internal/rosa/gtk: glib 2.87.5 to 2.88.0

Signed-off-by: Ophestra <cat@gensokyo.uk>

check/absolute_test.go

@@ -11,12 +11,12 @@ import (
 	"testing"
 	_ "unsafe" // for go:linkname
 
-	. "hakurei.app/container/check"
+	. "hakurei.app/check"
 )
 
 // unsafeAbs returns check.Absolute on any string value.
 //
-//go:linkname unsafeAbs hakurei.app/container/check.unsafeAbs
+//go:linkname unsafeAbs hakurei.app/check.unsafeAbs
 func unsafeAbs(pathname string) *Absolute
 
 func TestAbsoluteError(t *testing.T) {

check/overlay_test.go

@@ -3,7 +3,7 @@ package check_test
 import (
 	"testing"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func TestEscapeOverlayDataSegment(t *testing.T) {

cmd/hakurei/command.go

@@ -13,10 +13,10 @@ import (
 	"time"
 	_ "unsafe" // for go:linkname
 
+	"hakurei.app/check"
 	"hakurei.app/command"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/dbus"
 	"hakurei.app/internal/env"

cmd/hakurei/json_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"hakurei.app/container/stub"
+	"hakurei.app/internal/stub"
 )
 
 func TestDecodeJSON(t *testing.T) {

cmd/hakurei/main.go

@@ -13,6 +13,7 @@ import (
 	"syscall"
 
 	"hakurei.app/container"
+	"hakurei.app/ext"
 	"hakurei.app/message"
 )
 
@@ -35,8 +36,8 @@ func main() {
 	msg := message.New(log.Default())
 
 	early := earlyHardeningErrs{
-		yamaLSM:  container.SetPtracer(0),
-		dumpable: container.SetDumpable(container.SUID_DUMP_DISABLE),
+		yamaLSM:  ext.SetPtracer(0),
+		dumpable: ext.SetDumpable(ext.SUID_DUMP_DISABLE),
 	}
 
 	if os.Geteuid() == 0 {

cmd/hakurei/parse_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/hst"
 	"hakurei.app/internal/store"
 	"hakurei.app/message"

cmd/hakurei/print_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/hst"
 	"hakurei.app/internal/store"
 	"hakurei.app/message"

cmd/mbf/main.go

@@ -18,12 +18,13 @@ import (
 	"time"
 	"unique"
 
+	"hakurei.app/check"
 	"hakurei.app/command"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
+	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/internal/pkg"
 	"hakurei.app/internal/rosa"
 	"hakurei.app/message"
@@ -271,7 +272,7 @@ func main() {
 				return errors.New("report requires 1 argument")
 			}
 
-			if container.Isatty(int(w.Fd())) {
+			if ext.Isatty(int(w.Fd())) {
 				return errors.New("output appears to be a terminal")
 			}
 			return rosa.WriteReport(msg, w, cache)

cmd/sharefs/fuse.go

@@ -31,10 +31,10 @@ import (
 	"syscall"
 	"unsafe"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/std"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/helper/proc"
 	"hakurei.app/internal/info"

cmd/sharefs/fuse_test.go

@@ -6,7 +6,7 @@ import (
 	"reflect"
 	"testing"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func TestParseOpts(t *testing.T) {

container/autoetc.go

@@ -4,8 +4,8 @@ import (
 	"encoding/gob"
 	"fmt"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 )
 
 func init() { gob.Register(new(AutoEtcOp)) }

container/autoetc_test.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestAutoEtcOp(t *testing.T) {

container/autoroot.go

@@ -4,8 +4,8 @@ import (
 	"encoding/gob"
 	"fmt"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 	"hakurei.app/message"
 )
 

container/autoroot_test.go

@@ -5,9 +5,9 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
+	"hakurei.app/internal/stub"
 	"hakurei.app/message"
 )
 

container/capability.go

@@ -3,6 +3,8 @@ package container
 import (
 	"syscall"
 	"unsafe"
+
+	"hakurei.app/ext"
 )
 
 const (
@@ -51,15 +53,15 @@ func capset(hdrp *capHeader, datap *[2]capData) error {
 
