aboutsummaryrefslogtreecommitdiffhomepage
path: root/container/seccomp
diff options
context:
space:
mode:
Diffstat (limited to 'container/seccomp')
-rw-r--r--container/seccomp/libseccomp.go3
-rwxr-xr-xcontainer/seccomp/mksysnum_linux.pl89
-rw-r--r--container/seccomp/pnr.go267
-rw-r--r--container/seccomp/presets.go26
-rw-r--r--container/seccomp/presets_amd64_test.go (renamed from container/seccomp/hash_amd64_test.go)0
-rw-r--r--container/seccomp/presets_arm64_test.go (renamed from container/seccomp/hash_arm64_test.go)0
-rw-r--r--container/seccomp/presets_test.go (renamed from container/seccomp/hash_test.go)0
-rw-r--r--container/seccomp/syscall.go28
-rw-r--r--container/seccomp/syscall_extra_linux_amd64.go41
-rw-r--r--container/seccomp/syscall_extra_linux_arm64.go55
-rw-r--r--container/seccomp/syscall_linux_amd64.go459
-rw-r--r--container/seccomp/syscall_linux_arm64.go382
-rw-r--r--container/seccomp/syscall_test.go10
13 files changed, 20 insertions, 1340 deletions
diff --git a/container/seccomp/libseccomp.go b/container/seccomp/libseccomp.go
index 2044a668..c408b7b3 100644
--- a/container/seccomp/libseccomp.go
+++ b/container/seccomp/libseccomp.go
@@ -227,9 +227,10 @@ const (
// syscallResolveName resolves a syscall number by name via seccomp_syscall_resolve_name.
// This function is only for testing the lookup tables and included here for convenience.
-func syscallResolveName(s string) (trap int) {
+func syscallResolveName(s string) (trap int, ok bool) {
v := C.CString(s)
trap = int(C.seccomp_syscall_resolve_name(v))
C.free(unsafe.Pointer(v))
+ ok = trap != C.__NR_SCMP_ERROR
return
}
diff --git a/container/seccomp/mksysnum_linux.pl b/container/seccomp/mksysnum_linux.pl
deleted file mode 100755
index 2dbd12fd..00000000
--- a/container/seccomp/mksysnum_linux.pl
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/usr/bin/env perl
-# Copyright 2009 The Go Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style
-# license that can be found in the LICENSE file.
-
-use strict;
-use POSIX ();
-
-my $command = "mksysnum_linux.pl ". join(' ', @ARGV);
-my $uname_arch = (POSIX::uname)[4];
-my %syscall_cutoff_arch = (
- "x86_64" => 302,
- "aarch64" => 281,
-);
-
-print <<EOF;
-// $command
-// Code generated by the command above; DO NOT EDIT.
-
-package seccomp
-
-import . "syscall"
-
-var syscallNum = map[string]int{
-EOF
-
-my $offset = 0;
-my $state = -1;
-
-sub fmt {
- my ($name, $num) = @_;
- if($num > 999){
- # ignore deprecated syscalls that are no longer implemented
- # https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/uapi/asm-generic/unistd.h?id=refs/heads/master#n716
- return;
- }
- (my $name_upper = $name) =~ y/a-z/A-Z/;
- $num = $num + $offset;
- if($num > $syscall_cutoff_arch{$uname_arch}){ # not wired in Go standard library
- if($state < 0){
- print " \"$name\": SYS_$name_upper,\n";
- }
- else{
- print " SYS_$name_upper = $num;\n";
- }
- }
- elsif($state < 0){
- print " \"$name\": SYS_$name_upper,\n";
- }
- else{
- return;
- }
-}
-
-GENERATE:
-
-my $prev;
-open(GCC, "gcc -E -dD $ARGV[0] |") || die "can't run gcc";
-while(<GCC>){
- if(/^#define __NR_Linux\s+([0-9]+)/){
- # mips/mips64: extract offset
- $offset = $1;
- }
- elsif(/^#define __NR_syscalls\s+/) {
- # ignore redefinitions of __NR_syscalls
- }
- elsif(/^#define __NR_(\w+)\s+([0-9]+)/){
- $prev = $2;
- fmt($1, $2);
- }
- elsif(/^#define __NR3264_(\w+)\s+([0-9]+)/){
- $prev = $2;
- fmt($1, $2);
- }
- elsif(/^#define __NR_(\w+)\s+\(\w+\+\s*([0-9]+)\)/){
- fmt($1, $prev+$2)
- }
- elsif(/^#define __NR_(\w+)\s+\(__NR_Linux \+ ([0-9]+)/){
- fmt($1, $2);
- }
-}
-
-if($state < 0){
- $state = $state + 1;
- print "}\n\nconst (\n";
- goto GENERATE;
-}
-
-print ")";
diff --git a/container/seccomp/pnr.go b/container/seccomp/pnr.go
deleted file mode 100644
index 4cc7398b..00000000
--- a/container/seccomp/pnr.go
+++ /dev/null
@@ -1,267 +0,0 @@
-// Code generated from include/seccomp-syscalls.h; DO NOT EDIT.
-
-package seccomp
-
-/*
- * pseudo syscall definitions
- */
-
-const (
-
- /* socket syscalls */
-
- __PNR_socket = -101
- __PNR_bind = -102
- __PNR_connect = -103
- __PNR_listen = -104
- __PNR_accept = -105
- __PNR_getsockname = -106
- __PNR_getpeername = -107
- __PNR_socketpair = -108
- __PNR_send = -109
- __PNR_recv = -110
- __PNR_sendto = -111
- __PNR_recvfrom = -112
- __PNR_shutdown = -113
- __PNR_setsockopt = -114
- __PNR_getsockopt = -115
- __PNR_sendmsg = -116
- __PNR_recvmsg = -117
- __PNR_accept4 = -118
- __PNR_recvmmsg = -119
- __PNR_sendmmsg = -120
-
- /* ipc syscalls */
-
- __PNR_semop = -201
- __PNR_semget = -202
- __PNR_semctl = -203
- __PNR_semtimedop = -204
- __PNR_msgsnd = -211
- __PNR_msgrcv = -212
- __PNR_msgget = -213
- __PNR_msgctl = -214
- __PNR_shmat = -221
- __PNR_shmdt = -222
- __PNR_shmget = -223
- __PNR_shmctl = -224
-
- /* single syscalls */
-
- __PNR_arch_prctl = -10001
- __PNR_bdflush = -10002
- __PNR_break = -10003
- __PNR_chown32 = -10004
- __PNR_epoll_ctl_old = -10005
- __PNR_epoll_wait_old = -10006
- __PNR_fadvise64_64 = -10007
- __PNR_fchown32 = -10008
- __PNR_fcntl64 = -10009
- __PNR_fstat64 = -10010
- __PNR_fstatat64 = -10011
- __PNR_fstatfs64 = -10012
- __PNR_ftime = -10013
- __PNR_ftruncate64 = -10014
- __PNR_getegid32 = -10015
- __PNR_geteuid32 = -10016
- __PNR_getgid32 = -10017
- __PNR_getgroups32 = -10018
- __PNR_getresgid32 = -10019
- __PNR_getresuid32 = -10020
- __PNR_getuid32 = -10021
- __PNR_gtty = -10022
- __PNR_idle = -10023
- __PNR_ipc = -10024
- __PNR_lchown32 = -10025
- __PNR__llseek = -10026
- __PNR_lock = -10027
- __PNR_lstat64 = -10028
- __PNR_mmap2 = -10029
- __PNR_mpx = -10030
- __PNR_newfstatat = -10031
- __PNR__newselect = -10032
- __PNR_nice = -10033
- __PNR_oldfstat = -10034
- __PNR_oldlstat = -10035
- __PNR_oldolduname = -10036
- __PNR_oldstat = -10037
- __PNR_olduname = -10038
- __PNR_prof = -10039
- __PNR_profil = -10040
- __PNR_readdir = -10041
- __PNR_security = -10042
- __PNR_sendfile64 = -10043
- __PNR_setfsgid32 = -10044
- __PNR_setfsuid32 = -10045
- __PNR_setgid32 = -10046
- __PNR_setgroups32 = -10047
- __PNR_setregid32 = -10048
- __PNR_setresgid32 = -10049
- __PNR_setresuid32 = -10050
- __PNR_setreuid32 = -10051
- __PNR_setuid32 = -10052
- __PNR_sgetmask = -10053
