ext: add additional constants

This removes the syscall cutoff thresholds, instead declaring all
syscall number constants in package ext.

This also removes two constants from package container which were
inadvertently exported for 386 and amd64.

Signed-off-by: Ophestra <cat@gensokyo.uk>

15 files changed, 1330 insertions, 127 deletions

diff --git a/container/mount.go b/container/mount.go
index 84415fa8..978b90a9 100644
--- a/container/mount.go
+++ b/container/mount.go
@@ -123,7 +123,7 @@ func (p procPaths) remount(msg message.Msg, target string, flags uintptr) error
 	{
 		var destFd int
 		if err := ext.IgnoringEINTR(func() (err error) {
-			destFd, err = p.k.open(targetFinal, O_PATH|O_CLOEXEC, 0)
+			destFd, err = p.k.open(targetFinal, ext.O_PATH|O_CLOEXEC, 0)
 			return
 		}); err != nil {
 			return &os.PathError{Op: "open", Path: targetFinal, Err: err}
diff --git a/container/seccomp/presets.go b/container/seccomp/presets.go
index 4b76af61..252bf9f1 100644
--- a/container/seccomp/presets.go
+++ b/container/seccomp/presets.go
@@ -3,7 +3,7 @@ package seccomp
 /* flatpak commit 4c3bf179e2e4a2a298cd1db1d045adaf3f564532 */
 
 import (
-	. "syscall"
+	"syscall"
 
 	. "hakurei.app/container/std"
 	. "hakurei.app/ext"
@@ -69,121 +69,124 @@ func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
 var (
 	presetCommon = []NativeRule{
 		/* Block dmesg */
-		{Syscall: SNR_SYSLOG, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_SYSLOG, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 		/* Useless old syscall */
-		{Syscall: SNR_USELIB, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_USELIB, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 		/* Don't allow disabling accounting */
-		{Syscall: SNR_ACCT, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_ACCT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 		/* Don't allow reading current quota use */
-		{Syscall: SNR_QUOTACTL, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_QUOTACTL, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 
 		/* Don't allow access to the kernel keyring */
-		{Syscall: SNR_ADD_KEY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_KEYCTL, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_REQUEST_KEY, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_ADD_KEY, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_KEYCTL, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_REQUEST_KEY, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 
 		/* Scary VM/NUMA ops */
-		{Syscall: SNR_MOVE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_MBIND, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_GET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_MIGRATE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_MOVE_PAGES, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_MBIND, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_GET_MEMPOLICY, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SET_MEMPOLICY, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_MIGRATE_PAGES, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetCommonExt = []NativeRule{
 		/* system calls for changing the system clock */
-		{Syscall: SNR_ADJTIMEX, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_ADJTIME, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_ADJTIME64, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_SETTIME, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_SETTIME64, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETTIMEOFDAY, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_ADJTIMEX, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CLOCK_ADJTIME, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CLOCK_ADJTIME64, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CLOCK_SETTIME, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CLOCK_SETTIME64, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETTIMEOFDAY, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 
 		/* loading and unloading of kernel modules */
-		{Syscall: SNR_DELETE_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FINIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_INIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_DELETE_MODULE, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_FINIT_MODULE, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_INIT_MODULE, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 
 		/* system calls for rebooting and reboot preparation */
-		{Syscall: SNR_KEXEC_FILE_LOAD, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_KEXEC_LOAD, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_REBOOT, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_KEXEC_FILE_LOAD, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_KEXEC_LOAD, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_REBOOT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 
 		/* system calls for enabling/disabling swap devices */
-		{Syscall: SNR_SWAPOFF, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SWAPON, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_SWAPOFF, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SWAPON, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 	}
 
 	presetNamespace = []NativeRule{
 		/* Don't allow subnamespace setups: */
-		{Syscall: SNR_UNSHARE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETNS, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_MOUNT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_UMOUNT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_UMOUNT2, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_PIVOT_ROOT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CHROOT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLONE, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: cloneArg, Op: SCMP_CMP_MASKED_EQ, DatumA: CLONE_NEWUSER, DatumB: CLONE_NEWUSER}},
+		{Syscall: SNR_UNSHARE, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETNS, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_MOUNT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_UMOUNT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_UMOUNT2, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_PIVOT_ROOT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CHROOT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CLONE, Errno: ScmpErrno(syscall.EPERM),
+			Arg: &ScmpArgCmp{Arg: cloneArg, Op: SCMP_CMP_MASKED_EQ,
+				DatumA: syscall.CLONE_NEWUSER, DatumB: syscall.CLONE_NEWUSER}},
 
 		/* seccomp can't look into clone3()'s struct clone_args to check whether
 		 * the flags are OK, so we have no choice but to block clone3().
-		 * Return ENOSYS so user-space will fall back to clone().
+		 * Return syscall.ENOSYS so user-space will fall back to clone().
 		 * (CVE-2021-41133; see also https://github.com/moby/moby/commit/9f6b562d)
 		 */
-		{Syscall: SNR_CLONE3, Errno: ScmpErrno(ENOSYS), Arg: nil},
+		{Syscall: SNR_CLONE3, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
 
 		/* New mount manipulation APIs can also change our VFS. There's no
 		 * legitimate reason to do these in the sandbox, so block all of them
 		 * rather than thinking about which ones might be dangerous.
 		 * (CVE-2021-41133) */
-		{Syscall: SNR_OPEN_TREE, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_MOVE_MOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSOPEN, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSCONFIG, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSMOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSPICK, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_MOUNT_SETATTR, Errno: ScmpErrno(ENOSYS), Arg: nil},
+		{Syscall: SNR_OPEN_TREE, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_MOVE_MOUNT, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_FSOPEN, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_FSCONFIG, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_FSMOUNT, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_FSPICK, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_MOUNT_SETATTR, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetNamespaceExt = []NativeRule{
 		/* changing file ownership */
-		{Syscall: SNR_CHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FCHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FCHOWNAT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_LCHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_LCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_CHOWN, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_CHOWN32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_FCHOWN, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_FCHOWN32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_FCHOWNAT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_LCHOWN, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_LCHOWN32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 
 		/* system calls for changing user ID and group ID credentials */
-		{Syscall: SNR_SETGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETGROUPS, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETGROUPS32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESUID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREUID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETUID32, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_SETGID, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETGID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETGROUPS, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETGROUPS32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETREGID, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETREGID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETRESGID, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETRESGID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETRESUID, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETRESUID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETREUID, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETREUID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETUID, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
+		{Syscall: SNR_SETUID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 	}
 
 	presetTTY = []NativeRule{
 		/* Don't allow faking input to the controlling tty (CVE-2017-5226) */
-		{Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCSTI}},
+		{Syscall: SNR_IOCTL, Errno: ScmpErrno(syscall.EPERM),
+			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ,
+				DatumA: 0xFFFFFFFF, DatumB: syscall.TIOCSTI}},
 		/* In the unlikely event that the controlling tty is a Linux virtual
 		 * console (/dev/tty2 or similar), copy/paste operations have an effect
 		 * similar to TIOCSTI (CVE-2023-28100) */
-		{Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCLINUX}},
+		{Syscall: SNR_IOCTL, Errno: ScmpErrno(syscall.EPERM),
+			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ,
+				DatumA: 0xFFFFFFFF, DatumB: syscall.TIOCLINUX}},
 	}
 
 	presetEmu = []NativeRule{
@@ -191,15 +194,15 @@ var (
 		 * so it's disabled as a hardening measure.
 		 * However, it is required to run old 16-bit applications
 		 * as well as some Wine patches, so it's allowed in multiarch. */
-		{Syscall: SNR_MODIFY_LDT, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_MODIFY_LDT, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetEmuExt = []NativeRule{
-		{Syscall: SNR_SUBPAGE_PROT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_SWITCH_ENDIAN, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_VM86, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_VM86OLD, Errno: ScmpErrno(ENOSYS), Arg: nil},
+		{Syscall: SNR_SUBPAGE_PROT, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_SWITCH_ENDIAN, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_VM86, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
+		{Syscall: SNR_VM86OLD, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil},
 	}
 )
 
@@ -207,11 +210,11 @@ func presetDevel(allowedPersonality ScmpDatum) []NativeRule {
 	return []NativeRule{
 		/* Profiling operations; we expect these to be done by tools from outside
 		 * the sandbox.  In particular perf has been the source of many CVEs. */
-		{Syscall: SNR_PERF_EVENT_OPEN, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_PERF_EVENT_OPEN, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 		/* Don't allow you to switch to bsd emulation or whatnot */
-		{Syscall: SNR_PERSONALITY, Errno: ScmpErrno(EPERM),
+		{Syscall: SNR_PERSONALITY, Errno: ScmpErrno(syscall.EPERM),
 			Arg: &ScmpArgCmp{Arg: 0, Op: SCMP_CMP_NE, DatumA: allowedPersonality}},
 
-		{Syscall: SNR_PTRACE, Errno: ScmpErrno(EPERM), Arg: nil},
+		{Syscall: SNR_PTRACE, Errno: ScmpErrno(syscall.EPERM), Arg: nil},
 	}
 }
diff --git a/container/syscall.go b/container/syscall.go
index e008ecea..43e49bea 100644
--- a/container/syscall.go
+++ b/container/syscall.go
@@ -9,7 +9,7 @@ import (
 
 // setNoNewPrivs sets the calling thread's no_new_privs attribute.
 func setNoNewPrivs() error {
-	return ext.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0)
+	return ext.Prctl(ext.PR_SET_NO_NEW_PRIVS, 1, 0)
 }
 