 // capBoundingSetDrop drops a capability from the calling thread's capability bounding set.
 func capBoundingSetDrop(cap uintptr) error {
-	return Prctl(syscall.PR_CAPBSET_DROP, cap, 0)
+	return ext.Prctl(syscall.PR_CAPBSET_DROP, cap, 0)
 }
 
 // capAmbientClearAll clears the ambient capability set of the calling thread.
 func capAmbientClearAll() error {
-	return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0)
+	return ext.Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0)
 }
 
 // capAmbientRaise adds to the ambient capability set of the calling thread.
 func capAmbientRaise(cap uintptr) error {
-	return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap)
+	return ext.Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap)
 }

container/container.go

@@ -16,11 +16,11 @@ import (
 	. "syscall"
 	"time"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
 	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/message"
 )
 
@@ -186,31 +186,24 @@ var (
 	closeOnExecErr  error
 )
 
-// ensureCloseOnExec ensures all currently open file descriptors have the syscall.FD_CLOEXEC flag set.
-// This is only ran once as it is intended to handle files left open by the parent, and any file opened
-// on this side should already have syscall.FD_CLOEXEC set.
+// ensureCloseOnExec ensures all currently open file descriptors have the
+// syscall.FD_CLOEXEC flag set.
+//
+// This is only ran once as it is intended to handle files left open by the
+// parent, and any file opened on this side should already have
+// syscall.FD_CLOEXEC set.
 func ensureCloseOnExec() error {
-	closeOnExecOnce.Do(func() {
-		const fdPrefixPath = "/proc/self/fd/"
-
-		var entries []os.DirEntry
-		if entries, closeOnExecErr = os.ReadDir(fdPrefixPath); closeOnExecErr != nil {
-			return
-		}
-
-		var fd int
-		for _, ent := range entries {
-			if fd, closeOnExecErr = strconv.Atoi(ent.Name()); closeOnExecErr != nil {
-				break // not reached
-			}
-			CloseOnExec(fd)
-		}
-	})
+	closeOnExecOnce.Do(func() { closeOnExecErr = doCloseOnExec() })
 
 	if closeOnExecErr == nil {
 		return nil
 	}
-	return &StartError{Fatal: true, Step: "set FD_CLOEXEC on all open files", Err: closeOnExecErr, Passthrough: true}
+	return &StartError{
+		Fatal:       true,
+		Step:        "set FD_CLOEXEC on all open files",
+		Err:         closeOnExecErr,
+		Passthrough: true,
+	}
 }
 
 // Start starts the container init. The init process blocks until Serve is called.

container/container_test.go

@@ -18,17 +18,17 @@ import (
 	"testing"
 	"time"
 
+	"hakurei.app/check"
 	"hakurei.app/command"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
-	"hakurei.app/container/vfs"
 	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/ldd"
 	"hakurei.app/message"
+	"hakurei.app/vfs"
 )
 
 // Note: this package requires cgo, which is unavailable in the Go playground.

container/dispatcher.go

@@ -13,6 +13,7 @@ import (
 
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
+	"hakurei.app/ext"
 	"hakurei.app/internal/netlink"
 	"hakurei.app/message"
 )
@@ -143,8 +144,8 @@ func (k direct) new(f func(k syscallDispatcher)) { go f(k) }
 
 func (direct) lockOSThread() { runtime.LockOSThread() }
 
-func (direct) setPtracer(pid uintptr) error       { return SetPtracer(pid) }
-func (direct) setDumpable(dumpable uintptr) error { return SetDumpable(dumpable) }
+func (direct) setPtracer(pid uintptr) error       { return ext.SetPtracer(pid) }
+func (direct) setDumpable(dumpable uintptr) error { return ext.SetDumpable(dumpable) }
 func (direct) setNoNewPrivs() error               { return SetNoNewPrivs() }
 
