From 3ce63e95d7691450f7b368e639d984a223a764b1 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 7 Oct 2025 18:28:20 +0900 Subject: container: move seccomp preset bits This allows holding the bits without cgo. Signed-off-by: Ophestra --- container/bits/seccomp.go | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 container/bits/seccomp.go (limited to 'container/bits') diff --git a/container/bits/seccomp.go b/container/bits/seccomp.go new file mode 100644 index 00000000..57e3e122 --- /dev/null +++ b/container/bits/seccomp.go @@ -0,0 +1,20 @@ +package bits + +// FilterPreset specifies parts of the syscall filter preset to enable. +type FilterPreset int + +const ( + // PresetExt are project-specific extensions. + PresetExt FilterPreset = 1 << iota + // PresetDenyNS denies namespace setup syscalls. + PresetDenyNS + // PresetDenyTTY denies faking input. + PresetDenyTTY + // PresetDenyDevel denies development-related syscalls. + PresetDenyDevel + // PresetLinux32 sets PER_LINUX32. + PresetLinux32 + + // PresetStrict is a strict preset useful as a default value. + PresetStrict = PresetExt | PresetDenyNS | PresetDenyTTY | PresetDenyDevel +) -- cgit v1.3.1