 // schedParam is equivalent to struct sched_param from include/linux/sched.h.
diff --git a/container/syscall_386.go b/container/syscall_386.go
deleted file mode 100644
index 4b8e2df3..00000000
--- a/container/syscall_386.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package container
-
-const (
-	O_PATH = 0x200000
-
-	PR_SET_NO_NEW_PRIVS = 0x26
-)
diff --git a/container/syscall_amd64.go b/container/syscall_amd64.go
deleted file mode 100644
index 4b8e2df3..00000000
--- a/container/syscall_amd64.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package container
-
-const (
-	O_PATH = 0x200000
-
-	PR_SET_NO_NEW_PRIVS = 0x26
-)
diff --git a/ext/mksysnum_linux.pl b/ext/mksysnum_linux.pl
index 22ec3fcf..1b381b28 100755
--- a/ext/mksysnum_linux.pl
+++ b/ext/mksysnum_linux.pl
@@ -7,13 +7,6 @@ use strict;
 use POSIX ();
 
 my $command = "mksysnum_linux.pl ". join(' ', @ARGV);
-my $uname_arch = (POSIX::uname)[4];
-my %syscall_cutoff_arch = (
-	"x86" => 340,
-	"x86_64" => 302,
-	"aarch64" => 281,
-	"riscv64" => 281,
-);
 
 print <<EOF;
 // $command
@@ -21,8 +14,6 @@ print <<EOF;
 
 package ext
 
-import . "syscall"
-
 var syscallNum = map[string]SyscallNum{
 EOF
 
@@ -38,7 +29,7 @@ sub fmt {
 	}
 	(my $name_upper = $name) =~ y/a-z/A-Z/;
 	$num = $num + $offset;
-	if($num > $syscall_cutoff_arch{$uname_arch} && $state == 0){ # not wired in Go standard library
+	if($state == 0){ # not wired in Go standard library
 		print " SYS_$name_upper = $num\n";
 	}
 	elsif($state == -1){
diff --git a/ext/syscall_extra.go b/ext/syscall_extra.go
new file mode 100644
index 00000000..89adf1f3
--- /dev/null
+++ b/ext/syscall_extra.go
@@ -0,0 +1,9 @@
+//go:build !(arm64 || riscv64 || mips || mipsle || mips64 || mips64le || ppc64 || ppc64le || s390x || loong64)
+
+package ext
+
+const (
+	O_PATH = 0x200000
+
+	PR_SET_NO_NEW_PRIVS = 0x26
+)
diff --git a/ext/syscall_extra_linux_arm64.go b/ext/syscall_extra_linux_arm64.go
index 977c3cf3..91f98686 100644
--- a/ext/syscall_extra_linux_arm64.go
+++ b/ext/syscall_extra_linux_arm64.go
@@ -1,11 +1,5 @@
 package ext
 
-import "syscall"
-
-const (
-	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
-)
-
 var syscallNumExtra = map[string]SyscallNum{
 	"uselib":          SNR_USELIB,
 	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
diff --git a/ext/syscall_extra_linux_riscv64.go b/ext/syscall_extra_linux_riscv64.go
index 977c3cf3..91f98686 100644
--- a/ext/syscall_extra_linux_riscv64.go
+++ b/ext/syscall_extra_linux_riscv64.go
@@ -1,11 +1,5 @@
 package ext
 
-import "syscall"
-
-const (
-	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
-)
-
 var syscallNumExtra = map[string]SyscallNum{
 	"uselib":          SNR_USELIB,
 	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
diff --git a/ext/syscall_linux_386.go b/ext/syscall_linux_386.go
index c306e5fe..91e87eae 100644
--- a/ext/syscall_linux_386.go
+++ b/ext/syscall_linux_386.go
@@ -3,8 +3,6 @@
 
 package ext
 
-import . "syscall"
-
 var syscallNum = map[string]SyscallNum{
 	"restart_syscall":              SNR_RESTART_SYSCALL,
 	"exit":                         SNR_EXIT,
@@ -458,9 +456,350 @@ var syscallNum = map[string]SyscallNum{
 	"lsm_set_self_attr":            SNR_LSM_SET_SELF_ATTR,
 	"lsm_list_modules":             SNR_LSM_LIST_MODULES,
 	"mseal":                        SNR_MSEAL,
+	"setxattrat":                   SNR_SETXATTRAT,
+	"getxattrat":                   SNR_GETXATTRAT,
+	"listxattrat":                  SNR_LISTXATTRAT,
+	"removexattrat":                SNR_REMOVEXATTRAT,
 }
 