 func (direct) lastcap(msg message.Msg) uintptr                 { return LastCap(msg) }
@@ -152,7 +153,7 @@ func (direct) capset(hdrp *capHeader, datap *[2]capData) error { return capset(h
 func (direct) capBoundingSetDrop(cap uintptr) error            { return capBoundingSetDrop(cap) }
 func (direct) capAmbientClearAll() error                       { return capAmbientClearAll() }
 func (direct) capAmbientRaise(cap uintptr) error               { return capAmbientRaise(cap) }
-func (direct) isatty(fd int) bool                              { return Isatty(fd) }
+func (direct) isatty(fd int) bool                              { return ext.Isatty(fd) }
 func (direct) receive(key string, e any, fdp *uintptr) (func() error, error) {
 	return Receive(key, e, fdp)
 }

container/dispatcher_test.go

@@ -18,7 +18,7 @@ import (
 
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
+	"hakurei.app/internal/stub"
 	"hakurei.app/message"
 )
 

container/errors.go

@@ -5,9 +5,9 @@ import (
 	"os"
 	"syscall"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/vfs"
+	"hakurei.app/check"
 	"hakurei.app/message"
+	"hakurei.app/vfs"
 )
 
 // messageFromError returns a printable error message for a supported concrete type.

container/errors_test.go

@@ -8,9 +8,9 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
-	"hakurei.app/container/vfs"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
+	"hakurei.app/vfs"
 )
 
 func TestMessageFromError(t *testing.T) {

container/init.go

@@ -15,8 +15,9 @@ import (
 	. "syscall"
 	"time"
 
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
+	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/message"
 )
 
@@ -178,7 +179,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 
 	// write uid/gid map here so parent does not need to set dumpable
-	if err := k.setDumpable(SUID_DUMP_USER); err != nil {
+	if err := k.setDumpable(ext.SUID_DUMP_USER); err != nil {
 		k.fatalf(msg, "cannot set SUID_DUMP_USER: %v", err)
 	}
 	if err := k.writeFile(fhs.Proc+"self/uid_map",
@@ -196,7 +197,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		0); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
-	if err := k.setDumpable(SUID_DUMP_DISABLE); err != nil {
+	if err := k.setDumpable(ext.SUID_DUMP_DISABLE); err != nil {
 		k.fatalf(msg, "cannot set SUID_DUMP_DISABLE: %v", err)
 	}
 
@@ -290,7 +291,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 
 	{
 		var fd int
-		if err := IgnoringEINTR(func() (err error) {
+		if err := ext.IgnoringEINTR(func() (err error) {
 			fd, err = k.open(fhs.Root, O_DIRECTORY|O_RDONLY, 0)
 			return
 		}); err != nil {

container/init_test.go

@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
+	"hakurei.app/internal/stub"
 )
 
 func TestInitEntrypoint(t *testing.T) {

container/initbind.go

@@ -6,7 +6,7 @@ import (
 	"os"
 	"syscall"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/container/std"
 )
 

container/initbind_test.go

@@ -6,9 +6,9 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
+	"hakurei.app/internal/stub"
 )
 
 func TestBindMountOp(t *testing.T) {

container/initdaemon.go

@@ -12,8 +12,8 @@ import (
 	"syscall"
 	"time"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 )
 
 func init() { gob.Register(new(DaemonOp)) }

container/initdaemon_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 	"hakurei.app/message"
 )
 

container/initdev.go

@@ -6,8 +6,8 @@ import (
 	"path"
 	. "syscall"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 )
 
 func init() { gob.Register(new(MountDevOp)) }

container/initdev_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestMountDevOp(t *testing.T) {

container/initmkdir.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"os"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(MkdirOp)) }

container/initmkdir_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestMkdirOp(t *testing.T) {

container/initoverlay.go

@@ -6,8 +6,8 @@ import (
 	"slices"
 	"strings"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 )
 
 const (

container/initoverlay_test.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestMountOverlayOp(t *testing.T) {

container/initplace.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"syscall"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 )
 
 const (

container/initplace_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestTmpfileOp(t *testing.T) {

container/initproc.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	. "syscall"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(MountProcOp)) }

container/initproc_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestMountProcOp(t *testing.T) {

container/initremount.go

@@ -4,7 +4,7 @@ import (
 	"encoding/gob"
 	"fmt"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(RemountOp)) }

container/initremount_test.go

@@ -4,8 +4,8 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestRemountOp(t *testing.T) {

container/initsymlink.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"path"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(SymlinkOp)) }

container/initsymlink_test.go

@@ -4,8 +4,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestSymlinkOp(t *testing.T) {

container/inittmpfs.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	. "syscall"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(MountTmpfsOp)) }

container/inittmpfs_test.go

@@ -5,8 +5,8 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
+	"hakurei.app/check"
+	"hakurei.app/internal/stub"
 )
 
 func TestMountTmpfsOp(t *testing.T) {

container/mount.go

@@ -6,8 +6,9 @@ import (
 	"os"
 	. "syscall"
 
