aboutsummaryrefslogtreecommitdiffhomepage
path: root/sandbox
AgeCommit message (Collapse)Author
2025-06-30sandbox/seccomp: emit syscall constantsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-26treewide: switch to hakurei.appOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-26sandbox/seccomp: syscall name lookup tableOphestra
The script is from Go source of same name. The result is checked against libseccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-25treewide: reapply clang-formatOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-25treewide: rename to hakureiOphestra
Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-18treewide: switch to clang-formatOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-05nix: update flake lockOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-11sandbox: relative autoetc linksOphestra
This allows nested containers to use autoetc, and increases compatibility with other implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-10sandbox: implement autoetc as setup opOphestra
This significantly reduces setup op count and the readdir call now happens in the context of the init process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-08sandbox/seccomp: rename flag type and constantsOphestra
The names are ambiguous. Rename them to make more sense. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-07sandbox/seccomp: unexport println wrapperOphestra
This is an implementation detail that was exported for the bwrap argument builder. The removal of that package allows it to be unexported. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-01sandbox: document less obvious parts of setupOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-30sandbox/seccomp: update doc commentOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-28sandbox/seccomp: add fortify default sampleOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27sandbox: support privileged containerOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26sandbox/init: clear inheritable setOphestra
Inheritable should not be able to affect anything regardless of its value, due to no_new_privs. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26sandbox: wrap capset syscallOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26sandbox/init: drop capabilitiesOphestra
During development the syscall filter caused me to make an incorrect assumption about SysProcAttr. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26sandbox: cache kernel.cap_last_cap valueOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26sandbox: copy symlink with magic prefixOphestra
This does not dereference the symlink, but only reads one level of it. This is useful for symlink targets that are not yet known at the time the configuration is emitted. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25sandbox: remove hardcoded parent permOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25sandbox: wrap error with its own text messageOphestra
PathError has a pretty good text message, many of them are wrapped with its own text message. This change adds a function to do just that to improve readability. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25sandbox: do not ensure symlink targetOphestra
This masks EEXIST on target and might clobber filesystems and lead to other confusing behaviour. Create its parent instead. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25sandbox/wl: move into sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25app: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-24sandbox: resolve tty nameOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-24sandbox/vfs: add doc commentsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-24sandbox: set mkdir permOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox: verify outcome via mountinfoOphestra
This contains much more information than /proc/mounts and allows for more fields to be checked. This also removes the dependency on the test package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test/sandbox: parse full test caseOphestra
This makes declaring multiple tests much cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox/vfs: match MS_NOSYMFOLLOW flagOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox: apply vfs options to bind mountsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox/vfs: unfold mount hierarchyOphestra
This presents all visible mount points under path. This is useful for applying extra vfs options to bind mounts. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox/vfs: expose mountinfo line scanningOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: parse vfs optionsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox: resolve inverted flags in opOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: count mountinfo entriesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: implement proc_pid_mountinfo(5) parserOphestra
Test cases are mostly taken from util-linux. This implementation is more correct and slightly faster than the one found in github:kubernetes/utils. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-18sandbox: prepare ops earlyOphestra
Some setup code needs to run in host root. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: pass cmd to cancel functionOphestra
This is not usually in scope otherwise. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: place files with contentOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: create directoriesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/mount: pass absolute pathOphestra
This should never be used unless there is a good reason to, like using a file in the intermediate root. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: cancel process on serve errorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: rename params structOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: create symlinksOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/init: fail early on nil opOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/mount: rename device flagOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: mount container /dev/mqueueOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: unwrap path stringOphestra
Mount proc and dev takes no additional parameters. Signed-off-by: Ophestra <cat@gensokyo.uk>
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-05 06:56:28 +0000