hakurei/sandbox/seccomp, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/sandbox/seccomp?h=develop2025-07-02T12:31:29Zhakurei: move container helpers toplevel2025-07-02T12:31:29ZOphestracat@gensokyo.uk2025-07-02T12:31:29Zurn:sha1:eec021cc4b4eb42bc9c8311755826828bfba1996
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: expose seccomp interface2025-07-01T19:47:13ZOphestracat@gensokyo.uk2025-07-01T19:38:28Zurn:sha1:31aef905fa819310ee7694775a836c294ff742e4
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: prepare -> export2025-07-01T15:32:48ZOphestracat@gensokyo.uk2025-07-01T15:32:48Zurn:sha1:26b7afc890e23af19fe6662fd27f46b47e9feea9
Export makes a lot more sense, and also matches the libseccomp function.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: native rule slice in helpers2025-07-01T15:22:27ZOphestracat@gensokyo.uk2025-07-01T15:22:27Zurn:sha1:d5532aade0c3f042c5daa7d1c16e7cce2f4b524a
These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: native rule type alias2025-07-01T15:00:08ZOphestracat@gensokyo.uk2025-07-01T15:00:08Zurn:sha1:0c5409aec7455cbe9e34b0e4d2f0edf0bc3c6e37
This makes it easier to keep API stable.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: resolve rules natively2025-07-01T13:11:32ZOphestracat@gensokyo.uk2025-07-01T11:23:33Zurn:sha1:1a8840bebc673672235b6e10b1b9386f24751757
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: extra constants2025-07-01T11:15:42ZOphestracat@gensokyo.uk2025-07-01T11:15:42Zurn:sha1:1fb453dffe4c83866fedfa4590be30ec65e815ff
These all resolve to pseudo syscall numbers in libseccomp, but are necessary anyway for other platforms.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: implement syscall lookup2025-06-30T15:35:27ZOphestracat@gensokyo.uk2025-06-30T15:35:27Zurn:sha1:e03d702d088ad78645d1cce448713ef71b12e803
This uses the Go map and is verified against libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: wire extra syscall2025-06-30T15:32:08ZOphestracat@gensokyo.uk2025-06-30T15:32:08Zurn:sha1:241dc964a6bb2116cd95a78dbbc35f9792dad554
These values are only useful for libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: emit syscall constants2025-06-30T11:34:33ZOphestracat@gensokyo.uk2025-06-30T11:34:33Zurn:sha1:8ef71e14d511d0b85bc9e419aee4c43147a4eefa
Signed-off-by: Ophestra <cat@gensokyo.uk>