aboutsummaryrefslogtreecommitdiffhomepage
path: root/seccomp/proc.go
diff options
context:
space:
mode:
authorOphestra <cat@gensokyo.uk>2025-07-03 02:59:43 +0900
committerOphestra <cat@gensokyo.uk>2025-07-03 02:59:43 +0900
commit1b5ecd9eaf3289d164d8ed1bce6013e0e4ef8e86 (patch)
tree047fe5fabdfb37d5c0088f7f572cebc8b13853bb /seccomp/proc.go
parent82561d62b66f17c05604e87f18187bb3a91f00d2 (diff)
container: move out of toplevel
This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers. Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'seccomp/proc.go')
-rw-r--r--seccomp/proc.go78
1 files changed, 0 insertions, 78 deletions
diff --git a/seccomp/proc.go b/seccomp/proc.go
deleted file mode 100644
index e4ce1853..00000000
--- a/seccomp/proc.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package seccomp
-
-import (
- "context"
- "errors"
- "syscall"
-
- "git.gensokyo.uk/security/hakurei/helper/proc"
-)
-
-const (
- PresetStrict = PresetExt | PresetDenyNS | PresetDenyTTY | PresetDenyDevel
-)
-
-// New returns an inactive Encoder instance.
-func New(rules []NativeRule, flags ExportFlag) *Encoder { return &Encoder{newExporter(rules, flags)} }
-
-// Load loads a filter into the kernel.
-func Load(rules []NativeRule, flags ExportFlag) error { return Export(-1, rules, flags) }
-
-/*
-An Encoder writes a BPF program to an output stream.
-
-Methods of Encoder are not safe for concurrent use.
-
-An Encoder must not be copied after first use.
-*/
-type Encoder struct {
- *exporter
-}
-
-func (e *Encoder) Read(p []byte) (n int, err error) {
- if err = e.prepare(); err != nil {
- return
- }
- return e.r.Read(p)
-}
-
-func (e *Encoder) Close() error {
- if e.r == nil {
- return syscall.EINVAL
- }
-
- // this hangs if the cgo thread fails to exit
- return errors.Join(e.closeWrite(), <-e.exportErr)
-}
-
-// NewFile returns an instance of exporter implementing [proc.File].
-func NewFile(rules []NativeRule, flags ExportFlag) proc.File {
- return &File{rules: rules, flags: flags}
-}
-
-// File implements [proc.File] and provides access to the read end of exporter pipe.
-type File struct {
- rules []NativeRule
- flags ExportFlag
- proc.BaseFile
-}
-
-func (f *File) ErrCount() int { return 2 }
-func (f *File) Fulfill(ctx context.Context, dispatchErr func(error)) error {
- e := newExporter(f.rules, f.flags)
- if err := e.prepare(); err != nil {
- return err
- }
- f.Set(e.r)
- go func() {
- select {
- case err := <-e.exportErr:
- dispatchErr(nil)
- dispatchErr(err)
- case <-ctx.Done():
- dispatchErr(e.closeWrite())
- dispatchErr(<-e.exportErr)
- }
- }()
- return nil
-}