diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-02-03 18:10:29 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-02-03 19:43:03 +0900 |
| commit | 5b7b3fa9a4d8ca4ad08d6648752e28ee66f0ffae (patch) | |
| tree | 8f8790e0114e33bc19efeed9a8902404f5b0e61f /helper/seccomp/seccomp.go | |
| parent | d58fb8c6eee659e4a71c4d69bfb8539199b431bd (diff) | |
helper/seccomp: implement reader interface via pipe
This also does not require the libc tmpfile call.
BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'helper/seccomp/seccomp.go')
| -rw-r--r-- | helper/seccomp/seccomp.go | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/helper/seccomp/seccomp.go b/helper/seccomp/seccomp.go index ed13118a..affe369c 100644 --- a/helper/seccomp/seccomp.go +++ b/helper/seccomp/seccomp.go @@ -28,14 +28,22 @@ var resErr = [...]error{ type SyscallOpts = C.f_syscall_opts const ( - flagVerbose SyscallOpts = C.F_VERBOSE - FlagExt SyscallOpts = C.F_EXT - FlagDenyNS SyscallOpts = C.F_DENY_NS - FlagDenyTTY SyscallOpts = C.F_DENY_TTY + flagVerbose SyscallOpts = C.F_VERBOSE + // FlagExt are project-specific extensions. + FlagExt SyscallOpts = C.F_EXT + // FlagDenyNS denies namespace setup syscalls. + FlagDenyNS SyscallOpts = C.F_DENY_NS + // FlagDenyTTY denies faking input. + FlagDenyTTY SyscallOpts = C.F_DENY_TTY + // FlagDenyDevel denies development-related syscalls. FlagDenyDevel SyscallOpts = C.F_DENY_DEVEL + // FlagMultiarch allows multiarch/emulation. FlagMultiarch SyscallOpts = C.F_MULTIARCH - FlagLinux32 SyscallOpts = C.F_LINUX32 - FlagCan SyscallOpts = C.F_CAN + // FlagLinux32 sets PER_LINUX32. + FlagLinux32 SyscallOpts = C.F_LINUX32 + // FlagCan allows AF_CAN. + FlagCan SyscallOpts = C.F_CAN + // FlagBluetooth allows AF_BLUETOOTH. FlagBluetooth SyscallOpts = C.F_BLUETOOTH ) |