- __PNR_sigaction = -10054
- __PNR_signal = -10055
- __PNR_sigpending = -10056
- __PNR_sigprocmask = -10057
- __PNR_sigreturn = -10058
- __PNR_sigsuspend = -10059
- __PNR_socketcall = -10060
- __PNR_ssetmask = -10061
- __PNR_stat64 = -10062
- __PNR_statfs64 = -10063
- __PNR_stime = -10064
- __PNR_stty = -10065
- __PNR_truncate64 = -10066
- __PNR_tuxcall = -10067
- __PNR_ugetrlimit = -10068
- __PNR_ulimit = -10069
- __PNR_umount = -10070
- __PNR_vm86 = -10071
- __PNR_vm86old = -10072
- __PNR_waitpid = -10073
- __PNR_create_module = -10074
- __PNR_get_kernel_syms = -10075
- __PNR_get_thread_area = -10076
- __PNR_nfsservctl = -10077
- __PNR_query_module = -10078
- __PNR_set_thread_area = -10079
- __PNR__sysctl = -10080
- __PNR_uselib = -10081
- __PNR_vserver = -10082
- __PNR_arm_fadvise64_64 = -10083
- __PNR_arm_sync_file_range = -10084
- __PNR_pciconfig_iobase = -10086
- __PNR_pciconfig_read = -10087
- __PNR_pciconfig_write = -10088
- __PNR_sync_file_range2 = -10089
- __PNR_syscall = -10090
- __PNR_afs_syscall = -10091
- __PNR_fadvise64 = -10092
- __PNR_getpmsg = -10093
- __PNR_ioperm = -10094
- __PNR_iopl = -10095
- __PNR_migrate_pages = -10097
- __PNR_modify_ldt = -10098
- __PNR_putpmsg = -10099
- __PNR_sync_file_range = -10100
- __PNR_select = -10101
- __PNR_vfork = -10102
- __PNR_cachectl = -10103
- __PNR_cacheflush = -10104
- __PNR_sysmips = -10106
- __PNR_timerfd = -10107
- __PNR_time = -10108
- __PNR_getrandom = -10109
- __PNR_memfd_create = -10110
- __PNR_kexec_file_load = -10111
- __PNR_sysfs = -10145
- __PNR_oldwait4 = -10146
- __PNR_access = -10147
- __PNR_alarm = -10148
- __PNR_chmod = -10149
- __PNR_chown = -10150
- __PNR_creat = -10151
- __PNR_dup2 = -10152
- __PNR_epoll_create = -10153
- __PNR_epoll_wait = -10154
- __PNR_eventfd = -10155
- __PNR_fork = -10156
- __PNR_futimesat = -10157
- __PNR_getdents = -10158
- __PNR_getpgrp = -10159
- __PNR_inotify_init = -10160
- __PNR_lchown = -10161
- __PNR_link = -10162
- __PNR_lstat = -10163
- __PNR_mkdir = -10164
- __PNR_mknod = -10165
- __PNR_open = -10166
- __PNR_pause = -10167
- __PNR_pipe = -10168
- __PNR_poll = -10169
- __PNR_readlink = -10170
- __PNR_rename = -10171
- __PNR_rmdir = -10172
- __PNR_signalfd = -10173
- __PNR_stat = -10174
- __PNR_symlink = -10175
- __PNR_unlink = -10176
- __PNR_ustat = -10177
- __PNR_utime = -10178
- __PNR_utimes = -10179
- __PNR_getrlimit = -10180
- __PNR_mmap = -10181
- __PNR_breakpoint = -10182
- __PNR_set_tls = -10183
- __PNR_usr26 = -10184
- __PNR_usr32 = -10185
- __PNR_multiplexer = -10186
- __PNR_rtas = -10187
- __PNR_spu_create = -10188
- __PNR_spu_run = -10189
- __PNR_swapcontext = -10190
- __PNR_sys_debug_setcontext = -10191
- __PNR_switch_endian = -10191
- __PNR_get_mempolicy = -10192
- __PNR_move_pages = -10193
- __PNR_mbind = -10194
- __PNR_set_mempolicy = -10195
- __PNR_s390_runtime_instr = -10196
- __PNR_s390_pci_mmio_read = -10197
- __PNR_s390_pci_mmio_write = -10198
- __PNR_membarrier = -10199
- __PNR_userfaultfd = -10200
- __PNR_pkey_mprotect = -10201
- __PNR_pkey_alloc = -10202
- __PNR_pkey_free = -10203
- __PNR_get_tls = -10204
- __PNR_s390_guarded_storage = -10205
- __PNR_s390_sthyi = -10206
- __PNR_subpage_prot = -10207
- __PNR_statx = -10208
- __PNR_io_pgetevents = -10209
- __PNR_rseq = -10210
- __PNR_setrlimit = -10211
- __PNR_clock_adjtime64 = -10212
- __PNR_clock_getres_time64 = -10213
- __PNR_clock_gettime64 = -10214
- __PNR_clock_nanosleep_time64 = -10215
- __PNR_clock_settime64 = -10216
- __PNR_clone3 = -10217
- __PNR_fsconfig = -10218
- __PNR_fsmount = -10219
- __PNR_fsopen = -10220
- __PNR_fspick = -10221
- __PNR_futex_time64 = -10222
- __PNR_io_pgetevents_time64 = -10223
- __PNR_move_mount = -10224
- __PNR_mq_timedreceive_time64 = -10225
- __PNR_mq_timedsend_time64 = -10226
- __PNR_open_tree = -10227
- __PNR_pidfd_open = -10228
- __PNR_pidfd_send_signal = -10229
- __PNR_ppoll_time64 = -10230
- __PNR_pselect6_time64 = -10231
- __PNR_recvmmsg_time64 = -10232
- __PNR_rt_sigtimedwait_time64 = -10233
- __PNR_sched_rr_get_interval_time64 = -10234
- __PNR_semtimedop_time64 = -10235
- __PNR_timer_gettime64 = -10236
- __PNR_timer_settime64 = -10237
- __PNR_timerfd_gettime64 = -10238
- __PNR_timerfd_settime64 = -10239
- __PNR_utimensat_time64 = -10240
- __PNR_ppoll = -10241
- __PNR_renameat = -10242
- __PNR_riscv_flush_icache = -10243
- __PNR_memfd_secret = -10244
- __PNR_map_shadow_stack = -10245
- __PNR_fstat = -10246
- __PNR_atomic_barrier = -10247
- __PNR_atomic_cmpxchg_32 = -10248
- __PNR_getpagesize = -10249
- __PNR_riscv_hwprobe = -10250
- __PNR_uretprobe = -10251
-)
diff --git a/container/seccomp/presets.go b/container/seccomp/presets.go
index 8e9eaeb6..f16bc82c 100644
--- a/container/seccomp/presets.go
+++ b/container/seccomp/presets.go
@@ -5,32 +5,32 @@ package seccomp
import (
. "syscall"
- "hakurei.app/container/std"
+ . "hakurei.app/container/std"
)
-func Preset(presets std.FilterPreset, flags ExportFlag) (rules []NativeRule) {
+func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
allowedPersonality := PersonaLinux
- if presets&std.PresetLinux32 != 0 {
+ if presets&PresetLinux32 != 0 {
allowedPersonality = PersonaLinux32
}
presetDevelFinal := presetDevel(ScmpDatum(allowedPersonality))
l := len(presetCommon)
- if presets&std.PresetDenyNS != 0 {
+ if presets&PresetDenyNS != 0 {
l += len(presetNamespace)
}
- if presets&std.PresetDenyTTY != 0 {
+ if presets&PresetDenyTTY != 0 {
l += len(presetTTY)
}
- if presets&std.PresetDenyDevel != 0 {
+ if presets&PresetDenyDevel != 0 {
l += len(presetDevelFinal)
}
if flags&AllowMultiarch == 0 {
l += len(presetEmu)
}
- if presets&std.PresetExt != 0 {
+ if presets&PresetExt != 0 {
l += len(presetCommonExt)
- if presets&std.PresetDenyNS != 0 {
+ if presets&PresetDenyNS != 0 {
l += len(presetNamespaceExt)
}
if flags&AllowMultiarch == 0 {
@@ -40,21 +40,21 @@ func Preset(presets std.FilterPreset, flags ExportFlag) (rules []NativeRule) {
rules = make([]NativeRule, 0, l)
rules = append(rules, presetCommon...)
- if presets&std.PresetDenyNS != 0 {
+ if presets&PresetDenyNS != 0 {
rules = append(rules, presetNamespace...)
}
- if presets&std.PresetDenyTTY != 0 {
+ if presets&PresetDenyTTY != 0 {
rules = append(rules, presetTTY...)
