aboutsummaryrefslogtreecommitdiffhomepage
path: root/container/syscall.go
AgeCommit message (Collapse)Author
2026-04-10container: unexport PR_SET_NO_NEW_PRIVS wrapperOphestra
This is subtle to use correctly. It also does not make sense as part of the container API. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17ext: move syscall wrappers from containerOphestra
These are generally useful, and none of them are container-specific. Syscalls subtle to use and requiring container-specific setup remains in container. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-17ext: isolate from container/stdOphestra
These are too general to belong in the container package. This targets the v0.4 release to reduce the wrapper maintenance burden. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-12container: expose priority and SCHED_OTHER policyOphestra
The more explicit API removes the arbitrary limit preventing use of SCHED_OTHER (referred to as SCHED_NORMAL in the kernel). This change also exposes priority value to set. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-11container: move scheduler policy constants to stdOphestra
This avoids depending on cgo. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-10go: 1.26Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-03-09container: sched policy string representationOphestra
This also uses priority obtained via sched_get_priority_min, and improves bounds checking. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-28container/std: rename seccomp typesOphestra
Aliases will be kept until 0.4. Signed-off-by: Ophestra <cat@gensokyo.uk>
2026-02-26container: set scheduling policyOphestra
This is thread-directed so cannot be done externally. The glibc wrapper exposes this behaviour so most multithreaded programs using this is straight up incorrect. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-10-22container/syscall: export prctl wrapperOphestra
This is useful as package "syscall" does not provide such a wrapper. This change also improves error handling to fully conform to the manpage. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-10-21container/syscall: dot-import syscallOphestra
This avoids having arch-specific constants for arm64. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-22container/init: wrap syscall helper functionsOphestra
This allows tests to stub all kernel behaviour, enabling measurement of all function call arguments and error injection. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-21container/syscall: doc comments from manpagesOphestra
These are pulled straight from the manpages. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-20container: ptrace protection via Yama LSMOphestra
This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway. Closes #4. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-18container: move PR_SET_NO_NEW_PRIVS to parentOphestra
This allows some LSM setup in the parent. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-07container: move capset implementationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-07container: move syscall constantsOphestra
These aren't missing from all targets. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-03container: move out of toplevelOphestra
This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers. Signed-off-by: Ophestra <cat@gensokyo.uk>