hakurei/sandbox/container_test.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/sandbox/container_test.go?h=develop2025-07-02T12:23:55Zhakurei: move container toplevel2025-07-02T12:23:55ZOphestracat@gensokyo.uk2025-07-02T12:23:55Zurn:sha1:a1d98823f8d17b49b432508d071b62ccd426f1ce
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/hakurei: move to cmd2025-07-02T11:42:51ZOphestracat@gensokyo.uk2025-07-02T11:42:51Zurn:sha1:eb22a8bcc1ac03357d4073e5d3ed6d0ab5246a37
Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: expose seccomp interface2025-07-01T19:47:13ZOphestracat@gensokyo.uk2025-07-01T19:38:28Zurn:sha1:31aef905fa819310ee7694775a836c294ff742e4
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: resolve rules natively2025-07-01T13:11:32ZOphestracat@gensokyo.uk2025-07-01T11:23:33Zurn:sha1:1a8840bebc673672235b6e10b1b9386f24751757
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
treewide: rename to hakurei2025-06-24T19:57:41ZOphestracat@gensokyo.uk2025-06-24T18:59:52Zurn:sha1:87e008d56de974947ebb99c2cc40b25d3c2cf43e
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: update flake lock2025-06-04T19:05:39ZOphestracat@gensokyo.uk2025-06-02T09:53:28Zurn:sha1:b7e991de5bfa81bff474d07142555df51202640a
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: rename flag type and constants2025-04-07T16:59:45ZOphestracat@gensokyo.uk2025-04-07T16:59:45Zurn:sha1:584405f7ccd4c8c0e63762e113f4650f2abd469e
The names are ambiguous. Rename them to make more sense.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: resolve tty name2025-03-24T07:03:07ZOphestracat@gensokyo.uk2025-03-24T06:28:25Zurn:sha1:ad3576c16467d8b36452307b005b6af0d0f0f9d2
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/vfs: add doc comments2025-03-24T04:21:55ZOphestracat@gensokyo.uk2025-03-24T04:21:55Zurn:sha1:a11237b15848cc99d117ca6eb832eed0c92c64ec
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: set mkdir perm2025-03-24T03:51:39ZOphestracat@gensokyo.uk2025-03-24T03:45:19Zurn:sha1:40f00d570e10ba03910d16b734cc75817b83d00e
Signed-off-by: Ophestra <cat@gensokyo.uk>