-	"hakurei.app/container/vfs"
+	"hakurei.app/ext"
 	"hakurei.app/message"
+	"hakurei.app/vfs"
 )
 
 /*
@@ -115,7 +116,7 @@ func (p *procPaths) remount(msg message.Msg, target string, flags uintptr) error
 	var targetKFinal string
 	{
 		var destFd int
-		if err := IgnoringEINTR(func() (err error) {
+		if err := ext.IgnoringEINTR(func() (err error) {
 			destFd, err = p.k.open(targetFinal, O_PATH|O_CLOEXEC, 0)
 			return
 		}); err != nil {

container/mount_test.go

@@ -5,8 +5,8 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/stub"
-	"hakurei.app/container/vfs"
+	"hakurei.app/internal/stub"
+	"hakurei.app/vfs"
 )
 
 func TestBindMount(t *testing.T) {

container/path.go

@@ -9,8 +9,8 @@ import (
 	"strings"
 	"syscall"
 
-	"hakurei.app/container/fhs"
-	"hakurei.app/container/vfs"
+	"hakurei.app/fhs"
+	"hakurei.app/vfs"
 )
 
 const (

container/path_test.go

@@ -10,8 +10,8 @@ import (
 	"testing"
 	"unsafe"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/vfs"
+	"hakurei.app/check"
+	"hakurei.app/vfs"
 )
 
 func TestToSysroot(t *testing.T) {

container/seccomp/std_test.go

@@ -26,7 +26,9 @@ func TestSyscallResolveName(t *testing.T) {
 
 func TestRuleType(t *testing.T) {
 	assertKind[ext.Uint, scmpUint](t)
+	assertOverflow(t, ext.Uint(ext.MaxUint))
 	assertKind[ext.Int, scmpInt](t)
+	assertOverflow(t, ext.Int(ext.MaxInt))
 
 	assertSize[std.NativeRule, syscallRule](t)
 	assertKind[std.ScmpDatum, scmpDatum](t)
@@ -62,3 +64,14 @@ func assertKind[native, equivalent any](t *testing.T) {
 		t.Fatalf("%s: %s, want %s", nativeType.Name(), nativeType.Kind(), equivalentType.Kind())
 	}
 }
+
+// assertOverflow asserts that incrementing m overflows.
+func assertOverflow[T ~int32 | ~uint32](t *testing.T, m T) {
+	t.Helper()
+
+	old := m
+	m++
+	if m > old {
+		t.Fatalf("unexpected value %#x", m)
+	}
+}

container/syscall.go

@@ -7,40 +7,9 @@ import (
 	"hakurei.app/ext"
 )
 
-// Prctl manipulates various aspects of the behavior of the calling thread or process.
-func Prctl(op, arg2, arg3 uintptr) error {
-	r, _, errno := Syscall(SYS_PRCTL, op, arg2, arg3)
-	if r < 0 {
-		return errno
-	}
-	return nil
-}
-
-// SetPtracer allows processes to ptrace(2) the calling process.
-func SetPtracer(pid uintptr) error { return Prctl(PR_SET_PTRACER, pid, 0) }
-
-// linux/sched/coredump.h
-const (
-	SUID_DUMP_DISABLE = iota
-	SUID_DUMP_USER
-)
-
-// SetDumpable sets the "dumpable" attribute of the calling process.
-func SetDumpable(dumpable uintptr) error { return Prctl(PR_SET_DUMPABLE, dumpable, 0) }
-
 // SetNoNewPrivs sets the calling thread's no_new_privs attribute.
-func SetNoNewPrivs() error { return Prctl(PR_SET_NO_NEW_PRIVS, 1, 0) }
-
-// Isatty tests whether a file descriptor refers to a terminal.
-func Isatty(fd int) bool {
-	var buf [8]byte
-	r, _, _ := Syscall(
-		SYS_IOCTL,
-		uintptr(fd),
-		TIOCGWINSZ,
-		uintptr(unsafe.Pointer(&buf[0])),
-	)
-	return r == 0
+func SetNoNewPrivs() error {
+	return ext.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0)
 }
 