}
- if presets&std.PresetDenyDevel != 0 {
+ if presets&PresetDenyDevel != 0 {
rules = append(rules, presetDevelFinal...)
}
if flags&AllowMultiarch == 0 {
rules = append(rules, presetEmu...)
}
- if presets&std.PresetExt != 0 {
+ if presets&PresetExt != 0 {
rules = append(rules, presetCommonExt...)
- if presets&std.PresetDenyNS != 0 {
+ if presets&PresetDenyNS != 0 {
rules = append(rules, presetNamespaceExt...)
}
if flags&AllowMultiarch == 0 {
diff --git a/container/seccomp/hash_amd64_test.go b/container/seccomp/presets_amd64_test.go
index c021772c..c021772c 100644
--- a/container/seccomp/hash_amd64_test.go
+++ b/container/seccomp/presets_amd64_test.go
diff --git a/container/seccomp/hash_arm64_test.go b/container/seccomp/presets_arm64_test.go
index a445d3b7..a445d3b7 100644
--- a/container/seccomp/hash_arm64_test.go
+++ b/container/seccomp/presets_arm64_test.go
diff --git a/container/seccomp/hash_test.go b/container/seccomp/presets_test.go
index b86d49ba..b86d49ba 100644
--- a/container/seccomp/hash_test.go
+++ b/container/seccomp/presets_test.go
diff --git a/container/seccomp/syscall.go b/container/seccomp/syscall.go
deleted file mode 100644
index 36a988aa..00000000
--- a/container/seccomp/syscall.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package seccomp
-
-import "iter"
-
-// Syscalls returns an iterator over all wired syscalls.
-func Syscalls() iter.Seq2[string, int] {
- return func(yield func(string, int) bool) {
- for name, num := range syscallNum {
- if !yield(name, num) {
- return
- }
- }
- for name, num := range syscallNumExtra {
- if !yield(name, num) {
- return
- }
- }
- }
-}
-
-// SyscallResolveName resolves a syscall number from its string representation.
-func SyscallResolveName(name string) (num int, ok bool) {
- if num, ok = syscallNum[name]; ok {
- return
- }
- num, ok = syscallNumExtra[name]
- return
-}
diff --git a/container/seccomp/syscall_extra_linux_amd64.go b/container/seccomp/syscall_extra_linux_amd64.go
deleted file mode 100644
index 8b789890..00000000
--- a/container/seccomp/syscall_extra_linux_amd64.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package seccomp
-
-var syscallNumExtra = map[string]int{
- "umount": SYS_UMOUNT,
- "subpage_prot": SYS_SUBPAGE_PROT,
- "switch_endian": SYS_SWITCH_ENDIAN,
- "vm86": SYS_VM86,
- "vm86old": SYS_VM86OLD,
- "clock_adjtime64": SYS_CLOCK_ADJTIME64,
- "clock_settime64": SYS_CLOCK_SETTIME64,
- "chown32": SYS_CHOWN32,
- "fchown32": SYS_FCHOWN32,
- "lchown32": SYS_LCHOWN32,
- "setgid32": SYS_SETGID32,
- "setgroups32": SYS_SETGROUPS32,
- "setregid32": SYS_SETREGID32,
- "setresgid32": SYS_SETRESGID32,
- "setresuid32": SYS_SETRESUID32,
- "setreuid32": SYS_SETREUID32,
- "setuid32": SYS_SETUID32,
-}
-
-const (
- SYS_UMOUNT = __PNR_umount
- SYS_SUBPAGE_PROT = __PNR_subpage_prot
- SYS_SWITCH_ENDIAN = __PNR_switch_endian
- SYS_VM86 = __PNR_vm86
- SYS_VM86OLD = __PNR_vm86old
- SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64
- SYS_CLOCK_SETTIME64 = __PNR_clock_settime64
- SYS_CHOWN32 = __PNR_chown32
- SYS_FCHOWN32 = __PNR_fchown32
- SYS_LCHOWN32 = __PNR_lchown32
- SYS_SETGID32 = __PNR_setgid32
- SYS_SETGROUPS32 = __PNR_setgroups32
- SYS_SETREGID32 = __PNR_setregid32
- SYS_SETRESGID32 = __PNR_setresgid32
- SYS_SETRESUID32 = __PNR_setresuid32
- SYS_SETREUID32 = __PNR_setreuid32
- SYS_SETUID32 = __PNR_setuid32
-)
diff --git a/container/seccomp/syscall_extra_linux_arm64.go b/container/seccomp/syscall_extra_linux_arm64.go
deleted file mode 100644
index 62d8ff19..00000000
--- a/container/seccomp/syscall_extra_linux_arm64.go
+++ /dev/null
@@ -1,55 +0,0 @@
-package seccomp
-
-import "syscall"
-
-const (
- SYS_NEWFSTATAT = syscall.SYS_FSTATAT
-)
-
-var syscallNumExtra = map[string]int{
- "uselib": SYS_USELIB,
- "clock_adjtime64": SYS_CLOCK_ADJTIME64,
- "clock_settime64": SYS_CLOCK_SETTIME64,
- "umount": SYS_UMOUNT,
- "chown": SYS_CHOWN,
- "chown32": SYS_CHOWN32,
- "fchown32": SYS_FCHOWN32,
- "lchown": SYS_LCHOWN,
- "lchown32": SYS_LCHOWN32,
- "setgid32": SYS_SETGID32,
- "setgroups32": SYS_SETGROUPS32,
- "setregid32": SYS_SETREGID32,
- "setresgid32": SYS_SETRESGID32,
- "setresuid32": SYS_SETRESUID32,
- "setreuid32": SYS_SETREUID32,
- "setuid32": SYS_SETUID32,
- "modify_ldt": SYS_MODIFY_LDT,
- "subpage_prot": SYS_SUBPAGE_PROT,
- "switch_endian": SYS_SWITCH_ENDIAN,
- "vm86": SYS_VM86,
- "vm86old": SYS_VM86OLD,
-}
-
-const (
- SYS_USELIB = __PNR_uselib
- SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64
- SYS_CLOCK_SETTIME64 = __PNR_clock_settime64
- SYS_UMOUNT = __PNR_umount
- SYS_CHOWN = __PNR_chown
- SYS_CHOWN32 = __PNR_chown32
- SYS_FCHOWN32 = __PNR_fchown32
- SYS_LCHOWN = __PNR_lchown
- SYS_LCHOWN32 = __PNR_lchown32
- SYS_SETGID32 = __PNR_setgid32
- SYS_SETGROUPS32 = __PNR_setgroups32
- SYS_SETREGID32 = __PNR_setregid32
- SYS_SETRESGID32 = __PNR_setresgid32
- SYS_SETRESUID32 = __PNR_setresuid32
- SYS_SETREUID32 = __PNR_setreuid32
- SYS_SETUID32 = __PNR_setuid32
- SYS_MODIFY_LDT = __PNR_modify_ldt
- SYS_SUBPAGE_PROT = __PNR_subpage_prot
- SYS_SWITCH_ENDIAN = __PNR_switch_endian
- SYS_VM86 = __PNR_vm86
- SYS_VM86OLD = __PNR_vm86old
-)
diff --git a/container/seccomp/syscall_linux_amd64.go b/container/seccomp/syscall_linux_amd64.go
deleted file mode 100644
index 28dbcb47..00000000
--- a/container/seccomp/syscall_linux_amd64.go
+++ /dev/null
@@ -1,459 +0,0 @@
-// mksysnum_linux.pl /usr/include/asm/unistd_64.h
-// Code generated by the command above; DO NOT EDIT.
