From c5f59c5488cc529a5a7c7a89e1da56c2b44db16c Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 22 Oct 2025 05:26:54 +0900 Subject: container/syscall: export prctl wrapper This is useful as package "syscall" does not provide such a wrapper. This change also improves error handling to fully conform to the manpage. Signed-off-by: Ophestra --- container/capability.go | 37 +++---------------------------------- 1 file changed, 3 insertions(+), 34 deletions(-) (limited to 'container/capability.go') diff --git a/container/capability.go b/container/capability.go index f41bffa7..11d95b3d 100644 --- a/container/capability.go +++ b/container/capability.go @@ -49,41 +49,10 @@ func capset(hdrp *capHeader, datap *[2]capData) error { } // capBoundingSetDrop drops a capability from the calling thread's capability bounding set. -func capBoundingSetDrop(cap uintptr) error { - r, _, errno := syscall.Syscall( - syscall.SYS_PRCTL, - syscall.PR_CAPBSET_DROP, - cap, 0, - ) - if r != 0 { - return errno - } - return nil -} +func capBoundingSetDrop(cap uintptr) error { return Prctl(syscall.PR_CAPBSET_DROP, cap, 0) } // capAmbientClearAll clears the ambient capability set of the calling thread. -func capAmbientClearAll() error { - r, _, errno := syscall.Syscall( - syscall.SYS_PRCTL, - PR_CAP_AMBIENT, - PR_CAP_AMBIENT_CLEAR_ALL, 0, - ) - if r != 0 { - return errno - } - return nil -} +func capAmbientClearAll() error { return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0) } // capAmbientRaise adds to the ambient capability set of the calling thread. -func capAmbientRaise(cap uintptr) error { - r, _, errno := syscall.Syscall( - syscall.SYS_PRCTL, - PR_CAP_AMBIENT, - PR_CAP_AMBIENT_RAISE, - cap, - ) - if r != 0 { - return errno - } - return nil -} +func capAmbientRaise(cap uintptr) error { return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap) } -- cgit v1.3.1