 // schedParam is equivalent to struct sched_param from include/linux/sched.h.
@@ -73,19 +42,3 @@ func schedSetscheduler(tid int, policy ext.SchedPolicy, param *schedParam) error
 	}
 	return nil
 }
-
-// IgnoringEINTR makes a function call and repeats it if it returns an
-// EINTR error. This appears to be required even though we install all
-// signal handlers with SA_RESTART: see #22838, #38033, #38836, #40846.
-// Also #20400 and #36644 are issues in which a signal handler is
-// installed without setting SA_RESTART. None of these are the common case,
-// but there are enough of them that it seems that we can't avoid
-// an EINTR loop.
-func IgnoringEINTR(fn func() error) error {
-	for {
-		err := fn()
-		if err != EINTR {
-			return err
-		}
-	}
-}

container/syscall_close_range.go

@@ -0,0 +1,11 @@
+//go:build close_range
+
+package container
+
+import "hakurei.app/ext"
+
+// doCloseOnExec implements ensureCloseOnExec by calling CloseRange with
+// CLOSE_RANGE_CLOEXEC.
+func doCloseOnExec() error {
+	return ext.CloseRange(0, ext.MaxUint, ext.CLOSE_RANGE_CLOEXEC)
+}

container/syscall_range_proc.go

@@ -0,0 +1,28 @@
+//go:build !close_range
+
+package container
+
+import (
+	"os"
+	"strconv"
+	"syscall"
+
+	"hakurei.app/fhs"
+)
+
+// doCloseOnExec implements ensureCloseOnExec by ranging over proc_pid_fd(5).
+func doCloseOnExec() error {
+	entries, err := os.ReadDir(fhs.ProcSelf + "fd/")
+	if err != nil {
+		return err
+	}
+
+	var fd int
+	for _, ent := range entries {
+		if fd, err = strconv.Atoi(ent.Name()); err != nil {
+			return err // not reached
+		}
+		syscall.CloseOnExec(fd)
+	}
+	return nil
+}

container/sysctl.go

@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"sync"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/message"
 )
 

ext/ext.go

@@ -4,6 +4,7 @@ package ext
 import (
 	"encoding/json"
 	"iter"
+	"math"
 	"strconv"
 )
 
@@ -15,6 +16,12 @@ type (
 	Int = int32
 )
 
+// Integer limit values.
+const (
+	MaxUint = math.MaxUint32
+	MaxInt  = math.MaxInt32
+)
+
 // SyscallNum represents an architecture-specific, Linux syscall number.
 type SyscallNum Int
 

ext/syscall.go

@@ -5,8 +5,82 @@ import (
 	"strconv"
 	"sync"
 	"syscall"
+	"unsafe"
 )
 