-
-package seccomp
-
-import . "syscall"
-
-var syscallNum = map[string]int{
- "read": SYS_READ,
- "write": SYS_WRITE,
- "open": SYS_OPEN,
- "close": SYS_CLOSE,
- "stat": SYS_STAT,
- "fstat": SYS_FSTAT,
- "lstat": SYS_LSTAT,
- "poll": SYS_POLL,
- "lseek": SYS_LSEEK,
- "mmap": SYS_MMAP,
- "mprotect": SYS_MPROTECT,
- "munmap": SYS_MUNMAP,
- "brk": SYS_BRK,
- "rt_sigaction": SYS_RT_SIGACTION,
- "rt_sigprocmask": SYS_RT_SIGPROCMASK,
- "rt_sigreturn": SYS_RT_SIGRETURN,
- "ioctl": SYS_IOCTL,
- "pread64": SYS_PREAD64,
- "pwrite64": SYS_PWRITE64,
- "readv": SYS_READV,
- "writev": SYS_WRITEV,
- "access": SYS_ACCESS,
- "pipe": SYS_PIPE,
- "select": SYS_SELECT,
- "sched_yield": SYS_SCHED_YIELD,
- "mremap": SYS_MREMAP,
- "msync": SYS_MSYNC,
- "mincore": SYS_MINCORE,
- "madvise": SYS_MADVISE,
- "shmget": SYS_SHMGET,
- "shmat": SYS_SHMAT,
- "shmctl": SYS_SHMCTL,
- "dup": SYS_DUP,
- "dup2": SYS_DUP2,
- "pause": SYS_PAUSE,
- "nanosleep": SYS_NANOSLEEP,
- "getitimer": SYS_GETITIMER,
- "alarm": SYS_ALARM,
- "setitimer": SYS_SETITIMER,
- "getpid": SYS_GETPID,
- "sendfile": SYS_SENDFILE,
- "socket": SYS_SOCKET,
- "connect": SYS_CONNECT,
- "accept": SYS_ACCEPT,
- "sendto": SYS_SENDTO,
- "recvfrom": SYS_RECVFROM,
- "sendmsg": SYS_SENDMSG,
- "recvmsg": SYS_RECVMSG,
- "shutdown": SYS_SHUTDOWN,
- "bind": SYS_BIND,
- "listen": SYS_LISTEN,
- "getsockname": SYS_GETSOCKNAME,
- "getpeername": SYS_GETPEERNAME,
- "socketpair": SYS_SOCKETPAIR,
- "setsockopt": SYS_SETSOCKOPT,
- "getsockopt": SYS_GETSOCKOPT,
- "clone": SYS_CLONE,
- "fork": SYS_FORK,
- "vfork": SYS_VFORK,
- "execve": SYS_EXECVE,
- "exit": SYS_EXIT,
- "wait4": SYS_WAIT4,
- "kill": SYS_KILL,
- "uname": SYS_UNAME,
- "semget": SYS_SEMGET,
- "semop": SYS_SEMOP,
- "semctl": SYS_SEMCTL,
- "shmdt": SYS_SHMDT,
- "msgget": SYS_MSGGET,
- "msgsnd": SYS_MSGSND,
- "msgrcv": SYS_MSGRCV,
- "msgctl": SYS_MSGCTL,
- "fcntl": SYS_FCNTL,
- "flock": SYS_FLOCK,
- "fsync": SYS_FSYNC,
- "fdatasync": SYS_FDATASYNC,
- "truncate": SYS_TRUNCATE,
- "ftruncate": SYS_FTRUNCATE,
- "getdents": SYS_GETDENTS,
- "getcwd": SYS_GETCWD,
- "chdir": SYS_CHDIR,
- "fchdir": SYS_FCHDIR,
- "rename": SYS_RENAME,
- "mkdir": SYS_MKDIR,
- "rmdir": SYS_RMDIR,
- "creat": SYS_CREAT,
- "link": SYS_LINK,
- "unlink": SYS_UNLINK,
- "symlink": SYS_SYMLINK,
- "readlink": SYS_READLINK,
- "chmod": SYS_CHMOD,
- "fchmod": SYS_FCHMOD,
- "chown": SYS_CHOWN,
- "fchown": SYS_FCHOWN,
- "lchown": SYS_LCHOWN,
- "umask": SYS_UMASK,
- "gettimeofday": SYS_GETTIMEOFDAY,
- "getrlimit": SYS_GETRLIMIT,
- "getrusage": SYS_GETRUSAGE,
- "sysinfo": SYS_SYSINFO,
- "times": SYS_TIMES,
- "ptrace": SYS_PTRACE,
- "getuid": SYS_GETUID,
- "syslog": SYS_SYSLOG,
- "getgid": SYS_GETGID,
- "setuid": SYS_SETUID,
- "setgid": SYS_SETGID,
- "geteuid": SYS_GETEUID,
- "getegid": SYS_GETEGID,
- "setpgid": SYS_SETPGID,
- "getppid": SYS_GETPPID,
- "getpgrp": SYS_GETPGRP,
- "setsid": SYS_SETSID,
- "setreuid": SYS_SETREUID,
- "setregid": SYS_SETREGID,
- "getgroups": SYS_GETGROUPS,
- "setgroups": SYS_SETGROUPS,
- "setresuid": SYS_SETRESUID,
- "getresuid": SYS_GETRESUID,
- "setresgid": SYS_SETRESGID,
- "getresgid": SYS_GETRESGID,
- "getpgid": SYS_GETPGID,
- "setfsuid": SYS_SETFSUID,
- "setfsgid": SYS_SETFSGID,
- "getsid": SYS_GETSID,
- "capget": SYS_CAPGET,
- "capset": SYS_CAPSET,
- "rt_sigpending": SYS_RT_SIGPENDING,
- "rt_sigtimedwait": SYS_RT_SIGTIMEDWAIT,
- "rt_sigqueueinfo": SYS_RT_SIGQUEUEINFO,
- "rt_sigsuspend": SYS_RT_SIGSUSPEND,
- "sigaltstack": SYS_SIGALTSTACK,
- "utime": SYS_UTIME,
- "mknod": SYS_MKNOD,
- "uselib": SYS_USELIB,
- "personality": SYS_PERSONALITY,
- "ustat": SYS_USTAT,
- "statfs": SYS_STATFS,
- "fstatfs": SYS_FSTATFS,
- "sysfs": SYS_SYSFS,
- "getpriority": SYS_GETPRIORITY,
- "setpriority": SYS_SETPRIORITY,
- "sched_setparam": SYS_SCHED_SETPARAM,
- "sched_getparam": SYS_SCHED_GETPARAM,
- "sched_setscheduler": SYS_SCHED_SETSCHEDULER,
- "sched_getscheduler": SYS_SCHED_GETSCHEDULER,
- "sched_get_priority_max": SYS_SCHED_GET_PRIORITY_MAX,
- "sched_get_priority_min": SYS_SCHED_GET_PRIORITY_MIN,
- "sched_rr_get_interval": SYS_SCHED_RR_GET_INTERVAL,
- "mlock": SYS_MLOCK,
- "munlock": SYS_MUNLOCK,
- "mlockall": SYS_MLOCKALL,
- "munlockall": SYS_MUNLOCKALL,
- "vhangup": SYS_VHANGUP,
- "modify_ldt": SYS_MODIFY_LDT,
- "pivot_root": SYS_PIVOT_ROOT,
- "_sysctl": SYS__SYSCTL,
- "prctl": SYS_PRCTL,
- "arch_prctl": SYS_ARCH_PRCTL,
- "adjtimex": SYS_ADJTIMEX,
- "setrlimit": SYS_SETRLIMIT,
- "chroot": SYS_CHROOT,
- "sync": SYS_SYNC,
- "acct": SYS_ACCT,
- "settimeofday": SYS_SETTIMEOFDAY,
- "mount": SYS_MOUNT,
- "umount2": SYS_UMOUNT2,
- "swapon": SYS_SWAPON,
- "swapoff": SYS_SWAPOFF,
- "reboot": SYS_REBOOT,
- "sethostname": SYS_SETHOSTNAME,
- "setdomainname": SYS_SETDOMAINNAME,
- "iopl": SYS_IOPL,
- "ioperm": SYS_IOPERM,
- "create_module": SYS_CREATE_MODULE,
- "init_module": SYS_INIT_MODULE,
- "delete_module": SYS_DELETE_MODULE,
- "get_kernel_syms": SYS_GET_KERNEL_SYMS,
- "query_module": SYS_QUERY_MODULE,
- "quotactl": SYS_QUOTACTL,
- "nfsservctl": SYS_NFSSERVCTL,
- "getpmsg": SYS_GETPMSG,
- "putpmsg": SYS_PUTPMSG,
- "afs_syscall": SYS_AFS_SYSCALL,
- "tuxcall": SYS_TUXCALL,
- "security": SYS_SECURITY,
