container: move seccomp preset bits

This allows holding the bits without cgo.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 20 insertions, 0 deletions

diff --git a/container/bits/seccomp.go b/container/bits/seccomp.go
new file mode 100644
index 00000000..57e3e122
--- /dev/null
+++ b/container/bits/seccomp.go
@@ -0,0 +1,20 @@
+package bits
+
+// FilterPreset specifies parts of the syscall filter preset to enable.
+type FilterPreset int
+
+const (
+	// PresetExt are project-specific extensions.
+	PresetExt FilterPreset = 1 << iota
+	// PresetDenyNS denies namespace setup syscalls.
+	PresetDenyNS
+	// PresetDenyTTY denies faking input.
+	PresetDenyTTY
+	// PresetDenyDevel denies development-related syscalls.
+	PresetDenyDevel
+	// PresetLinux32 sets PER_LINUX32.
+	PresetLinux32
+
+	// PresetStrict is a strict preset useful as a default value.
+	PresetStrict = PresetExt | PresetDenyNS | PresetDenyTTY | PresetDenyDevel
+)