+// Prctl manipulates various aspects of the behavior of the calling thread or process.
+func Prctl(op, arg2, arg3 uintptr) error {
+	r, _, errno := syscall.Syscall(syscall.SYS_PRCTL, op, arg2, arg3)
+	if r < 0 {
+		return errno
+	}
+	return nil
+}
+
+// SetPtracer allows processes to ptrace(2) the calling process.
+func SetPtracer(pid uintptr) error {
+	return Prctl(syscall.PR_SET_PTRACER, pid, 0)
+}
+
+// linux/sched/coredump.h
+const (
+	SUID_DUMP_DISABLE = iota
+	SUID_DUMP_USER
+)
+
+// SetDumpable sets the "dumpable" attribute of the calling process.
+func SetDumpable(dumpable uintptr) error {
+	return Prctl(syscall.PR_SET_DUMPABLE, dumpable, 0)
+}
+
+// Isatty tests whether a file descriptor refers to a terminal.
+func Isatty(fd int) bool {
+	var buf [8]byte
+	r, _, _ := syscall.Syscall(
+		syscall.SYS_IOCTL,
+		uintptr(fd),
+		syscall.TIOCGWINSZ,
+		uintptr(unsafe.Pointer(&buf[0])),
+	)
+	return r == 0
+}
+
+// IgnoringEINTR makes a function call and repeats it if it returns an
+// EINTR error. This appears to be required even though we install all
+// signal handlers with SA_RESTART: see #22838, #38033, #38836, #40846.
+// Also #20400 and #36644 are issues in which a signal handler is
+// installed without setting SA_RESTART. None of these are the common case,
+// but there are enough of them that it seems that we can't avoid
+// an EINTR loop.
+func IgnoringEINTR(fn func() error) error {
+	for {
+		err := fn()
+		if err != syscall.EINTR {
+			return err
+		}
+	}
+}
+
+// include/uapi/linux/close_range.h
+const (
+	CLOSE_RANGE_UNSHARE = 1 << (iota + 1)
+	CLOSE_RANGE_CLOEXEC
+)
+
+// CloseRange close all file descriptors in a given range.
+func CloseRange(first, last Uint, flags Int) error {
+	_, _, errno := syscall.Syscall(
+		SYS_CLOSE_RANGE,
+		uintptr(first),
+		uintptr(last),
+		uintptr(flags),
+	)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
 // SchedPolicy denotes a scheduling policy defined in include/uapi/linux/sched.h.
 type SchedPolicy int
 

fhs/abs.go

@@ -3,14 +3,14 @@ package fhs
 import (
 	_ "unsafe" // for go:linkname
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 /* constants in this file bypass abs check, be extremely careful when changing them! */
 
 // unsafeAbs returns check.Absolute on any string value.
 //
-//go:linkname unsafeAbs hakurei.app/container/check.unsafeAbs
+//go:linkname unsafeAbs hakurei.app/check.unsafeAbs
 func unsafeAbs(pathname string) *check.Absolute
 
 var (

hst/config.go

@@ -5,7 +5,7 @@ import (
 	"strconv"
 	"strings"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/ext"
 )
 

hst/config_test.go

@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 )
 

hst/container.go

@@ -6,7 +6,7 @@ import (
 	"syscall"
 	"time"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 // PrivateTmp is a private writable path in a hakurei container.

hst/fs.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"reflect"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 // FilesystemConfig is an abstract representation of a mount point.

hst/fs_test.go

@@ -9,8 +9,8 @@ import (
 	"syscall"
 	"testing"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/hst"
 )
 

hst/fsbind.go

@@ -4,9 +4,9 @@ import (
 	"encoding/gob"
 	"strings"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
 	"hakurei.app/container/std"
+	"hakurei.app/fhs"
 )
 
 func init() { gob.Register(new(FSBind)) }

hst/fsdaemon.go

@@ -3,7 +3,7 @@ package hst
 import (
 	"encoding/gob"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(FSDaemon)) }

hst/fsephemeral.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"strings"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(FSEphemeral)) }

hst/fslink.go

@@ -4,7 +4,7 @@ import (
 	"encoding/gob"
 	"path"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(FSLink)) }

hst/fsoverlay.go

@@ -4,7 +4,7 @@ import (
 	"encoding/gob"
 	"strings"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func init() { gob.Register(new(FSOverlay)) }

hst/fsoverlay_test.go

@@ -3,8 +3,8 @@ package hst_test
 import (
 	"testing"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/hst"
 )
 

hst/hst.go

@@ -7,8 +7,8 @@ import (
 	"net"
 	"os"
 
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/check"
+	"hakurei.app/fhs"
 )
 
 // An AppError is returned while starting an app according to [hst.Config].

