diff options
Diffstat (limited to 'container/bits')
| -rw-r--r-- | container/bits/seccomp.go | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/container/bits/seccomp.go b/container/bits/seccomp.go new file mode 100644 index 00000000..57e3e122 --- /dev/null +++ b/container/bits/seccomp.go @@ -0,0 +1,20 @@ +package bits + +// FilterPreset specifies parts of the syscall filter preset to enable. +type FilterPreset int + +const ( + // PresetExt are project-specific extensions. + PresetExt FilterPreset = 1 << iota + // PresetDenyNS denies namespace setup syscalls. + PresetDenyNS + // PresetDenyTTY denies faking input. + PresetDenyTTY + // PresetDenyDevel denies development-related syscalls. + PresetDenyDevel + // PresetLinux32 sets PER_LINUX32. + PresetLinux32 + + // PresetStrict is a strict preset useful as a default value. + PresetStrict = PresetExt | PresetDenyNS | PresetDenyTTY | PresetDenyDevel +) |