From e03d702d088ad78645d1cce448713ef71b12e803 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Tue, 1 Jul 2025 00:35:27 +0900
Subject: sandbox/seccomp: implement syscall lookup

This uses the Go map and is verified against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 flake.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'flake.nix')

diff --git a/flake.nix b/flake.nix
index 717dea23..53db737d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -187,12 +187,14 @@
 
           generateSyscallTable = pkgs.mkShell {
             # this should be made cross-platform via nix
-            shellHook = ''
-              exec ${pkgs.perl}/bin/perl \
+            shellHook = "exec ${pkgs.writeShellScript "generate-syscall-table" ''
+              set -e
+              ${pkgs.perl}/bin/perl \
                 sandbox/seccomp/mksysnum_linux.pl \
-                ${pkgs.linuxHeaders}/include/asm/unistd_64.h > \
+                ${pkgs.linuxHeaders}/include/asm/unistd_64.h | \
+                ${pkgs.go}/bin/gofmt > \
                 sandbox/seccomp/syscall_linux_amd64.go
-            '';
+            ''}";
           };
         }
       );
-- 
cgit v1.3.1