aboutsummaryrefslogtreecommitdiffhomepage
path: root/container/std/seccomp.go
diff options
context:
space:
mode:
authorOphestra <cat@gensokyo.uk>2026-03-17 13:35:48 +0900
committerOphestra <cat@gensokyo.uk>2026-03-17 13:39:26 +0900
commitcd5959fe5ab04786cd5dee3cf09f725229ae7c7b (patch)
treec0dae3f950528e7c3b6d7359441ee8aeb9a488cd /container/std/seccomp.go
parent08c35ca24fabc41268411cec14ea386a6d87ece9 (diff)
ext: isolate from container/std
These are too general to belong in the container package. This targets the v0.4 release to reduce the wrapper maintenance burden. Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'container/std/seccomp.go')
-rw-r--r--container/std/seccomp.go58
1 files changed, 6 insertions, 52 deletions
diff --git a/container/std/seccomp.go b/container/std/seccomp.go
index e808e61f..55974777 100644
--- a/container/std/seccomp.go
+++ b/container/std/seccomp.go
@@ -1,34 +1,20 @@
package std
-import (
- "encoding/json"
- "strconv"
-)
+import "hakurei.app/ext"
type (
- // ScmpUint is equivalent to C.uint.
- //
- // Deprecated: This type has been renamed to Uint and will be removed in 0.4.
- ScmpUint = Uint
- // ScmpInt is equivalent to C.int.
- //
- // Deprecated: This type has been renamed to Int and will be removed in 0.4.
- ScmpInt = Int
-
- // ScmpSyscall represents a syscall number passed to libseccomp via [NativeRule.Syscall].
- ScmpSyscall Int
// ScmpErrno represents an errno value passed to libseccomp via [NativeRule.Errno].
- ScmpErrno Int
+ ScmpErrno = ext.Int
// ScmpCompare is equivalent to enum scmp_compare;
- ScmpCompare Uint
+ ScmpCompare = ext.Uint
// ScmpDatum is equivalent to scmp_datum_t.
- ScmpDatum uint64
+ ScmpDatum = uint64
// ScmpArgCmp is equivalent to struct scmp_arg_cmp.
ScmpArgCmp struct {
// argument number, starting at 0
- Arg Uint `json:"arg"`
+ Arg ext.Uint `json:"arg"`
// the comparison op, e.g. SCMP_CMP_*
Op ScmpCompare `json:"op"`
@@ -39,42 +25,10 @@ type (
// A NativeRule specifies an arch-specific action taken by seccomp under certain conditions.
NativeRule struct {
// Syscall is the arch-dependent syscall number to act against.
- Syscall ScmpSyscall `json:"syscall"`
+ Syscall ext.SyscallNum `json:"syscall"`
// Errno is the errno value to return when the condition is satisfied.
Errno ScmpErrno `json:"errno"`
// Arg is the optional struct scmp_arg_cmp passed to libseccomp.
Arg *ScmpArgCmp `json:"arg,omitempty"`
}
)
-
-// MarshalJSON resolves the name of [ScmpSyscall] and encodes it as a [json] string.
-// If such a name does not exist, the syscall number is encoded instead.
-func (num *ScmpSyscall) MarshalJSON() ([]byte, error) {
- n := *num
- for name, cur := range Syscalls() {
- if cur == n {
- return json.Marshal(name)
- }
- }
- return json.Marshal(n)
-}
-
-// SyscallNameError is returned when trying to unmarshal an invalid syscall name into [ScmpSyscall].
-type SyscallNameError string
-
-func (e SyscallNameError) Error() string { return "invalid syscall name " + strconv.Quote(string(e)) }
-
-// UnmarshalJSON looks up the syscall number corresponding to name encoded in data
-// by calling [SyscallResolveName].
-func (num *ScmpSyscall) UnmarshalJSON(data []byte) error {
- var name string
- if err := json.Unmarshal(data, &name); err != nil {
- return err
- }
- if n, ok := SyscallResolveName(name); !ok {
- return SyscallNameError(name)
- } else {
- *num = n
- return nil
- }
-}