hakurei/sandbox, branch developlow-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/sandbox?h=develop2025-07-02T12:52:07Zsystem: move system access packages2025-07-02T12:52:07ZOphestracat@gensokyo.uk2025-07-02T12:52:07Zurn:sha1:82561d62b66f17c05604e87f18187bb3a91f00d2
These packages loosely belong in the "system" package and "system" provides high level wrappers for all of them.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hakurei: move container helpers toplevel2025-07-02T12:31:29ZOphestracat@gensokyo.uk2025-07-02T12:31:29Zurn:sha1:eec021cc4b4eb42bc9c8311755826828bfba1996
Signed-off-by: Ophestra <cat@gensokyo.uk>
hakurei: move container toplevel2025-07-02T12:23:55ZOphestracat@gensokyo.uk2025-07-02T12:23:55Zurn:sha1:a1d98823f8d17b49b432508d071b62ccd426f1ce
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/wl: track generated files2025-07-02T11:52:22ZOphestracat@gensokyo.uk2025-07-02T11:52:22Zurn:sha1:f84ec5a3f8d648031bc8e7c4baf6e31d67d2d5a4
This allows the package to be imported.
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/hakurei: move to cmd2025-07-02T11:42:51ZOphestracat@gensokyo.uk2025-07-02T11:42:51Zurn:sha1:eb22a8bcc1ac03357d4073e5d3ed6d0ab5246a37
Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox: expose seccomp interface2025-07-01T19:47:13ZOphestracat@gensokyo.uk2025-07-01T19:38:28Zurn:sha1:31aef905fa819310ee7694775a836c294ff742e4
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: import dot for syscall2025-07-01T17:30:35ZOphestracat@gensokyo.uk2025-07-01T17:30:35Zurn:sha1:a6887f7253ae822357f0d4d019675acc8c3e0b4d
This significantly increases readability in some places.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: append suffix to ops2025-07-01T16:09:04ZOphestracat@gensokyo.uk2025-07-01T16:09:04Zurn:sha1:69bd581af78909ce924b810da67979b57c5b5747
This avoids clashes with stdlib names to allow for . imports.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: prepare -> export2025-07-01T15:32:48ZOphestracat@gensokyo.uk2025-07-01T15:32:48Zurn:sha1:26b7afc890e23af19fe6662fd27f46b47e9feea9
Export makes a lot more sense, and also matches the libseccomp function.
Signed-off-by: Ophestra <cat@gensokyo.uk>
sandbox/seccomp: native rule slice in helpers2025-07-01T15:22:27ZOphestracat@gensokyo.uk2025-07-01T15:22:27Zurn:sha1:d5532aade0c3f042c5daa7d1c16e7cce2f4b524a
These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule.
Signed-off-by: Ophestra <cat@gensokyo.uk>