hst/hst_test.go

@@ -9,8 +9,8 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/stub"
 	"hakurei.app/hst"
+	"hakurei.app/internal/stub"
 	"hakurei.app/message"
 )
 

internal/dbus/dbus_test.go

@@ -65,13 +65,13 @@ func TestProxyStartWaitCloseString(t *testing.T) {
 }
 
 const (
-	stubProxyTimeout = 5 * time.Second
+	stubProxyTimeout = 15 * time.Second
 )
 
 func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) {
 	{
 		oldWaitDelay := helper.WaitDelay
-		helper.WaitDelay = 16 * time.Second
+		helper.WaitDelay = 30 * time.Second
 		t.Cleanup(func() { helper.WaitDelay = oldWaitDelay })
 	}
 

internal/dbus/proc.go

@@ -8,8 +8,8 @@ import (
 	"strconv"
 	"syscall"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
 	"hakurei.app/internal/helper"

internal/env/env.go

@@ -6,7 +6,7 @@ import (
 	"os"
 	"strconv"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 	"hakurei.app/hst"
 )
 

internal/env/env_test.go

@@ -5,12 +5,12 @@ import (
 	"reflect"
 	"testing"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
-	"hakurei.app/container/stub"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/env"
+	"hakurei.app/internal/stub"
 )
 
 func TestPaths(t *testing.T) {

internal/helper/container.go

@@ -9,8 +9,8 @@ import (
 	"slices"
 	"sync"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/internal/helper/proc"
 	"hakurei.app/message"
 )

internal/helper/container_test.go

@@ -6,9 +6,9 @@ import (
 	"os"
 	"testing"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/internal/helper"
 )
 

internal/helper/helper.go

@@ -11,7 +11,7 @@ import (
 	"hakurei.app/internal/helper/proc"
 )
 
-var WaitDelay = 2 * time.Second
+var WaitDelay = 5 * time.Second
 
 const (
 	// HakureiHelper is set to 1 when args fd is enabled and 0 otherwise.

internal/helper/helper_test.go

@@ -56,7 +56,7 @@ const (
 // this function tests an implementation of the helper.Helper interface
 func testHelper(t *testing.T, createHelper func(ctx context.Context, setOutput func(stdoutP, stderrP *io.Writer), stat bool) helper.Helper) {
 	oldWaitDelay := helper.WaitDelay
-	helper.WaitDelay = 16 * time.Second
+	helper.WaitDelay = 30 * time.Second
 	t.Cleanup(func() { helper.WaitDelay = oldWaitDelay })
 
 	t.Run("start helper with status channel and wait", func(t *testing.T) {

internal/helper/proc/files.go

@@ -10,7 +10,7 @@ import (
 	"time"
 )
 
-var FulfillmentTimeout = 2 * time.Second
+var FulfillmentTimeout = 15 * time.Second
 
 func init() {
 	if testing.Testing() {

internal/info/path.go

@@ -3,7 +3,7 @@ package info
 import (
 	"log"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 // Absolute paths to the Hakurei installation.

internal/info/path_test.go

@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	"hakurei.app/container/check"
+	"hakurei.app/check"
 )
 
 func TestMustCheckPath(t *testing.T) {

internal/info/version.go

@@ -1,3 +1,4 @@
+// Package info holds metadata populated at link time.
 package info
 
 // FallbackVersion is returned when a version string was not set by the linker.

internal/lockedfile/internal/filelock/filelock_test.go

@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/internal/lockedfile/internal/filelock"
 	"hakurei.app/internal/lockedfile/internal/testexec"
 )

internal/lockedfile/lockedfile_test.go

@@ -15,7 +15,7 @@ import (
 	"testing"
 	"time"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/internal/lockedfile"
 	"hakurei.app/internal/lockedfile/internal/testexec"
 )

internal/outcome/dispatcher.go

@@ -10,10 +10,11 @@ import (
 	"os/user"
 	"path/filepath"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
+	"hakurei.app/ext"
 	"hakurei.app/internal/dbus"
 	"hakurei.app/internal/info"
 	"hakurei.app/message"
@@ -149,10 +150,10 @@ func (direct) notifyContext(parent context.Context, signals ...os.Signal) (ctx c
 	return signal.NotifyContext(parent, signals...)
 }
 