- "gettid": SYS_GETTID,
- "readahead": SYS_READAHEAD,
- "setxattr": SYS_SETXATTR,
- "lsetxattr": SYS_LSETXATTR,
- "fsetxattr": SYS_FSETXATTR,
- "getxattr": SYS_GETXATTR,
- "lgetxattr": SYS_LGETXATTR,
- "fgetxattr": SYS_FGETXATTR,
- "listxattr": SYS_LISTXATTR,
- "llistxattr": SYS_LLISTXATTR,
- "flistxattr": SYS_FLISTXATTR,
- "removexattr": SYS_REMOVEXATTR,
- "lremovexattr": SYS_LREMOVEXATTR,
- "fremovexattr": SYS_FREMOVEXATTR,
- "tkill": SYS_TKILL,
- "time": SYS_TIME,
- "futex": SYS_FUTEX,
- "sched_setaffinity": SYS_SCHED_SETAFFINITY,
- "sched_getaffinity": SYS_SCHED_GETAFFINITY,
- "set_thread_area": SYS_SET_THREAD_AREA,
- "io_setup": SYS_IO_SETUP,
- "io_destroy": SYS_IO_DESTROY,
- "io_getevents": SYS_IO_GETEVENTS,
- "io_submit": SYS_IO_SUBMIT,
- "io_cancel": SYS_IO_CANCEL,
- "get_thread_area": SYS_GET_THREAD_AREA,
- "lookup_dcookie": SYS_LOOKUP_DCOOKIE,
- "epoll_create": SYS_EPOLL_CREATE,
- "epoll_ctl_old": SYS_EPOLL_CTL_OLD,
- "epoll_wait_old": SYS_EPOLL_WAIT_OLD,
- "remap_file_pages": SYS_REMAP_FILE_PAGES,
- "getdents64": SYS_GETDENTS64,
- "set_tid_address": SYS_SET_TID_ADDRESS,
- "restart_syscall": SYS_RESTART_SYSCALL,
- "semtimedop": SYS_SEMTIMEDOP,
- "fadvise64": SYS_FADVISE64,
- "timer_create": SYS_TIMER_CREATE,
- "timer_settime": SYS_TIMER_SETTIME,
- "timer_gettime": SYS_TIMER_GETTIME,
- "timer_getoverrun": SYS_TIMER_GETOVERRUN,
- "timer_delete": SYS_TIMER_DELETE,
- "clock_settime": SYS_CLOCK_SETTIME,
- "clock_gettime": SYS_CLOCK_GETTIME,
- "clock_getres": SYS_CLOCK_GETRES,
- "clock_nanosleep": SYS_CLOCK_NANOSLEEP,
- "exit_group": SYS_EXIT_GROUP,
- "epoll_wait": SYS_EPOLL_WAIT,
- "epoll_ctl": SYS_EPOLL_CTL,
- "tgkill": SYS_TGKILL,
- "utimes": SYS_UTIMES,
- "vserver": SYS_VSERVER,
- "mbind": SYS_MBIND,
- "set_mempolicy": SYS_SET_MEMPOLICY,
- "get_mempolicy": SYS_GET_MEMPOLICY,
- "mq_open": SYS_MQ_OPEN,
- "mq_unlink": SYS_MQ_UNLINK,
- "mq_timedsend": SYS_MQ_TIMEDSEND,
- "mq_timedreceive": SYS_MQ_TIMEDRECEIVE,
- "mq_notify": SYS_MQ_NOTIFY,
- "mq_getsetattr": SYS_MQ_GETSETATTR,
- "kexec_load": SYS_KEXEC_LOAD,
- "waitid": SYS_WAITID,
- "add_key": SYS_ADD_KEY,
- "request_key": SYS_REQUEST_KEY,
- "keyctl": SYS_KEYCTL,
- "ioprio_set": SYS_IOPRIO_SET,
- "ioprio_get": SYS_IOPRIO_GET,
- "inotify_init": SYS_INOTIFY_INIT,
- "inotify_add_watch": SYS_INOTIFY_ADD_WATCH,
- "inotify_rm_watch": SYS_INOTIFY_RM_WATCH,
- "migrate_pages": SYS_MIGRATE_PAGES,
- "openat": SYS_OPENAT,
- "mkdirat": SYS_MKDIRAT,
- "mknodat": SYS_MKNODAT,
- "fchownat": SYS_FCHOWNAT,
- "futimesat": SYS_FUTIMESAT,
- "newfstatat": SYS_NEWFSTATAT,
- "unlinkat": SYS_UNLINKAT,
- "renameat": SYS_RENAMEAT,
- "linkat": SYS_LINKAT,
- "symlinkat": SYS_SYMLINKAT,
- "readlinkat": SYS_READLINKAT,
- "fchmodat": SYS_FCHMODAT,
- "faccessat": SYS_FACCESSAT,
- "pselect6": SYS_PSELECT6,
- "ppoll": SYS_PPOLL,
- "unshare": SYS_UNSHARE,
- "set_robust_list": SYS_SET_ROBUST_LIST,
- "get_robust_list": SYS_GET_ROBUST_LIST,
- "splice": SYS_SPLICE,
- "tee": SYS_TEE,
- "sync_file_range": SYS_SYNC_FILE_RANGE,
- "vmsplice": SYS_VMSPLICE,
- "move_pages": SYS_MOVE_PAGES,
- "utimensat": SYS_UTIMENSAT,
- "epoll_pwait": SYS_EPOLL_PWAIT,
- "signalfd": SYS_SIGNALFD,
- "timerfd_create": SYS_TIMERFD_CREATE,
- "eventfd": SYS_EVENTFD,
- "fallocate": SYS_FALLOCATE,
- "timerfd_settime": SYS_TIMERFD_SETTIME,
- "timerfd_gettime": SYS_TIMERFD_GETTIME,
- "accept4": SYS_ACCEPT4,
- "signalfd4": SYS_SIGNALFD4,
- "eventfd2": SYS_EVENTFD2,
- "epoll_create1": SYS_EPOLL_CREATE1,
- "dup3": SYS_DUP3,
- "pipe2": SYS_PIPE2,
- "inotify_init1": SYS_INOTIFY_INIT1,
- "preadv": SYS_PREADV,
- "pwritev": SYS_PWRITEV,
- "rt_tgsigqueueinfo": SYS_RT_TGSIGQUEUEINFO,
- "perf_event_open": SYS_PERF_EVENT_OPEN,
- "recvmmsg": SYS_RECVMMSG,
- "fanotify_init": SYS_FANOTIFY_INIT,
- "fanotify_mark": SYS_FANOTIFY_MARK,
- "prlimit64": SYS_PRLIMIT64,
- "name_to_handle_at": SYS_NAME_TO_HANDLE_AT,
- "open_by_handle_at": SYS_OPEN_BY_HANDLE_AT,
- "clock_adjtime": SYS_CLOCK_ADJTIME,
- "syncfs": SYS_SYNCFS,
- "sendmmsg": SYS_SENDMMSG,
- "setns": SYS_SETNS,
- "getcpu": SYS_GETCPU,
- "process_vm_readv": SYS_PROCESS_VM_READV,
- "process_vm_writev": SYS_PROCESS_VM_WRITEV,
- "kcmp": SYS_KCMP,
- "finit_module": SYS_FINIT_MODULE,
- "sched_setattr": SYS_SCHED_SETATTR,
- "sched_getattr": SYS_SCHED_GETATTR,
- "renameat2": SYS_RENAMEAT2,
- "seccomp": SYS_SECCOMP,
- "getrandom": SYS_GETRANDOM,
- "memfd_create": SYS_MEMFD_CREATE,
- "kexec_file_load": SYS_KEXEC_FILE_LOAD,
- "bpf": SYS_BPF,
- "execveat": SYS_EXECVEAT,
- "userfaultfd": SYS_USERFAULTFD,
- "membarrier": SYS_MEMBARRIER,
- "mlock2": SYS_MLOCK2,
- "copy_file_range": SYS_COPY_FILE_RANGE,
- "preadv2": SYS_PREADV2,
- "pwritev2": SYS_PWRITEV2,
- "pkey_mprotect": SYS_PKEY_MPROTECT,
- "pkey_alloc": SYS_PKEY_ALLOC,
- "pkey_free": SYS_PKEY_FREE,
- "statx": SYS_STATX,
- "io_pgetevents": SYS_IO_PGETEVENTS,
- "rseq": SYS_RSEQ,
- "uretprobe": SYS_URETPROBE,
- "pidfd_send_signal": SYS_PIDFD_SEND_SIGNAL,
- "io_uring_setup": SYS_IO_URING_SETUP,
- "io_uring_enter": SYS_IO_URING_ENTER,
- "io_uring_register": SYS_IO_URING_REGISTER,
- "open_tree": SYS_OPEN_TREE,
- "move_mount": SYS_MOVE_MOUNT,
- "fsopen": SYS_FSOPEN,
