26b7afc890
sandbox/seccomp: prepare -> export
...
Export makes a lot more sense, and also matches the libseccomp function.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-02 00:32:48 +09:00
d5532aade0
sandbox/seccomp: native rule slice in helpers
...
These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-02 00:22:27 +09:00
1a8840bebc
sandbox/seccomp: resolve rules natively
...
This enables loading syscall filter policies from external cross-platform config files.
This also removes a significant amount of C code.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-01 22:11:32 +09:00
9a8a047908
sandbox/seccomp: syscall name lookup table
...
The script is from Go source of same name. The result is checked against libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-06-26 03:49:07 +09:00
87e008d56d
treewide: rename to hakurei
...
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-06-25 04:57:41 +09:00
584405f7cc
sandbox/seccomp: rename flag type and constants
...
The names are ambiguous. Rename them to make more sense.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-04-08 01:59:45 +09:00
f885dede9b
sandbox/seccomp: unexport println wrapper
...
This is an implementation detail that was exported for the bwrap argument builder. The removal of that package allows it to be unexported.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-04-07 04:07:20 +09:00
2a46f5bb12
sandbox/seccomp: update doc comment
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-30 23:00:20 +09:00
24618ab9a1
sandbox: move out of internal
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-17 02:55:36 +09:00