 const (
+	SYS_RESTART_SYSCALL              = 0
+	SYS_EXIT                         = 1
+	SYS_FORK                         = 2
+	SYS_READ                         = 3
+	SYS_WRITE                        = 4
+	SYS_OPEN                         = 5
+	SYS_CLOSE                        = 6
+	SYS_WAITPID                      = 7
+	SYS_CREAT                        = 8
+	SYS_LINK                         = 9
+	SYS_UNLINK                       = 10
+	SYS_EXECVE                       = 11
+	SYS_CHDIR                        = 12
+	SYS_TIME                         = 13
+	SYS_MKNOD                        = 14
+	SYS_CHMOD                        = 15
+	SYS_LCHOWN                       = 16
+	SYS_BREAK                        = 17
+	SYS_OLDSTAT                      = 18
+	SYS_LSEEK                        = 19
+	SYS_GETPID                       = 20
+	SYS_MOUNT                        = 21
+	SYS_UMOUNT                       = 22
+	SYS_SETUID                       = 23
+	SYS_GETUID                       = 24
+	SYS_STIME                        = 25
+	SYS_PTRACE                       = 26
+	SYS_ALARM                        = 27
+	SYS_OLDFSTAT                     = 28
+	SYS_PAUSE                        = 29
+	SYS_UTIME                        = 30
+	SYS_STTY                         = 31
+	SYS_GTTY                         = 32
+	SYS_ACCESS                       = 33
+	SYS_NICE                         = 34
+	SYS_FTIME                        = 35
+	SYS_SYNC                         = 36
+	SYS_KILL                         = 37
+	SYS_RENAME                       = 38
+	SYS_MKDIR                        = 39
+	SYS_RMDIR                        = 40
+	SYS_DUP                          = 41
+	SYS_PIPE                         = 42
+	SYS_TIMES                        = 43
+	SYS_PROF                         = 44
+	SYS_BRK                          = 45
+	SYS_SETGID                       = 46
+	SYS_GETGID                       = 47
+	SYS_SIGNAL                       = 48
+	SYS_GETEUID                      = 49
+	SYS_GETEGID                      = 50
+	SYS_ACCT                         = 51
+	SYS_UMOUNT2                      = 52
+	SYS_LOCK                         = 53
+	SYS_IOCTL                        = 54
+	SYS_FCNTL                        = 55
+	SYS_MPX                          = 56
+	SYS_SETPGID                      = 57
+	SYS_ULIMIT                       = 58
+	SYS_OLDOLDUNAME                  = 59
+	SYS_UMASK                        = 60
+	SYS_CHROOT                       = 61
+	SYS_USTAT                        = 62
+	SYS_DUP2                         = 63
+	SYS_GETPPID                      = 64
+	SYS_GETPGRP                      = 65
+	SYS_SETSID                       = 66
+	SYS_SIGACTION                    = 67
+	SYS_SGETMASK                     = 68
+	SYS_SSETMASK                     = 69
+	SYS_SETREUID                     = 70
+	SYS_SETREGID                     = 71
+	SYS_SIGSUSPEND                   = 72
+	SYS_SIGPENDING                   = 73
+	SYS_SETHOSTNAME                  = 74
+	SYS_SETRLIMIT                    = 75
+	SYS_GETRLIMIT                    = 76
+	SYS_GETRUSAGE                    = 77
+	SYS_GETTIMEOFDAY                 = 78
+	SYS_SETTIMEOFDAY                 = 79
+	SYS_GETGROUPS                    = 80
+	SYS_SETGROUPS                    = 81
+	SYS_SELECT                       = 82
+	SYS_SYMLINK                      = 83
+	SYS_OLDLSTAT                     = 84
+	SYS_READLINK                     = 85
+	SYS_USELIB                       = 86
+	SYS_SWAPON                       = 87
+	SYS_REBOOT                       = 88
+	SYS_READDIR                      = 89
+	SYS_MMAP                         = 90
+	SYS_MUNMAP                       = 91
+	SYS_TRUNCATE                     = 92
+	SYS_FTRUNCATE                    = 93
+	SYS_FCHMOD                       = 94
+	SYS_FCHOWN                       = 95
+	SYS_GETPRIORITY                  = 96
+	SYS_SETPRIORITY                  = 97
+	SYS_PROFIL                       = 98
+	SYS_STATFS                       = 99
+	SYS_FSTATFS                      = 100
+	SYS_IOPERM                       = 101
+	SYS_SOCKETCALL                   = 102
+	SYS_SYSLOG                       = 103
+	SYS_SETITIMER                    = 104
+	SYS_GETITIMER                    = 105
+	SYS_STAT                         = 106
+	SYS_LSTAT                        = 107
+	SYS_FSTAT                        = 108
+	SYS_OLDUNAME                     = 109
+	SYS_IOPL                         = 110
+	SYS_VHANGUP                      = 111
+	SYS_IDLE                         = 112
+	SYS_VM86OLD                      = 113
+	SYS_WAIT4                        = 114
+	SYS_SWAPOFF                      = 115
+	SYS_SYSINFO                      = 116
+	SYS_IPC                          = 117
+	SYS_FSYNC                        = 118
+	SYS_SIGRETURN                    = 119
+	SYS_CLONE                        = 120
+	SYS_SETDOMAINNAME                = 121
+	SYS_UNAME                        = 122
+	SYS_MODIFY_LDT                   = 123
+	SYS_ADJTIMEX                     = 124
+	SYS_MPROTECT                     = 125
+	SYS_SIGPROCMASK                  = 126
+	SYS_CREATE_MODULE                = 127
+	SYS_INIT_MODULE                  = 128
+	SYS_DELETE_MODULE                = 129
+	SYS_GET_KERNEL_SYMS              = 130
+	SYS_QUOTACTL                     = 131
+	SYS_GETPGID                      = 132
+	SYS_FCHDIR                       = 133
+	SYS_BDFLUSH                      = 134
+	SYS_SYSFS                        = 135
+	SYS_PERSONALITY                  = 136
+	SYS_AFS_SYSCALL                  = 137
+	SYS_SETFSUID                     = 138
+	SYS_SETFSGID                     = 139
+	SYS__LLSEEK                      = 140
+	SYS_GETDENTS                     = 141
+	SYS__NEWSELECT                   = 142
+	SYS_FLOCK                        = 143
+	SYS_MSYNC                        = 144
+	SYS_READV                        = 145
+	SYS_WRITEV                       = 146
+	SYS_GETSID                       = 147
+	SYS_FDATASYNC                    = 148
+	SYS__SYSCTL                      = 149
+	SYS_MLOCK                        = 150
+	SYS_MUNLOCK                      = 151
+	SYS_MLOCKALL                     = 152
+	SYS_MUNLOCKALL                   = 153
+	SYS_SCHED_SETPARAM               = 154
+	SYS_SCHED_GETPARAM               = 155
+	SYS_SCHED_SETSCHEDULER           = 156
+	SYS_SCHED_GETSCHEDULER           = 157
+	SYS_SCHED_YIELD                  = 158
+	SYS_SCHED_GET_PRIORITY_MAX       = 159
+	SYS_SCHED_GET_PRIORITY_MIN       = 160
+	SYS_SCHED_RR_GET_INTERVAL        = 161
+	SYS_NANOSLEEP                    = 162
+	SYS_MREMAP                       = 163
+	SYS_SETRESUID                    = 164
+	SYS_GETRESUID                    = 165
+	SYS_VM86                         = 166
+	SYS_QUERY_MODULE                 = 167
+	SYS_POLL                         = 168
+	SYS_NFSSERVCTL                   = 169
+	SYS_SETRESGID                    = 170
+	SYS_GETRESGID                    = 171
+	SYS_PRCTL                        = 172
+	SYS_RT_SIGRETURN                 = 173
+	SYS_RT_SIGACTION                 = 174
+	SYS_RT_SIGPROCMASK               = 175
+	SYS_RT_SIGPENDING                = 176
+	SYS_RT_SIGTIMEDWAIT              = 177
+	SYS_RT_SIGQUEUEINFO              = 178
+	SYS_RT_SIGSUSPEND                = 179
+	SYS_PREAD64                      = 180
+	SYS_PWRITE64                     = 181
+	SYS_CHOWN                        = 182
+	SYS_GETCWD                       = 183
+	SYS_CAPGET                       = 184
+	SYS_CAPSET                       = 185
+	SYS_SIGALTSTACK                  = 186
+	SYS_SENDFILE                     = 187
+	SYS_GETPMSG                      = 188
+	SYS_PUTPMSG                      = 189
+	SYS_VFORK                        = 190
+	SYS_UGETRLIMIT                   = 191
+	SYS_MMAP2                        = 192
+	SYS_TRUNCATE64                   = 193
+	SYS_FTRUNCATE64                  = 194
+	SYS_STAT64                       = 195
+	SYS_LSTAT64                      = 196
+	SYS_FSTAT64                      = 197
+	SYS_LCHOWN32                     = 198
+	SYS_GETUID32                     = 199
+	SYS_GETGID32                     = 200
+	SYS_GETEUID32                    = 201
+	SYS_GETEGID32                    = 202
+	SYS_SETREUID32                   = 203
+	SYS_SETREGID32                   = 204
+	SYS_GETGROUPS32                  = 205
+	SYS_SETGROUPS32                  = 206
+	SYS_FCHOWN32                     = 207
+	SYS_SETRESUID32                  = 208
+	SYS_GETRESUID32                  = 209
+	SYS_SETRESGID32                  = 210
+	SYS_GETRESGID32                  = 211
+	SYS_CHOWN32                      = 212
+	SYS_SETUID32                     = 213
+	SYS_SETGID32                     = 214
+	SYS_SETFSUID32                   = 215
+	SYS_SETFSGID32                   = 216
+	SYS_PIVOT_ROOT                   = 217
+	SYS_MINCORE                      = 218
+	SYS_MADVISE                      = 219
+	SYS_GETDENTS64                   = 220
+	SYS_FCNTL64                      = 221
+	SYS_GETTID                       = 224
+	SYS_READAHEAD                    = 225
+	SYS_SETXATTR                     = 226
+	SYS_LSETXATTR                    = 227
+	SYS_FSETXATTR                    = 228
+	SYS_GETXATTR                     = 229
+	SYS_LGETXATTR                    = 230
+	SYS_FGETXATTR                    = 231
+	SYS_LISTXATTR                    = 232
+	SYS_LLISTXATTR                   = 233
+	SYS_FLISTXATTR                   = 234
+	SYS_REMOVEXATTR                  = 235
+	SYS_LREMOVEXATTR                 = 236
+	SYS_FREMOVEXATTR                 = 237
+	SYS_TKILL                        = 238
+	SYS_SENDFILE64                   = 239
+	SYS_FUTEX                        = 240
+	SYS_SCHED_SETAFFINITY            = 241
+	SYS_SCHED_GETAFFINITY            = 242
+	SYS_SET_THREAD_AREA              = 243
+	SYS_GET_THREAD_AREA              = 244
+	SYS_IO_SETUP                     = 245
+	SYS_IO_DESTROY                   = 246
+	SYS_IO_GETEVENTS                 = 247
+	SYS_IO_SUBMIT                    = 248
+	SYS_IO_CANCEL                    = 249
+	SYS_FADVISE64                    = 250
+	SYS_EXIT_GROUP                   = 252
+	SYS_LOOKUP_DCOOKIE               = 253
+	SYS_EPOLL_CREATE                 = 254
+	SYS_EPOLL_CTL                    = 255
+	SYS_EPOLL_WAIT                   = 256
+	SYS_REMAP_FILE_PAGES             = 257
+	SYS_SET_TID_ADDRESS              = 258
+	SYS_TIMER_CREATE                 = 259
+	SYS_TIMER_SETTIME                = 260
+	SYS_TIMER_GETTIME                = 261
+	SYS_TIMER_GETOVERRUN             = 262
+	SYS_TIMER_DELETE                 = 263
+	SYS_CLOCK_SETTIME                = 264
+	SYS_CLOCK_GETTIME                = 265
+	SYS_CLOCK_GETRES                 = 266
+	SYS_CLOCK_NANOSLEEP              = 267
+	SYS_STATFS64                     = 268
+	SYS_FSTATFS64                    = 269
+	SYS_TGKILL                       = 270
+	SYS_UTIMES                       = 271
+	SYS_FADVISE64_64                 = 272
+	SYS_VSERVER                      = 273
+	SYS_MBIND                        = 274
+	SYS_GET_MEMPOLICY                = 275
+	SYS_SET_MEMPOLICY                = 276
+	SYS_MQ_OPEN                      = 277
+	SYS_MQ_UNLINK                    = 278
+	SYS_MQ_TIMEDSEND                 = 279
+	SYS_MQ_TIMEDRECEIVE              = 280
+	SYS_MQ_NOTIFY                    = 281
+	SYS_MQ_GETSETATTR                = 282
+	SYS_KEXEC_LOAD                   = 283
+	SYS_WAITID                       = 284
+	SYS_ADD_KEY                      = 286
+	SYS_REQUEST_KEY                  = 287
+	SYS_KEYCTL                       = 288
+	SYS_IOPRIO_SET                   = 289
+	SYS_IOPRIO_GET                   = 290
+	SYS_INOTIFY_INIT                 = 291
+	SYS_INOTIFY_ADD_WATCH            = 292
+	SYS_INOTIFY_RM_WATCH             = 293
+	SYS_MIGRATE_PAGES                = 294
+	SYS_OPENAT                       = 295
+	SYS_MKDIRAT                      = 296
+	SYS_MKNODAT                      = 297
+	SYS_FCHOWNAT                     = 298
+	SYS_FUTIMESAT                    = 299
+	SYS_FSTATAT64                    = 300
+	SYS_UNLINKAT                     = 301
+	SYS_RENAMEAT                     = 302
+	SYS_LINKAT                       = 303
+	SYS_SYMLINKAT                    = 304
+	SYS_READLINKAT                   = 305
+	SYS_FCHMODAT                     = 306
+	SYS_FACCESSAT                    = 307
+	SYS_PSELECT6                     = 308
+	SYS_PPOLL                        = 309
+	SYS_UNSHARE                      = 310
+	SYS_SET_ROBUST_LIST              = 311
+	SYS_GET_ROBUST_LIST              = 312
+	SYS_SPLICE                       = 313
+	SYS_SYNC_FILE_RANGE              = 314
+	SYS_TEE                          = 315
+	SYS_VMSPLICE                     = 316
+	SYS_MOVE_PAGES                   = 317
+	SYS_GETCPU                       = 318
+	SYS_EPOLL_PWAIT                  = 319
+	SYS_UTIMENSAT                    = 320
+	SYS_SIGNALFD                     = 321
+	SYS_TIMERFD_CREATE               = 322
+	SYS_EVENTFD                      = 323
+	SYS_FALLOCATE                    = 324
+	SYS_TIMERFD_SETTIME              = 325
+	SYS_TIMERFD_GETTIME              = 326
+	SYS_SIGNALFD4                    = 327
+	SYS_EVENTFD2                     = 328
+	SYS_EPOLL_CREATE1                = 329
+	SYS_DUP3                         = 330
+	SYS_PIPE2                        = 331
+	SYS_INOTIFY_INIT1                = 332
+	SYS_PREADV                       = 333
+	SYS_PWRITEV                      = 334
+	SYS_RT_TGSIGQUEUEINFO            = 335
+	SYS_PERF_EVENT_OPEN              = 336
+	SYS_RECVMMSG                     = 337
+	SYS_FANOTIFY_INIT                = 338
+	SYS_FANOTIFY_MARK                = 339
+	SYS_PRLIMIT64                    = 340
 	SYS_NAME_TO_HANDLE_AT            = 341
 	SYS_OPEN_BY_HANDLE_AT            = 342
 	SYS_CLOCK_ADJTIME                = 343
@@ -576,6 +915,10 @@ const (
 	SYS_LSM_SET_SELF_ATTR            = 460
 	SYS_LSM_LIST_MODULES             = 461
 	SYS_MSEAL                        = 462
+	SYS_SETXATTRAT                   = 463
+	SYS_GETXATTRAT                   = 464
+	SYS_LISTXATTRAT                  = 465
+	SYS_REMOVEXATTRAT                = 466
 )
 