- "fsconfig": SYS_FSCONFIG,
- "fsmount": SYS_FSMOUNT,
- "fspick": SYS_FSPICK,
- "pidfd_open": SYS_PIDFD_OPEN,
- "clone3": SYS_CLONE3,
- "close_range": SYS_CLOSE_RANGE,
- "openat2": SYS_OPENAT2,
- "pidfd_getfd": SYS_PIDFD_GETFD,
- "faccessat2": SYS_FACCESSAT2,
- "process_madvise": SYS_PROCESS_MADVISE,
- "epoll_pwait2": SYS_EPOLL_PWAIT2,
- "mount_setattr": SYS_MOUNT_SETATTR,
- "quotactl_fd": SYS_QUOTACTL_FD,
- "landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET,
- "landlock_add_rule": SYS_LANDLOCK_ADD_RULE,
- "landlock_restrict_self": SYS_LANDLOCK_RESTRICT_SELF,
- "memfd_secret": SYS_MEMFD_SECRET,
- "process_mrelease": SYS_PROCESS_MRELEASE,
- "futex_waitv": SYS_FUTEX_WAITV,
- "set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE,
- "cachestat": SYS_CACHESTAT,
- "fchmodat2": SYS_FCHMODAT2,
- "map_shadow_stack": SYS_MAP_SHADOW_STACK,
- "futex_wake": SYS_FUTEX_WAKE,
- "futex_wait": SYS_FUTEX_WAIT,
- "futex_requeue": SYS_FUTEX_REQUEUE,
- "statmount": SYS_STATMOUNT,
- "listmount": SYS_LISTMOUNT,
- "lsm_get_self_attr": SYS_LSM_GET_SELF_ATTR,
- "lsm_set_self_attr": SYS_LSM_SET_SELF_ATTR,
- "lsm_list_modules": SYS_LSM_LIST_MODULES,
- "mseal": SYS_MSEAL,
-}
-
-const (
- SYS_NAME_TO_HANDLE_AT = 303
- SYS_OPEN_BY_HANDLE_AT = 304
- SYS_CLOCK_ADJTIME = 305
- SYS_SYNCFS = 306
- SYS_SENDMMSG = 307
- SYS_SETNS = 308
- SYS_GETCPU = 309
- SYS_PROCESS_VM_READV = 310
- SYS_PROCESS_VM_WRITEV = 311
- SYS_KCMP = 312
- SYS_FINIT_MODULE = 313
- SYS_SCHED_SETATTR = 314
- SYS_SCHED_GETATTR = 315
- SYS_RENAMEAT2 = 316
- SYS_SECCOMP = 317
- SYS_GETRANDOM = 318
- SYS_MEMFD_CREATE = 319
- SYS_KEXEC_FILE_LOAD = 320
- SYS_BPF = 321
- SYS_EXECVEAT = 322
- SYS_USERFAULTFD = 323
- SYS_MEMBARRIER = 324
- SYS_MLOCK2 = 325
- SYS_COPY_FILE_RANGE = 326
- SYS_PREADV2 = 327
- SYS_PWRITEV2 = 328
- SYS_PKEY_MPROTECT = 329
- SYS_PKEY_ALLOC = 330
- SYS_PKEY_FREE = 331
- SYS_STATX = 332
- SYS_IO_PGETEVENTS = 333
- SYS_RSEQ = 334
- SYS_URETPROBE = 335
- SYS_PIDFD_SEND_SIGNAL = 424
- SYS_IO_URING_SETUP = 425
- SYS_IO_URING_ENTER = 426
- SYS_IO_URING_REGISTER = 427
- SYS_OPEN_TREE = 428
- SYS_MOVE_MOUNT = 429
- SYS_FSOPEN = 430
- SYS_FSCONFIG = 431
- SYS_FSMOUNT = 432
- SYS_FSPICK = 433
- SYS_PIDFD_OPEN = 434
- SYS_CLONE3 = 435
- SYS_CLOSE_RANGE = 436
- SYS_OPENAT2 = 437
- SYS_PIDFD_GETFD = 438
- SYS_FACCESSAT2 = 439
- SYS_PROCESS_MADVISE = 440
- SYS_EPOLL_PWAIT2 = 441
- SYS_MOUNT_SETATTR = 442
- SYS_QUOTACTL_FD = 443
- SYS_LANDLOCK_CREATE_RULESET = 444
- SYS_LANDLOCK_ADD_RULE = 445
- SYS_LANDLOCK_RESTRICT_SELF = 446
- SYS_MEMFD_SECRET = 447
- SYS_PROCESS_MRELEASE = 448
- SYS_FUTEX_WAITV = 449
- SYS_SET_MEMPOLICY_HOME_NODE = 450
- SYS_CACHESTAT = 451
- SYS_FCHMODAT2 = 452
- SYS_MAP_SHADOW_STACK = 453
- SYS_FUTEX_WAKE = 454
- SYS_FUTEX_WAIT = 455
- SYS_FUTEX_REQUEUE = 456
- SYS_STATMOUNT = 457
- SYS_LISTMOUNT = 458
- SYS_LSM_GET_SELF_ATTR = 459
- SYS_LSM_SET_SELF_ATTR = 460
- SYS_LSM_LIST_MODULES = 461
- SYS_MSEAL = 462
-)
diff --git a/container/seccomp/syscall_linux_arm64.go b/container/seccomp/syscall_linux_arm64.go
deleted file mode 100644
index 9790ad6a..00000000
--- a/container/seccomp/syscall_linux_arm64.go
+++ /dev/null
@@ -1,382 +0,0 @@
-// mksysnum_linux.pl /usr/include/asm/unistd_64.h
-// Code generated by the command above; DO NOT EDIT.
-
-package seccomp
-
-import . "syscall"
-
-var syscallNum = map[string]int{
- "io_setup": SYS_IO_SETUP,
- "io_destroy": SYS_IO_DESTROY,
- "io_submit": SYS_IO_SUBMIT,
- "io_cancel": SYS_IO_CANCEL,
- "io_getevents": SYS_IO_GETEVENTS,
- "setxattr": SYS_SETXATTR,
- "lsetxattr": SYS_LSETXATTR,
- "fsetxattr": SYS_FSETXATTR,
- "getxattr": SYS_GETXATTR,
- "lgetxattr": SYS_LGETXATTR,
- "fgetxattr": SYS_FGETXATTR,
- "listxattr": SYS_LISTXATTR,
- "llistxattr": SYS_LLISTXATTR,
- "flistxattr": SYS_FLISTXATTR,
- "removexattr": SYS_REMOVEXATTR,
- "lremovexattr": SYS_LREMOVEXATTR,
- "fremovexattr": SYS_FREMOVEXATTR,
- "getcwd": SYS_GETCWD,
- "lookup_dcookie": SYS_LOOKUP_DCOOKIE,
- "eventfd2": SYS_EVENTFD2,
- "epoll_create1": SYS_EPOLL_CREATE1,
- "epoll_ctl": SYS_EPOLL_CTL,
- "epoll_pwait": SYS_EPOLL_PWAIT,
- "dup": SYS_DUP,
- "dup3": SYS_DUP3,
- "fcntl": SYS_FCNTL,
- "inotify_init1": SYS_INOTIFY_INIT1,
- "inotify_add_watch": SYS_INOTIFY_ADD_WATCH,
- "inotify_rm_watch": SYS_INOTIFY_RM_WATCH,
- "ioctl": SYS_IOCTL,
- "ioprio_set": SYS_IOPRIO_SET,
- "ioprio_get": SYS_IOPRIO_GET,
- "flock": SYS_FLOCK,
- "mknodat": SYS_MKNODAT,
- "mkdirat": SYS_MKDIRAT,
- "unlinkat": SYS_UNLINKAT,
- "symlinkat": SYS_SYMLINKAT,
- "linkat": SYS_LINKAT,
- "renameat": SYS_RENAMEAT,
- "umount2": SYS_UMOUNT2,
- "mount": SYS_MOUNT,
- "pivot_root": SYS_PIVOT_ROOT,
- "nfsservctl": SYS_NFSSERVCTL,
- "statfs": SYS_STATFS,
- "fstatfs": SYS_FSTATFS,
- "truncate": SYS_TRUNCATE,
- "ftruncate": SYS_FTRUNCATE,
- "fallocate": SYS_FALLOCATE,
- "faccessat": SYS_FACCESSAT,
- "chdir": SYS_CHDIR,
- "fchdir": SYS_FCHDIR,
- "chroot": SYS_CHROOT,
- "fchmod": SYS_FCHMOD,
- "fchmodat": SYS_FCHMODAT,
- "fchownat": SYS_FCHOWNAT,
- "fchown": SYS_FCHOWN,
- "openat": SYS_OPENAT,
- "close": SYS_CLOSE,
- "vhangup": SYS_VHANGUP,
- "pipe2": SYS_PIPE2,
- "quotactl": SYS_QUOTACTL,
- "getdents64": SYS_GETDENTS64,
