15 Commits

Author	SHA1	Message	Date
Ophestra	d5532aade0	sandbox/seccomp: native rule slice in helpers ... These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 00:22:27 +09:00
Ophestra	1a8840bebc	sandbox/seccomp: resolve rules natively ... This enables loading syscall filter policies from external cross-platform config files. This also removes a significant amount of C code. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-01 22:11:32 +09:00
Ophestra	87e008d56d	treewide: rename to hakurei ... Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 04:57:41 +09:00
Ophestra	0ba8be659f	sandbox: document less obvious parts of setup ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-01 01:21:04 +09:00
Ophestra	184e9db2b2	sandbox: support privileged container ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 19:40:19 +09:00
Ophestra	d613257841	sandbox/init: clear inheritable set ... Inheritable should not be able to affect anything regardless of its value, due to no_new_privs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:46:13 +09:00
Ophestra	52fcc48ac1	sandbox/init: drop capabilities ... During development the syscall filter caused me to make an incorrect assumption about SysProcAttr. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 06:32:08 +09:00
Ophestra	971c79bb80	sandbox: remove hardcoded parent perm ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:49:51 +09:00
Ophestra	ad3576c164	sandbox: resolve tty name ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:03:07 +09:00
Ophestra	b74a08dda9	sandbox: prepare ops early ... Some setup code needs to run in host root. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-18 02:17:46 +09:00
Ophestra	1b9408864f	sandbox: pass cmd to cancel function ... This is not usually in scope otherwise. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:36:39 +09:00
Ophestra	d7eddd54a2	sandbox: rename params struct ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:45:08 +09:00
Ophestra	af3619d440	sandbox: create symlinks ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:37:56 +09:00
Ophestra	528674cb6e	sandbox/init: fail early on nil op ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:17:03 +09:00
Ophestra	24618ab9a1	sandbox: move out of internal ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:55:36 +09:00