 const (
@@ -1031,4 +1374,8 @@ const (
 	SNR_LSM_SET_SELF_ATTR            SyscallNum = SYS_LSM_SET_SELF_ATTR
 	SNR_LSM_LIST_MODULES             SyscallNum = SYS_LSM_LIST_MODULES
 	SNR_MSEAL                        SyscallNum = SYS_MSEAL
+	SNR_SETXATTRAT                   SyscallNum = SYS_SETXATTRAT
+	SNR_GETXATTRAT                   SyscallNum = SYS_GETXATTRAT
+	SNR_LISTXATTRAT                  SyscallNum = SYS_LISTXATTRAT
+	SNR_REMOVEXATTRAT                SyscallNum = SYS_REMOVEXATTRAT
 )
diff --git a/ext/syscall_linux_amd64.go b/ext/syscall_linux_amd64.go
index e4391217..38d99bda 100644
--- a/ext/syscall_linux_amd64.go
+++ b/ext/syscall_linux_amd64.go
@@ -3,8 +3,6 @@
 
 package ext
 
-import . "syscall"
-
 var syscallNum = map[string]SyscallNum{
 	"read":                    SNR_READ,
 	"write":                   SNR_WRITE,
@@ -381,9 +379,316 @@ var syscallNum = map[string]SyscallNum{
 	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
 	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
 	"mseal":                   SNR_MSEAL,
+	"setxattrat":              SNR_SETXATTRAT,
+	"getxattrat":              SNR_GETXATTRAT,
+	"listxattrat":             SNR_LISTXATTRAT,
+	"removexattrat":           SNR_REMOVEXATTRAT,
 }
 
 const (
+	SYS_READ                    = 0
+	SYS_WRITE                   = 1
+	SYS_OPEN                    = 2
+	SYS_CLOSE                   = 3
+	SYS_STAT                    = 4
+	SYS_FSTAT                   = 5
+	SYS_LSTAT                   = 6
+	SYS_POLL                    = 7
+	SYS_LSEEK                   = 8
+	SYS_MMAP                    = 9
+	SYS_MPROTECT                = 10
+	SYS_MUNMAP                  = 11
+	SYS_BRK                     = 12
+	SYS_RT_SIGACTION            = 13
+	SYS_RT_SIGPROCMASK          = 14
+	SYS_RT_SIGRETURN            = 15
+	SYS_IOCTL                   = 16
+	SYS_PREAD64                 = 17
+	SYS_PWRITE64                = 18
+	SYS_READV                   = 19
+	SYS_WRITEV                  = 20
+	SYS_ACCESS                  = 21
+	SYS_PIPE                    = 22
+	SYS_SELECT                  = 23
+	SYS_SCHED_YIELD             = 24
+	SYS_MREMAP                  = 25
+	SYS_MSYNC                   = 26
+	SYS_MINCORE                 = 27
+	SYS_MADVISE                 = 28
+	SYS_SHMGET                  = 29
+	SYS_SHMAT                   = 30
+	SYS_SHMCTL                  = 31
+	SYS_DUP                     = 32
+	SYS_DUP2                    = 33
+	SYS_PAUSE                   = 34
+	SYS_NANOSLEEP               = 35
+	SYS_GETITIMER               = 36
+	SYS_ALARM                   = 37
+	SYS_SETITIMER               = 38
+	SYS_GETPID                  = 39
+	SYS_SENDFILE                = 40
+	SYS_SOCKET                  = 41
+	SYS_CONNECT                 = 42
+	SYS_ACCEPT                  = 43
+	SYS_SENDTO                  = 44
+	SYS_RECVFROM                = 45
+	SYS_SENDMSG                 = 46
+	SYS_RECVMSG                 = 47
+	SYS_SHUTDOWN                = 48
+	SYS_BIND                    = 49
+	SYS_LISTEN                  = 50
+	SYS_GETSOCKNAME             = 51
+	SYS_GETPEERNAME             = 52
+	SYS_SOCKETPAIR              = 53
+	SYS_SETSOCKOPT              = 54
+	SYS_GETSOCKOPT              = 55
+	SYS_CLONE                   = 56
+	SYS_FORK                    = 57
+	SYS_VFORK                   = 58
+	SYS_EXECVE                  = 59
+	SYS_EXIT                    = 60
+	SYS_WAIT4                   = 61
+	SYS_KILL                    = 62
+	SYS_UNAME                   = 63
+	SYS_SEMGET                  = 64
+	SYS_SEMOP                   = 65
+	SYS_SEMCTL                  = 66
+	SYS_SHMDT                   = 67
+	SYS_MSGGET                  = 68
+	SYS_MSGSND                  = 69
+	SYS_MSGRCV                  = 70
+	SYS_MSGCTL                  = 71
+	SYS_FCNTL                   = 72
+	SYS_FLOCK                   = 73
+	SYS_FSYNC                   = 74
+	SYS_FDATASYNC               = 75
+	SYS_TRUNCATE                = 76
+	SYS_FTRUNCATE               = 77
+	SYS_GETDENTS                = 78
+	SYS_GETCWD                  = 79
+	SYS_CHDIR                   = 80
+	SYS_FCHDIR                  = 81
+	SYS_RENAME                  = 82
+	SYS_MKDIR                   = 83
+	SYS_RMDIR                   = 84
+	SYS_CREAT                   = 85
+	SYS_LINK                    = 86
+	SYS_UNLINK                  = 87
+	SYS_SYMLINK                 = 88
+	SYS_READLINK                = 89
+	SYS_CHMOD                   = 90
+	SYS_FCHMOD                  = 91
+	SYS_CHOWN                   = 92
+	SYS_FCHOWN                  = 93
+	SYS_LCHOWN                  = 94
+	SYS_UMASK                   = 95
+	SYS_GETTIMEOFDAY            = 96
+	SYS_GETRLIMIT               = 97
+	SYS_GETRUSAGE               = 98
+	SYS_SYSINFO                 = 99
+	SYS_TIMES                   = 100
+	SYS_PTRACE                  = 101
+	SYS_GETUID                  = 102
+	SYS_SYSLOG                  = 103
+	SYS_GETGID                  = 104
+	SYS_SETUID                  = 105
+	SYS_SETGID                  = 106
+	SYS_GETEUID                 = 107
+	SYS_GETEGID                 = 108
+	SYS_SETPGID                 = 109
+	SYS_GETPPID                 = 110
+	SYS_GETPGRP                 = 111
+	SYS_SETSID                  = 112
+	SYS_SETREUID                = 113
+	SYS_SETREGID                = 114
+	SYS_GETGROUPS               = 115
+	SYS_SETGROUPS               = 116
+	SYS_SETRESUID               = 117
+	SYS_GETRESUID               = 118
+	SYS_SETRESGID               = 119
+	SYS_GETRESGID               = 120
+	SYS_GETPGID                 = 121
+	SYS_SETFSUID                = 122
+	SYS_SETFSGID                = 123
+	SYS_GETSID                  = 124
+	SYS_CAPGET                  = 125
+	SYS_CAPSET                  = 126
+	SYS_RT_SIGPENDING           = 127
+	SYS_RT_SIGTIMEDWAIT         = 128
+	SYS_RT_SIGQUEUEINFO         = 129
+	SYS_RT_SIGSUSPEND           = 130
+	SYS_SIGALTSTACK             = 131
+	SYS_UTIME                   = 132
+	SYS_MKNOD                   = 133
+	SYS_USELIB                  = 134
+	SYS_PERSONALITY             = 135
+	SYS_USTAT                   = 136
+	SYS_STATFS                  = 137
+	SYS_FSTATFS                 = 138
+	SYS_SYSFS                   = 139
+	SYS_GETPRIORITY             = 140
+	SYS_SETPRIORITY             = 141
+	SYS_SCHED_SETPARAM          = 142
+	SYS_SCHED_GETPARAM          = 143
+	SYS_SCHED_SETSCHEDULER      = 144
+	SYS_SCHED_GETSCHEDULER      = 145
+	SYS_SCHED_GET_PRIORITY_MAX  = 146
+	SYS_SCHED_GET_PRIORITY_MIN  = 147
+	SYS_SCHED_RR_GET_INTERVAL   = 148
+	SYS_MLOCK                   = 149
+	SYS_MUNLOCK                 = 150
+	SYS_MLOCKALL                = 151
+	SYS_MUNLOCKALL              = 152
+	SYS_VHANGUP                 = 153
+	SYS_MODIFY_LDT              = 154
+	SYS_PIVOT_ROOT              = 155
+	SYS__SYSCTL                 = 156
+	SYS_PRCTL                   = 157
+	SYS_ARCH_PRCTL              = 158
+	SYS_ADJTIMEX                = 159
+	SYS_SETRLIMIT               = 160
+	SYS_CHROOT                  = 161
+	SYS_SYNC                    = 162
+	SYS_ACCT                    = 163
+	SYS_SETTIMEOFDAY            = 164
+	SYS_MOUNT                   = 165
+	SYS_UMOUNT2                 = 166
+	SYS_SWAPON                  = 167
+	SYS_SWAPOFF                 = 168
+	SYS_REBOOT                  = 169
+	SYS_SETHOSTNAME             = 170
+	SYS_SETDOMAINNAME           = 171
+	SYS_IOPL                    = 172
+	SYS_IOPERM                  = 173
+	SYS_CREATE_MODULE           = 174
+	SYS_INIT_MODULE             = 175
+	SYS_DELETE_MODULE           = 176
+	SYS_GET_KERNEL_SYMS         = 177
+	SYS_QUERY_MODULE            = 178
+	SYS_QUOTACTL                = 179
+	SYS_NFSSERVCTL              = 180
+	SYS_GETPMSG                 = 181
+	SYS_PUTPMSG                 = 182
+	SYS_AFS_SYSCALL             = 183
+	SYS_TUXCALL                 = 184
+	SYS_SECURITY                = 185
+	SYS_GETTID                  = 186
+	SYS_READAHEAD               = 187
+	SYS_SETXATTR                = 188
+	SYS_LSETXATTR               = 189
+	SYS_FSETXATTR               = 190
+	SYS_GETXATTR                = 191
+	SYS_LGETXATTR               = 192
+	SYS_FGETXATTR               = 193
+	SYS_LISTXATTR               = 194
+	SYS_LLISTXATTR              = 195
+	SYS_FLISTXATTR              = 196
+	SYS_REMOVEXATTR             = 197
+	SYS_LREMOVEXATTR            = 198
+	SYS_FREMOVEXATTR            = 199
+	SYS_TKILL                   = 200
+	SYS_TIME                    = 201
+	SYS_FUTEX                   = 202
+	SYS_SCHED_SETAFFINITY       = 203
+	SYS_SCHED_GETAFFINITY       = 204
+	SYS_SET_THREAD_AREA         = 205
+	SYS_IO_SETUP                = 206
+	SYS_IO_DESTROY              = 207
+	SYS_IO_GETEVENTS            = 208
+	SYS_IO_SUBMIT               = 209
+	SYS_IO_CANCEL               = 210
+	SYS_GET_THREAD_AREA         = 211
+	SYS_LOOKUP_DCOOKIE          = 212
+	SYS_EPOLL_CREATE            = 213
+	SYS_EPOLL_CTL_OLD           = 214
+	SYS_EPOLL_WAIT_OLD          = 215
+	SYS_REMAP_FILE_PAGES        = 216
+	SYS_GETDENTS64              = 217
+	SYS_SET_TID_ADDRESS         = 218
+	SYS_RESTART_SYSCALL         = 219
+	SYS_SEMTIMEDOP              = 220
+	SYS_FADVISE64               = 221
+	SYS_TIMER_CREATE            = 222
+	SYS_TIMER_SETTIME           = 223
+	SYS_TIMER_GETTIME           = 224
+	SYS_TIMER_GETOVERRUN        = 225
+	SYS_TIMER_DELETE            = 226
+	SYS_CLOCK_SETTIME           = 227
+	SYS_CLOCK_GETTIME           = 228
+	SYS_CLOCK_GETRES            = 229
+	SYS_CLOCK_NANOSLEEP         = 230
+	SYS_EXIT_GROUP              = 231
+	SYS_EPOLL_WAIT              = 232
+	SYS_EPOLL_CTL               = 233
+	SYS_TGKILL                  = 234
+	SYS_UTIMES                  = 235
+	SYS_VSERVER                 = 236
+	SYS_MBIND                   = 237
+	SYS_SET_MEMPOLICY           = 238
+	SYS_GET_MEMPOLICY           = 239
+	SYS_MQ_OPEN                 = 240
+	SYS_MQ_UNLINK               = 241
+	SYS_MQ_TIMEDSEND            = 242
+	SYS_MQ_TIMEDRECEIVE         = 243
+	SYS_MQ_NOTIFY               = 244
+	SYS_MQ_GETSETATTR           = 245
+	SYS_KEXEC_LOAD              = 246
+	SYS_WAITID                  = 247
+	SYS_ADD_KEY                 = 248
+	SYS_REQUEST_KEY             = 249
+	SYS_KEYCTL                  = 250
+	SYS_IOPRIO_SET              = 251
+	SYS_IOPRIO_GET              = 252
+	SYS_INOTIFY_INIT            = 253
+	SYS_INOTIFY_ADD_WATCH       = 254
+	SYS_INOTIFY_RM_WATCH        = 255
+	SYS_MIGRATE_PAGES           = 256
+	SYS_OPENAT                  = 257
+	SYS_MKDIRAT                 = 258
+	SYS_MKNODAT                 = 259
+	SYS_FCHOWNAT                = 260
+	SYS_FUTIMESAT               = 261
+	SYS_NEWFSTATAT              = 262
+	SYS_UNLINKAT                = 263
+	SYS_RENAMEAT                = 264
+	SYS_LINKAT                  = 265
+	SYS_SYMLINKAT               = 266
+	SYS_READLINKAT              = 267
+	SYS_FCHMODAT                = 268
+	SYS_FACCESSAT               = 269
+	SYS_PSELECT6                = 270
+	SYS_PPOLL                   = 271
+	SYS_UNSHARE                 = 272
+	SYS_SET_ROBUST_LIST         = 273
+	SYS_GET_ROBUST_LIST         = 274
+	SYS_SPLICE                  = 275
+	SYS_TEE                     = 276
+	SYS_SYNC_FILE_RANGE         = 277
+	SYS_VMSPLICE                = 278
+	SYS_MOVE_PAGES              = 279
+	SYS_UTIMENSAT               = 280
+	SYS_EPOLL_PWAIT             = 281
+	SYS_SIGNALFD                = 282
+	SYS_TIMERFD_CREATE          = 283
+	SYS_EVENTFD                 = 284
+	SYS_FALLOCATE               = 285
+	SYS_TIMERFD_SETTIME         = 286
+	SYS_TIMERFD_GETTIME         = 287
+	SYS_ACCEPT4                 = 288
+	SYS_SIGNALFD4               = 289
+	SYS_EVENTFD2                = 290
+	SYS_EPOLL_CREATE1           = 291
+	SYS_DUP3                    = 292
+	SYS_PIPE2                   = 293
+	SYS_INOTIFY_INIT1           = 294
+	SYS_PREADV                  = 295
+	SYS_PWRITEV                 = 296
+	SYS_RT_TGSIGQUEUEINFO       = 297
+	SYS_PERF_EVENT_OPEN         = 298
+	SYS_RECVMMSG                = 299
+	SYS_FANOTIFY_INIT           = 300
+	SYS_FANOTIFY_MARK           = 301
+	SYS_PRLIMIT64               = 302
 	SYS_NAME_TO_HANDLE_AT       = 303
 	SYS_OPEN_BY_HANDLE_AT       = 304
 	SYS_CLOCK_ADJTIME           = 305
@@ -456,6 +761,10 @@ const (
 	SYS_LSM_SET_SELF_ATTR       = 460
 	SYS_LSM_LIST_MODULES        = 461
 	SYS_MSEAL                   = 462
+	SYS_SETXATTRAT              = 463
+	SYS_GETXATTRAT              = 464
+	SYS_LISTXATTRAT             = 465
+	SYS_REMOVEXATTRAT           = 466
 )
 