- "lseek": SYS_LSEEK,
- "read": SYS_READ,
- "write": SYS_WRITE,
- "readv": SYS_READV,
- "writev": SYS_WRITEV,
- "pread64": SYS_PREAD64,
- "pwrite64": SYS_PWRITE64,
- "preadv": SYS_PREADV,
- "pwritev": SYS_PWRITEV,
- "sendfile": SYS_SENDFILE,
- "pselect6": SYS_PSELECT6,
- "ppoll": SYS_PPOLL,
- "signalfd4": SYS_SIGNALFD4,
- "vmsplice": SYS_VMSPLICE,
- "splice": SYS_SPLICE,
- "tee": SYS_TEE,
- "readlinkat": SYS_READLINKAT,
- "newfstatat": SYS_NEWFSTATAT,
- "fstat": SYS_FSTAT,
- "sync": SYS_SYNC,
- "fsync": SYS_FSYNC,
- "fdatasync": SYS_FDATASYNC,
- "sync_file_range": SYS_SYNC_FILE_RANGE,
- "timerfd_create": SYS_TIMERFD_CREATE,
- "timerfd_settime": SYS_TIMERFD_SETTIME,
- "timerfd_gettime": SYS_TIMERFD_GETTIME,
- "utimensat": SYS_UTIMENSAT,
- "acct": SYS_ACCT,
- "capget": SYS_CAPGET,
- "capset": SYS_CAPSET,
- "personality": SYS_PERSONALITY,
- "exit": SYS_EXIT,
- "exit_group": SYS_EXIT_GROUP,
- "waitid": SYS_WAITID,
- "set_tid_address": SYS_SET_TID_ADDRESS,
- "unshare": SYS_UNSHARE,
- "futex": SYS_FUTEX,
- "set_robust_list": SYS_SET_ROBUST_LIST,
- "get_robust_list": SYS_GET_ROBUST_LIST,
- "nanosleep": SYS_NANOSLEEP,
- "getitimer": SYS_GETITIMER,
- "setitimer": SYS_SETITIMER,
- "kexec_load": SYS_KEXEC_LOAD,
- "init_module": SYS_INIT_MODULE,
- "delete_module": SYS_DELETE_MODULE,
- "timer_create": SYS_TIMER_CREATE,
- "timer_gettime": SYS_TIMER_GETTIME,
- "timer_getoverrun": SYS_TIMER_GETOVERRUN,
- "timer_settime": SYS_TIMER_SETTIME,
- "timer_delete": SYS_TIMER_DELETE,
- "clock_settime": SYS_CLOCK_SETTIME,
- "clock_gettime": SYS_CLOCK_GETTIME,
- "clock_getres": SYS_CLOCK_GETRES,
- "clock_nanosleep": SYS_CLOCK_NANOSLEEP,
- "syslog": SYS_SYSLOG,
- "ptrace": SYS_PTRACE,
- "sched_setparam": SYS_SCHED_SETPARAM,
- "sched_setscheduler": SYS_SCHED_SETSCHEDULER,
- "sched_getscheduler": SYS_SCHED_GETSCHEDULER,
- "sched_getparam": SYS_SCHED_GETPARAM,
- "sched_setaffinity": SYS_SCHED_SETAFFINITY,
- "sched_getaffinity": SYS_SCHED_GETAFFINITY,
- "sched_yield": SYS_SCHED_YIELD,
- "sched_get_priority_max": SYS_SCHED_GET_PRIORITY_MAX,
- "sched_get_priority_min": SYS_SCHED_GET_PRIORITY_MIN,
- "sched_rr_get_interval": SYS_SCHED_RR_GET_INTERVAL,
- "restart_syscall": SYS_RESTART_SYSCALL,
- "kill": SYS_KILL,
- "tkill": SYS_TKILL,
- "tgkill": SYS_TGKILL,
- "sigaltstack": SYS_SIGALTSTACK,
- "rt_sigsuspend": SYS_RT_SIGSUSPEND,
- "rt_sigaction": SYS_RT_SIGACTION,
- "rt_sigprocmask": SYS_RT_SIGPROCMASK,
- "rt_sigpending": SYS_RT_SIGPENDING,
- "rt_sigtimedwait": SYS_RT_SIGTIMEDWAIT,
- "rt_sigqueueinfo": SYS_RT_SIGQUEUEINFO,
- "rt_sigreturn": SYS_RT_SIGRETURN,
- "setpriority": SYS_SETPRIORITY,
- "getpriority": SYS_GETPRIORITY,
- "reboot": SYS_REBOOT,
- "setregid": SYS_SETREGID,
- "setgid": SYS_SETGID,
- "setreuid": SYS_SETREUID,
- "setuid": SYS_SETUID,
- "setresuid": SYS_SETRESUID,
- "getresuid": SYS_GETRESUID,
- "setresgid": SYS_SETRESGID,
- "getresgid": SYS_GETRESGID,
- "setfsuid": SYS_SETFSUID,
- "setfsgid": SYS_SETFSGID,
- "times": SYS_TIMES,
- "setpgid": SYS_SETPGID,
- "getpgid": SYS_GETPGID,
- "getsid": SYS_GETSID,
- "setsid": SYS_SETSID,
- "getgroups": SYS_GETGROUPS,
- "setgroups": SYS_SETGROUPS,
- "uname": SYS_UNAME,
- "sethostname": SYS_SETHOSTNAME,
- "setdomainname": SYS_SETDOMAINNAME,
- "getrlimit": SYS_GETRLIMIT,
- "setrlimit": SYS_SETRLIMIT,
- "getrusage": SYS_GETRUSAGE,
- "umask": SYS_UMASK,
- "prctl": SYS_PRCTL,
- "getcpu": SYS_GETCPU,
- "gettimeofday": SYS_GETTIMEOFDAY,
- "settimeofday": SYS_SETTIMEOFDAY,
- "adjtimex": SYS_ADJTIMEX,
- "getpid": SYS_GETPID,
- "getppid": SYS_GETPPID,
- "getuid": SYS_GETUID,
- "geteuid": SYS_GETEUID,
- "getgid": SYS_GETGID,
- "getegid": SYS_GETEGID,
- "gettid": SYS_GETTID,
- "sysinfo": SYS_SYSINFO,
- "mq_open": SYS_MQ_OPEN,
- "mq_unlink": SYS_MQ_UNLINK,
- "mq_timedsend": SYS_MQ_TIMEDSEND,
- "mq_timedreceive": SYS_MQ_TIMEDRECEIVE,
- "mq_notify": SYS_MQ_NOTIFY,
- "mq_getsetattr": SYS_MQ_GETSETATTR,
- "msgget": SYS_MSGGET,
- "msgctl": SYS_MSGCTL,
- "msgrcv": SYS_MSGRCV,
- "msgsnd": SYS_MSGSND,
- "semget": SYS_SEMGET,
- "semctl": SYS_SEMCTL,
- "semtimedop": SYS_SEMTIMEDOP,
- "semop": SYS_SEMOP,
- "shmget": SYS_SHMGET,
- "shmctl": SYS_SHMCTL,
- "shmat": SYS_SHMAT,
- "shmdt": SYS_SHMDT,
- "socket": SYS_SOCKET,
- "socketpair": SYS_SOCKETPAIR,
- "bind": SYS_BIND,
- "listen": SYS_LISTEN,
- "accept": SYS_ACCEPT,
- "connect": SYS_CONNECT,
- "getsockname": SYS_GETSOCKNAME,
- "getpeername": SYS_GETPEERNAME,
- "sendto": SYS_SENDTO,
- "recvfrom": SYS_RECVFROM,
- "setsockopt": SYS_SETSOCKOPT,
- "getsockopt": SYS_GETSOCKOPT,
- "shutdown": SYS_SHUTDOWN,
- "sendmsg": SYS_SENDMSG,
- "recvmsg": SYS_RECVMSG,
- "readahead": SYS_READAHEAD,
- "brk": SYS_BRK,
- "munmap": SYS_MUNMAP,
- "mremap": SYS_MREMAP,
- "add_key": SYS_ADD_KEY,
- "request_key": SYS_REQUEST_KEY,
- "keyctl": SYS_KEYCTL,
- "clone": SYS_CLONE,
- "execve": SYS_EXECVE,
- "mmap": SYS_MMAP,
- "fadvise64": SYS_FADVISE64,
- "swapon": SYS_SWAPON,
- "swapoff": SYS_SWAPOFF,
- "mprotect": SYS_MPROTECT,
- "msync": SYS_MSYNC,
- "mlock": SYS_MLOCK,
- "munlock": SYS_MUNLOCK,
- "mlockall": SYS_MLOCKALL,
- "munlockall": SYS_MUNLOCKALL,
- "mincore": SYS_MINCORE,
- "madvise": SYS_MADVISE,
