container: move seccomp preset bits

This allows holding the bits without cgo.

Signed-off-by: Ophestra <cat@gensokyo.uk>

6 files changed, 24 insertions, 33 deletions

diff --git a/container/seccomp/hash_amd64_test.go b/container/seccomp/hash_amd64_test.go
index 7ef2b1d7..5a5e5439 100644
--- a/container/seccomp/hash_amd64_test.go
+++ b/container/seccomp/hash_amd64_test.go
@@ -1,6 +1,9 @@
 package seccomp_test
 
-import . "hakurei.app/container/seccomp"
+import (
+	. "hakurei.app/container/bits"
+	. "hakurei.app/container/seccomp"
+)
 
 var bpfExpected = bpfLookup{
 	{AllowMultiarch | AllowCAN |
diff --git a/container/seccomp/hash_arm64_test.go b/container/seccomp/hash_arm64_test.go
index d8ffa188..2395bcee 100644
--- a/container/seccomp/hash_arm64_test.go
+++ b/container/seccomp/hash_arm64_test.go
@@ -1,6 +1,9 @@
 package seccomp_test
 
-import . "hakurei.app/container/seccomp"
+import (
+	. "hakurei.app/container/bits"
+	. "hakurei.app/container/seccomp"
+)
 
 var bpfExpected = bpfLookup{
 	{AllowMultiarch | AllowCAN |
diff --git a/container/seccomp/hash_test.go b/container/seccomp/hash_test.go
index 1d31ac0f..24f6b1c7 100644
--- a/container/seccomp/hash_test.go
+++ b/container/seccomp/hash_test.go
@@ -3,13 +3,14 @@ package seccomp_test
 import (
 	"encoding/hex"
 
+	"hakurei.app/container/bits"
 	"hakurei.app/container/seccomp"
 )
 
 type (
 	bpfPreset = struct {
 		seccomp.ExportFlag
-		seccomp.FilterPreset
+		bits.FilterPreset
 	}
 	bpfLookup map[bpfPreset][]byte
 )
diff --git a/container/seccomp/libseccomp_test.go b/container/seccomp/libseccomp_test.go
index 1ae3f764..81f52511 100644
--- a/container/seccomp/libseccomp_test.go
+++ b/container/seccomp/libseccomp_test.go
@@ -8,6 +8,7 @@ import (
 	"syscall"
 	"testing"
 
+	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
 )
 
diff --git a/container/seccomp/presets.go b/container/seccomp/presets.go
index 4a01d2b0..abd3d5cd 100644
--- a/container/seccomp/presets.go
+++ b/container/seccomp/presets.go
@@ -4,46 +4,33 @@ package seccomp
 
 import (
 	. "syscall"
-)
-
-type FilterPreset int
 
-const (
-	// PresetExt are project-specific extensions.
-	PresetExt FilterPreset = 1 << iota
-	// PresetDenyNS denies namespace setup syscalls.
-	PresetDenyNS
-	// PresetDenyTTY denies faking input.
-	PresetDenyTTY
-	// PresetDenyDevel denies development-related syscalls.
-	PresetDenyDevel
-	// PresetLinux32 sets PER_LINUX32.
-	PresetLinux32
+	"hakurei.app/container/bits"
 )
 
-func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
+func Preset(presets bits.FilterPreset, flags ExportFlag) (rules []NativeRule) {
 	allowedPersonality := PER_LINUX
-	if presets&PresetLinux32 != 0 {
+	if presets&bits.PresetLinux32 != 0 {
 		allowedPersonality = PER_LINUX32
 	}
 	presetDevelFinal := presetDevel(ScmpDatum(allowedPersonality))
 
 	l := len(presetCommon)
-	if presets&PresetDenyNS != 0 {
+	if presets&bits.PresetDenyNS != 0 {
 		l += len(presetNamespace)
 	}
-	if presets&PresetDenyTTY != 0 {
+	if presets&bits.PresetDenyTTY != 0 {
 		l += len(presetTTY)
 	}
-	if presets&PresetDenyDevel != 0 {
+	if presets&bits.PresetDenyDevel != 0 {
 		l += len(presetDevelFinal)
 	}
 	if flags&AllowMultiarch == 0 {
 		l += len(presetEmu)
 	}
-	if presets&PresetExt != 0 {
+	if presets&bits.PresetExt != 0 {
 		l += len(presetCommonExt)
-		if presets&PresetDenyNS != 0 {
+		if presets&bits.PresetDenyNS != 0 {
 			l += len(presetNamespaceExt)
 		}
 		if flags&AllowMultiarch == 0 {
@@ -53,21 +40,21 @@ func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
 
 	rules = make([]NativeRule, 0, l)
 	rules = append(rules, presetCommon...)
-	if presets&PresetDenyNS != 0 {
+	if presets&bits.PresetDenyNS != 0 {
 		rules = append(rules, presetNamespace...)
 	}
-	if presets&PresetDenyTTY != 0 {
+	if presets&bits.PresetDenyTTY != 0 {
 		rules = append(rules, presetTTY...)
 	}
-	if presets&PresetDenyDevel != 0 {
+	if presets&bits.PresetDenyDevel != 0 {
 		rules = append(rules, presetDevelFinal...)
 	}
 	if flags&AllowMultiarch == 0 {
 		rules = append(rules, presetEmu...)
 	}
-	if presets&PresetExt != 0 {
+	if presets&bits.PresetExt != 0 {
 		rules = append(rules, presetCommonExt...)
-		if presets&PresetDenyNS != 0 {
+		if presets&bits.PresetDenyNS != 0 {
 			rules = append(rules, presetNamespaceExt...)
 		}
 		if flags&AllowMultiarch == 0 {
diff --git a/container/seccomp/proc.go b/container/seccomp/proc.go
index 76773b25..7027cc6b 100644
--- a/container/seccomp/proc.go
+++ b/container/seccomp/proc.go
@@ -8,10 +8,6 @@ import (
 	"hakurei.app/helper/proc"
 )
 
-const (
-	PresetStrict = PresetExt | PresetDenyNS | PresetDenyTTY | PresetDenyDevel
-)
-
 // New returns an inactive Encoder instance.
 func New(rules []NativeRule, flags ExportFlag) *Encoder { return &Encoder{newExporter(rules, flags)} }