 const (
@@ -834,4 +1143,8 @@ const (
 	SNR_LSM_SET_SELF_ATTR       SyscallNum = SYS_LSM_SET_SELF_ATTR
 	SNR_LSM_LIST_MODULES        SyscallNum = SYS_LSM_LIST_MODULES
 	SNR_MSEAL                   SyscallNum = SYS_MSEAL
+	SNR_SETXATTRAT              SyscallNum = SYS_SETXATTRAT
+	SNR_GETXATTRAT              SyscallNum = SYS_GETXATTRAT
+	SNR_LISTXATTRAT             SyscallNum = SYS_LISTXATTRAT
+	SNR_REMOVEXATTRAT           SyscallNum = SYS_REMOVEXATTRAT
 )
diff --git a/ext/syscall_linux_arm64.go b/ext/syscall_linux_arm64.go
index 178c3182..f4a2b307 100644
--- a/ext/syscall_linux_arm64.go
+++ b/ext/syscall_linux_arm64.go
@@ -3,8 +3,6 @@
 
 package ext
 
-import . "syscall"
-
 var syscallNum = map[string]SyscallNum{
 	"io_setup":                SNR_IO_SETUP,
 	"io_destroy":              SNR_IO_DESTROY,
@@ -324,9 +322,282 @@ var syscallNum = map[string]SyscallNum{
 	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
 	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
 	"mseal":                   SNR_MSEAL,
+	"setxattrat":              SNR_SETXATTRAT,
+	"getxattrat":              SNR_GETXATTRAT,
+	"listxattrat":             SNR_LISTXATTRAT,
+	"removexattrat":           SNR_REMOVEXATTRAT,
+	"open_tree_attr":          SNR_OPEN_TREE_ATTR,
+	"file_getattr":            SNR_FILE_GETATTR,
+	"file_setattr":            SNR_FILE_SETATTR,
 }
 
