From becaf8b6d7151971907ff65f338afa038f021c92 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 5 Nov 2025 04:48:05 +0900 Subject: std: relocate seccomp lookup tables This should enable resolving NativeRule in hst. Signed-off-by: Ophestra --- container/landlock.go | 6 +- container/seccomp/hash_amd64_test.go | 27 -- container/seccomp/hash_arm64_test.go | 27 -- container/seccomp/hash_test.go | 30 -- container/seccomp/libseccomp.go | 3 +- container/seccomp/mksysnum_linux.pl | 89 ----- container/seccomp/pnr.go | 267 -------------- container/seccomp/presets.go | 26 +- container/seccomp/presets_amd64_test.go | 27 ++ container/seccomp/presets_arm64_test.go | 27 ++ container/seccomp/presets_test.go | 30 ++ container/seccomp/syscall.go | 28 -- container/seccomp/syscall_extra_linux_amd64.go | 41 --- container/seccomp/syscall_extra_linux_arm64.go | 55 --- container/seccomp/syscall_linux_amd64.go | 459 ------------------------- container/seccomp/syscall_linux_arm64.go | 382 -------------------- container/seccomp/syscall_test.go | 10 +- container/std/mksysnum_linux.pl | 89 +++++ container/std/pnr.go | 267 ++++++++++++++ container/std/syscall.go | 28 ++ container/std/syscall_extra_linux_amd64.go | 41 +++ container/std/syscall_extra_linux_arm64.go | 55 +++ container/std/syscall_linux_amd64.go | 459 +++++++++++++++++++++++++ container/std/syscall_linux_arm64.go | 382 ++++++++++++++++++++ container/std/syscall_test.go | 21 ++ 25 files changed, 1449 insertions(+), 1427 deletions(-) delete mode 100644 container/seccomp/hash_amd64_test.go delete mode 100644 container/seccomp/hash_arm64_test.go delete mode 100644 container/seccomp/hash_test.go delete mode 100755 container/seccomp/mksysnum_linux.pl delete mode 100644 container/seccomp/pnr.go create mode 100644 container/seccomp/presets_amd64_test.go create mode 100644 container/seccomp/presets_arm64_test.go create mode 100644 container/seccomp/presets_test.go delete mode 100644 container/seccomp/syscall.go delete mode 100644 container/seccomp/syscall_extra_linux_amd64.go delete mode 100644 container/seccomp/syscall_extra_linux_arm64.go delete mode 100644 container/seccomp/syscall_linux_amd64.go delete mode 100644 container/seccomp/syscall_linux_arm64.go create mode 100755 container/std/mksysnum_linux.pl create mode 100644 container/std/pnr.go create mode 100644 container/std/syscall.go create mode 100644 container/std/syscall_extra_linux_amd64.go create mode 100644 container/std/syscall_extra_linux_arm64.go create mode 100644 container/std/syscall_linux_amd64.go create mode 100644 container/std/syscall_linux_arm64.go create mode 100644 container/std/syscall_test.go diff --git a/container/landlock.go b/container/landlock.go index 7f7461e2..63d03817 100644 --- a/container/landlock.go +++ b/container/landlock.go @@ -5,7 +5,7 @@ import ( "syscall" "unsafe" - "hakurei.app/container/seccomp" + "hakurei.app/container/std" ) // include/uapi/linux/landlock.h @@ -212,7 +212,7 @@ func (rulesetAttr *RulesetAttr) Create(flags uintptr) (fd int, err error) { size = unsafe.Sizeof(*rulesetAttr) } - rulesetFd, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags) + rulesetFd, _, errno := syscall.Syscall(std.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags) fd = int(rulesetFd) err = errno @@ -231,7 +231,7 @@ func LandlockGetABI() (int, error) { } func LandlockRestrictSelf(rulesetFd int, flags uintptr) error { - r, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0) + r, _, errno := syscall.Syscall(std.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0) if r != 0 { return errno } diff --git a/container/seccomp/hash_amd64_test.go b/container/seccomp/hash_amd64_test.go deleted file mode 100644 index c021772c..00000000 --- a/container/seccomp/hash_amd64_test.go +++ /dev/null @@ -1,27 +0,0 @@ -package seccomp_test - -import ( - . "hakurei.app/container/seccomp" - . "hakurei.app/container/std" -) - -var bpfExpected = bpfLookup{ - {AllowMultiarch | AllowCAN | - AllowBluetooth, PresetExt | - PresetDenyNS | PresetDenyTTY | PresetDenyDevel | - PresetLinux32}: toHash( - "e99dd345e195413473d3cbee07b4ed57b908bfa89ea2072fe93482847f50b5b758da17e74ca2bbc00813de49a2b9bf834c024ed48850be69b68a9a4c5f53a9db"), - - {0, 0}: toHash( - "95ec69d017733e072160e0da80fdebecdf27ae8166f5e2a731270c98ea2d2946cb5231029063668af215879155da21aca79b070e04c0ee9acdf58f55cfa815a5"), - {0, PresetExt}: toHash( - "dc7f2e1c5e829b79ebb7efc759150f54a83a75c8df6fee4dce5dadc4736c585d4deebfeb3c7969af3a077e90b77bb4741db05d90997c8659b95891206ac9952d"), - {0, PresetStrict}: toHash( - "e880298df2bd6751d0040fc21bc0ed4c00f95dc0d7ba506c244d8b8cf6866dba8ef4a33296f287b66cccc1d78e97026597f84cc7dec1573e148960fbd35cd735"), - {0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash( - "39871b93ffafc8b979fcedc0b0c37b9e03922f5b02748dc5c3c17c92527f6e022ede1f48bff59246ea452c0d1de54827808b1a6f84f32bbde1aa02ae30eedcfa"), - {0, PresetExt | PresetDenyDevel}: toHash( - "c698b081ff957afe17a6d94374537d37f2a63f6f9dd75da7546542407a9e32476ebda3312ba7785d7f618542bcfaf27ca27dcc2dddba852069d28bcfe8cad39a"), - {0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash( - "0b76007476c1c9e25dbf674c29fdf609a1656a70063e49327654e1b5360ad3da06e1a3e32bf80e961c5516ad83d4b9e7e9bde876a93797e27627d2555c25858b"), -} diff --git a/container/seccomp/hash_arm64_test.go b/container/seccomp/hash_arm64_test.go deleted file mode 100644 index a445d3b7..00000000 --- a/container/seccomp/hash_arm64_test.go +++ /dev/null @@ -1,27 +0,0 @@ -package seccomp_test - -import ( - . "hakurei.app/container/seccomp" - . "hakurei.app/container/std" -) - -var bpfExpected = bpfLookup{ - {AllowMultiarch | AllowCAN | - AllowBluetooth, PresetExt | - PresetDenyNS | PresetDenyTTY | PresetDenyDevel | - PresetLinux32}: toHash( - "1431c013f2ddac3adae577821cb5d351b1514e7c754d62346ddffd31f46ea02fb368e46e3f8104f81019617e721fe687ddd83f1e79580622ccc991da12622170"), - - {0, 0}: toHash( - "450c21210dbf124dfa7ae56d0130f9c2e24b26f5bce8795ee75766c75850438ff9e7d91c5e73d63bbe51a5d4b06c2a0791c4de2903b2b9805f16265318183235"), - {0, PresetExt}: toHash( - "d971d0f2d30f54ac920fc6d84df2be279e9fd28cf2d48be775d7fdbd790b750e1369401cd3bb8bcf9ba3adb91874fe9792d9e3f62209b8ee59c9fdd2ddd10c7b"), - {0, PresetStrict}: toHash( - "79318538a3dc851314b6bd96f10d5861acb2aa7e13cb8de0619d0f6a76709d67f01ef3fd67e195862b02f9711e5b769bc4d1eb4fc0dfc41a723c89c968a93297"), - {0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash( - "228286c2f5df8e44463be0a57b91977b7f38b63b09e5d98dfabe5c61545b8f9ac3e5ea3d86df55d7edf2ce61875f0a5a85c0ab82800bef178c42533e8bdc9a6c"), - {0, PresetExt | PresetDenyDevel}: toHash( - "433ce9b911282d6dcc8029319fb79b816b60d5a795ec8fc94344dd027614d68f023166a91bb881faaeeedd26e3d89474e141e5a69a97e93b8984ca8f14999980"), - {0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash( - "cf1f4dc87436ba8ec95d268b663a6397bb0b4a5ac64d8557e6cc529d8b0f6f65dad3a92b62ed29d85eee9c6dde1267757a4d0f86032e8a45ca1bceadfa34cf5e"), -} diff --git a/container/seccomp/hash_test.go b/container/seccomp/hash_test.go deleted file mode 100644 index b86d49ba..00000000 --- a/container/seccomp/hash_test.go +++ /dev/null @@ -1,30 +0,0 @@ -package seccomp_test - -import ( - "crypto/sha512" - "encoding/hex" - - "hakurei.app/container/seccomp" - "hakurei.app/container/std" -) - -type ( - bpfPreset = struct { - seccomp.ExportFlag - std.FilterPreset - } - bpfLookup map[bpfPreset][sha512.Size]byte -) - -func toHash(s string) [sha512.Size]byte { - if len(s) != sha512.Size*2 { - panic("bad sha512 string length") - } - if v, err := hex.DecodeString(s); err != nil { - panic(err.Error()) - } else if len(v) != sha512.Size { - panic("unreachable") - } else { - return ([sha512.Size]byte)(v) - } -} diff --git a/container/seccomp/libseccomp.go b/container/seccomp/libseccomp.go index 2044a668..c408b7b3 100644 --- a/container/seccomp/libseccomp.go +++ b/container/seccomp/libseccomp.go @@ -227,9 +227,10 @@ const ( // syscallResolveName resolves a syscall number by name via seccomp_syscall_resolve_name. // This function is only for testing the lookup tables and included here for convenience. -func syscallResolveName(s string) (trap int) { +func syscallResolveName(s string) (trap int, ok bool) { v := C.CString(s) trap = int(C.seccomp_syscall_resolve_name(v)) C.free(unsafe.Pointer(v)) + ok = trap != C.__NR_SCMP_ERROR return } diff --git a/container/seccomp/mksysnum_linux.pl b/container/seccomp/mksysnum_linux.pl deleted file mode 100755 index 2dbd12fd..00000000 --- a/container/seccomp/mksysnum_linux.pl +++ /dev/null @@ -1,89 +0,0 @@ -#!/usr/bin/env perl -# Copyright 2009 The Go Authors. All rights reserved. -# Use of this source code is governed by a BSD-style -# license that can be found in the LICENSE file. - -use strict; -use POSIX (); - -my $command = "mksysnum_linux.pl ". join(' ', @ARGV); -my $uname_arch = (POSIX::uname)[4]; -my %syscall_cutoff_arch = ( - "x86_64" => 302, - "aarch64" => 281, -); - -print < 999){ - # ignore deprecated syscalls that are no longer implemented - # https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/uapi/asm-generic/unistd.h?id=refs/heads/master#n716 - return; - } - (my $name_upper = $name) =~ y/a-z/A-Z/; - $num = $num + $offset; - if($num > $syscall_cutoff_arch{$uname_arch}){ # not wired in Go standard library - if($state < 0){ - print " \"$name\": SYS_$name_upper,\n"; - } - else{ - print " SYS_$name_upper = $num;\n"; - } - } - elsif($state < 0){ - print " \"$name\": SYS_$name_upper,\n"; - } - else{ - return; - } -} - -GENERATE: - -my $prev; -open(GCC, "gcc -E -dD $ARGV[0] |") || die "can't run gcc"; -while(){ - if(/^#define __NR_Linux\s+([0-9]+)/){ - # mips/mips64: extract offset - $offset = $1; - } - elsif(/^#define __NR_syscalls\s+/) { - # ignore redefinitions of __NR_syscalls - } - elsif(/^#define __NR_(\w+)\s+([0-9]+)/){ - $prev = $2; - fmt($1, $2); - } - elsif(/^#define __NR3264_(\w+)\s+([0-9]+)/){ - $prev = $2; - fmt($1, $2); - } - elsif(/^#define __NR_(\w+)\s+\(\w+\+\s*([0-9]+)\)/){ - fmt($1, $prev+$2) - } - elsif(/^#define __NR_(\w+)\s+\(__NR_Linux \+ ([0-9]+)/){ - fmt($1, $2); - } -} - -if($state < 0){ - $state = $state + 1; - print "}\n\nconst (\n"; - goto GENERATE; -} - -print ")"; diff --git a/container/seccomp/pnr.go b/container/seccomp/pnr.go deleted file mode 100644 index 4cc7398b..00000000 --- a/container/seccomp/pnr.go +++ /dev/null @@ -1,267 +0,0 @@ -// Code generated from include/seccomp-syscalls.h; DO NOT EDIT. - -package seccomp - -/* - * pseudo syscall definitions - */ - -const ( - - /* socket syscalls */ - - __PNR_socket = -101 - __PNR_bind = -102 - __PNR_connect = -103 - __PNR_listen = -104 - __PNR_accept = -105 - __PNR_getsockname = -106 - __PNR_getpeername = -107 - __PNR_socketpair = -108 - __PNR_send = -109 - __PNR_recv = -110 - __PNR_sendto = -111 - __PNR_recvfrom = -112 - __PNR_shutdown = -113 - __PNR_setsockopt = -114 - __PNR_getsockopt = -115 - __PNR_sendmsg = -116 - __PNR_recvmsg = -117 - __PNR_accept4 = -118 - __PNR_recvmmsg = -119 - __PNR_sendmmsg = -120 - - /* ipc syscalls */ - - __PNR_semop = -201 - __PNR_semget = -202 - __PNR_semctl = -203 - __PNR_semtimedop = -204 - __PNR_msgsnd = -211 - __PNR_msgrcv = -212 - __PNR_msgget = -213 - __PNR_msgctl = -214 - __PNR_shmat = -221 - __PNR_shmdt = -222 - __PNR_shmget = -223 - __PNR_shmctl = -224 - - /* single syscalls */ - - __PNR_arch_prctl = -10001 - __PNR_bdflush = -10002 - __PNR_break = -10003 - __PNR_chown32 = -10004 - __PNR_epoll_ctl_old = -10005 - __PNR_epoll_wait_old = -10006 - __PNR_fadvise64_64 = -10007 - __PNR_fchown32 = -10008 - __PNR_fcntl64 = -10009 - __PNR_fstat64 = -10010 - __PNR_fstatat64 = -10011 - __PNR_fstatfs64 = -10012 - __PNR_ftime = -10013 - __PNR_ftruncate64 = -10014 - __PNR_getegid32 = -10015 - __PNR_geteuid32 = -10016 - __PNR_getgid32 = -10017 - __PNR_getgroups32 = -10018 - __PNR_getresgid32 = -10019 - __PNR_getresuid32 = -10020 - __PNR_getuid32 = -10021 - __PNR_gtty = -10022 - __PNR_idle = -10023 - __PNR_ipc = -10024 - __PNR_lchown32 = -10025 - __PNR__llseek = -10026 - __PNR_lock = -10027 - __PNR_lstat64 = -10028 - __PNR_mmap2 = -10029 - __PNR_mpx = -10030 - __PNR_newfstatat = -10031 - __PNR__newselect = -10032 - __PNR_nice = -10033 - __PNR_oldfstat = -10034 - __PNR_oldlstat = -10035 - __PNR_oldolduname = -10036 - __PNR_oldstat = -10037 - __PNR_olduname = -10038 - __PNR_prof = -10039 - __PNR_profil = -10040 - __PNR_readdir = -10041 - __PNR_security = -10042 - __PNR_sendfile64 = -10043 - __PNR_setfsgid32 = -10044 - __PNR_setfsuid32 = -10045 - __PNR_setgid32 = -10046 - __PNR_setgroups32 = -10047 - __PNR_setregid32 = -10048 - __PNR_setresgid32 = -10049 - __PNR_setresuid32 = -10050 - __PNR_setreuid32 = -10051 - __PNR_setuid32 = -10052 - __PNR_sgetmask = -10053 - __PNR_sigaction = -10054 - __PNR_signal = -10055 - __PNR_sigpending = -10056 - __PNR_sigprocmask = -10057 - __PNR_sigreturn = -10058 - __PNR_sigsuspend = -10059 - __PNR_socketcall = -10060 - __PNR_ssetmask = -10061 - __PNR_stat64 = -10062 - __PNR_statfs64 = -10063 - __PNR_stime = -10064 - __PNR_stty = -10065 - __PNR_truncate64 = -10066 - __PNR_tuxcall = -10067 - __PNR_ugetrlimit = -10068 - __PNR_ulimit = -10069 - __PNR_umount = -10070 - __PNR_vm86 = -10071 - __PNR_vm86old = -10072 - __PNR_waitpid = -10073 - __PNR_create_module = -10074 - __PNR_get_kernel_syms = -10075 - __PNR_get_thread_area = -10076 - __PNR_nfsservctl = -10077 - __PNR_query_module = -10078 - __PNR_set_thread_area = -10079 - __PNR__sysctl = -10080 - __PNR_uselib = -10081 - __PNR_vserver = -10082 - __PNR_arm_fadvise64_64 = -10083 - __PNR_arm_sync_file_range = -10084 - __PNR_pciconfig_iobase = -10086 - __PNR_pciconfig_read = -10087 - __PNR_pciconfig_write = -10088 - __PNR_sync_file_range2 = -10089 - __PNR_syscall = -10090 - __PNR_afs_syscall = -10091 - __PNR_fadvise64 = -10092 - __PNR_getpmsg = -10093 - __PNR_ioperm = -10094 - __PNR_iopl = -10095 - __PNR_migrate_pages = -10097 - __PNR_modify_ldt = -10098 - __PNR_putpmsg = -10099 - __PNR_sync_file_range = -10100 - __PNR_select = -10101 - __PNR_vfork = -10102 - __PNR_cachectl = -10103 - __PNR_cacheflush = -10104 - __PNR_sysmips = -10106 - __PNR_timerfd = -10107 - __PNR_time = -10108 - __PNR_getrandom = -10109 - __PNR_memfd_create = -10110 - __PNR_kexec_file_load = -10111 - __PNR_sysfs = -10145 - __PNR_oldwait4 = -10146 - __PNR_access = -10147 - __PNR_alarm = -10148 - __PNR_chmod = -10149 - __PNR_chown = -10150 - __PNR_creat = -10151 - __PNR_dup2 = -10152 - __PNR_epoll_create = -10153 - __PNR_epoll_wait = -10154 - __PNR_eventfd = -10155 - __PNR_fork = -10156 - __PNR_futimesat = -10157 - __PNR_getdents = -10158 - __PNR_getpgrp = -10159 - __PNR_inotify_init = -10160 - __PNR_lchown = -10161 - __PNR_link = -10162 - __PNR_lstat = -10163 - __PNR_mkdir = -10164 - __PNR_mknod = -10165 - __PNR_open = -10166 - __PNR_pause = -10167 - __PNR_pipe = -10168 - __PNR_poll = -10169 - __PNR_readlink = -10170 - __PNR_rename = -10171 - __PNR_rmdir = -10172 - __PNR_signalfd = -10173 - __PNR_stat = -10174 - __PNR_symlink = -10175 - __PNR_unlink = -10176 - __PNR_ustat = -10177 - __PNR_utime = -10178 - __PNR_utimes = -10179 - __PNR_getrlimit = -10180 - __PNR_mmap = -10181 - __PNR_breakpoint = -10182 - __PNR_set_tls = -10183 - __PNR_usr26 = -10184 - __PNR_usr32 = -10185 - __PNR_multiplexer = -10186 - __PNR_rtas = -10187 - __PNR_spu_create = -10188 - __PNR_spu_run = -10189 - __PNR_swapcontext = -10190 - __PNR_sys_debug_setcontext = -10191 - __PNR_switch_endian = -10191 - __PNR_get_mempolicy = -10192 - __PNR_move_pages = -10193 - __PNR_mbind = -10194 - __PNR_set_mempolicy = -10195 - __PNR_s390_runtime_instr = -10196 - __PNR_s390_pci_mmio_read = -10197 - __PNR_s390_pci_mmio_write = -10198 - __PNR_membarrier = -10199 - __PNR_userfaultfd = -10200 - __PNR_pkey_mprotect = -10201 - __PNR_pkey_alloc = -10202 - __PNR_pkey_free = -10203 - __PNR_get_tls = -10204 - __PNR_s390_guarded_storage = -10205 - __PNR_s390_sthyi = -10206 - __PNR_subpage_prot = -10207 - __PNR_statx = -10208 - __PNR_io_pgetevents = -10209 - __PNR_rseq = -10210 - __PNR_setrlimit = -10211 - __PNR_clock_adjtime64 = -10212 - __PNR_clock_getres_time64 = -10213 - __PNR_clock_gettime64 = -10214 - __PNR_clock_nanosleep_time64 = -10215 - __PNR_clock_settime64 = -10216 - __PNR_clone3 = -10217 - __PNR_fsconfig = -10218 - __PNR_fsmount = -10219 - __PNR_fsopen = -10220 - __PNR_fspick = -10221 - __PNR_futex_time64 = -10222 - __PNR_io_pgetevents_time64 = -10223 - __PNR_move_mount = -10224 - __PNR_mq_timedreceive_time64 = -10225 - __PNR_mq_timedsend_time64 = -10226 - __PNR_open_tree = -10227 - __PNR_pidfd_open = -10228 - __PNR_pidfd_send_signal = -10229 - __PNR_ppoll_time64 = -10230 - __PNR_pselect6_time64 = -10231 - __PNR_recvmmsg_time64 = -10232 - __PNR_rt_sigtimedwait_time64 = -10233 - __PNR_sched_rr_get_interval_time64 = -10234 - __PNR_semtimedop_time64 = -10235 - __PNR_timer_gettime64 = -10236 - __PNR_timer_settime64 = -10237 - __PNR_timerfd_gettime64 = -10238 - __PNR_timerfd_settime64 = -10239 - __PNR_utimensat_time64 = -10240 - __PNR_ppoll = -10241 - __PNR_renameat = -10242 - __PNR_riscv_flush_icache = -10243 - __PNR_memfd_secret = -10244 - __PNR_map_shadow_stack = -10245 - __PNR_fstat = -10246 - __PNR_atomic_barrier = -10247 - __PNR_atomic_cmpxchg_32 = -10248 - __PNR_getpagesize = -10249 - __PNR_riscv_hwprobe = -10250 - __PNR_uretprobe = -10251 -) diff --git a/container/seccomp/presets.go b/container/seccomp/presets.go index 8e9eaeb6..f16bc82c 100644 --- a/container/seccomp/presets.go +++ b/container/seccomp/presets.go @@ -5,32 +5,32 @@ package seccomp import ( . "syscall" - "hakurei.app/container/std" + . "hakurei.app/container/std" ) -func Preset(presets std.FilterPreset, flags ExportFlag) (rules []NativeRule) { +func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) { allowedPersonality := PersonaLinux - if presets&std.PresetLinux32 != 0 { + if presets&PresetLinux32 != 0 { allowedPersonality = PersonaLinux32 } presetDevelFinal := presetDevel(ScmpDatum(allowedPersonality)) l := len(presetCommon) - if presets&std.PresetDenyNS != 0 { + if presets&PresetDenyNS != 0 { l += len(presetNamespace) } - if presets&std.PresetDenyTTY != 0 { + if presets&PresetDenyTTY != 0 { l += len(presetTTY) } - if presets&std.PresetDenyDevel != 0 { + if presets&PresetDenyDevel != 0 { l += len(presetDevelFinal) } if flags&AllowMultiarch == 0 { l += len(presetEmu) } - if presets&std.PresetExt != 0 { + if presets&PresetExt != 0 { l += len(presetCommonExt) - if presets&std.PresetDenyNS != 0 { + if presets&PresetDenyNS != 0 { l += len(presetNamespaceExt) } if flags&AllowMultiarch == 0 { @@ -40,21 +40,21 @@ func Preset(presets std.FilterPreset, flags ExportFlag) (rules []NativeRule) { rules = make([]NativeRule, 0, l) rules = append(rules, presetCommon...) - if presets&std.PresetDenyNS != 0 { + if presets&PresetDenyNS != 0 { rules = append(rules, presetNamespace...) } - if presets&std.PresetDenyTTY != 0 { + if presets&PresetDenyTTY != 0 { rules = append(rules, presetTTY...) } - if presets&std.PresetDenyDevel != 0 { + if presets&PresetDenyDevel != 0 { rules = append(rules, presetDevelFinal...) } if flags&AllowMultiarch == 0 { rules = append(rules, presetEmu...) } - if presets&std.PresetExt != 0 { + if presets&PresetExt != 0 { rules = append(rules, presetCommonExt...) - if presets&std.PresetDenyNS != 0 { + if presets&PresetDenyNS != 0 { rules = append(rules, presetNamespaceExt...) } if flags&AllowMultiarch == 0 { diff --git a/container/seccomp/presets_amd64_test.go b/container/seccomp/presets_amd64_test.go new file mode 100644 index 00000000..c021772c --- /dev/null +++ b/container/seccomp/presets_amd64_test.go @@ -0,0 +1,27 @@ +package seccomp_test + +import ( + . "hakurei.app/container/seccomp" + . "hakurei.app/container/std" +) + +var bpfExpected = bpfLookup{ + {AllowMultiarch | AllowCAN | + AllowBluetooth, PresetExt | + PresetDenyNS | PresetDenyTTY | PresetDenyDevel | + PresetLinux32}: toHash( + "e99dd345e195413473d3cbee07b4ed57b908bfa89ea2072fe93482847f50b5b758da17e74ca2bbc00813de49a2b9bf834c024ed48850be69b68a9a4c5f53a9db"), + + {0, 0}: toHash( + "95ec69d017733e072160e0da80fdebecdf27ae8166f5e2a731270c98ea2d2946cb5231029063668af215879155da21aca79b070e04c0ee9acdf58f55cfa815a5"), + {0, PresetExt}: toHash( + "dc7f2e1c5e829b79ebb7efc759150f54a83a75c8df6fee4dce5dadc4736c585d4deebfeb3c7969af3a077e90b77bb4741db05d90997c8659b95891206ac9952d"), + {0, PresetStrict}: toHash( + "e880298df2bd6751d0040fc21bc0ed4c00f95dc0d7ba506c244d8b8cf6866dba8ef4a33296f287b66cccc1d78e97026597f84cc7dec1573e148960fbd35cd735"), + {0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash( + "39871b93ffafc8b979fcedc0b0c37b9e03922f5b02748dc5c3c17c92527f6e022ede1f48bff59246ea452c0d1de54827808b1a6f84f32bbde1aa02ae30eedcfa"), + {0, PresetExt | PresetDenyDevel}: toHash( + "c698b081ff957afe17a6d94374537d37f2a63f6f9dd75da7546542407a9e32476ebda3312ba7785d7f618542bcfaf27ca27dcc2dddba852069d28bcfe8cad39a"), + {0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash( + "0b76007476c1c9e25dbf674c29fdf609a1656a70063e49327654e1b5360ad3da06e1a3e32bf80e961c5516ad83d4b9e7e9bde876a93797e27627d2555c25858b"), +} diff --git a/container/seccomp/presets_arm64_test.go b/container/seccomp/presets_arm64_test.go new file mode 100644 index 00000000..a445d3b7 --- /dev/null +++ b/container/seccomp/presets_arm64_test.go @@ -0,0 +1,27 @@ +package seccomp_test + +import ( + . "hakurei.app/container/seccomp" + . "hakurei.app/container/std" +) + +var bpfExpected = bpfLookup{ + {AllowMultiarch | AllowCAN | + AllowBluetooth, PresetExt | + PresetDenyNS | PresetDenyTTY | PresetDenyDevel | + PresetLinux32}: toHash( + "1431c013f2ddac3adae577821cb5d351b1514e7c754d62346ddffd31f46ea02fb368e46e3f8104f81019617e721fe687ddd83f1e79580622ccc991da12622170"), + + {0, 0}: toHash( + "450c21210dbf124dfa7ae56d0130f9c2e24b26f5bce8795ee75766c75850438ff9e7d91c5e73d63bbe51a5d4b06c2a0791c4de2903b2b9805f16265318183235"), + {0, PresetExt}: toHash( + "d971d0f2d30f54ac920fc6d84df2be279e9fd28cf2d48be775d7fdbd790b750e1369401cd3bb8bcf9ba3adb91874fe9792d9e3f62209b8ee59c9fdd2ddd10c7b"), + {0, PresetStrict}: toHash( + "79318538a3dc851314b6bd96f10d5861acb2aa7e13cb8de0619d0f6a76709d67f01ef3fd67e195862b02f9711e5b769bc4d1eb4fc0dfc41a723c89c968a93297"), + {0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash( + "228286c2f5df8e44463be0a57b91977b7f38b63b09e5d98dfabe5c61545b8f9ac3e5ea3d86df55d7edf2ce61875f0a5a85c0ab82800bef178c42533e8bdc9a6c"), + {0, PresetExt | PresetDenyDevel}: toHash( + "433ce9b911282d6dcc8029319fb79b816b60d5a795ec8fc94344dd027614d68f023166a91bb881faaeeedd26e3d89474e141e5a69a97e93b8984ca8f14999980"), + {0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash( + "cf1f4dc87436ba8ec95d268b663a6397bb0b4a5ac64d8557e6cc529d8b0f6f65dad3a92b62ed29d85eee9c6dde1267757a4d0f86032e8a45ca1bceadfa34cf5e"), +} diff --git a/container/seccomp/presets_test.go b/container/seccomp/presets_test.go new file mode 100644 index 00000000..b86d49ba --- /dev/null +++ b/container/seccomp/presets_test.go @@ -0,0 +1,30 @@ +package seccomp_test + +import ( + "crypto/sha512" + "encoding/hex" + + "hakurei.app/container/seccomp" + "hakurei.app/container/std" +) + +type ( + bpfPreset = struct { + seccomp.ExportFlag + std.FilterPreset + } + bpfLookup map[bpfPreset][sha512.Size]byte +) + +func toHash(s string) [sha512.Size]byte { + if len(s) != sha512.Size*2 { + panic("bad sha512 string length") + } + if v, err := hex.DecodeString(s); err != nil { + panic(err.Error()) + } else if len(v) != sha512.Size { + panic("unreachable") + } else { + return ([sha512.Size]byte)(v) + } +} diff --git a/container/seccomp/syscall.go b/container/seccomp/syscall.go deleted file mode 100644 index 36a988aa..00000000 --- a/container/seccomp/syscall.go +++ /dev/null @@ -1,28 +0,0 @@ -package seccomp - -import "iter" - -// Syscalls returns an iterator over all wired syscalls. -func Syscalls() iter.Seq2[string, int] { - return func(yield func(string, int) bool) { - for name, num := range syscallNum { - if !yield(name, num) { - return - } - } - for name, num := range syscallNumExtra { - if !yield(name, num) { - return - } - } - } -} - -// SyscallResolveName resolves a syscall number from its string representation. -func SyscallResolveName(name string) (num int, ok bool) { - if num, ok = syscallNum[name]; ok { - return - } - num, ok = syscallNumExtra[name] - return -} diff --git a/container/seccomp/syscall_extra_linux_amd64.go b/container/seccomp/syscall_extra_linux_amd64.go deleted file mode 100644 index 8b789890..00000000 --- a/container/seccomp/syscall_extra_linux_amd64.go +++ /dev/null @@ -1,41 +0,0 @@ -package seccomp - -var syscallNumExtra = map[string]int{ - "umount": SYS_UMOUNT, - "subpage_prot": SYS_SUBPAGE_PROT, - "switch_endian": SYS_SWITCH_ENDIAN, - "vm86": SYS_VM86, - "vm86old": SYS_VM86OLD, - "clock_adjtime64": SYS_CLOCK_ADJTIME64, - "clock_settime64": SYS_CLOCK_SETTIME64, - "chown32": SYS_CHOWN32, - "fchown32": SYS_FCHOWN32, - "lchown32": SYS_LCHOWN32, - "setgid32": SYS_SETGID32, - "setgroups32": SYS_SETGROUPS32, - "setregid32": SYS_SETREGID32, - "setresgid32": SYS_SETRESGID32, - "setresuid32": SYS_SETRESUID32, - "setreuid32": SYS_SETREUID32, - "setuid32": SYS_SETUID32, -} - -const ( - SYS_UMOUNT = __PNR_umount - SYS_SUBPAGE_PROT = __PNR_subpage_prot - SYS_SWITCH_ENDIAN = __PNR_switch_endian - SYS_VM86 = __PNR_vm86 - SYS_VM86OLD = __PNR_vm86old - SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64 - SYS_CLOCK_SETTIME64 = __PNR_clock_settime64 - SYS_CHOWN32 = __PNR_chown32 - SYS_FCHOWN32 = __PNR_fchown32 - SYS_LCHOWN32 = __PNR_lchown32 - SYS_SETGID32 = __PNR_setgid32 - SYS_SETGROUPS32 = __PNR_setgroups32 - SYS_SETREGID32 = __PNR_setregid32 - SYS_SETRESGID32 = __PNR_setresgid32 - SYS_SETRESUID32 = __PNR_setresuid32 - SYS_SETREUID32 = __PNR_setreuid32 - SYS_SETUID32 = __PNR_setuid32 -) diff --git a/container/seccomp/syscall_extra_linux_arm64.go b/container/seccomp/syscall_extra_linux_arm64.go deleted file mode 100644 index 62d8ff19..00000000 --- a/container/seccomp/syscall_extra_linux_arm64.go +++ /dev/null @@ -1,55 +0,0 @@ -package seccomp - -import "syscall" - -const ( - SYS_NEWFSTATAT = syscall.SYS_FSTATAT -) - -var syscallNumExtra = map[string]int{ - "uselib": SYS_USELIB, - "clock_adjtime64": SYS_CLOCK_ADJTIME64, - "clock_settime64": SYS_CLOCK_SETTIME64, - "umount": SYS_UMOUNT, - "chown": SYS_CHOWN, - "chown32": SYS_CHOWN32, - "fchown32": SYS_FCHOWN32, - "lchown": SYS_LCHOWN, - "lchown32": SYS_LCHOWN32, - "setgid32": SYS_SETGID32, - "setgroups32": SYS_SETGROUPS32, - "setregid32": SYS_SETREGID32, - "setresgid32": SYS_SETRESGID32, - "setresuid32": SYS_SETRESUID32, - "setreuid32": SYS_SETREUID32, - "setuid32": SYS_SETUID32, - "modify_ldt": SYS_MODIFY_LDT, - "subpage_prot": SYS_SUBPAGE_PROT, - "switch_endian": SYS_SWITCH_ENDIAN, - "vm86": SYS_VM86, - "vm86old": SYS_VM86OLD, -} - -const ( - SYS_USELIB = __PNR_uselib - SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64 - SYS_CLOCK_SETTIME64 = __PNR_clock_settime64 - SYS_UMOUNT = __PNR_umount - SYS_CHOWN = __PNR_chown - SYS_CHOWN32 = __PNR_chown32 - SYS_FCHOWN32 = __PNR_fchown32 - SYS_LCHOWN = __PNR_lchown - SYS_LCHOWN32 = __PNR_lchown32 - SYS_SETGID32 = __PNR_setgid32 - SYS_SETGROUPS32 = __PNR_setgroups32 - SYS_SETREGID32 = __PNR_setregid32 - SYS_SETRESGID32 = __PNR_setresgid32 - SYS_SETRESUID32 = __PNR_setresuid32 - SYS_SETREUID32 = __PNR_setreuid32 - SYS_SETUID32 = __PNR_setuid32 - SYS_MODIFY_LDT = __PNR_modify_ldt - SYS_SUBPAGE_PROT = __PNR_subpage_prot - SYS_SWITCH_ENDIAN = __PNR_switch_endian - SYS_VM86 = __PNR_vm86 - SYS_VM86OLD = __PNR_vm86old -) diff --git a/container/seccomp/syscall_linux_amd64.go b/container/seccomp/syscall_linux_amd64.go deleted file mode 100644 index 28dbcb47..00000000 --- a/container/seccomp/syscall_linux_amd64.go +++ /dev/null @@ -1,459 +0,0 @@ -// mksysnum_linux.pl /usr/include/asm/unistd_64.h -// Code generated by the command above; DO NOT EDIT. - -package seccomp - -import . "syscall" - -var syscallNum = map[string]int{ - "read": SYS_READ, - "write": SYS_WRITE, - "open": SYS_OPEN, - "close": SYS_CLOSE, - "stat": SYS_STAT, - "fstat": SYS_FSTAT, - "lstat": SYS_LSTAT, - "poll": SYS_POLL, - "lseek": SYS_LSEEK, - "mmap": SYS_MMAP, - "mprotect": SYS_MPROTECT, - "munmap": SYS_MUNMAP, - "brk": SYS_BRK, - "rt_sigaction": SYS_RT_SIGACTION, - "rt_sigprocmask": SYS_RT_SIGPROCMASK, - "rt_sigreturn": SYS_RT_SIGRETURN, - "ioctl": SYS_IOCTL, - "pread64": SYS_PREAD64, - "pwrite64": SYS_PWRITE64, - "readv": SYS_READV, - "writev": SYS_WRITEV, - "access": SYS_ACCESS, - "pipe": SYS_PIPE, - "select": SYS_SELECT, - "sched_yield": SYS_SCHED_YIELD, - "mremap": SYS_MREMAP, - "msync": SYS_MSYNC, - "mincore": SYS_MINCORE, - "madvise": SYS_MADVISE, - "shmget": SYS_SHMGET, - "shmat": SYS_SHMAT, - "shmctl": SYS_SHMCTL, - "dup": SYS_DUP, - "dup2": SYS_DUP2, - "pause": SYS_PAUSE, - "nanosleep": SYS_NANOSLEEP, - "getitimer": SYS_GETITIMER, - "alarm": SYS_ALARM, - "setitimer": SYS_SETITIMER, - "getpid": SYS_GETPID, - "sendfile": SYS_SENDFILE, - "socket": SYS_SOCKET, - "connect": SYS_CONNECT, - "accept": SYS_ACCEPT, - "sendto": SYS_SENDTO, - "recvfrom": SYS_RECVFROM, - "sendmsg": SYS_SENDMSG, - "recvmsg": SYS_RECVMSG, - "shutdown": SYS_SHUTDOWN, - "bind": SYS_BIND, - "listen": SYS_LISTEN, - "getsockname": SYS_GETSOCKNAME, - "getpeername": SYS_GETPEERNAME, - "socketpair": SYS_SOCKETPAIR, - "setsockopt": SYS_SETSOCKOPT, - "getsockopt": SYS_GETSOCKOPT, - "clone": SYS_CLONE, - "fork": SYS_FORK, - "vfork": SYS_VFORK, - "execve": SYS_EXECVE, - "exit": SYS_EXIT, - "wait4": SYS_WAIT4, - "kill": SYS_KILL, - "uname": SYS_UNAME, - "semget": SYS_SEMGET, - "semop": SYS_SEMOP, - "semctl": SYS_SEMCTL, - "shmdt": SYS_SHMDT, - "msgget": SYS_MSGGET, - "msgsnd": SYS_MSGSND, - "msgrcv": SYS_MSGRCV, - "msgctl": SYS_MSGCTL, - "fcntl": SYS_FCNTL, - "flock": SYS_FLOCK, - "fsync": SYS_FSYNC, - "fdatasync": SYS_FDATASYNC, - "truncate": SYS_TRUNCATE, - "ftruncate": SYS_FTRUNCATE, - "getdents": SYS_GETDENTS, - "getcwd": SYS_GETCWD, - "chdir": SYS_CHDIR, - "fchdir": SYS_FCHDIR, - "rename": SYS_RENAME, - "mkdir": SYS_MKDIR, - "rmdir": SYS_RMDIR, - "creat": SYS_CREAT, - "link": SYS_LINK, - "unlink": SYS_UNLINK, - "symlink": SYS_SYMLINK, - "readlink": SYS_READLINK, - "chmod": SYS_CHMOD, - "fchmod": SYS_FCHMOD, - "chown": SYS_CHOWN, - "fchown": SYS_FCHOWN, - "lchown": SYS_LCHOWN, - "umask": SYS_UMASK, - "gettimeofday": SYS_GETTIMEOFDAY, - "getrlimit": SYS_GETRLIMIT, - "getrusage": SYS_GETRUSAGE, - "sysinfo": SYS_SYSINFO, - "times": SYS_TIMES, - "ptrace": SYS_PTRACE, - "getuid": SYS_GETUID, - "syslog": SYS_SYSLOG, - "getgid": SYS_GETGID, - "setuid": SYS_SETUID, - "setgid": SYS_SETGID, - "geteuid": SYS_GETEUID, - "getegid": SYS_GETEGID, - "setpgid": SYS_SETPGID, - "getppid": SYS_GETPPID, - "getpgrp": SYS_GETPGRP, - "setsid": SYS_SETSID, - "setreuid": SYS_SETREUID, - "setregid": SYS_SETREGID, - "getgroups": SYS_GETGROUPS, - "setgroups": SYS_SETGROUPS, - "setresuid": SYS_SETRESUID, - "getresuid": SYS_GETRESUID, - "setresgid": SYS_SETRESGID, - "getresgid": SYS_GETRESGID, - "getpgid": SYS_GETPGID, - "setfsuid": SYS_SETFSUID, - "setfsgid": SYS_SETFSGID, - "getsid": SYS_GETSID, - "capget": SYS_CAPGET, - "capset": SYS_CAPSET, - "rt_sigpending": SYS_RT_SIGPENDING, - "rt_sigtimedwait": SYS_RT_SIGTIMEDWAIT, - "rt_sigqueueinfo": SYS_RT_SIGQUEUEINFO, - "rt_sigsuspend": SYS_RT_SIGSUSPEND, - "sigaltstack": SYS_SIGALTSTACK, - "utime": SYS_UTIME, - "mknod": SYS_MKNOD, - "uselib": SYS_USELIB, - "personality": SYS_PERSONALITY, - "ustat": SYS_USTAT, - "statfs": SYS_STATFS, - "fstatfs": SYS_FSTATFS, - "sysfs": SYS_SYSFS, - "getpriority": SYS_GETPRIORITY, - "setpriority": SYS_SETPRIORITY, - "sched_setparam": SYS_SCHED_SETPARAM, - "sched_getparam": SYS_SCHED_GETPARAM, - "sched_setscheduler": SYS_SCHED_SETSCHEDULER, - "sched_getscheduler": SYS_SCHED_GETSCHEDULER, - "sched_get_priority_max": SYS_SCHED_GET_PRIORITY_MAX, - "sched_get_priority_min": SYS_SCHED_GET_PRIORITY_MIN, - "sched_rr_get_interval": SYS_SCHED_RR_GET_INTERVAL, - "mlock": SYS_MLOCK, - "munlock": SYS_MUNLOCK, - "mlockall": SYS_MLOCKALL, - "munlockall": SYS_MUNLOCKALL, - "vhangup": SYS_VHANGUP, - "modify_ldt": SYS_MODIFY_LDT, - "pivot_root": SYS_PIVOT_ROOT, - "_sysctl": SYS__SYSCTL, - "prctl": SYS_PRCTL, - "arch_prctl": SYS_ARCH_PRCTL, - "adjtimex": SYS_ADJTIMEX, - "setrlimit": SYS_SETRLIMIT, - "chroot": SYS_CHROOT, - "sync": SYS_SYNC, - "acct": SYS_ACCT, - "settimeofday": SYS_SETTIMEOFDAY, - "mount": SYS_MOUNT, - "umount2": SYS_UMOUNT2, - "swapon": SYS_SWAPON, - "swapoff": SYS_SWAPOFF, - "reboot": SYS_REBOOT, - "sethostname": SYS_SETHOSTNAME, - "setdomainname": SYS_SETDOMAINNAME, - "iopl": SYS_IOPL, - "ioperm": SYS_IOPERM, - "create_module": SYS_CREATE_MODULE, - "init_module": SYS_INIT_MODULE, - "delete_module": SYS_DELETE_MODULE, - "get_kernel_syms": SYS_GET_KERNEL_SYMS, - "query_module": SYS_QUERY_MODULE, - "quotactl": SYS_QUOTACTL, - "nfsservctl": SYS_NFSSERVCTL, - "getpmsg": SYS_GETPMSG, - "putpmsg": SYS_PUTPMSG, - "afs_syscall": SYS_AFS_SYSCALL, - "tuxcall": SYS_TUXCALL, - "security": SYS_SECURITY, - "gettid": SYS_GETTID, - "readahead": SYS_READAHEAD, - "setxattr": SYS_SETXATTR, - "lsetxattr": SYS_LSETXATTR, - "fsetxattr": SYS_FSETXATTR, - "getxattr": SYS_GETXATTR, - "lgetxattr": SYS_LGETXATTR, - "fgetxattr": SYS_FGETXATTR, - "listxattr": SYS_LISTXATTR, - "llistxattr": SYS_LLISTXATTR, - "flistxattr": SYS_FLISTXATTR, - "removexattr": SYS_REMOVEXATTR, - "lremovexattr": SYS_LREMOVEXATTR, - "fremovexattr": SYS_FREMOVEXATTR, - "tkill": SYS_TKILL, - "time": SYS_TIME, - "futex": SYS_FUTEX, - "sched_setaffinity": SYS_SCHED_SETAFFINITY, - "sched_getaffinity": SYS_SCHED_GETAFFINITY, - "set_thread_area": SYS_SET_THREAD_AREA, - "io_setup": SYS_IO_SETUP, - "io_destroy": SYS_IO_DESTROY, - "io_getevents": SYS_IO_GETEVENTS, - "io_submit": SYS_IO_SUBMIT, - "io_cancel": SYS_IO_CANCEL, - "get_thread_area": SYS_GET_THREAD_AREA, - "lookup_dcookie": SYS_LOOKUP_DCOOKIE, - "epoll_create": SYS_EPOLL_CREATE, - "epoll_ctl_old": SYS_EPOLL_CTL_OLD, - "epoll_wait_old": SYS_EPOLL_WAIT_OLD, - "remap_file_pages": SYS_REMAP_FILE_PAGES, - "getdents64": SYS_GETDENTS64, - "set_tid_address": SYS_SET_TID_ADDRESS, - "restart_syscall": SYS_RESTART_SYSCALL, - "semtimedop": SYS_SEMTIMEDOP, - "fadvise64": SYS_FADVISE64, - "timer_create": SYS_TIMER_CREATE, - "timer_settime": SYS_TIMER_SETTIME, - "timer_gettime": SYS_TIMER_GETTIME, - "timer_getoverrun": SYS_TIMER_GETOVERRUN, - "timer_delete": SYS_TIMER_DELETE, - "clock_settime": SYS_CLOCK_SETTIME, - "clock_gettime": SYS_CLOCK_GETTIME, - "clock_getres": SYS_CLOCK_GETRES, - "clock_nanosleep": SYS_CLOCK_NANOSLEEP, - "exit_group": SYS_EXIT_GROUP, - "epoll_wait": SYS_EPOLL_WAIT, - "epoll_ctl": SYS_EPOLL_CTL, - "tgkill": SYS_TGKILL, - "utimes": SYS_UTIMES, - "vserver": SYS_VSERVER, - "mbind": SYS_MBIND, - "set_mempolicy": SYS_SET_MEMPOLICY, - "get_mempolicy": SYS_GET_MEMPOLICY, - "mq_open": SYS_MQ_OPEN, - "mq_unlink": SYS_MQ_UNLINK, - "mq_timedsend": SYS_MQ_TIMEDSEND, - "mq_timedreceive": SYS_MQ_TIMEDRECEIVE, - "mq_notify": SYS_MQ_NOTIFY, - "mq_getsetattr": SYS_MQ_GETSETATTR, - "kexec_load": SYS_KEXEC_LOAD, - "waitid": SYS_WAITID, - "add_key": SYS_ADD_KEY, - "request_key": SYS_REQUEST_KEY, - "keyctl": SYS_KEYCTL, - "ioprio_set": SYS_IOPRIO_SET, - "ioprio_get": SYS_IOPRIO_GET, - "inotify_init": SYS_INOTIFY_INIT, - "inotify_add_watch": SYS_INOTIFY_ADD_WATCH, - "inotify_rm_watch": SYS_INOTIFY_RM_WATCH, - "migrate_pages": SYS_MIGRATE_PAGES, - "openat": SYS_OPENAT, - "mkdirat": SYS_MKDIRAT, - "mknodat": SYS_MKNODAT, - "fchownat": SYS_FCHOWNAT, - "futimesat": SYS_FUTIMESAT, - "newfstatat": SYS_NEWFSTATAT, - "unlinkat": SYS_UNLINKAT, - "renameat": SYS_RENAMEAT, - "linkat": SYS_LINKAT, - "symlinkat": SYS_SYMLINKAT, - "readlinkat": SYS_READLINKAT, - "fchmodat": SYS_FCHMODAT, - "faccessat": SYS_FACCESSAT, - "pselect6": SYS_PSELECT6, - "ppoll": SYS_PPOLL, - "unshare": SYS_UNSHARE, - "set_robust_list": SYS_SET_ROBUST_LIST, - "get_robust_list": SYS_GET_ROBUST_LIST, - "splice": SYS_SPLICE, - "tee": SYS_TEE, - "sync_file_range": SYS_SYNC_FILE_RANGE, - "vmsplice": SYS_VMSPLICE, - "move_pages": SYS_MOVE_PAGES, - "utimensat": SYS_UTIMENSAT, - "epoll_pwait": SYS_EPOLL_PWAIT, - "signalfd": SYS_SIGNALFD, - "timerfd_create": SYS_TIMERFD_CREATE, - "eventfd": SYS_EVENTFD, - "fallocate": SYS_FALLOCATE, - "timerfd_settime": SYS_TIMERFD_SETTIME, - "timerfd_gettime": SYS_TIMERFD_GETTIME, - "accept4": SYS_ACCEPT4, - "signalfd4": SYS_SIGNALFD4, - "eventfd2": SYS_EVENTFD2, - "epoll_create1": SYS_EPOLL_CREATE1, - "dup3": SYS_DUP3, - "pipe2": SYS_PIPE2, - "inotify_init1": SYS_INOTIFY_INIT1, - "preadv": SYS_PREADV, - "pwritev": SYS_PWRITEV, - "rt_tgsigqueueinfo": SYS_RT_TGSIGQUEUEINFO, - "perf_event_open": SYS_PERF_EVENT_OPEN, - "recvmmsg": SYS_RECVMMSG, - "fanotify_init": SYS_FANOTIFY_INIT, - "fanotify_mark": SYS_FANOTIFY_MARK, - "prlimit64": SYS_PRLIMIT64, - "name_to_handle_at": SYS_NAME_TO_HANDLE_AT, - "open_by_handle_at": SYS_OPEN_BY_HANDLE_AT, - "clock_adjtime": SYS_CLOCK_ADJTIME, - "syncfs": SYS_SYNCFS, - "sendmmsg": SYS_SENDMMSG, - "setns": SYS_SETNS, - "getcpu": SYS_GETCPU, - "process_vm_readv": SYS_PROCESS_VM_READV, - "process_vm_writev": SYS_PROCESS_VM_WRITEV, - "kcmp": SYS_KCMP, - "finit_module": SYS_FINIT_MODULE, - "sched_setattr": SYS_SCHED_SETATTR, - "sched_getattr": SYS_SCHED_GETATTR, - "renameat2": SYS_RENAMEAT2, - "seccomp": SYS_SECCOMP, - "getrandom": SYS_GETRANDOM, - "memfd_create": SYS_MEMFD_CREATE, - "kexec_file_load": SYS_KEXEC_FILE_LOAD, - "bpf": SYS_BPF, - "execveat": SYS_EXECVEAT, - "userfaultfd": SYS_USERFAULTFD, - "membarrier": SYS_MEMBARRIER, - "mlock2": SYS_MLOCK2, - "copy_file_range": SYS_COPY_FILE_RANGE, - "preadv2": SYS_PREADV2, - "pwritev2": SYS_PWRITEV2, - "pkey_mprotect": SYS_PKEY_MPROTECT, - "pkey_alloc": SYS_PKEY_ALLOC, - "pkey_free": SYS_PKEY_FREE, - "statx": SYS_STATX, - "io_pgetevents": SYS_IO_PGETEVENTS, - "rseq": SYS_RSEQ, - "uretprobe": SYS_URETPROBE, - "pidfd_send_signal": SYS_PIDFD_SEND_SIGNAL, - "io_uring_setup": SYS_IO_URING_SETUP, - "io_uring_enter": SYS_IO_URING_ENTER, - "io_uring_register": SYS_IO_URING_REGISTER, - "open_tree": SYS_OPEN_TREE, - "move_mount": SYS_MOVE_MOUNT, - "fsopen": SYS_FSOPEN, - "fsconfig": SYS_FSCONFIG, - "fsmount": SYS_FSMOUNT, - "fspick": SYS_FSPICK, - "pidfd_open": SYS_PIDFD_OPEN, - "clone3": SYS_CLONE3, - "close_range": SYS_CLOSE_RANGE, - "openat2": SYS_OPENAT2, - "pidfd_getfd": SYS_PIDFD_GETFD, - "faccessat2": SYS_FACCESSAT2, - "process_madvise": SYS_PROCESS_MADVISE, - "epoll_pwait2": SYS_EPOLL_PWAIT2, - "mount_setattr": SYS_MOUNT_SETATTR, - "quotactl_fd": SYS_QUOTACTL_FD, - "landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET, - "landlock_add_rule": SYS_LANDLOCK_ADD_RULE, - "landlock_restrict_self": SYS_LANDLOCK_RESTRICT_SELF, - "memfd_secret": SYS_MEMFD_SECRET, - "process_mrelease": SYS_PROCESS_MRELEASE, - "futex_waitv": SYS_FUTEX_WAITV, - "set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE, - "cachestat": SYS_CACHESTAT, - "fchmodat2": SYS_FCHMODAT2, - "map_shadow_stack": SYS_MAP_SHADOW_STACK, - "futex_wake": SYS_FUTEX_WAKE, - "futex_wait": SYS_FUTEX_WAIT, - "futex_requeue": SYS_FUTEX_REQUEUE, - "statmount": SYS_STATMOUNT, - "listmount": SYS_LISTMOUNT, - "lsm_get_self_attr": SYS_LSM_GET_SELF_ATTR, - "lsm_set_self_attr": SYS_LSM_SET_SELF_ATTR, - "lsm_list_modules": SYS_LSM_LIST_MODULES, - "mseal": SYS_MSEAL, -} - -const ( - SYS_NAME_TO_HANDLE_AT = 303 - SYS_OPEN_BY_HANDLE_AT = 304 - SYS_CLOCK_ADJTIME = 305 - SYS_SYNCFS = 306 - SYS_SENDMMSG = 307 - SYS_SETNS = 308 - SYS_GETCPU = 309 - SYS_PROCESS_VM_READV = 310 - SYS_PROCESS_VM_WRITEV = 311 - SYS_KCMP = 312 - SYS_FINIT_MODULE = 313 - SYS_SCHED_SETATTR = 314 - SYS_SCHED_GETATTR = 315 - SYS_RENAMEAT2 = 316 - SYS_SECCOMP = 317 - SYS_GETRANDOM = 318 - SYS_MEMFD_CREATE = 319 - SYS_KEXEC_FILE_LOAD = 320 - SYS_BPF = 321 - SYS_EXECVEAT = 322 - SYS_USERFAULTFD = 323 - SYS_MEMBARRIER = 324 - SYS_MLOCK2 = 325 - SYS_COPY_FILE_RANGE = 326 - SYS_PREADV2 = 327 - SYS_PWRITEV2 = 328 - SYS_PKEY_MPROTECT = 329 - SYS_PKEY_ALLOC = 330 - SYS_PKEY_FREE = 331 - SYS_STATX = 332 - SYS_IO_PGETEVENTS = 333 - SYS_RSEQ = 334 - SYS_URETPROBE = 335 - SYS_PIDFD_SEND_SIGNAL = 424 - SYS_IO_URING_SETUP = 425 - SYS_IO_URING_ENTER = 426 - SYS_IO_URING_REGISTER = 427 - SYS_OPEN_TREE = 428 - SYS_MOVE_MOUNT = 429 - SYS_FSOPEN = 430 - SYS_FSCONFIG = 431 - SYS_FSMOUNT = 432 - SYS_FSPICK = 433 - SYS_PIDFD_OPEN = 434 - SYS_CLONE3 = 435 - SYS_CLOSE_RANGE = 436 - SYS_OPENAT2 = 437 - SYS_PIDFD_GETFD = 438 - SYS_FACCESSAT2 = 439 - SYS_PROCESS_MADVISE = 440 - SYS_EPOLL_PWAIT2 = 441 - SYS_MOUNT_SETATTR = 442 - SYS_QUOTACTL_FD = 443 - SYS_LANDLOCK_CREATE_RULESET = 444 - SYS_LANDLOCK_ADD_RULE = 445 - SYS_LANDLOCK_RESTRICT_SELF = 446 - SYS_MEMFD_SECRET = 447 - SYS_PROCESS_MRELEASE = 448 - SYS_FUTEX_WAITV = 449 - SYS_SET_MEMPOLICY_HOME_NODE = 450 - SYS_CACHESTAT = 451 - SYS_FCHMODAT2 = 452 - SYS_MAP_SHADOW_STACK = 453 - SYS_FUTEX_WAKE = 454 - SYS_FUTEX_WAIT = 455 - SYS_FUTEX_REQUEUE = 456 - SYS_STATMOUNT = 457 - SYS_LISTMOUNT = 458 - SYS_LSM_GET_SELF_ATTR = 459 - SYS_LSM_SET_SELF_ATTR = 460 - SYS_LSM_LIST_MODULES = 461 - SYS_MSEAL = 462 -) diff --git a/container/seccomp/syscall_linux_arm64.go b/container/seccomp/syscall_linux_arm64.go deleted file mode 100644 index 9790ad6a..00000000 --- a/container/seccomp/syscall_linux_arm64.go +++ /dev/null @@ -1,382 +0,0 @@ -// mksysnum_linux.pl /usr/include/asm/unistd_64.h -// Code generated by the command above; DO NOT EDIT. - -package seccomp - -import . "syscall" - -var syscallNum = map[string]int{ - "io_setup": SYS_IO_SETUP, - "io_destroy": SYS_IO_DESTROY, - "io_submit": SYS_IO_SUBMIT, - "io_cancel": SYS_IO_CANCEL, - "io_getevents": SYS_IO_GETEVENTS, - "setxattr": SYS_SETXATTR, - "lsetxattr": SYS_LSETXATTR, - "fsetxattr": SYS_FSETXATTR, - "getxattr": SYS_GETXATTR, - "lgetxattr": SYS_LGETXATTR, - "fgetxattr": SYS_FGETXATTR, - "listxattr": SYS_LISTXATTR, - "llistxattr": SYS_LLISTXATTR, - "flistxattr": SYS_FLISTXATTR, - "removexattr": SYS_REMOVEXATTR, - "lremovexattr": SYS_LREMOVEXATTR, - "fremovexattr": SYS_FREMOVEXATTR, - "getcwd": SYS_GETCWD, - "lookup_dcookie": SYS_LOOKUP_DCOOKIE, - "eventfd2": SYS_EVENTFD2, - "epoll_create1": SYS_EPOLL_CREATE1, - "epoll_ctl": SYS_EPOLL_CTL, - "epoll_pwait": SYS_EPOLL_PWAIT, - "dup": SYS_DUP, - "dup3": SYS_DUP3, - "fcntl": SYS_FCNTL, - "inotify_init1": SYS_INOTIFY_INIT1, - "inotify_add_watch": SYS_INOTIFY_ADD_WATCH, - "inotify_rm_watch": SYS_INOTIFY_RM_WATCH, - "ioctl": SYS_IOCTL, - "ioprio_set": SYS_IOPRIO_SET, - "ioprio_get": SYS_IOPRIO_GET, - "flock": SYS_FLOCK, - "mknodat": SYS_MKNODAT, - "mkdirat": SYS_MKDIRAT, - "unlinkat": SYS_UNLINKAT, - "symlinkat": SYS_SYMLINKAT, - "linkat": SYS_LINKAT, - "renameat": SYS_RENAMEAT, - "umount2": SYS_UMOUNT2, - "mount": SYS_MOUNT, - "pivot_root": SYS_PIVOT_ROOT, - "nfsservctl": SYS_NFSSERVCTL, - "statfs": SYS_STATFS, - "fstatfs": SYS_FSTATFS, - "truncate": SYS_TRUNCATE, - "ftruncate": SYS_FTRUNCATE, - "fallocate": SYS_FALLOCATE, - "faccessat": SYS_FACCESSAT, - "chdir": SYS_CHDIR, - "fchdir": SYS_FCHDIR, - "chroot": SYS_CHROOT, - "fchmod": SYS_FCHMOD, - "fchmodat": SYS_FCHMODAT, - "fchownat": SYS_FCHOWNAT, - "fchown": SYS_FCHOWN, - "openat": SYS_OPENAT, - "close": SYS_CLOSE, - "vhangup": SYS_VHANGUP, - "pipe2": SYS_PIPE2, - "quotactl": SYS_QUOTACTL, - "getdents64": SYS_GETDENTS64, - "lseek": SYS_LSEEK, - "read": SYS_READ, - "write": SYS_WRITE, - "readv": SYS_READV, - "writev": SYS_WRITEV, - "pread64": SYS_PREAD64, - "pwrite64": SYS_PWRITE64, - "preadv": SYS_PREADV, - "pwritev": SYS_PWRITEV, - "sendfile": SYS_SENDFILE, - "pselect6": SYS_PSELECT6, - "ppoll": SYS_PPOLL, - "signalfd4": SYS_SIGNALFD4, - "vmsplice": SYS_VMSPLICE, - "splice": SYS_SPLICE, - "tee": SYS_TEE, - "readlinkat": SYS_READLINKAT, - "newfstatat": SYS_NEWFSTATAT, - "fstat": SYS_FSTAT, - "sync": SYS_SYNC, - "fsync": SYS_FSYNC, - "fdatasync": SYS_FDATASYNC, - "sync_file_range": SYS_SYNC_FILE_RANGE, - "timerfd_create": SYS_TIMERFD_CREATE, - "timerfd_settime": SYS_TIMERFD_SETTIME, - "timerfd_gettime": SYS_TIMERFD_GETTIME, - "utimensat": SYS_UTIMENSAT, - "acct": SYS_ACCT, - "capget": SYS_CAPGET, - "capset": SYS_CAPSET, - "personality": SYS_PERSONALITY, - "exit": SYS_EXIT, - "exit_group": SYS_EXIT_GROUP, - "waitid": SYS_WAITID, - "set_tid_address": SYS_SET_TID_ADDRESS, - "unshare": SYS_UNSHARE, - "futex": SYS_FUTEX, - "set_robust_list": SYS_SET_ROBUST_LIST, - "get_robust_list": SYS_GET_ROBUST_LIST, - "nanosleep": SYS_NANOSLEEP, - "getitimer": SYS_GETITIMER, - "setitimer": SYS_SETITIMER, - "kexec_load": SYS_KEXEC_LOAD, - "init_module": SYS_INIT_MODULE, - "delete_module": SYS_DELETE_MODULE, - "timer_create": SYS_TIMER_CREATE, - "timer_gettime": SYS_TIMER_GETTIME, - "timer_getoverrun": SYS_TIMER_GETOVERRUN, - "timer_settime": SYS_TIMER_SETTIME, - "timer_delete": SYS_TIMER_DELETE, - "clock_settime": SYS_CLOCK_SETTIME, - "clock_gettime": SYS_CLOCK_GETTIME, - "clock_getres": SYS_CLOCK_GETRES, - "clock_nanosleep": SYS_CLOCK_NANOSLEEP, - "syslog": SYS_SYSLOG, - "ptrace": SYS_PTRACE, - "sched_setparam": SYS_SCHED_SETPARAM, - "sched_setscheduler": SYS_SCHED_SETSCHEDULER, - "sched_getscheduler": SYS_SCHED_GETSCHEDULER, - "sched_getparam": SYS_SCHED_GETPARAM, - "sched_setaffinity": SYS_SCHED_SETAFFINITY, - "sched_getaffinity": SYS_SCHED_GETAFFINITY, - "sched_yield": SYS_SCHED_YIELD, - "sched_get_priority_max": SYS_SCHED_GET_PRIORITY_MAX, - "sched_get_priority_min": SYS_SCHED_GET_PRIORITY_MIN, - "sched_rr_get_interval": SYS_SCHED_RR_GET_INTERVAL, - "restart_syscall": SYS_RESTART_SYSCALL, - "kill": SYS_KILL, - "tkill": SYS_TKILL, - "tgkill": SYS_TGKILL, - "sigaltstack": SYS_SIGALTSTACK, - "rt_sigsuspend": SYS_RT_SIGSUSPEND, - "rt_sigaction": SYS_RT_SIGACTION, - "rt_sigprocmask": SYS_RT_SIGPROCMASK, - "rt_sigpending": SYS_RT_SIGPENDING, - "rt_sigtimedwait": SYS_RT_SIGTIMEDWAIT, - "rt_sigqueueinfo": SYS_RT_SIGQUEUEINFO, - "rt_sigreturn": SYS_RT_SIGRETURN, - "setpriority": SYS_SETPRIORITY, - "getpriority": SYS_GETPRIORITY, - "reboot": SYS_REBOOT, - "setregid": SYS_SETREGID, - "setgid": SYS_SETGID, - "setreuid": SYS_SETREUID, - "setuid": SYS_SETUID, - "setresuid": SYS_SETRESUID, - "getresuid": SYS_GETRESUID, - "setresgid": SYS_SETRESGID, - "getresgid": SYS_GETRESGID, - "setfsuid": SYS_SETFSUID, - "setfsgid": SYS_SETFSGID, - "times": SYS_TIMES, - "setpgid": SYS_SETPGID, - "getpgid": SYS_GETPGID, - "getsid": SYS_GETSID, - "setsid": SYS_SETSID, - "getgroups": SYS_GETGROUPS, - "setgroups": SYS_SETGROUPS, - "uname": SYS_UNAME, - "sethostname": SYS_SETHOSTNAME, - "setdomainname": SYS_SETDOMAINNAME, - "getrlimit": SYS_GETRLIMIT, - "setrlimit": SYS_SETRLIMIT, - "getrusage": SYS_GETRUSAGE, - "umask": SYS_UMASK, - "prctl": SYS_PRCTL, - "getcpu": SYS_GETCPU, - "gettimeofday": SYS_GETTIMEOFDAY, - "settimeofday": SYS_SETTIMEOFDAY, - "adjtimex": SYS_ADJTIMEX, - "getpid": SYS_GETPID, - "getppid": SYS_GETPPID, - "getuid": SYS_GETUID, - "geteuid": SYS_GETEUID, - "getgid": SYS_GETGID, - "getegid": SYS_GETEGID, - "gettid": SYS_GETTID, - "sysinfo": SYS_SYSINFO, - "mq_open": SYS_MQ_OPEN, - "mq_unlink": SYS_MQ_UNLINK, - "mq_timedsend": SYS_MQ_TIMEDSEND, - "mq_timedreceive": SYS_MQ_TIMEDRECEIVE, - "mq_notify": SYS_MQ_NOTIFY, - "mq_getsetattr": SYS_MQ_GETSETATTR, - "msgget": SYS_MSGGET, - "msgctl": SYS_MSGCTL, - "msgrcv": SYS_MSGRCV, - "msgsnd": SYS_MSGSND, - "semget": SYS_SEMGET, - "semctl": SYS_SEMCTL, - "semtimedop": SYS_SEMTIMEDOP, - "semop": SYS_SEMOP, - "shmget": SYS_SHMGET, - "shmctl": SYS_SHMCTL, - "shmat": SYS_SHMAT, - "shmdt": SYS_SHMDT, - "socket": SYS_SOCKET, - "socketpair": SYS_SOCKETPAIR, - "bind": SYS_BIND, - "listen": SYS_LISTEN, - "accept": SYS_ACCEPT, - "connect": SYS_CONNECT, - "getsockname": SYS_GETSOCKNAME, - "getpeername": SYS_GETPEERNAME, - "sendto": SYS_SENDTO, - "recvfrom": SYS_RECVFROM, - "setsockopt": SYS_SETSOCKOPT, - "getsockopt": SYS_GETSOCKOPT, - "shutdown": SYS_SHUTDOWN, - "sendmsg": SYS_SENDMSG, - "recvmsg": SYS_RECVMSG, - "readahead": SYS_READAHEAD, - "brk": SYS_BRK, - "munmap": SYS_MUNMAP, - "mremap": SYS_MREMAP, - "add_key": SYS_ADD_KEY, - "request_key": SYS_REQUEST_KEY, - "keyctl": SYS_KEYCTL, - "clone": SYS_CLONE, - "execve": SYS_EXECVE, - "mmap": SYS_MMAP, - "fadvise64": SYS_FADVISE64, - "swapon": SYS_SWAPON, - "swapoff": SYS_SWAPOFF, - "mprotect": SYS_MPROTECT, - "msync": SYS_MSYNC, - "mlock": SYS_MLOCK, - "munlock": SYS_MUNLOCK, - "mlockall": SYS_MLOCKALL, - "munlockall": SYS_MUNLOCKALL, - "mincore": SYS_MINCORE, - "madvise": SYS_MADVISE, - "remap_file_pages": SYS_REMAP_FILE_PAGES, - "mbind": SYS_MBIND, - "get_mempolicy": SYS_GET_MEMPOLICY, - "set_mempolicy": SYS_SET_MEMPOLICY, - "migrate_pages": SYS_MIGRATE_PAGES, - "move_pages": SYS_MOVE_PAGES, - "rt_tgsigqueueinfo": SYS_RT_TGSIGQUEUEINFO, - "perf_event_open": SYS_PERF_EVENT_OPEN, - "accept4": SYS_ACCEPT4, - "recvmmsg": SYS_RECVMMSG, - "wait4": SYS_WAIT4, - "prlimit64": SYS_PRLIMIT64, - "fanotify_init": SYS_FANOTIFY_INIT, - "fanotify_mark": SYS_FANOTIFY_MARK, - "name_to_handle_at": SYS_NAME_TO_HANDLE_AT, - "open_by_handle_at": SYS_OPEN_BY_HANDLE_AT, - "clock_adjtime": SYS_CLOCK_ADJTIME, - "syncfs": SYS_SYNCFS, - "setns": SYS_SETNS, - "sendmmsg": SYS_SENDMMSG, - "process_vm_readv": SYS_PROCESS_VM_READV, - "process_vm_writev": SYS_PROCESS_VM_WRITEV, - "kcmp": SYS_KCMP, - "finit_module": SYS_FINIT_MODULE, - "sched_setattr": SYS_SCHED_SETATTR, - "sched_getattr": SYS_SCHED_GETATTR, - "renameat2": SYS_RENAMEAT2, - "seccomp": SYS_SECCOMP, - "getrandom": SYS_GETRANDOM, - "memfd_create": SYS_MEMFD_CREATE, - "bpf": SYS_BPF, - "execveat": SYS_EXECVEAT, - "userfaultfd": SYS_USERFAULTFD, - "membarrier": SYS_MEMBARRIER, - "mlock2": SYS_MLOCK2, - "copy_file_range": SYS_COPY_FILE_RANGE, - "preadv2": SYS_PREADV2, - "pwritev2": SYS_PWRITEV2, - "pkey_mprotect": SYS_PKEY_MPROTECT, - "pkey_alloc": SYS_PKEY_ALLOC, - "pkey_free": SYS_PKEY_FREE, - "statx": SYS_STATX, - "io_pgetevents": SYS_IO_PGETEVENTS, - "rseq": SYS_RSEQ, - "kexec_file_load": SYS_KEXEC_FILE_LOAD, - "pidfd_send_signal": SYS_PIDFD_SEND_SIGNAL, - "io_uring_setup": SYS_IO_URING_SETUP, - "io_uring_enter": SYS_IO_URING_ENTER, - "io_uring_register": SYS_IO_URING_REGISTER, - "open_tree": SYS_OPEN_TREE, - "move_mount": SYS_MOVE_MOUNT, - "fsopen": SYS_FSOPEN, - "fsconfig": SYS_FSCONFIG, - "fsmount": SYS_FSMOUNT, - "fspick": SYS_FSPICK, - "pidfd_open": SYS_PIDFD_OPEN, - "clone3": SYS_CLONE3, - "close_range": SYS_CLOSE_RANGE, - "openat2": SYS_OPENAT2, - "pidfd_getfd": SYS_PIDFD_GETFD, - "faccessat2": SYS_FACCESSAT2, - "process_madvise": SYS_PROCESS_MADVISE, - "epoll_pwait2": SYS_EPOLL_PWAIT2, - "mount_setattr": SYS_MOUNT_SETATTR, - "quotactl_fd": SYS_QUOTACTL_FD, - "landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET, - "landlock_add_rule": SYS_LANDLOCK_ADD_RULE, - "landlock_restrict_self": SYS_LANDLOCK_RESTRICT_SELF, - "memfd_secret": SYS_MEMFD_SECRET, - "process_mrelease": SYS_PROCESS_MRELEASE, - "futex_waitv": SYS_FUTEX_WAITV, - "set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE, - "cachestat": SYS_CACHESTAT, - "fchmodat2": SYS_FCHMODAT2, - "map_shadow_stack": SYS_MAP_SHADOW_STACK, - "futex_wake": SYS_FUTEX_WAKE, - "futex_wait": SYS_FUTEX_WAIT, - "futex_requeue": SYS_FUTEX_REQUEUE, - "statmount": SYS_STATMOUNT, - "listmount": SYS_LISTMOUNT, - "lsm_get_self_attr": SYS_LSM_GET_SELF_ATTR, - "lsm_set_self_attr": SYS_LSM_SET_SELF_ATTR, - "lsm_list_modules": SYS_LSM_LIST_MODULES, - "mseal": SYS_MSEAL, -} - -const ( - SYS_USERFAULTFD = 282 - SYS_MEMBARRIER = 283 - SYS_MLOCK2 = 284 - SYS_COPY_FILE_RANGE = 285 - SYS_PREADV2 = 286 - SYS_PWRITEV2 = 287 - SYS_PKEY_MPROTECT = 288 - SYS_PKEY_ALLOC = 289 - SYS_PKEY_FREE = 290 - SYS_STATX = 291 - SYS_IO_PGETEVENTS = 292 - SYS_RSEQ = 293 - SYS_KEXEC_FILE_LOAD = 294 - SYS_PIDFD_SEND_SIGNAL = 424 - SYS_IO_URING_SETUP = 425 - SYS_IO_URING_ENTER = 426 - SYS_IO_URING_REGISTER = 427 - SYS_OPEN_TREE = 428 - SYS_MOVE_MOUNT = 429 - SYS_FSOPEN = 430 - SYS_FSCONFIG = 431 - SYS_FSMOUNT = 432 - SYS_FSPICK = 433 - SYS_PIDFD_OPEN = 434 - SYS_CLONE3 = 435 - SYS_CLOSE_RANGE = 436 - SYS_OPENAT2 = 437 - SYS_PIDFD_GETFD = 438 - SYS_FACCESSAT2 = 439 - SYS_PROCESS_MADVISE = 440 - SYS_EPOLL_PWAIT2 = 441 - SYS_MOUNT_SETATTR = 442 - SYS_QUOTACTL_FD = 443 - SYS_LANDLOCK_CREATE_RULESET = 444 - SYS_LANDLOCK_ADD_RULE = 445 - SYS_LANDLOCK_RESTRICT_SELF = 446 - SYS_MEMFD_SECRET = 447 - SYS_PROCESS_MRELEASE = 448 - SYS_FUTEX_WAITV = 449 - SYS_SET_MEMPOLICY_HOME_NODE = 450 - SYS_CACHESTAT = 451 - SYS_FCHMODAT2 = 452 - SYS_MAP_SHADOW_STACK = 453 - SYS_FUTEX_WAKE = 454 - SYS_FUTEX_WAIT = 455 - SYS_FUTEX_REQUEUE = 456 - SYS_STATMOUNT = 457 - SYS_LISTMOUNT = 458 - SYS_LSM_GET_SELF_ATTR = 459 - SYS_LSM_SET_SELF_ATTR = 460 - SYS_LSM_LIST_MODULES = 461 - SYS_MSEAL = 462 -) diff --git a/container/seccomp/syscall_test.go b/container/seccomp/syscall_test.go index e385a12c..57a73265 100644 --- a/container/seccomp/syscall_test.go +++ b/container/seccomp/syscall_test.go @@ -2,21 +2,21 @@ package seccomp import ( "testing" + + "hakurei.app/container/std" ) func TestSyscallResolveName(t *testing.T) { t.Parallel() - for name, want := range Syscalls() { + for name, want := range std.Syscalls() { t.Run(name, func(t *testing.T) { t.Parallel() - if got := syscallResolveName(name); got != want { + // this checks the std implementation against libseccomp. + if got, ok := syscallResolveName(name); !ok || got != want { t.Errorf("syscallResolveName(%q) = %d, want %d", name, got, want) } - if got, ok := SyscallResolveName(name); !ok || got != want { - t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want) - } }) } } diff --git a/container/std/mksysnum_linux.pl b/container/std/mksysnum_linux.pl new file mode 100755 index 00000000..0dee69d8 --- /dev/null +++ b/container/std/mksysnum_linux.pl @@ -0,0 +1,89 @@ +#!/usr/bin/env perl +# Copyright 2009 The Go Authors. All rights reserved. +# Use of this source code is governed by a BSD-style +# license that can be found in the LICENSE file. + +use strict; +use POSIX (); + +my $command = "mksysnum_linux.pl ". join(' ', @ARGV); +my $uname_arch = (POSIX::uname)[4]; +my %syscall_cutoff_arch = ( + "x86_64" => 302, + "aarch64" => 281, +); + +print < 999){ + # ignore deprecated syscalls that are no longer implemented + # https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/uapi/asm-generic/unistd.h?id=refs/heads/master#n716 + return; + } + (my $name_upper = $name) =~ y/a-z/A-Z/; + $num = $num + $offset; + if($num > $syscall_cutoff_arch{$uname_arch}){ # not wired in Go standard library + if($state < 0){ + print " \"$name\": SYS_$name_upper,\n"; + } + else{ + print " SYS_$name_upper = $num;\n"; + } + } + elsif($state < 0){ + print " \"$name\": SYS_$name_upper,\n"; + } + else{ + return; + } +} + +GENERATE: + +my $prev; +open(GCC, "gcc -E -dD $ARGV[0] |") || die "can't run gcc"; +while(){ + if(/^#define __NR_Linux\s+([0-9]+)/){ + # mips/mips64: extract offset + $offset = $1; + } + elsif(/^#define __NR_syscalls\s+/) { + # ignore redefinitions of __NR_syscalls + } + elsif(/^#define __NR_(\w+)\s+([0-9]+)/){ + $prev = $2; + fmt($1, $2); + } + elsif(/^#define __NR3264_(\w+)\s+([0-9]+)/){ + $prev = $2; + fmt($1, $2); + } + elsif(/^#define __NR_(\w+)\s+\(\w+\+\s*([0-9]+)\)/){ + fmt($1, $prev+$2) + } + elsif(/^#define __NR_(\w+)\s+\(__NR_Linux \+ ([0-9]+)/){ + fmt($1, $2); + } +} + +if($state < 0){ + $state = $state + 1; + print "}\n\nconst (\n"; + goto GENERATE; +} + +print ")"; diff --git a/container/std/pnr.go b/container/std/pnr.go new file mode 100644 index 00000000..1fa20ec0 --- /dev/null +++ b/container/std/pnr.go @@ -0,0 +1,267 @@ +// Code generated from include/seccomp-syscalls.h; DO NOT EDIT. + +package std + +/* + * pseudo syscall definitions + */ + +const ( + + /* socket syscalls */ + + __PNR_socket = -101 + __PNR_bind = -102 + __PNR_connect = -103 + __PNR_listen = -104 + __PNR_accept = -105 + __PNR_getsockname = -106 + __PNR_getpeername = -107 + __PNR_socketpair = -108 + __PNR_send = -109 + __PNR_recv = -110 + __PNR_sendto = -111 + __PNR_recvfrom = -112 + __PNR_shutdown = -113 + __PNR_setsockopt = -114 + __PNR_getsockopt = -115 + __PNR_sendmsg = -116 + __PNR_recvmsg = -117 + __PNR_accept4 = -118 + __PNR_recvmmsg = -119 + __PNR_sendmmsg = -120 + + /* ipc syscalls */ + + __PNR_semop = -201 + __PNR_semget = -202 + __PNR_semctl = -203 + __PNR_semtimedop = -204 + __PNR_msgsnd = -211 + __PNR_msgrcv = -212 + __PNR_msgget = -213 + __PNR_msgctl = -214 + __PNR_shmat = -221 + __PNR_shmdt = -222 + __PNR_shmget = -223 + __PNR_shmctl = -224 + + /* single syscalls */ + + __PNR_arch_prctl = -10001 + __PNR_bdflush = -10002 + __PNR_break = -10003 + __PNR_chown32 = -10004 + __PNR_epoll_ctl_old = -10005 + __PNR_epoll_wait_old = -10006 + __PNR_fadvise64_64 = -10007 + __PNR_fchown32 = -10008 + __PNR_fcntl64 = -10009 + __PNR_fstat64 = -10010 + __PNR_fstatat64 = -10011 + __PNR_fstatfs64 = -10012 + __PNR_ftime = -10013 + __PNR_ftruncate64 = -10014 + __PNR_getegid32 = -10015 + __PNR_geteuid32 = -10016 + __PNR_getgid32 = -10017 + __PNR_getgroups32 = -10018 + __PNR_getresgid32 = -10019 + __PNR_getresuid32 = -10020 + __PNR_getuid32 = -10021 + __PNR_gtty = -10022 + __PNR_idle = -10023 + __PNR_ipc = -10024 + __PNR_lchown32 = -10025 + __PNR__llseek = -10026 + __PNR_lock = -10027 + __PNR_lstat64 = -10028 + __PNR_mmap2 = -10029 + __PNR_mpx = -10030 + __PNR_newfstatat = -10031 + __PNR__newselect = -10032 + __PNR_nice = -10033 + __PNR_oldfstat = -10034 + __PNR_oldlstat = -10035 + __PNR_oldolduname = -10036 + __PNR_oldstat = -10037 + __PNR_olduname = -10038 + __PNR_prof = -10039 + __PNR_profil = -10040 + __PNR_readdir = -10041 + __PNR_security = -10042 + __PNR_sendfile64 = -10043 + __PNR_setfsgid32 = -10044 + __PNR_setfsuid32 = -10045 + __PNR_setgid32 = -10046 + __PNR_setgroups32 = -10047 + __PNR_setregid32 = -10048 + __PNR_setresgid32 = -10049 + __PNR_setresuid32 = -10050 + __PNR_setreuid32 = -10051 + __PNR_setuid32 = -10052 + __PNR_sgetmask = -10053 + __PNR_sigaction = -10054 + __PNR_signal = -10055 + __PNR_sigpending = -10056 + __PNR_sigprocmask = -10057 + __PNR_sigreturn = -10058 + __PNR_sigsuspend = -10059 + __PNR_socketcall = -10060 + __PNR_ssetmask = -10061 + __PNR_stat64 = -10062 + __PNR_statfs64 = -10063 + __PNR_stime = -10064 + __PNR_stty = -10065 + __PNR_truncate64 = -10066 + __PNR_tuxcall = -10067 + __PNR_ugetrlimit = -10068 + __PNR_ulimit = -10069 + __PNR_umount = -10070 + __PNR_vm86 = -10071 + __PNR_vm86old = -10072 + __PNR_waitpid = -10073 + __PNR_create_module = -10074 + __PNR_get_kernel_syms = -10075 + __PNR_get_thread_area = -10076 + __PNR_nfsservctl = -10077 + __PNR_query_module = -10078 + __PNR_set_thread_area = -10079 + __PNR__sysctl = -10080 + __PNR_uselib = -10081 + __PNR_vserver = -10082 + __PNR_arm_fadvise64_64 = -10083 + __PNR_arm_sync_file_range = -10084 + __PNR_pciconfig_iobase = -10086 + __PNR_pciconfig_read = -10087 + __PNR_pciconfig_write = -10088 + __PNR_sync_file_range2 = -10089 + __PNR_syscall = -10090 + __PNR_afs_syscall = -10091 + __PNR_fadvise64 = -10092 + __PNR_getpmsg = -10093 + __PNR_ioperm = -10094 + __PNR_iopl = -10095 + __PNR_migrate_pages = -10097 + __PNR_modify_ldt = -10098 + __PNR_putpmsg = -10099 + __PNR_sync_file_range = -10100 + __PNR_select = -10101 + __PNR_vfork = -10102 + __PNR_cachectl = -10103 + __PNR_cacheflush = -10104 + __PNR_sysmips = -10106 + __PNR_timerfd = -10107 + __PNR_time = -10108 + __PNR_getrandom = -10109 + __PNR_memfd_create = -10110 + __PNR_kexec_file_load = -10111 + __PNR_sysfs = -10145 + __PNR_oldwait4 = -10146 + __PNR_access = -10147 + __PNR_alarm = -10148 + __PNR_chmod = -10149 + __PNR_chown = -10150 + __PNR_creat = -10151 + __PNR_dup2 = -10152 + __PNR_epoll_create = -10153 + __PNR_epoll_wait = -10154 + __PNR_eventfd = -10155 + __PNR_fork = -10156 + __PNR_futimesat = -10157 + __PNR_getdents = -10158 + __PNR_getpgrp = -10159 + __PNR_inotify_init = -10160 + __PNR_lchown = -10161 + __PNR_link = -10162 + __PNR_lstat = -10163 + __PNR_mkdir = -10164 + __PNR_mknod = -10165 + __PNR_open = -10166 + __PNR_pause = -10167 + __PNR_pipe = -10168 + __PNR_poll = -10169 + __PNR_readlink = -10170 + __PNR_rename = -10171 + __PNR_rmdir = -10172 + __PNR_signalfd = -10173 + __PNR_stat = -10174 + __PNR_symlink = -10175 + __PNR_unlink = -10176 + __PNR_ustat = -10177 + __PNR_utime = -10178 + __PNR_utimes = -10179 + __PNR_getrlimit = -10180 + __PNR_mmap = -10181 + __PNR_breakpoint = -10182 + __PNR_set_tls = -10183 + __PNR_usr26 = -10184 + __PNR_usr32 = -10185 + __PNR_multiplexer = -10186 + __PNR_rtas = -10187 + __PNR_spu_create = -10188 + __PNR_spu_run = -10189 + __PNR_swapcontext = -10190 + __PNR_sys_debug_setcontext = -10191 + __PNR_switch_endian = -10191 + __PNR_get_mempolicy = -10192 + __PNR_move_pages = -10193 + __PNR_mbind = -10194 + __PNR_set_mempolicy = -10195 + __PNR_s390_runtime_instr = -10196 + __PNR_s390_pci_mmio_read = -10197 + __PNR_s390_pci_mmio_write = -10198 + __PNR_membarrier = -10199 + __PNR_userfaultfd = -10200 + __PNR_pkey_mprotect = -10201 + __PNR_pkey_alloc = -10202 + __PNR_pkey_free = -10203 + __PNR_get_tls = -10204 + __PNR_s390_guarded_storage = -10205 + __PNR_s390_sthyi = -10206 + __PNR_subpage_prot = -10207 + __PNR_statx = -10208 + __PNR_io_pgetevents = -10209 + __PNR_rseq = -10210 + __PNR_setrlimit = -10211 + __PNR_clock_adjtime64 = -10212 + __PNR_clock_getres_time64 = -10213 + __PNR_clock_gettime64 = -10214 + __PNR_clock_nanosleep_time64 = -10215 + __PNR_clock_settime64 = -10216 + __PNR_clone3 = -10217 + __PNR_fsconfig = -10218 + __PNR_fsmount = -10219 + __PNR_fsopen = -10220 + __PNR_fspick = -10221 + __PNR_futex_time64 = -10222 + __PNR_io_pgetevents_time64 = -10223 + __PNR_move_mount = -10224 + __PNR_mq_timedreceive_time64 = -10225 + __PNR_mq_timedsend_time64 = -10226 + __PNR_open_tree = -10227 + __PNR_pidfd_open = -10228 + __PNR_pidfd_send_signal = -10229 + __PNR_ppoll_time64 = -10230 + __PNR_pselect6_time64 = -10231 + __PNR_recvmmsg_time64 = -10232 + __PNR_rt_sigtimedwait_time64 = -10233 + __PNR_sched_rr_get_interval_time64 = -10234 + __PNR_semtimedop_time64 = -10235 + __PNR_timer_gettime64 = -10236 + __PNR_timer_settime64 = -10237 + __PNR_timerfd_gettime64 = -10238 + __PNR_timerfd_settime64 = -10239 + __PNR_utimensat_time64 = -10240 + __PNR_ppoll = -10241 + __PNR_renameat = -10242 + __PNR_riscv_flush_icache = -10243 + __PNR_memfd_secret = -10244 + __PNR_map_shadow_stack = -10245 + __PNR_fstat = -10246 + __PNR_atomic_barrier = -10247 + __PNR_atomic_cmpxchg_32 = -10248 + __PNR_getpagesize = -10249 + __PNR_riscv_hwprobe = -10250 + __PNR_uretprobe = -10251 +) diff --git a/container/std/syscall.go b/container/std/syscall.go new file mode 100644 index 00000000..ff8d396e --- /dev/null +++ b/container/std/syscall.go @@ -0,0 +1,28 @@ +package std + +import "iter" + +// Syscalls returns an iterator over all wired syscalls. +func Syscalls() iter.Seq2[string, int] { + return func(yield func(string, int) bool) { + for name, num := range syscallNum { + if !yield(name, num) { + return + } + } + for name, num := range syscallNumExtra { + if !yield(name, num) { + return + } + } + } +} + +// SyscallResolveName resolves a syscall number from its string representation. +func SyscallResolveName(name string) (num int, ok bool) { + if num, ok = syscallNum[name]; ok { + return + } + num, ok = syscallNumExtra[name] + return +} diff --git a/container/std/syscall_extra_linux_amd64.go b/container/std/syscall_extra_linux_amd64.go new file mode 100644 index 00000000..5f8d4837 --- /dev/null +++ b/container/std/syscall_extra_linux_amd64.go @@ -0,0 +1,41 @@ +package std + +var syscallNumExtra = map[string]int{ + "umount": SYS_UMOUNT, + "subpage_prot": SYS_SUBPAGE_PROT, + "switch_endian": SYS_SWITCH_ENDIAN, + "vm86": SYS_VM86, + "vm86old": SYS_VM86OLD, + "clock_adjtime64": SYS_CLOCK_ADJTIME64, + "clock_settime64": SYS_CLOCK_SETTIME64, + "chown32": SYS_CHOWN32, + "fchown32": SYS_FCHOWN32, + "lchown32": SYS_LCHOWN32, + "setgid32": SYS_SETGID32, + "setgroups32": SYS_SETGROUPS32, + "setregid32": SYS_SETREGID32, + "setresgid32": SYS_SETRESGID32, + "setresuid32": SYS_SETRESUID32, + "setreuid32": SYS_SETREUID32, + "setuid32": SYS_SETUID32, +} + +const ( + SYS_UMOUNT = __PNR_umount + SYS_SUBPAGE_PROT = __PNR_subpage_prot + SYS_SWITCH_ENDIAN = __PNR_switch_endian + SYS_VM86 = __PNR_vm86 + SYS_VM86OLD = __PNR_vm86old + SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64 + SYS_CLOCK_SETTIME64 = __PNR_clock_settime64 + SYS_CHOWN32 = __PNR_chown32 + SYS_FCHOWN32 = __PNR_fchown32 + SYS_LCHOWN32 = __PNR_lchown32 + SYS_SETGID32 = __PNR_setgid32 + SYS_SETGROUPS32 = __PNR_setgroups32 + SYS_SETREGID32 = __PNR_setregid32 + SYS_SETRESGID32 = __PNR_setresgid32 + SYS_SETRESUID32 = __PNR_setresuid32 + SYS_SETREUID32 = __PNR_setreuid32 + SYS_SETUID32 = __PNR_setuid32 +) diff --git a/container/std/syscall_extra_linux_arm64.go b/container/std/syscall_extra_linux_arm64.go new file mode 100644 index 00000000..d21af8ea --- /dev/null +++ b/container/std/syscall_extra_linux_arm64.go @@ -0,0 +1,55 @@ +package std + +import "syscall" + +const ( + SYS_NEWFSTATAT = syscall.SYS_FSTATAT +) + +var syscallNumExtra = map[string]int{ + "uselib": SYS_USELIB, + "clock_adjtime64": SYS_CLOCK_ADJTIME64, + "clock_settime64": SYS_CLOCK_SETTIME64, + "umount": SYS_UMOUNT, + "chown": SYS_CHOWN, + "chown32": SYS_CHOWN32, + "fchown32": SYS_FCHOWN32, + "lchown": SYS_LCHOWN, + "lchown32": SYS_LCHOWN32, + "setgid32": SYS_SETGID32, + "setgroups32": SYS_SETGROUPS32, + "setregid32": SYS_SETREGID32, + "setresgid32": SYS_SETRESGID32, + "setresuid32": SYS_SETRESUID32, + "setreuid32": SYS_SETREUID32, + "setuid32": SYS_SETUID32, + "modify_ldt": SYS_MODIFY_LDT, + "subpage_prot": SYS_SUBPAGE_PROT, + "switch_endian": SYS_SWITCH_ENDIAN, + "vm86": SYS_VM86, + "vm86old": SYS_VM86OLD, +} + +const ( + SYS_USELIB = __PNR_uselib + SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64 + SYS_CLOCK_SETTIME64 = __PNR_clock_settime64 + SYS_UMOUNT = __PNR_umount + SYS_CHOWN = __PNR_chown + SYS_CHOWN32 = __PNR_chown32 + SYS_FCHOWN32 = __PNR_fchown32 + SYS_LCHOWN = __PNR_lchown + SYS_LCHOWN32 = __PNR_lchown32 + SYS_SETGID32 = __PNR_setgid32 + SYS_SETGROUPS32 = __PNR_setgroups32 + SYS_SETREGID32 = __PNR_setregid32 + SYS_SETRESGID32 = __PNR_setresgid32 + SYS_SETRESUID32 = __PNR_setresuid32 + SYS_SETREUID32 = __PNR_setreuid32 + SYS_SETUID32 = __PNR_setuid32 + SYS_MODIFY_LDT = __PNR_modify_ldt + SYS_SUBPAGE_PROT = __PNR_subpage_prot + SYS_SWITCH_ENDIAN = __PNR_switch_endian + SYS_VM86 = __PNR_vm86 + SYS_VM86OLD = __PNR_vm86old +) diff --git a/container/std/syscall_linux_amd64.go b/container/std/syscall_linux_amd64.go new file mode 100644 index 00000000..183c99f6 --- /dev/null +++ b/container/std/syscall_linux_amd64.go @@ -0,0 +1,459 @@ +// mksysnum_linux.pl /usr/include/asm/unistd_64.h +// Code generated by the command above; DO NOT EDIT. + +package std + +import . "syscall" + +var syscallNum = map[string]int{ + "read": SYS_READ, + "write": SYS_WRITE, + "open": SYS_OPEN, + "close": SYS_CLOSE, + "stat": SYS_STAT, + "fstat": SYS_FSTAT, + "lstat": SYS_LSTAT, + "poll": SYS_POLL, + "lseek": SYS_LSEEK, + "mmap": SYS_MMAP, + "mprotect": SYS_MPROTECT, + "munmap": SYS_MUNMAP, + "brk": SYS_BRK, + "rt_sigaction": SYS_RT_SIGACTION, + "rt_sigprocmask": SYS_RT_SIGPROCMASK, + "rt_sigreturn": SYS_RT_SIGRETURN, + "ioctl": SYS_IOCTL, + "pread64": SYS_PREAD64, + "pwrite64": SYS_PWRITE64, + "readv": SYS_READV, + "writev": SYS_WRITEV, + "access": SYS_ACCESS, + "pipe": SYS_PIPE, + "select": SYS_SELECT, + "sched_yield": SYS_SCHED_YIELD, + "mremap": SYS_MREMAP, + "msync": SYS_MSYNC, + "mincore": SYS_MINCORE, + "madvise": SYS_MADVISE, + "shmget": SYS_SHMGET, + "shmat": SYS_SHMAT, + "shmctl": SYS_SHMCTL, + "dup": SYS_DUP, + "dup2": SYS_DUP2, + "pause": SYS_PAUSE, + "nanosleep": SYS_NANOSLEEP, + "getitimer": SYS_GETITIMER, + "alarm": SYS_ALARM, + "setitimer": SYS_SETITIMER, + "getpid": SYS_GETPID, + "sendfile": SYS_SENDFILE, + "socket": SYS_SOCKET, + "connect": SYS_CONNECT, + "accept": SYS_ACCEPT, + "sendto": SYS_SENDTO, + "recvfrom": SYS_RECVFROM, + "sendmsg": SYS_SENDMSG, + "recvmsg": SYS_RECVMSG, + "shutdown": SYS_SHUTDOWN, + "bind": SYS_BIND, + "listen": SYS_LISTEN, + "getsockname": SYS_GETSOCKNAME, + "getpeername": SYS_GETPEERNAME, + "socketpair": SYS_SOCKETPAIR, + "setsockopt": SYS_SETSOCKOPT, + "getsockopt": SYS_GETSOCKOPT, + "clone": SYS_CLONE, + "fork": SYS_FORK, + "vfork": SYS_VFORK, + "execve": SYS_EXECVE, + "exit": SYS_EXIT, + "wait4": SYS_WAIT4, + "kill": SYS_KILL, + "uname": SYS_UNAME, + "semget": SYS_SEMGET, + "semop": SYS_SEMOP, + "semctl": SYS_SEMCTL, + "shmdt": SYS_SHMDT, + "msgget": SYS_MSGGET, + "msgsnd": SYS_MSGSND, + "msgrcv": SYS_MSGRCV, + "msgctl": SYS_MSGCTL, + "fcntl": SYS_FCNTL, + "flock": SYS_FLOCK, + "fsync": SYS_FSYNC, + "fdatasync": SYS_FDATASYNC, + "truncate": SYS_TRUNCATE, + "ftruncate": SYS_FTRUNCATE, + "getdents": SYS_GETDENTS, + "getcwd": SYS_GETCWD, + "chdir": SYS_CHDIR, + "fchdir": SYS_FCHDIR, + "rename": SYS_RENAME, + "mkdir": SYS_MKDIR, + "rmdir": SYS_RMDIR, + "creat": SYS_CREAT, + "link": SYS_LINK, + "unlink": SYS_UNLINK, + "symlink": SYS_SYMLINK, + "readlink": SYS_READLINK, + "chmod": SYS_CHMOD, + "fchmod": SYS_FCHMOD, + "chown": SYS_CHOWN, + "fchown": SYS_FCHOWN, + "lchown": SYS_LCHOWN, + "umask": SYS_UMASK, + "gettimeofday": SYS_GETTIMEOFDAY, + "getrlimit": SYS_GETRLIMIT, + "getrusage": SYS_GETRUSAGE, + "sysinfo": SYS_SYSINFO, + "times": SYS_TIMES, + "ptrace": SYS_PTRACE, + "getuid": SYS_GETUID, + "syslog": SYS_SYSLOG, + "getgid": SYS_GETGID, + "setuid": SYS_SETUID, + "setgid": SYS_SETGID, + "geteuid": SYS_GETEUID, + "getegid": SYS_GETEGID, + "setpgid": SYS_SETPGID, + "getppid": SYS_GETPPID, + "getpgrp": SYS_GETPGRP, + "setsid": SYS_SETSID, + "setreuid": SYS_SETREUID, + "setregid": SYS_SETREGID, + "getgroups": SYS_GETGROUPS, + "setgroups": SYS_SETGROUPS, + "setresuid": SYS_SETRESUID, + "getresuid": SYS_GETRESUID, + "setresgid": SYS_SETRESGID, + "getresgid": SYS_GETRESGID, + "getpgid": SYS_GETPGID, + "setfsuid": SYS_SETFSUID, + "setfsgid": SYS_SETFSGID, + "getsid": SYS_GETSID, + "capget": SYS_CAPGET, + "capset": SYS_CAPSET, + "rt_sigpending": SYS_RT_SIGPENDING, + "rt_sigtimedwait": SYS_RT_SIGTIMEDWAIT, + "rt_sigqueueinfo": SYS_RT_SIGQUEUEINFO, + "rt_sigsuspend": SYS_RT_SIGSUSPEND, + "sigaltstack": SYS_SIGALTSTACK, + "utime": SYS_UTIME, + "mknod": SYS_MKNOD, + "uselib": SYS_USELIB, + "personality": SYS_PERSONALITY, + "ustat": SYS_USTAT, + "statfs": SYS_STATFS, + "fstatfs": SYS_FSTATFS, + "sysfs": SYS_SYSFS, + "getpriority": SYS_GETPRIORITY, + "setpriority": SYS_SETPRIORITY, + "sched_setparam": SYS_SCHED_SETPARAM, + "sched_getparam": SYS_SCHED_GETPARAM, + "sched_setscheduler": SYS_SCHED_SETSCHEDULER, + "sched_getscheduler": SYS_SCHED_GETSCHEDULER, + "sched_get_priority_max": SYS_SCHED_GET_PRIORITY_MAX, + "sched_get_priority_min": SYS_SCHED_GET_PRIORITY_MIN, + "sched_rr_get_interval": SYS_SCHED_RR_GET_INTERVAL, + "mlock": SYS_MLOCK, + "munlock": SYS_MUNLOCK, + "mlockall": SYS_MLOCKALL, + "munlockall": SYS_MUNLOCKALL, + "vhangup": SYS_VHANGUP, + "modify_ldt": SYS_MODIFY_LDT, + "pivot_root": SYS_PIVOT_ROOT, + "_sysctl": SYS__SYSCTL, + "prctl": SYS_PRCTL, + "arch_prctl": SYS_ARCH_PRCTL, + "adjtimex": SYS_ADJTIMEX, + "setrlimit": SYS_SETRLIMIT, + "chroot": SYS_CHROOT, + "sync": SYS_SYNC, + "acct": SYS_ACCT, + "settimeofday": SYS_SETTIMEOFDAY, + "mount": SYS_MOUNT, + "umount2": SYS_UMOUNT2, + "swapon": SYS_SWAPON, + "swapoff": SYS_SWAPOFF, + "reboot": SYS_REBOOT, + "sethostname": SYS_SETHOSTNAME, + "setdomainname": SYS_SETDOMAINNAME, + "iopl": SYS_IOPL, + "ioperm": SYS_IOPERM, + "create_module": SYS_CREATE_MODULE, + "init_module": SYS_INIT_MODULE, + "delete_module": SYS_DELETE_MODULE, + "get_kernel_syms": SYS_GET_KERNEL_SYMS, + "query_module": SYS_QUERY_MODULE, + "quotactl": SYS_QUOTACTL, + "nfsservctl": SYS_NFSSERVCTL, + "getpmsg": SYS_GETPMSG, + "putpmsg": SYS_PUTPMSG, + "afs_syscall": SYS_AFS_SYSCALL, + "tuxcall": SYS_TUXCALL, + "security": SYS_SECURITY, + "gettid": SYS_GETTID, + "readahead": SYS_READAHEAD, + "setxattr": SYS_SETXATTR, + "lsetxattr": SYS_LSETXATTR, + "fsetxattr": SYS_FSETXATTR, + "getxattr": SYS_GETXATTR, + "lgetxattr": SYS_LGETXATTR, + "fgetxattr": SYS_FGETXATTR, + "listxattr": SYS_LISTXATTR, + "llistxattr": SYS_LLISTXATTR, + "flistxattr": SYS_FLISTXATTR, + "removexattr": SYS_REMOVEXATTR, + "lremovexattr": SYS_LREMOVEXATTR, + "fremovexattr": SYS_FREMOVEXATTR, + "tkill": SYS_TKILL, + "time": SYS_TIME, + "futex": SYS_FUTEX, + "sched_setaffinity": SYS_SCHED_SETAFFINITY, + "sched_getaffinity": SYS_SCHED_GETAFFINITY, + "set_thread_area": SYS_SET_THREAD_AREA, + "io_setup": SYS_IO_SETUP, + "io_destroy": SYS_IO_DESTROY, + "io_getevents": SYS_IO_GETEVENTS, + "io_submit": SYS_IO_SUBMIT, + "io_cancel": SYS_IO_CANCEL, + "get_thread_area": SYS_GET_THREAD_AREA, + "lookup_dcookie": SYS_LOOKUP_DCOOKIE, + "epoll_create": SYS_EPOLL_CREATE, + "epoll_ctl_old": SYS_EPOLL_CTL_OLD, + "epoll_wait_old": SYS_EPOLL_WAIT_OLD, + "remap_file_pages": SYS_REMAP_FILE_PAGES, + "getdents64": SYS_GETDENTS64, + "set_tid_address": SYS_SET_TID_ADDRESS, + "restart_syscall": SYS_RESTART_SYSCALL, + "semtimedop": SYS_SEMTIMEDOP, + "fadvise64": SYS_FADVISE64, + "timer_create": SYS_TIMER_CREATE, + "timer_settime": SYS_TIMER_SETTIME, + "timer_gettime": SYS_TIMER_GETTIME, + "timer_getoverrun": SYS_TIMER_GETOVERRUN, + "timer_delete": SYS_TIMER_DELETE, + "clock_settime": SYS_CLOCK_SETTIME, + "clock_gettime": SYS_CLOCK_GETTIME, + "clock_getres": SYS_CLOCK_GETRES, + "clock_nanosleep": SYS_CLOCK_NANOSLEEP, + "exit_group": SYS_EXIT_GROUP, + "epoll_wait": SYS_EPOLL_WAIT, + "epoll_ctl": SYS_EPOLL_CTL, + "tgkill": SYS_TGKILL, + "utimes": SYS_UTIMES, + "vserver": SYS_VSERVER, + "mbind": SYS_MBIND, + "set_mempolicy": SYS_SET_MEMPOLICY, + "get_mempolicy": SYS_GET_MEMPOLICY, + "mq_open": SYS_MQ_OPEN, + "mq_unlink": SYS_MQ_UNLINK, + "mq_timedsend": SYS_MQ_TIMEDSEND, + "mq_timedreceive": SYS_MQ_TIMEDRECEIVE, + "mq_notify": SYS_MQ_NOTIFY, + "mq_getsetattr": SYS_MQ_GETSETATTR, + "kexec_load": SYS_KEXEC_LOAD, + "waitid": SYS_WAITID, + "add_key": SYS_ADD_KEY, + "request_key": SYS_REQUEST_KEY, + "keyctl": SYS_KEYCTL, + "ioprio_set": SYS_IOPRIO_SET, + "ioprio_get": SYS_IOPRIO_GET, + "inotify_init": SYS_INOTIFY_INIT, + "inotify_add_watch": SYS_INOTIFY_ADD_WATCH, + "inotify_rm_watch": SYS_INOTIFY_RM_WATCH, + "migrate_pages": SYS_MIGRATE_PAGES, + "openat": SYS_OPENAT, + "mkdirat": SYS_MKDIRAT, + "mknodat": SYS_MKNODAT, + "fchownat": SYS_FCHOWNAT, + "futimesat": SYS_FUTIMESAT, + "newfstatat": SYS_NEWFSTATAT, + "unlinkat": SYS_UNLINKAT, + "renameat": SYS_RENAMEAT, + "linkat": SYS_LINKAT, + "symlinkat": SYS_SYMLINKAT, + "readlinkat": SYS_READLINKAT, + "fchmodat": SYS_FCHMODAT, + "faccessat": SYS_FACCESSAT, + "pselect6": SYS_PSELECT6, + "ppoll": SYS_PPOLL, + "unshare": SYS_UNSHARE, + "set_robust_list": SYS_SET_ROBUST_LIST, + "get_robust_list": SYS_GET_ROBUST_LIST, + "splice": SYS_SPLICE, + "tee": SYS_TEE, + "sync_file_range": SYS_SYNC_FILE_RANGE, + "vmsplice": SYS_VMSPLICE, + "move_pages": SYS_MOVE_PAGES, + "utimensat": SYS_UTIMENSAT, + "epoll_pwait": SYS_EPOLL_PWAIT, + "signalfd": SYS_SIGNALFD, + "timerfd_create": SYS_TIMERFD_CREATE, + "eventfd": SYS_EVENTFD, + "fallocate": SYS_FALLOCATE, + "timerfd_settime": SYS_TIMERFD_SETTIME, + "timerfd_gettime": SYS_TIMERFD_GETTIME, + "accept4": SYS_ACCEPT4, + "signalfd4": SYS_SIGNALFD4, + "eventfd2": SYS_EVENTFD2, + "epoll_create1": SYS_EPOLL_CREATE1, + "dup3": SYS_DUP3, + "pipe2": SYS_PIPE2, + "inotify_init1": SYS_INOTIFY_INIT1, + "preadv": SYS_PREADV, + "pwritev": SYS_PWRITEV, + "rt_tgsigqueueinfo": SYS_RT_TGSIGQUEUEINFO, + "perf_event_open": SYS_PERF_EVENT_OPEN, + "recvmmsg": SYS_RECVMMSG, + "fanotify_init": SYS_FANOTIFY_INIT, + "fanotify_mark": SYS_FANOTIFY_MARK, + "prlimit64": SYS_PRLIMIT64, + "name_to_handle_at": SYS_NAME_TO_HANDLE_AT, + "open_by_handle_at": SYS_OPEN_BY_HANDLE_AT, + "clock_adjtime": SYS_CLOCK_ADJTIME, + "syncfs": SYS_SYNCFS, + "sendmmsg": SYS_SENDMMSG, + "setns": SYS_SETNS, + "getcpu": SYS_GETCPU, + "process_vm_readv": SYS_PROCESS_VM_READV, + "process_vm_writev": SYS_PROCESS_VM_WRITEV, + "kcmp": SYS_KCMP, + "finit_module": SYS_FINIT_MODULE, + "sched_setattr": SYS_SCHED_SETATTR, + "sched_getattr": SYS_SCHED_GETATTR, + "renameat2": SYS_RENAMEAT2, + "seccomp": SYS_SECCOMP, + "getrandom": SYS_GETRANDOM, + "memfd_create": SYS_MEMFD_CREATE, + "kexec_file_load": SYS_KEXEC_FILE_LOAD, + "bpf": SYS_BPF, + "execveat": SYS_EXECVEAT, + "userfaultfd": SYS_USERFAULTFD, + "membarrier": SYS_MEMBARRIER, + "mlock2": SYS_MLOCK2, + "copy_file_range": SYS_COPY_FILE_RANGE, + "preadv2": SYS_PREADV2, + "pwritev2": SYS_PWRITEV2, + "pkey_mprotect": SYS_PKEY_MPROTECT, + "pkey_alloc": SYS_PKEY_ALLOC, + "pkey_free": SYS_PKEY_FREE, + "statx": SYS_STATX, + "io_pgetevents": SYS_IO_PGETEVENTS, + "rseq": SYS_RSEQ, + "uretprobe": SYS_URETPROBE, + "pidfd_send_signal": SYS_PIDFD_SEND_SIGNAL, + "io_uring_setup": SYS_IO_URING_SETUP, + "io_uring_enter": SYS_IO_URING_ENTER, + "io_uring_register": SYS_IO_URING_REGISTER, + "open_tree": SYS_OPEN_TREE, + "move_mount": SYS_MOVE_MOUNT, + "fsopen": SYS_FSOPEN, + "fsconfig": SYS_FSCONFIG, + "fsmount": SYS_FSMOUNT, + "fspick": SYS_FSPICK, + "pidfd_open": SYS_PIDFD_OPEN, + "clone3": SYS_CLONE3, + "close_range": SYS_CLOSE_RANGE, + "openat2": SYS_OPENAT2, + "pidfd_getfd": SYS_PIDFD_GETFD, + "faccessat2": SYS_FACCESSAT2, + "process_madvise": SYS_PROCESS_MADVISE, + "epoll_pwait2": SYS_EPOLL_PWAIT2, + "mount_setattr": SYS_MOUNT_SETATTR, + "quotactl_fd": SYS_QUOTACTL_FD, + "landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET, + "landlock_add_rule": SYS_LANDLOCK_ADD_RULE, + "landlock_restrict_self": SYS_LANDLOCK_RESTRICT_SELF, + "memfd_secret": SYS_MEMFD_SECRET, + "process_mrelease": SYS_PROCESS_MRELEASE, + "futex_waitv": SYS_FUTEX_WAITV, + "set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE, + "cachestat": SYS_CACHESTAT, + "fchmodat2": SYS_FCHMODAT2, + "map_shadow_stack": SYS_MAP_SHADOW_STACK, + "futex_wake": SYS_FUTEX_WAKE, + "futex_wait": SYS_FUTEX_WAIT, + "futex_requeue": SYS_FUTEX_REQUEUE, + "statmount": SYS_STATMOUNT, + "listmount": SYS_LISTMOUNT, + "lsm_get_self_attr": SYS_LSM_GET_SELF_ATTR, + "lsm_set_self_attr": SYS_LSM_SET_SELF_ATTR, + "lsm_list_modules": SYS_LSM_LIST_MODULES, + "mseal": SYS_MSEAL, +} + +const ( + SYS_NAME_TO_HANDLE_AT = 303 + SYS_OPEN_BY_HANDLE_AT = 304 + SYS_CLOCK_ADJTIME = 305 + SYS_SYNCFS = 306 + SYS_SENDMMSG = 307 + SYS_SETNS = 308 + SYS_GETCPU = 309 + SYS_PROCESS_VM_READV = 310 + SYS_PROCESS_VM_WRITEV = 311 + SYS_KCMP = 312 + SYS_FINIT_MODULE = 313 + SYS_SCHED_SETATTR = 314 + SYS_SCHED_GETATTR = 315 + SYS_RENAMEAT2 = 316 + SYS_SECCOMP = 317 + SYS_GETRANDOM = 318 + SYS_MEMFD_CREATE = 319 + SYS_KEXEC_FILE_LOAD = 320 + SYS_BPF = 321 + SYS_EXECVEAT = 322 + SYS_USERFAULTFD = 323 + SYS_MEMBARRIER = 324 + SYS_MLOCK2 = 325 + SYS_COPY_FILE_RANGE = 326 + SYS_PREADV2 = 327 + SYS_PWRITEV2 = 328 + SYS_PKEY_MPROTECT = 329 + SYS_PKEY_ALLOC = 330 + SYS_PKEY_FREE = 331 + SYS_STATX = 332 + SYS_IO_PGETEVENTS = 333 + SYS_RSEQ = 334 + SYS_URETPROBE = 335 + SYS_PIDFD_SEND_SIGNAL = 424 + SYS_IO_URING_SETUP = 425 + SYS_IO_URING_ENTER = 426 + SYS_IO_URING_REGISTER = 427 + SYS_OPEN_TREE = 428 + SYS_MOVE_MOUNT = 429 + SYS_FSOPEN = 430 + SYS_FSCONFIG = 431 + SYS_FSMOUNT = 432 + SYS_FSPICK = 433 + SYS_PIDFD_OPEN = 434 + SYS_CLONE3 = 435 + SYS_CLOSE_RANGE = 436 + SYS_OPENAT2 = 437 + SYS_PIDFD_GETFD = 438 + SYS_FACCESSAT2 = 439 + SYS_PROCESS_MADVISE = 440 + SYS_EPOLL_PWAIT2 = 441 + SYS_MOUNT_SETATTR = 442 + SYS_QUOTACTL_FD = 443 + SYS_LANDLOCK_CREATE_RULESET = 444 + SYS_LANDLOCK_ADD_RULE = 445 + SYS_LANDLOCK_RESTRICT_SELF = 446 + SYS_MEMFD_SECRET = 447 + SYS_PROCESS_MRELEASE = 448 + SYS_FUTEX_WAITV = 449 + SYS_SET_MEMPOLICY_HOME_NODE = 450 + SYS_CACHESTAT = 451 + SYS_FCHMODAT2 = 452 + SYS_MAP_SHADOW_STACK = 453 + SYS_FUTEX_WAKE = 454 + SYS_FUTEX_WAIT = 455 + SYS_FUTEX_REQUEUE = 456 + SYS_STATMOUNT = 457 + SYS_LISTMOUNT = 458 + SYS_LSM_GET_SELF_ATTR = 459 + SYS_LSM_SET_SELF_ATTR = 460 + SYS_LSM_LIST_MODULES = 461 + SYS_MSEAL = 462 +) diff --git a/container/std/syscall_linux_arm64.go b/container/std/syscall_linux_arm64.go new file mode 100644 index 00000000..223da39c --- /dev/null +++ b/container/std/syscall_linux_arm64.go @@ -0,0 +1,382 @@ +// mksysnum_linux.pl /usr/include/asm/unistd_64.h +// Code generated by the command above; DO NOT EDIT. + +package std + +import . "syscall" + +var syscallNum = map[string]int{ + "io_setup": SYS_IO_SETUP, + "io_destroy": SYS_IO_DESTROY, + "io_submit": SYS_IO_SUBMIT, + "io_cancel": SYS_IO_CANCEL, + "io_getevents": SYS_IO_GETEVENTS, + "setxattr": SYS_SETXATTR, + "lsetxattr": SYS_LSETXATTR, + "fsetxattr": SYS_FSETXATTR, + "getxattr": SYS_GETXATTR, + "lgetxattr": SYS_LGETXATTR, + "fgetxattr": SYS_FGETXATTR, + "listxattr": SYS_LISTXATTR, + "llistxattr": SYS_LLISTXATTR, + "flistxattr": SYS_FLISTXATTR, + "removexattr": SYS_REMOVEXATTR, + "lremovexattr": SYS_LREMOVEXATTR, + "fremovexattr": SYS_FREMOVEXATTR, + "getcwd": SYS_GETCWD, + "lookup_dcookie": SYS_LOOKUP_DCOOKIE, + "eventfd2": SYS_EVENTFD2, + "epoll_create1": SYS_EPOLL_CREATE1, + "epoll_ctl": SYS_EPOLL_CTL, + "epoll_pwait": SYS_EPOLL_PWAIT, + "dup": SYS_DUP, + "dup3": SYS_DUP3, + "fcntl": SYS_FCNTL, + "inotify_init1": SYS_INOTIFY_INIT1, + "inotify_add_watch": SYS_INOTIFY_ADD_WATCH, + "inotify_rm_watch": SYS_INOTIFY_RM_WATCH, + "ioctl": SYS_IOCTL, + "ioprio_set": SYS_IOPRIO_SET, + "ioprio_get": SYS_IOPRIO_GET, + "flock": SYS_FLOCK, + "mknodat": SYS_MKNODAT, + "mkdirat": SYS_MKDIRAT, + "unlinkat": SYS_UNLINKAT, + "symlinkat": SYS_SYMLINKAT, + "linkat": SYS_LINKAT, + "renameat": SYS_RENAMEAT, + "umount2": SYS_UMOUNT2, + "mount": SYS_MOUNT, + "pivot_root": SYS_PIVOT_ROOT, + "nfsservctl": SYS_NFSSERVCTL, + "statfs": SYS_STATFS, + "fstatfs": SYS_FSTATFS, + "truncate": SYS_TRUNCATE, + "ftruncate": SYS_FTRUNCATE, + "fallocate": SYS_FALLOCATE, + "faccessat": SYS_FACCESSAT, + "chdir": SYS_CHDIR, + "fchdir": SYS_FCHDIR, + "chroot": SYS_CHROOT, + "fchmod": SYS_FCHMOD, + "fchmodat": SYS_FCHMODAT, + "fchownat": SYS_FCHOWNAT, + "fchown": SYS_FCHOWN, + "openat": SYS_OPENAT, + "close": SYS_CLOSE, + "vhangup": SYS_VHANGUP, + "pipe2": SYS_PIPE2, + "quotactl": SYS_QUOTACTL, + "getdents64": SYS_GETDENTS64, + "lseek": SYS_LSEEK, + "read": SYS_READ, + "write": SYS_WRITE, + "readv": SYS_READV, + "writev": SYS_WRITEV, + "pread64": SYS_PREAD64, + "pwrite64": SYS_PWRITE64, + "preadv": SYS_PREADV, + "pwritev": SYS_PWRITEV, + "sendfile": SYS_SENDFILE, + "pselect6": SYS_PSELECT6, + "ppoll": SYS_PPOLL, + "signalfd4": SYS_SIGNALFD4, + "vmsplice": SYS_VMSPLICE, + "splice": SYS_SPLICE, + "tee": SYS_TEE, + "readlinkat": SYS_READLINKAT, + "newfstatat": SYS_NEWFSTATAT, + "fstat": SYS_FSTAT, + "sync": SYS_SYNC, + "fsync": SYS_FSYNC, + "fdatasync": SYS_FDATASYNC, + "sync_file_range": SYS_SYNC_FILE_RANGE, + "timerfd_create": SYS_TIMERFD_CREATE, + "timerfd_settime": SYS_TIMERFD_SETTIME, + "timerfd_gettime": SYS_TIMERFD_GETTIME, + "utimensat": SYS_UTIMENSAT, + "acct": SYS_ACCT, + "capget": SYS_CAPGET, + "capset": SYS_CAPSET, + "personality": SYS_PERSONALITY, + "exit": SYS_EXIT, + "exit_group": SYS_EXIT_GROUP, + "waitid": SYS_WAITID, + "set_tid_address": SYS_SET_TID_ADDRESS, + "unshare": SYS_UNSHARE, + "futex": SYS_FUTEX, + "set_robust_list": SYS_SET_ROBUST_LIST, + "get_robust_list": SYS_GET_ROBUST_LIST, + "nanosleep": SYS_NANOSLEEP, + "getitimer": SYS_GETITIMER, + "setitimer": SYS_SETITIMER, + "kexec_load": SYS_KEXEC_LOAD, + "init_module": SYS_INIT_MODULE, + "delete_module": SYS_DELETE_MODULE, + "timer_create": SYS_TIMER_CREATE, + "timer_gettime": SYS_TIMER_GETTIME, + "timer_getoverrun": SYS_TIMER_GETOVERRUN, + "timer_settime": SYS_TIMER_SETTIME, + "timer_delete": SYS_TIMER_DELETE, + "clock_settime": SYS_CLOCK_SETTIME, + "clock_gettime": SYS_CLOCK_GETTIME, + "clock_getres": SYS_CLOCK_GETRES, + "clock_nanosleep": SYS_CLOCK_NANOSLEEP, + "syslog": SYS_SYSLOG, + "ptrace": SYS_PTRACE, + "sched_setparam": SYS_SCHED_SETPARAM, + "sched_setscheduler": SYS_SCHED_SETSCHEDULER, + "sched_getscheduler": SYS_SCHED_GETSCHEDULER, + "sched_getparam": SYS_SCHED_GETPARAM, + "sched_setaffinity": SYS_SCHED_SETAFFINITY, + "sched_getaffinity": SYS_SCHED_GETAFFINITY, + "sched_yield": SYS_SCHED_YIELD, + "sched_get_priority_max": SYS_SCHED_GET_PRIORITY_MAX, + "sched_get_priority_min": SYS_SCHED_GET_PRIORITY_MIN, + "sched_rr_get_interval": SYS_SCHED_RR_GET_INTERVAL, + "restart_syscall": SYS_RESTART_SYSCALL, + "kill": SYS_KILL, + "tkill": SYS_TKILL, + "tgkill": SYS_TGKILL, + "sigaltstack": SYS_SIGALTSTACK, + "rt_sigsuspend": SYS_RT_SIGSUSPEND, + "rt_sigaction": SYS_RT_SIGACTION, + "rt_sigprocmask": SYS_RT_SIGPROCMASK, + "rt_sigpending": SYS_RT_SIGPENDING, + "rt_sigtimedwait": SYS_RT_SIGTIMEDWAIT, + "rt_sigqueueinfo": SYS_RT_SIGQUEUEINFO, + "rt_sigreturn": SYS_RT_SIGRETURN, + "setpriority": SYS_SETPRIORITY, + "getpriority": SYS_GETPRIORITY, + "reboot": SYS_REBOOT, + "setregid": SYS_SETREGID, + "setgid": SYS_SETGID, + "setreuid": SYS_SETREUID, + "setuid": SYS_SETUID, + "setresuid": SYS_SETRESUID, + "getresuid": SYS_GETRESUID, + "setresgid": SYS_SETRESGID, + "getresgid": SYS_GETRESGID, + "setfsuid": SYS_SETFSUID, + "setfsgid": SYS_SETFSGID, + "times": SYS_TIMES, + "setpgid": SYS_SETPGID, + "getpgid": SYS_GETPGID, + "getsid": SYS_GETSID, + "setsid": SYS_SETSID, + "getgroups": SYS_GETGROUPS, + "setgroups": SYS_SETGROUPS, + "uname": SYS_UNAME, + "sethostname": SYS_SETHOSTNAME, + "setdomainname": SYS_SETDOMAINNAME, + "getrlimit": SYS_GETRLIMIT, + "setrlimit": SYS_SETRLIMIT, + "getrusage": SYS_GETRUSAGE, + "umask": SYS_UMASK, + "prctl": SYS_PRCTL, + "getcpu": SYS_GETCPU, + "gettimeofday": SYS_GETTIMEOFDAY, + "settimeofday": SYS_SETTIMEOFDAY, + "adjtimex": SYS_ADJTIMEX, + "getpid": SYS_GETPID, + "getppid": SYS_GETPPID, + "getuid": SYS_GETUID, + "geteuid": SYS_GETEUID, + "getgid": SYS_GETGID, + "getegid": SYS_GETEGID, + "gettid": SYS_GETTID, + "sysinfo": SYS_SYSINFO, + "mq_open": SYS_MQ_OPEN, + "mq_unlink": SYS_MQ_UNLINK, + "mq_timedsend": SYS_MQ_TIMEDSEND, + "mq_timedreceive": SYS_MQ_TIMEDRECEIVE, + "mq_notify": SYS_MQ_NOTIFY, + "mq_getsetattr": SYS_MQ_GETSETATTR, + "msgget": SYS_MSGGET, + "msgctl": SYS_MSGCTL, + "msgrcv": SYS_MSGRCV, + "msgsnd": SYS_MSGSND, + "semget": SYS_SEMGET, + "semctl": SYS_SEMCTL, + "semtimedop": SYS_SEMTIMEDOP, + "semop": SYS_SEMOP, + "shmget": SYS_SHMGET, + "shmctl": SYS_SHMCTL, + "shmat": SYS_SHMAT, + "shmdt": SYS_SHMDT, + "socket": SYS_SOCKET, + "socketpair": SYS_SOCKETPAIR, + "bind": SYS_BIND, + "listen": SYS_LISTEN, + "accept": SYS_ACCEPT, + "connect": SYS_CONNECT, + "getsockname": SYS_GETSOCKNAME, + "getpeername": SYS_GETPEERNAME, + "sendto": SYS_SENDTO, + "recvfrom": SYS_RECVFROM, + "setsockopt": SYS_SETSOCKOPT, + "getsockopt": SYS_GETSOCKOPT, + "shutdown": SYS_SHUTDOWN, + "sendmsg": SYS_SENDMSG, + "recvmsg": SYS_RECVMSG, + "readahead": SYS_READAHEAD, + "brk": SYS_BRK, + "munmap": SYS_MUNMAP, + "mremap": SYS_MREMAP, + "add_key": SYS_ADD_KEY, + "request_key": SYS_REQUEST_KEY, + "keyctl": SYS_KEYCTL, + "clone": SYS_CLONE, + "execve": SYS_EXECVE, + "mmap": SYS_MMAP, + "fadvise64": SYS_FADVISE64, + "swapon": SYS_SWAPON, + "swapoff": SYS_SWAPOFF, + "mprotect": SYS_MPROTECT, + "msync": SYS_MSYNC, + "mlock": SYS_MLOCK, + "munlock": SYS_MUNLOCK, + "mlockall": SYS_MLOCKALL, + "munlockall": SYS_MUNLOCKALL, + "mincore": SYS_MINCORE, + "madvise": SYS_MADVISE, + "remap_file_pages": SYS_REMAP_FILE_PAGES, + "mbind": SYS_MBIND, + "get_mempolicy": SYS_GET_MEMPOLICY, + "set_mempolicy": SYS_SET_MEMPOLICY, + "migrate_pages": SYS_MIGRATE_PAGES, + "move_pages": SYS_MOVE_PAGES, + "rt_tgsigqueueinfo": SYS_RT_TGSIGQUEUEINFO, + "perf_event_open": SYS_PERF_EVENT_OPEN, + "accept4": SYS_ACCEPT4, + "recvmmsg": SYS_RECVMMSG, + "wait4": SYS_WAIT4, + "prlimit64": SYS_PRLIMIT64, + "fanotify_init": SYS_FANOTIFY_INIT, + "fanotify_mark": SYS_FANOTIFY_MARK, + "name_to_handle_at": SYS_NAME_TO_HANDLE_AT, + "open_by_handle_at": SYS_OPEN_BY_HANDLE_AT, + "clock_adjtime": SYS_CLOCK_ADJTIME, + "syncfs": SYS_SYNCFS, + "setns": SYS_SETNS, + "sendmmsg": SYS_SENDMMSG, + "process_vm_readv": SYS_PROCESS_VM_READV, + "process_vm_writev": SYS_PROCESS_VM_WRITEV, + "kcmp": SYS_KCMP, + "finit_module": SYS_FINIT_MODULE, + "sched_setattr": SYS_SCHED_SETATTR, + "sched_getattr": SYS_SCHED_GETATTR, + "renameat2": SYS_RENAMEAT2, + "seccomp": SYS_SECCOMP, + "getrandom": SYS_GETRANDOM, + "memfd_create": SYS_MEMFD_CREATE, + "bpf": SYS_BPF, + "execveat": SYS_EXECVEAT, + "userfaultfd": SYS_USERFAULTFD, + "membarrier": SYS_MEMBARRIER, + "mlock2": SYS_MLOCK2, + "copy_file_range": SYS_COPY_FILE_RANGE, + "preadv2": SYS_PREADV2, + "pwritev2": SYS_PWRITEV2, + "pkey_mprotect": SYS_PKEY_MPROTECT, + "pkey_alloc": SYS_PKEY_ALLOC, + "pkey_free": SYS_PKEY_FREE, + "statx": SYS_STATX, + "io_pgetevents": SYS_IO_PGETEVENTS, + "rseq": SYS_RSEQ, + "kexec_file_load": SYS_KEXEC_FILE_LOAD, + "pidfd_send_signal": SYS_PIDFD_SEND_SIGNAL, + "io_uring_setup": SYS_IO_URING_SETUP, + "io_uring_enter": SYS_IO_URING_ENTER, + "io_uring_register": SYS_IO_URING_REGISTER, + "open_tree": SYS_OPEN_TREE, + "move_mount": SYS_MOVE_MOUNT, + "fsopen": SYS_FSOPEN, + "fsconfig": SYS_FSCONFIG, + "fsmount": SYS_FSMOUNT, + "fspick": SYS_FSPICK, + "pidfd_open": SYS_PIDFD_OPEN, + "clone3": SYS_CLONE3, + "close_range": SYS_CLOSE_RANGE, + "openat2": SYS_OPENAT2, + "pidfd_getfd": SYS_PIDFD_GETFD, + "faccessat2": SYS_FACCESSAT2, + "process_madvise": SYS_PROCESS_MADVISE, + "epoll_pwait2": SYS_EPOLL_PWAIT2, + "mount_setattr": SYS_MOUNT_SETATTR, + "quotactl_fd": SYS_QUOTACTL_FD, + "landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET, + "landlock_add_rule": SYS_LANDLOCK_ADD_RULE, + "landlock_restrict_self": SYS_LANDLOCK_RESTRICT_SELF, + "memfd_secret": SYS_MEMFD_SECRET, + "process_mrelease": SYS_PROCESS_MRELEASE, + "futex_waitv": SYS_FUTEX_WAITV, + "set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE, + "cachestat": SYS_CACHESTAT, + "fchmodat2": SYS_FCHMODAT2, + "map_shadow_stack": SYS_MAP_SHADOW_STACK, + "futex_wake": SYS_FUTEX_WAKE, + "futex_wait": SYS_FUTEX_WAIT, + "futex_requeue": SYS_FUTEX_REQUEUE, + "statmount": SYS_STATMOUNT, + "listmount": SYS_LISTMOUNT, + "lsm_get_self_attr": SYS_LSM_GET_SELF_ATTR, + "lsm_set_self_attr": SYS_LSM_SET_SELF_ATTR, + "lsm_list_modules": SYS_LSM_LIST_MODULES, + "mseal": SYS_MSEAL, +} + +const ( + SYS_USERFAULTFD = 282 + SYS_MEMBARRIER = 283 + SYS_MLOCK2 = 284 + SYS_COPY_FILE_RANGE = 285 + SYS_PREADV2 = 286 + SYS_PWRITEV2 = 287 + SYS_PKEY_MPROTECT = 288 + SYS_PKEY_ALLOC = 289 + SYS_PKEY_FREE = 290 + SYS_STATX = 291 + SYS_IO_PGETEVENTS = 292 + SYS_RSEQ = 293 + SYS_KEXEC_FILE_LOAD = 294 + SYS_PIDFD_SEND_SIGNAL = 424 + SYS_IO_URING_SETUP = 425 + SYS_IO_URING_ENTER = 426 + SYS_IO_URING_REGISTER = 427 + SYS_OPEN_TREE = 428 + SYS_MOVE_MOUNT = 429 + SYS_FSOPEN = 430 + SYS_FSCONFIG = 431 + SYS_FSMOUNT = 432 + SYS_FSPICK = 433 + SYS_PIDFD_OPEN = 434 + SYS_CLONE3 = 435 + SYS_CLOSE_RANGE = 436 + SYS_OPENAT2 = 437 + SYS_PIDFD_GETFD = 438 + SYS_FACCESSAT2 = 439 + SYS_PROCESS_MADVISE = 440 + SYS_EPOLL_PWAIT2 = 441 + SYS_MOUNT_SETATTR = 442 + SYS_QUOTACTL_FD = 443 + SYS_LANDLOCK_CREATE_RULESET = 444 + SYS_LANDLOCK_ADD_RULE = 445 + SYS_LANDLOCK_RESTRICT_SELF = 446 + SYS_MEMFD_SECRET = 447 + SYS_PROCESS_MRELEASE = 448 + SYS_FUTEX_WAITV = 449 + SYS_SET_MEMPOLICY_HOME_NODE = 450 + SYS_CACHESTAT = 451 + SYS_FCHMODAT2 = 452 + SYS_MAP_SHADOW_STACK = 453 + SYS_FUTEX_WAKE = 454 + SYS_FUTEX_WAIT = 455 + SYS_FUTEX_REQUEUE = 456 + SYS_STATMOUNT = 457 + SYS_LISTMOUNT = 458 + SYS_LSM_GET_SELF_ATTR = 459 + SYS_LSM_SET_SELF_ATTR = 460 + SYS_LSM_LIST_MODULES = 461 + SYS_MSEAL = 462 +) diff --git a/container/std/syscall_test.go b/container/std/syscall_test.go new file mode 100644 index 00000000..b82cc46a --- /dev/null +++ b/container/std/syscall_test.go @@ -0,0 +1,21 @@ +package std_test + +import ( + "testing" + + "hakurei.app/container/std" +) + +func TestSyscallResolveName(t *testing.T) { + t.Parallel() + + for name, want := range std.Syscalls() { + t.Run(name, func(t *testing.T) { + t.Parallel() + + if got, ok := std.SyscallResolveName(name); !ok || got != want { + t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want) + } + }) + } +} -- cgit v1.3.1