- "remap_file_pages": SYS_REMAP_FILE_PAGES,
- "mbind": SYS_MBIND,
- "get_mempolicy": SYS_GET_MEMPOLICY,
- "set_mempolicy": SYS_SET_MEMPOLICY,
- "migrate_pages": SYS_MIGRATE_PAGES,
- "move_pages": SYS_MOVE_PAGES,
- "rt_tgsigqueueinfo": SYS_RT_TGSIGQUEUEINFO,
- "perf_event_open": SYS_PERF_EVENT_OPEN,
- "accept4": SYS_ACCEPT4,
- "recvmmsg": SYS_RECVMMSG,
- "wait4": SYS_WAIT4,
- "prlimit64": SYS_PRLIMIT64,
- "fanotify_init": SYS_FANOTIFY_INIT,
- "fanotify_mark": SYS_FANOTIFY_MARK,
- "name_to_handle_at": SYS_NAME_TO_HANDLE_AT,
- "open_by_handle_at": SYS_OPEN_BY_HANDLE_AT,
- "clock_adjtime": SYS_CLOCK_ADJTIME,
- "syncfs": SYS_SYNCFS,
- "setns": SYS_SETNS,
- "sendmmsg": SYS_SENDMMSG,
- "process_vm_readv": SYS_PROCESS_VM_READV,
- "process_vm_writev": SYS_PROCESS_VM_WRITEV,
- "kcmp": SYS_KCMP,
- "finit_module": SYS_FINIT_MODULE,
- "sched_setattr": SYS_SCHED_SETATTR,
- "sched_getattr": SYS_SCHED_GETATTR,
- "renameat2": SYS_RENAMEAT2,
- "seccomp": SYS_SECCOMP,
- "getrandom": SYS_GETRANDOM,
- "memfd_create": SYS_MEMFD_CREATE,
- "bpf": SYS_BPF,
- "execveat": SYS_EXECVEAT,
- "userfaultfd": SYS_USERFAULTFD,
- "membarrier": SYS_MEMBARRIER,
- "mlock2": SYS_MLOCK2,
- "copy_file_range": SYS_COPY_FILE_RANGE,
- "preadv2": SYS_PREADV2,
- "pwritev2": SYS_PWRITEV2,
- "pkey_mprotect": SYS_PKEY_MPROTECT,
- "pkey_alloc": SYS_PKEY_ALLOC,
- "pkey_free": SYS_PKEY_FREE,
- "statx": SYS_STATX,
- "io_pgetevents": SYS_IO_PGETEVENTS,
- "rseq": SYS_RSEQ,
- "kexec_file_load": SYS_KEXEC_FILE_LOAD,
- "pidfd_send_signal": SYS_PIDFD_SEND_SIGNAL,
- "io_uring_setup": SYS_IO_URING_SETUP,
- "io_uring_enter": SYS_IO_URING_ENTER,
- "io_uring_register": SYS_IO_URING_REGISTER,
- "open_tree": SYS_OPEN_TREE,
- "move_mount": SYS_MOVE_MOUNT,
- "fsopen": SYS_FSOPEN,
- "fsconfig": SYS_FSCONFIG,
- "fsmount": SYS_FSMOUNT,
- "fspick": SYS_FSPICK,
- "pidfd_open": SYS_PIDFD_OPEN,
- "clone3": SYS_CLONE3,
- "close_range": SYS_CLOSE_RANGE,
- "openat2": SYS_OPENAT2,
- "pidfd_getfd": SYS_PIDFD_GETFD,
- "faccessat2": SYS_FACCESSAT2,
- "process_madvise": SYS_PROCESS_MADVISE,
- "epoll_pwait2": SYS_EPOLL_PWAIT2,
- "mount_setattr": SYS_MOUNT_SETATTR,
- "quotactl_fd": SYS_QUOTACTL_FD,
- "landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET,
- "landlock_add_rule": SYS_LANDLOCK_ADD_RULE,
- "landlock_restrict_self": SYS_LANDLOCK_RESTRICT_SELF,
- "memfd_secret": SYS_MEMFD_SECRET,
- "process_mrelease": SYS_PROCESS_MRELEASE,
- "futex_waitv": SYS_FUTEX_WAITV,
- "set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE,
- "cachestat": SYS_CACHESTAT,
- "fchmodat2": SYS_FCHMODAT2,
- "map_shadow_stack": SYS_MAP_SHADOW_STACK,
- "futex_wake": SYS_FUTEX_WAKE,
- "futex_wait": SYS_FUTEX_WAIT,
- "futex_requeue": SYS_FUTEX_REQUEUE,
- "statmount": SYS_STATMOUNT,
- "listmount": SYS_LISTMOUNT,
- "lsm_get_self_attr": SYS_LSM_GET_SELF_ATTR,
- "lsm_set_self_attr": SYS_LSM_SET_SELF_ATTR,
- "lsm_list_modules": SYS_LSM_LIST_MODULES,
- "mseal": SYS_MSEAL,
-}
-
-const (
- SYS_USERFAULTFD = 282
- SYS_MEMBARRIER = 283
- SYS_MLOCK2 = 284
- SYS_COPY_FILE_RANGE = 285
- SYS_PREADV2 = 286
- SYS_PWRITEV2 = 287
- SYS_PKEY_MPROTECT = 288
- SYS_PKEY_ALLOC = 289
- SYS_PKEY_FREE = 290
- SYS_STATX = 291
- SYS_IO_PGETEVENTS = 292
- SYS_RSEQ = 293
- SYS_KEXEC_FILE_LOAD = 294
- SYS_PIDFD_SEND_SIGNAL = 424
- SYS_IO_URING_SETUP = 425
- SYS_IO_URING_ENTER = 426
- SYS_IO_URING_REGISTER = 427
- SYS_OPEN_TREE = 428
- SYS_MOVE_MOUNT = 429
- SYS_FSOPEN = 430
- SYS_FSCONFIG = 431
- SYS_FSMOUNT = 432
- SYS_FSPICK = 433
- SYS_PIDFD_OPEN = 434
- SYS_CLONE3 = 435
- SYS_CLOSE_RANGE = 436
- SYS_OPENAT2 = 437
- SYS_PIDFD_GETFD = 438
- SYS_FACCESSAT2 = 439
- SYS_PROCESS_MADVISE = 440
- SYS_EPOLL_PWAIT2 = 441
- SYS_MOUNT_SETATTR = 442
- SYS_QUOTACTL_FD = 443
- SYS_LANDLOCK_CREATE_RULESET = 444
- SYS_LANDLOCK_ADD_RULE = 445
- SYS_LANDLOCK_RESTRICT_SELF = 446
- SYS_MEMFD_SECRET = 447
- SYS_PROCESS_MRELEASE = 448
- SYS_FUTEX_WAITV = 449
- SYS_SET_MEMPOLICY_HOME_NODE = 450
- SYS_CACHESTAT = 451
- SYS_FCHMODAT2 = 452
- SYS_MAP_SHADOW_STACK = 453
- SYS_FUTEX_WAKE = 454
- SYS_FUTEX_WAIT = 455
- SYS_FUTEX_REQUEUE = 456
- SYS_STATMOUNT = 457
- SYS_LISTMOUNT = 458
- SYS_LSM_GET_SELF_ATTR = 459
- SYS_LSM_SET_SELF_ATTR = 460
- SYS_LSM_LIST_MODULES = 461
- SYS_MSEAL = 462
-)
diff --git a/container/seccomp/syscall_test.go b/container/seccomp/syscall_test.go
index e385a12c..57a73265 100644
--- a/container/seccomp/syscall_test.go
+++ b/container/seccomp/syscall_test.go
@@ -2,21 +2,21 @@ package seccomp
import (
"testing"
+
+ "hakurei.app/container/std"
)
func TestSyscallResolveName(t *testing.T) {
t.Parallel()
- for name, want := range Syscalls() {
+ for name, want := range std.Syscalls() {
t.Run(name, func(t *testing.T) {
t.Parallel()
- if got := syscallResolveName(name); got != want {
+ // this checks the std implementation against libseccomp.
+ if got, ok := syscallResolveName(name); !ok || got != want {
t.Errorf("syscallResolveName(%q) = %d, want %d", name, got, want)
}
- if got, ok := SyscallResolveName(name); !ok || got != want {
- t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want)
- }
})
}
}
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 06:50:15 +0000