 const (
+	SYS_IO_SETUP                = 0
+	SYS_IO_DESTROY              = 1
+	SYS_IO_SUBMIT               = 2
+	SYS_IO_CANCEL               = 3
+	SYS_IO_GETEVENTS            = 4
+	SYS_SETXATTR                = 5
+	SYS_LSETXATTR               = 6
+	SYS_FSETXATTR               = 7
+	SYS_GETXATTR                = 8
+	SYS_LGETXATTR               = 9
+	SYS_FGETXATTR               = 10
+	SYS_LISTXATTR               = 11
+	SYS_LLISTXATTR              = 12
+	SYS_FLISTXATTR              = 13
+	SYS_REMOVEXATTR             = 14
+	SYS_LREMOVEXATTR            = 15
+	SYS_FREMOVEXATTR            = 16
+	SYS_GETCWD                  = 17
+	SYS_LOOKUP_DCOOKIE          = 18
+	SYS_EVENTFD2                = 19
+	SYS_EPOLL_CREATE1           = 20
+	SYS_EPOLL_CTL               = 21
+	SYS_EPOLL_PWAIT             = 22
+	SYS_DUP                     = 23
+	SYS_DUP3                    = 24
+	SYS_FCNTL                   = 25
+	SYS_INOTIFY_INIT1           = 26
+	SYS_INOTIFY_ADD_WATCH       = 27
+	SYS_INOTIFY_RM_WATCH        = 28
+	SYS_IOCTL                   = 29
+	SYS_IOPRIO_SET              = 30
+	SYS_IOPRIO_GET              = 31
+	SYS_FLOCK                   = 32
+	SYS_MKNODAT                 = 33
+	SYS_MKDIRAT                 = 34
+	SYS_UNLINKAT                = 35
+	SYS_SYMLINKAT               = 36
+	SYS_LINKAT                  = 37
+	SYS_RENAMEAT                = 38
+	SYS_UMOUNT2                 = 39
+	SYS_MOUNT                   = 40
+	SYS_PIVOT_ROOT              = 41
+	SYS_NFSSERVCTL              = 42
+	SYS_STATFS                  = 43
+	SYS_FSTATFS                 = 44
+	SYS_TRUNCATE                = 45
+	SYS_FTRUNCATE               = 46
+	SYS_FALLOCATE               = 47
+	SYS_FACCESSAT               = 48
+	SYS_CHDIR                   = 49
+	SYS_FCHDIR                  = 50
+	SYS_CHROOT                  = 51
+	SYS_FCHMOD                  = 52
+	SYS_FCHMODAT                = 53
+	SYS_FCHOWNAT                = 54
+	SYS_FCHOWN                  = 55
+	SYS_OPENAT                  = 56
+	SYS_CLOSE                   = 57
+	SYS_VHANGUP                 = 58
+	SYS_PIPE2                   = 59
+	SYS_QUOTACTL                = 60
+	SYS_GETDENTS64              = 61
+	SYS_LSEEK                   = 62
+	SYS_READ                    = 63
+	SYS_WRITE                   = 64
+	SYS_READV                   = 65
+	SYS_WRITEV                  = 66
+	SYS_PREAD64                 = 67
+	SYS_PWRITE64                = 68
+	SYS_PREADV                  = 69
+	SYS_PWRITEV                 = 70
+	SYS_SENDFILE                = 71
+	SYS_PSELECT6                = 72
+	SYS_PPOLL                   = 73
+	SYS_SIGNALFD4               = 74
+	SYS_VMSPLICE                = 75
+	SYS_SPLICE                  = 76
+	SYS_TEE                     = 77
+	SYS_READLINKAT              = 78
+	SYS_NEWFSTATAT              = 79
+	SYS_FSTAT                   = 80
+	SYS_SYNC                    = 81
+	SYS_FSYNC                   = 82
+	SYS_FDATASYNC               = 83
+	SYS_SYNC_FILE_RANGE         = 84
+	SYS_TIMERFD_CREATE          = 85
+	SYS_TIMERFD_SETTIME         = 86
+	SYS_TIMERFD_GETTIME         = 87
+	SYS_UTIMENSAT               = 88
+	SYS_ACCT                    = 89
+	SYS_CAPGET                  = 90
+	SYS_CAPSET                  = 91
+	SYS_PERSONALITY             = 92
+	SYS_EXIT                    = 93
+	SYS_EXIT_GROUP              = 94
+	SYS_WAITID                  = 95
+	SYS_SET_TID_ADDRESS         = 96
+	SYS_UNSHARE                 = 97
+	SYS_FUTEX                   = 98
+	SYS_SET_ROBUST_LIST         = 99
+	SYS_GET_ROBUST_LIST         = 100
+	SYS_NANOSLEEP               = 101
+	SYS_GETITIMER               = 102
+	SYS_SETITIMER               = 103
+	SYS_KEXEC_LOAD              = 104
+	SYS_INIT_MODULE             = 105
+	SYS_DELETE_MODULE           = 106
+	SYS_TIMER_CREATE            = 107
+	SYS_TIMER_GETTIME           = 108
+	SYS_TIMER_GETOVERRUN        = 109
+	SYS_TIMER_SETTIME           = 110
+	SYS_TIMER_DELETE            = 111
+	SYS_CLOCK_SETTIME           = 112
+	SYS_CLOCK_GETTIME           = 113
+	SYS_CLOCK_GETRES            = 114
+	SYS_CLOCK_NANOSLEEP         = 115
+	SYS_SYSLOG                  = 116
+	SYS_PTRACE                  = 117
+	SYS_SCHED_SETPARAM          = 118
+	SYS_SCHED_SETSCHEDULER      = 119
+	SYS_SCHED_GETSCHEDULER      = 120
+	SYS_SCHED_GETPARAM          = 121
+	SYS_SCHED_SETAFFINITY       = 122
+	SYS_SCHED_GETAFFINITY       = 123
+	SYS_SCHED_YIELD             = 124
+	SYS_SCHED_GET_PRIORITY_MAX  = 125
+	SYS_SCHED_GET_PRIORITY_MIN  = 126
+	SYS_SCHED_RR_GET_INTERVAL   = 127
+	SYS_RESTART_SYSCALL         = 128
+	SYS_KILL                    = 129
+	SYS_TKILL                   = 130
+	SYS_TGKILL                  = 131
+	SYS_SIGALTSTACK             = 132
+	SYS_RT_SIGSUSPEND           = 133
+	SYS_RT_SIGACTION            = 134
+	SYS_RT_SIGPROCMASK          = 135
+	SYS_RT_SIGPENDING           = 136
+	SYS_RT_SIGTIMEDWAIT         = 137
+	SYS_RT_SIGQUEUEINFO         = 138
+	SYS_RT_SIGRETURN            = 139
+	SYS_SETPRIORITY             = 140
+	SYS_GETPRIORITY             = 141
+	SYS_REBOOT                  = 142
+	SYS_SETREGID                = 143
+	SYS_SETGID                  = 144
+	SYS_SETREUID                = 145
+	SYS_SETUID                  = 146
+	SYS_SETRESUID               = 147
+	SYS_GETRESUID               = 148
+	SYS_SETRESGID               = 149
+	SYS_GETRESGID               = 150
+	SYS_SETFSUID                = 151
+	SYS_SETFSGID                = 152
+	SYS_TIMES                   = 153
+	SYS_SETPGID                 = 154
+	SYS_GETPGID                 = 155
+	SYS_GETSID                  = 156
+	SYS_SETSID                  = 157
+	SYS_GETGROUPS               = 158
+	SYS_SETGROUPS               = 159
+	SYS_UNAME                   = 160
+	SYS_SETHOSTNAME             = 161
+	SYS_SETDOMAINNAME           = 162
+	SYS_GETRLIMIT               = 163
+	SYS_SETRLIMIT               = 164
+	SYS_GETRUSAGE               = 165
+	SYS_UMASK                   = 166
+	SYS_PRCTL                   = 167
+	SYS_GETCPU                  = 168
+	SYS_GETTIMEOFDAY            = 169
+	SYS_SETTIMEOFDAY            = 170
+	SYS_ADJTIMEX                = 171
+	SYS_GETPID                  = 172
+	SYS_GETPPID                 = 173
+	SYS_GETUID                  = 174
+	SYS_GETEUID                 = 175
+	SYS_GETGID                  = 176
+	SYS_GETEGID                 = 177
+	SYS_GETTID                  = 178
+	SYS_SYSINFO                 = 179
+	SYS_MQ_OPEN                 = 180
+	SYS_MQ_UNLINK               = 181
+	SYS_MQ_TIMEDSEND            = 182
+	SYS_MQ_TIMEDRECEIVE         = 183
+	SYS_MQ_NOTIFY               = 184
+	SYS_MQ_GETSETATTR           = 185
+	SYS_MSGGET                  = 186
+	SYS_MSGCTL                  = 187
+	SYS_MSGRCV                  = 188
+	SYS_MSGSND                  = 189
+	SYS_SEMGET                  = 190
+	SYS_SEMCTL                  = 191
+	SYS_SEMTIMEDOP              = 192
+	SYS_SEMOP                   = 193
+	SYS_SHMGET                  = 194
+	SYS_SHMCTL                  = 195
+	SYS_SHMAT                   = 196
+	SYS_SHMDT                   = 197
+	SYS_SOCKET                  = 198
+	SYS_SOCKETPAIR              = 199
+	SYS_BIND                    = 200
+	SYS_LISTEN                  = 201
+	SYS_ACCEPT                  = 202
+	SYS_CONNECT                 = 203
+	SYS_GETSOCKNAME             = 204
+	SYS_GETPEERNAME             = 205
+	SYS_SENDTO                  = 206
+	SYS_RECVFROM                = 207
+	SYS_SETSOCKOPT              = 208
+	SYS_GETSOCKOPT              = 209
+	SYS_SHUTDOWN                = 210
+	SYS_SENDMSG                 = 211
+	SYS_RECVMSG                 = 212
+	SYS_READAHEAD               = 213
+	SYS_BRK                     = 214
+	SYS_MUNMAP                  = 215
+	SYS_MREMAP                  = 216
+	SYS_ADD_KEY                 = 217
+	SYS_REQUEST_KEY             = 218
+	SYS_KEYCTL                  = 219
+	SYS_CLONE                   = 220
+	SYS_EXECVE                  = 221
+	SYS_MMAP                    = 222
+	SYS_FADVISE64               = 223
+	SYS_SWAPON                  = 224
+	SYS_SWAPOFF                 = 225
+	SYS_MPROTECT                = 226
+	SYS_MSYNC                   = 227
+	SYS_MLOCK                   = 228
+	SYS_MUNLOCK                 = 229
+	SYS_MLOCKALL                = 230
+	SYS_MUNLOCKALL              = 231
+	SYS_MINCORE                 = 232
+	SYS_MADVISE                 = 233
+	SYS_REMAP_FILE_PAGES        = 234
+	SYS_MBIND                   = 235
+	SYS_GET_MEMPOLICY           = 236
+	SYS_SET_MEMPOLICY           = 237
+	SYS_MIGRATE_PAGES           = 238
+	SYS_MOVE_PAGES              = 239
+	SYS_RT_TGSIGQUEUEINFO       = 240
+	SYS_PERF_EVENT_OPEN         = 241
+	SYS_ACCEPT4                 = 242
+	SYS_RECVMMSG                = 243
+	SYS_WAIT4                   = 260
+	SYS_PRLIMIT64               = 261
+	SYS_FANOTIFY_INIT           = 262
+	SYS_FANOTIFY_MARK           = 263
+	SYS_NAME_TO_HANDLE_AT       = 264
+	SYS_OPEN_BY_HANDLE_AT       = 265
+	SYS_CLOCK_ADJTIME           = 266
+	SYS_SYNCFS                  = 267
+	SYS_SETNS                   = 268
+	SYS_SENDMMSG                = 269
+	SYS_PROCESS_VM_READV        = 270
+	SYS_PROCESS_VM_WRITEV       = 271
+	SYS_KCMP                    = 272
+	SYS_FINIT_MODULE            = 273
+	SYS_SCHED_SETATTR           = 274
+	SYS_SCHED_GETATTR           = 275
+	SYS_RENAMEAT2               = 276
+	SYS_SECCOMP                 = 277
+	SYS_GETRANDOM               = 278
+	SYS_MEMFD_CREATE            = 279
+	SYS_BPF                     = 280
+	SYS_EXECVEAT                = 281
 	SYS_USERFAULTFD             = 282
 	SYS_MEMBARRIER              = 283
 	SYS_MLOCK2                  = 284
@@ -379,6 +650,13 @@ const (
 	SYS_LSM_SET_SELF_ATTR       = 460
 	SYS_LSM_LIST_MODULES        = 461
 	SYS_MSEAL                   = 462
+	SYS_SETXATTRAT              = 463
+	SYS_GETXATTRAT              = 464
+	SYS_LISTXATTRAT             = 465
+	SYS_REMOVEXATTRAT           = 466
+	SYS_OPEN_TREE_ATTR          = 467
+	SYS_FILE_GETATTR            = 468
+	SYS_FILE_SETATTR            = 469
 )
 
