aboutsummaryrefslogtreecommitdiffhomepage
path: root/helper/seccomp
AgeCommit message (Collapse)Author
2025-03-14seccomp: move out of helperOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12helper/seccomp: improve error handlingOphestra
This passes both errno and libseccomp return value. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12helper/seccomp: seccomp_load on negative fdOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23fortify: keep external files aliveOphestra
This should eliminate sporadic failures, like the known double close in "seccomp". Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-16fmsg: implement suspend in writerOphestra
This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-13helper: use generic extra files interfaceOphestra
This replaces the pipes object and integrates context into helper process lifecycle. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-13helper/seccomp: use sync.Once for closeWriteOphestra
This makes the code much cleaner, and eliminates the intermittent ErrInvalid errors. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-13helper/seccomp: benchmark exporterOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-13helper/seccomp: eliminate data race on pfdOphestra
Turns out the doc comment on os.File was lying about its methods being safe for concurrent use. The race detector picked up a data race from concurrent use of Fd and Close. This change eliminates that by calling Fd in the prepare routine. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-07helper/seccomp: panic on invalid closeWrite useOphestra
Returning an error here puts exporter in an invalid state. The caller should guard against this condition instead. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-03helper/seccomp: implement reader interface via pipeOphestra
This also does not require the libc tmpfile call. BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-25helper/seccomp: do not call F_println if not verboseOphestra
This (slightly) improves performance. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-25helper/seccomp: separate seccomp packageOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>