hakurei/sandbox/init.go, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/sandbox/init.go?h=develop2025-07-02T12:23:55Zhakurei: move container toplevel2025-07-02T12:23:55ZOphestracat@gensokyo.uk2025-07-02T12:23:55Zurn:sha1:a1d98823f8d17b49b432508d071b62ccd426f1ce
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: expose seccomp interface2025-07-01T19:47:13ZOphestracat@gensokyo.uk2025-07-01T19:38:28Zurn:sha1:31aef905fa819310ee7694775a836c294ff742e4
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: import dot for syscall2025-07-01T17:30:35ZOphestracat@gensokyo.uk2025-07-01T17:30:35Zurn:sha1:a6887f7253ae822357f0d4d019675acc8c3e0b4d
This significantly increases readability in some places.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: native rule slice in helpers2025-07-01T15:22:27ZOphestracat@gensokyo.uk2025-07-01T15:22:27Zurn:sha1:d5532aade0c3f042c5daa7d1c16e7cce2f4b524a
These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: resolve rules natively2025-07-01T13:11:32ZOphestracat@gensokyo.uk2025-07-01T11:23:33Zurn:sha1:1a8840bebc673672235b6e10b1b9386f24751757
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
treewide: rename to hakurei2025-06-24T19:57:41ZOphestracat@gensokyo.uk2025-06-24T18:59:52Zurn:sha1:87e008d56de974947ebb99c2cc40b25d3c2cf43e
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: document less obvious parts of setup2025-03-31T16:21:04ZOphestracat@gensokyo.uk2025-03-31T16:21:04Zurn:sha1:0ba8be659f0bb22065824190e2d872d869a2fe92
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: support privileged container2025-03-27T10:40:19ZOphestracat@gensokyo.uk2025-03-27T10:40:19Zurn:sha1:184e9db2b2ee960e7c7b2014aec72a28d9110bcc
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/init: clear inheritable set2025-03-25T22:46:13ZOphestracat@gensokyo.uk2025-03-25T22:46:13Zurn:sha1:d613257841492a1e8aa7a42f9f15c93aeb6e5649
Inheritable should not be able to affect anything regardless of its value, due to no_new_privs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/init: drop capabilities2025-03-25T21:32:08ZOphestracat@gensokyo.uk2025-03-25T21:28:32Zurn:sha1:52fcc48ac141147324c3baac0e87ea49e8c2ca09
During development the syscall filter caused me to make an incorrect assumption about SysProcAttr.
Signed-off-by: Ophestra <cat@gensokyo.uk>