 const (
@@ -700,4 +978,11 @@ const (
 	SNR_LSM_SET_SELF_ATTR       SyscallNum = SYS_LSM_SET_SELF_ATTR
 	SNR_LSM_LIST_MODULES        SyscallNum = SYS_LSM_LIST_MODULES
 	SNR_MSEAL                   SyscallNum = SYS_MSEAL
+	SNR_SETXATTRAT              SyscallNum = SYS_SETXATTRAT
+	SNR_GETXATTRAT              SyscallNum = SYS_GETXATTRAT
+	SNR_LISTXATTRAT             SyscallNum = SYS_LISTXATTRAT
+	SNR_REMOVEXATTRAT           SyscallNum = SYS_REMOVEXATTRAT
+	SNR_OPEN_TREE_ATTR          SyscallNum = SYS_OPEN_TREE_ATTR
+	SNR_FILE_GETATTR            SyscallNum = SYS_FILE_GETATTR
+	SNR_FILE_SETATTR            SyscallNum = SYS_FILE_SETATTR
 )
diff --git a/ext/syscall_linux_riscv64.go b/ext/syscall_linux_riscv64.go
index da3c3ae6..7ef22a16 100644
--- a/ext/syscall_linux_riscv64.go
+++ b/ext/syscall_linux_riscv64.go
@@ -1,10 +1,8 @@
-// mksysnum_linux.pl /usr/include/riscv64-linux-gnu/asm/unistd.h
+// mksysnum_linux.pl /usr/include/asm/unistd.h
 // Code generated by the command above; DO NOT EDIT.
 
 package ext
 
-import . "syscall"
-
 var syscallNum = map[string]SyscallNum{
 	"io_setup":                SNR_IO_SETUP,
 	"io_destroy":              SNR_IO_DESTROY,
@@ -249,6 +247,8 @@ var syscallNum = map[string]SyscallNum{
 	"perf_event_open":         SNR_PERF_EVENT_OPEN,
 	"accept4":                 SNR_ACCEPT4,
 	"recvmmsg":                SNR_RECVMMSG,
+	"riscv_hwprobe":           SNR_RISCV_HWPROBE,
+	"riscv_flush_icache":      SNR_RISCV_FLUSH_ICACHE,
 	"wait4":                   SNR_WAIT4,
 	"prlimit64":               SNR_PRLIMIT64,
 	"fanotify_init":           SNR_FANOTIFY_INIT,
@@ -327,9 +327,277 @@ var syscallNum = map[string]SyscallNum{
 	"getxattrat":              SNR_GETXATTRAT,
 	"listxattrat":             SNR_LISTXATTRAT,
 	"removexattrat":           SNR_REMOVEXATTRAT,
+	"open_tree_attr":          SNR_OPEN_TREE_ATTR,
 }
 
