aboutsummaryrefslogtreecommitdiffhomepage
path: root/helper/bwrap/seccomp.go
diff options
context:
space:
mode:
authorOphestra <cat@gensokyo.uk>2025-01-25 12:59:11 +0900
committerOphestra <cat@gensokyo.uk>2025-01-25 12:59:11 +0900
commit163f15e93f009d15ecc2f93932e26728aff9904b (patch)
treedbc225ab0f19da2cb5d70bed1fe5fc79986fd427 /helper/bwrap/seccomp.go
parent016da204435b19813862ae0498bf2058c6024eda (diff)
helper/seccomp: separate seccomp package
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'helper/bwrap/seccomp.go')
-rw-r--r--helper/bwrap/seccomp.go84
1 files changed, 0 insertions, 84 deletions
diff --git a/helper/bwrap/seccomp.go b/helper/bwrap/seccomp.go
deleted file mode 100644
index f77abc66..00000000
--- a/helper/bwrap/seccomp.go
+++ /dev/null
@@ -1,84 +0,0 @@
-package bwrap
-
-/*
-#cgo linux pkg-config: --static libseccomp
-
-#include "seccomp-export.h"
-*/
-import "C"
-import (
- "errors"
- "fmt"
- "os"
- "runtime"
-)
-
-var CPrintln func(v ...any)
-
-var resErr = [...]error{
- 0: nil,
- 1: errors.New("seccomp_init failed"),
- 2: errors.New("seccomp_arch_add failed"),
- 3: errors.New("seccomp_arch_add failed (multiarch)"),
- 4: errors.New("internal libseccomp failure"),
- 5: errors.New("seccomp_rule_add failed"),
- 6: errors.New("seccomp_export_bpf failed"),
-}
-
-type (
- syscallOpts = C.f_syscall_opts
-)
-
-const (
- flagExt syscallOpts = C.F_EXT
- flagDenyNS syscallOpts = C.F_DENY_NS
- flagDenyTTY syscallOpts = C.F_DENY_TTY
- flagDenyDevel syscallOpts = C.F_DENY_DEVEL
- flagMultiarch syscallOpts = C.F_MULTIARCH
- flagLinux32 syscallOpts = C.F_LINUX32
- flagCan syscallOpts = C.F_CAN
- flagBluetooth syscallOpts = C.F_BLUETOOTH
-)
-
-func tmpfile() (*os.File, error) {
- fd, err := C.f_tmpfile_fd()
- if err != nil {
- return nil, err
- }
- return os.NewFile(uintptr(fd), "tmpfile"), err
-}
-
-func exportFilter(fd uintptr, opts syscallOpts) error {
- var (
- arch C.uint32_t = 0
- multiarch C.uint32_t = 0
- )
- switch runtime.GOARCH {
- case "386":
- arch = C.SCMP_ARCH_X86
- case "amd64":
- arch = C.SCMP_ARCH_X86_64
- multiarch = C.SCMP_ARCH_X86
- case "arm":
- arch = C.SCMP_ARCH_ARM
- case "arm64":
- arch = C.SCMP_ARCH_AARCH64
- multiarch = C.SCMP_ARCH_ARM
- }
-
- res, err := C.f_export_bpf(C.int(fd), arch, multiarch, opts)
- if re := resErr[res]; re != nil {
- if err == nil {
- return re
- }
- return fmt.Errorf("%s: %v", re.Error(), err)
- }
- return err
-}
-
-//export F_println
-func F_println(v *C.char) {
- if CPrintln != nil {
- CPrintln(C.GoString(v))
- }
-}