472b323e4
Signed-off-by: Ophestra <cat@gensokyo.uk>
fortify: keep external files alive2025-02-22T18:24:37ZOphestracat@gensokyo.uk2025-02-22T18:24:37Zurn:sha1:eda4d612c2e64321766e1074a698caeae843102a
This should eliminate sporadic failures, like the known double close in "seccomp".
Signed-off-by: Ophestra <cat@gensokyo.uk>
helper/seccomp: use sync.Once for closeWrite2025-02-13T13:49:16ZOphestracat@gensokyo.uk2025-02-13T13:49:16Zurn:sha1:d1d20c06fb0c3ed5aaff15f284921a5e61c291e1
This makes the code much cleaner, and eliminates the intermittent ErrInvalid errors.
Signed-off-by: Ophestra <cat@gensokyo.uk>
helper/seccomp: eliminate data race on pfd2025-02-13T01:40:51ZOphestracat@gensokyo.uk2025-02-13T01:40:51Zurn:sha1:099da78af5b78ac69a9c3550229a29d8dac0e9f8
Turns out the doc comment on os.File was lying about its methods being safe for concurrent use. The race detector picked up a data race from concurrent use of Fd and Close.
This change eliminates that by calling Fd in the prepare routine.
Signed-off-by: Ophestra <cat@gensokyo.uk>
helper/seccomp: panic on invalid closeWrite use2025-02-07T03:58:20ZOphestracat@gensokyo.uk2025-02-07T03:58:20Zurn:sha1:568d7758d5308457967672997d9d2e786c7403f1
Returning an error here puts exporter in an invalid state. The caller should guard against this condition instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
helper/seccomp: implement reader interface via pipe2025-02-03T10:43:03ZOphestracat@gensokyo.uk2025-02-03T09:10:29Zurn:sha1:5b7b3fa9a4d8ca4ad08d6648752e28ee66f0ffae
This also does not require the libc tmpfile call.
BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing.
Signed-off-by: Ophestra <cat@gensokyo.uk>
helper/seccomp: separate seccomp package2025-01-25T03:59:11ZOphestracat@gensokyo.uk2025-01-25T03:59:11Zurn:sha1:163f15e93f009d15ecc2f93932e26728aff9904b
Signed-off-by: Ophestra <cat@gensokyo.uk>