 const (
+	SYS_IO_SETUP                = 0
+	SYS_IO_DESTROY              = 1
+	SYS_IO_SUBMIT               = 2
+	SYS_IO_CANCEL               = 3
+	SYS_IO_GETEVENTS            = 4
+	SYS_SETXATTR                = 5
+	SYS_LSETXATTR               = 6
+	SYS_FSETXATTR               = 7
+	SYS_GETXATTR                = 8
+	SYS_LGETXATTR               = 9
+	SYS_FGETXATTR               = 10
+	SYS_LISTXATTR               = 11
+	SYS_LLISTXATTR              = 12
+	SYS_FLISTXATTR              = 13
+	SYS_REMOVEXATTR             = 14
+	SYS_LREMOVEXATTR            = 15
+	SYS_FREMOVEXATTR            = 16
+	SYS_GETCWD                  = 17
+	SYS_LOOKUP_DCOOKIE          = 18
+	SYS_EVENTFD2                = 19
+	SYS_EPOLL_CREATE1           = 20
+	SYS_EPOLL_CTL               = 21
+	SYS_EPOLL_PWAIT             = 22
+	SYS_DUP                     = 23
+	SYS_DUP3                    = 24
+	SYS_FCNTL                   = 25
+	SYS_INOTIFY_INIT1           = 26
+	SYS_INOTIFY_ADD_WATCH       = 27
+	SYS_INOTIFY_RM_WATCH        = 28
+	SYS_IOCTL                   = 29
+	SYS_IOPRIO_SET              = 30
+	SYS_IOPRIO_GET              = 31
+	SYS_FLOCK                   = 32
+	SYS_MKNODAT                 = 33
+	SYS_MKDIRAT                 = 34
+	SYS_UNLINKAT                = 35
+	SYS_SYMLINKAT               = 36
+	SYS_LINKAT                  = 37
+	SYS_UMOUNT2                 = 39
+	SYS_MOUNT                   = 40
+	SYS_PIVOT_ROOT              = 41
+	SYS_NFSSERVCTL              = 42
+	SYS_STATFS                  = 43
+	SYS_FSTATFS                 = 44
+	SYS_TRUNCATE                = 45
+	SYS_FTRUNCATE               = 46
+	SYS_FALLOCATE               = 47
+	SYS_FACCESSAT               = 48
+	SYS_CHDIR                   = 49
+	SYS_FCHDIR                  = 50
+	SYS_CHROOT                  = 51
+	SYS_FCHMOD                  = 52
+	SYS_FCHMODAT                = 53
+	SYS_FCHOWNAT                = 54
+	SYS_FCHOWN                  = 55
+	SYS_OPENAT                  = 56
+	SYS_CLOSE                   = 57
+	SYS_VHANGUP                 = 58
+	SYS_PIPE2                   = 59
+	SYS_QUOTACTL                = 60
+	SYS_GETDENTS64              = 61
+	SYS_LSEEK                   = 62
+	SYS_READ                    = 63
+	SYS_WRITE                   = 64
+	SYS_READV                   = 65
+	SYS_WRITEV                  = 66
+	SYS_PREAD64                 = 67
+	SYS_PWRITE64                = 68
+	SYS_PREADV                  = 69
+	SYS_PWRITEV                 = 70
+	SYS_SENDFILE                = 71
+	SYS_PSELECT6                = 72
+	SYS_PPOLL                   = 73
+	SYS_SIGNALFD4               = 74
+	SYS_VMSPLICE                = 75
+	SYS_SPLICE                  = 76
+	SYS_TEE                     = 77
+	SYS_READLINKAT              = 78
+	SYS_NEWFSTATAT              = 79
+	SYS_FSTAT                   = 80
+	SYS_SYNC                    = 81
+	SYS_FSYNC                   = 82
+	SYS_FDATASYNC               = 83
+	SYS_SYNC_FILE_RANGE         = 84
+	SYS_TIMERFD_CREATE          = 85
+	SYS_TIMERFD_SETTIME         = 86
+	SYS_TIMERFD_GETTIME         = 87
+	SYS_UTIMENSAT               = 88
+	SYS_ACCT                    = 89
+	SYS_CAPGET                  = 90
+	SYS_CAPSET                  = 91
+	SYS_PERSONALITY             = 92
+	SYS_EXIT                    = 93
+	SYS_EXIT_GROUP              = 94
+	SYS_WAITID                  = 95
+	SYS_SET_TID_ADDRESS         = 96
+	SYS_UNSHARE                 = 97
+	SYS_FUTEX                   = 98
+	SYS_SET_ROBUST_LIST         = 99
+	SYS_GET_ROBUST_LIST         = 100
+	SYS_NANOSLEEP               = 101
+	SYS_GETITIMER               = 102
+	SYS_SETITIMER               = 103
+	SYS_KEXEC_LOAD              = 104
+	SYS_INIT_MODULE             = 105
+	SYS_DELETE_MODULE           = 106
+	SYS_TIMER_CREATE            = 107
+	SYS_TIMER_GETTIME           = 108
+	SYS_TIMER_GETOVERRUN        = 109
+	SYS_TIMER_SETTIME           = 110
+	SYS_TIMER_DELETE            = 111
+	SYS_CLOCK_SETTIME           = 112
+	SYS_CLOCK_GETTIME           = 113
+	SYS_CLOCK_GETRES            = 114
+	SYS_CLOCK_NANOSLEEP         = 115
+	SYS_SYSLOG                  = 116
+	SYS_PTRACE                  = 117
+	SYS_SCHED_SETPARAM          = 118
+	SYS_SCHED_SETSCHEDULER      = 119
+	SYS_SCHED_GETSCHEDULER      = 120
+	SYS_SCHED_GETPARAM          = 121
+	SYS_SCHED_SETAFFINITY       = 122
+	SYS_SCHED_GETAFFINITY       = 123
+	SYS_SCHED_YIELD             = 124
+	SYS_SCHED_GET_PRIORITY_MAX  = 125
+	SYS_SCHED_GET_PRIORITY_MIN  = 126
+	SYS_SCHED_RR_GET_INTERVAL   = 127
+	SYS_RESTART_SYSCALL         = 128
+	SYS_KILL                    = 129
+	SYS_TKILL                   = 130
+	SYS_TGKILL                  = 131
+	SYS_SIGALTSTACK             = 132
+	SYS_RT_SIGSUSPEND           = 133
+	SYS_RT_SIGACTION            = 134
+	SYS_RT_SIGPROCMASK          = 135
+	SYS_RT_SIGPENDING           = 136
+	SYS_RT_SIGTIMEDWAIT         = 137
+	SYS_RT_SIGQUEUEINFO         = 138
+	SYS_RT_SIGRETURN            = 139
+	SYS_SETPRIORITY             = 140
+	SYS_GETPRIORITY             = 141
+	SYS_REBOOT                  = 142
+	SYS_SETREGID                = 143
+	SYS_SETGID                  = 144
+	SYS_SETREUID                = 145
+	SYS_SETUID                  = 146
+	SYS_SETRESUID               = 147
+	SYS_GETRESUID               = 148
+	SYS_SETRESGID               = 149
+	SYS_GETRESGID               = 150
+	SYS_SETFSUID                = 151
+	SYS_SETFSGID                = 152
+	SYS_TIMES                   = 153
+	SYS_SETPGID                 = 154
+	SYS_GETPGID                 = 155
+	SYS_GETSID                  = 156
+	SYS_SETSID                  = 157
+	SYS_GETGROUPS               = 158
+	SYS_SETGROUPS               = 159
+	SYS_UNAME                   = 160
+	SYS_SETHOSTNAME             = 161
+	SYS_SETDOMAINNAME           = 162
+	SYS_GETRLIMIT               = 163
+	SYS_SETRLIMIT               = 164
+	SYS_GETRUSAGE               = 165
+	SYS_UMASK                   = 166
+	SYS_PRCTL                   = 167
+	SYS_GETCPU                  = 168
+	SYS_GETTIMEOFDAY            = 169
+	SYS_SETTIMEOFDAY            = 170
+	SYS_ADJTIMEX                = 171
+	SYS_GETPID                  = 172
+	SYS_GETPPID                 = 173
+	SYS_GETUID                  = 174
+	SYS_GETEUID                 = 175
+	SYS_GETGID                  = 176
+	SYS_GETEGID                 = 177
+	SYS_GETTID                  = 178
+	SYS_SYSINFO                 = 179
+	SYS_MQ_OPEN                 = 180
+	SYS_MQ_UNLINK               = 181
+	SYS_MQ_TIMEDSEND            = 182
+	SYS_MQ_TIMEDRECEIVE         = 183
+	SYS_MQ_NOTIFY               = 184
+	SYS_MQ_GETSETATTR           = 185
+	SYS_MSGGET                  = 186
+	SYS_MSGCTL                  = 187
+	SYS_MSGRCV                  = 188
+	SYS_MSGSND                  = 189
+	SYS_SEMGET                  = 190
+	SYS_SEMCTL                  = 191
+	SYS_SEMTIMEDOP              = 192
+	SYS_SEMOP                   = 193
+	SYS_SHMGET                  = 194
+	SYS_SHMCTL                  = 195
+	SYS_SHMAT                   = 196
+	SYS_SHMDT                   = 197
+	SYS_SOCKET                  = 198
+	SYS_SOCKETPAIR              = 199
+	SYS_BIND                    = 200
+	SYS_LISTEN                  = 201
+	SYS_ACCEPT                  = 202
+	SYS_CONNECT                 = 203
+	SYS_GETSOCKNAME             = 204
+	SYS_GETPEERNAME             = 205
+	SYS_SENDTO                  = 206
+	SYS_RECVFROM                = 207
+	SYS_SETSOCKOPT              = 208
+	SYS_GETSOCKOPT              = 209
+	SYS_SHUTDOWN                = 210
+	SYS_SENDMSG                 = 211
+	SYS_RECVMSG                 = 212
+	SYS_READAHEAD               = 213
+	SYS_BRK                     = 214
+	SYS_MUNMAP                  = 215
+	SYS_MREMAP                  = 216
+	SYS_ADD_KEY                 = 217
+	SYS_REQUEST_KEY             = 218
+	SYS_KEYCTL                  = 219
+	SYS_CLONE                   = 220
+	SYS_EXECVE                  = 221
+	SYS_MMAP                    = 222
+	SYS_FADVISE64               = 223
+	SYS_SWAPON                  = 224
+	SYS_SWAPOFF                 = 225
+	SYS_MPROTECT                = 226
+	SYS_MSYNC                   = 227
+	SYS_MLOCK                   = 228
+	SYS_MUNLOCK                 = 229
+	SYS_MLOCKALL                = 230
+	SYS_MUNLOCKALL              = 231
+	SYS_MINCORE                 = 232
+	SYS_MADVISE                 = 233
+	SYS_REMAP_FILE_PAGES        = 234
+	SYS_MBIND                   = 235
+	SYS_GET_MEMPOLICY           = 236
+	SYS_SET_MEMPOLICY           = 237
+	SYS_MIGRATE_PAGES           = 238
+	SYS_MOVE_PAGES              = 239
+	SYS_RT_TGSIGQUEUEINFO       = 240
+	SYS_PERF_EVENT_OPEN         = 241
+	SYS_ACCEPT4                 = 242
+	SYS_RECVMMSG                = 243
+	SYS_RISCV_HWPROBE           = 258
+	SYS_RISCV_FLUSH_ICACHE      = 259
+	SYS_WAIT4                   = 260
+	SYS_PRLIMIT64               = 261
+	SYS_FANOTIFY_INIT           = 262
+	SYS_FANOTIFY_MARK           = 263
+	SYS_NAME_TO_HANDLE_AT       = 264
+	SYS_OPEN_BY_HANDLE_AT       = 265
+	SYS_CLOCK_ADJTIME           = 266
+	SYS_SYNCFS                  = 267
+	SYS_SETNS                   = 268
+	SYS_SENDMMSG                = 269
+	SYS_PROCESS_VM_READV        = 270
+	SYS_PROCESS_VM_WRITEV       = 271
+	SYS_KCMP                    = 272
+	SYS_FINIT_MODULE            = 273
+	SYS_SCHED_SETATTR           = 274
+	SYS_SCHED_GETATTR           = 275
+	SYS_RENAMEAT2               = 276
+	SYS_SECCOMP                 = 277
+	SYS_GETRANDOM               = 278
+	SYS_MEMFD_CREATE            = 279
+	SYS_BPF                     = 280
+	SYS_EXECVEAT                = 281
 	SYS_USERFAULTFD             = 282
 	SYS_MEMBARRIER              = 283
 	SYS_MLOCK2                  = 284
@@ -635,6 +903,8 @@ const (
 	SNR_PERF_EVENT_OPEN         SyscallNum = SYS_PERF_EVENT_OPEN
 	SNR_ACCEPT4                 SyscallNum = SYS_ACCEPT4
 	SNR_RECVMMSG                SyscallNum = SYS_RECVMMSG
+	SNR_RISCV_HWPROBE           SyscallNum = SYS_RISCV_HWPROBE
+	SNR_RISCV_FLUSH_ICACHE      SyscallNum = SYS_RISCV_FLUSH_ICACHE
 	SNR_WAIT4                   SyscallNum = SYS_WAIT4
 	SNR_PRLIMIT64               SyscallNum = SYS_PRLIMIT64
 	SNR_FANOTIFY_INIT           SyscallNum = SYS_FANOTIFY_INIT
diff --git a/ext/syscall_other.go b/ext/syscall_other.go
new file mode 100644
index 00000000..b2518d64
--- /dev/null
+++ b/ext/syscall_other.go
@@ -0,0 +1,11 @@
+//go:build arm64 || riscv64 || mips || mipsle || mips64 || mips64le || ppc64 || ppc64le || s390x || loong64
+
+package ext
+
+import "syscall"
+
+const (
+	O_PATH = syscall.O_PATH
+
+	PR_SET_NO_NEW_PRIVS = syscall.PR_SET_NO_NEW_PRIVS
+)
diff --git a/internal/acl/acl.go b/internal/acl/acl.go
index 8b862ba2..d5b53095 100644
--- a/internal/acl/acl.go
+++ b/internal/acl/acl.go
@@ -11,7 +11,7 @@ import "C"
 import (
 	"os"
 
-	"hakurei.app/container"
+	"hakurei.app/ext"
 )
 
 // Perm represents acl_perm_t.
@@ -88,7 +88,7 @@ func (e Error) Error() string {
 
 // Update replaces ACL_USER entry with qualifier uid.
 func Update(name string, uid int, perms Perm) error {
-	f, _err := os.OpenFile(name, container.O_PATH, 0)
+	f, _err := os.OpenFile(name, ext.O_PATH, 0)
 	if _err != nil {
 		return _err
 	}