-func (direct) prctl(op, arg2, arg3 uintptr) error { return container.Prctl(op, arg2, arg3) }
+func (direct) prctl(op, arg2, arg3 uintptr) error { return ext.Prctl(op, arg2, arg3) }
 func (direct) overflowUid(msg message.Msg) int    { return container.OverflowUid(msg) }
 func (direct) overflowGid(msg message.Msg) int    { return container.OverflowGid(msg) }
-func (direct) setDumpable(dumpable uintptr) error { return container.SetDumpable(dumpable) }
+func (direct) setDumpable(dumpable uintptr) error { return ext.SetDumpable(dumpable) }
 func (direct) receive(key string, e any, fdp *uintptr) (func() error, error) {
 	return container.Receive(key, e, fdp)
 }

internal/outcome/dispatcher_test.go

@@ -18,12 +18,12 @@ import (
 	"time"
 	"unsafe"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
 	"hakurei.app/hst"
+	"hakurei.app/internal/stub"
 	"hakurei.app/internal/system"
 	"hakurei.app/message"
 )

internal/outcome/hsu.go

@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"sync"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/message"
 )

internal/outcome/hsu_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 	"unsafe"
 
-	"hakurei.app/container/stub"
 	"hakurei.app/hst"
+	"hakurei.app/internal/stub"
 )
 
 func TestHsu(t *testing.T) {

internal/outcome/outcome.go

@@ -7,8 +7,8 @@ import (
 	"maps"
 	"strconv"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/env"

internal/outcome/process.go

@@ -12,9 +12,9 @@ import (
 	"syscall"
 	"time"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/info"
 	"hakurei.app/internal/store"

internal/outcome/run_test.go

@@ -15,11 +15,11 @@ import (
 	"testing"
 	"time"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/dbus"

internal/outcome/shim.go

@@ -13,12 +13,12 @@ import (
 	"syscall"
 	"time"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
 	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/pipewire"
 	"hakurei.app/message"
@@ -147,7 +147,7 @@ func (sp *shimPrivate) destroy() {
 const (
 	// shimPipeWireTimeout is the duration pipewire-pulse is allowed to run
 	// before its socket becomes available.
-	shimPipeWireTimeout = 5 * time.Second
+	shimPipeWireTimeout = 15 * time.Second
 )
 
 func shimEntrypoint(k syscallDispatcher) {
@@ -159,7 +159,7 @@ func shimEntrypoint(k syscallDispatcher) {
 		logger.SetFlags(0)
 	}
 
-	if err := k.setDumpable(container.SUID_DUMP_DISABLE); err != nil {
+	if err := k.setDumpable(ext.SUID_DUMP_DISABLE); err != nil {
 		k.fatalf("cannot set SUID_DUMP_DISABLE: %v", err)
 	}
 

internal/outcome/shim_test.go

@@ -10,12 +10,13 @@ import (
 	"testing"
 
 	"hakurei.app/container"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
+	"hakurei.app/ext"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/env"
+	"hakurei.app/internal/stub"
 )
 
 func TestShimEntrypoint(t *testing.T) {
@@ -135,14 +136,14 @@ func TestShimEntrypoint(t *testing.T) {
 		{"dumpable", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, new(log.Logger), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, stub.UniqueError(11)),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, stub.UniqueError(11)),
 			call("fatalf", stub.ExpectArgs{"cannot set SUID_DUMP_DISABLE: %v", []any{stub.UniqueError(11)}}, nil, nil),
 		}}, nil},
 
 		{"receive exit request", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, io.EOF),
@@ -155,7 +156,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"receive fd", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, syscall.EBADF),
@@ -168,7 +169,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"receive env", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, container.ErrReceiveEnv),
@@ -181,7 +182,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"receive strange", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{}, nil}, nil, stub.UniqueError(10)),
@@ -194,7 +195,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"reparent", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
@@ -214,7 +215,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"invalid state", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
@@ -233,7 +234,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"sigaction pipe", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, &os.SyscallError{Syscall: "pipe2", Err: stub.UniqueError(9)}),
 			call("fatal", stub.ExpectArgs{[]any{"pipe2: unique error 9 injected by the test suite"}}, nil, nil),
@@ -242,7 +243,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"sigaction cgo", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, syscall.ENOTRECOVERABLE),
 			call("fatalf", stub.ExpectArgs{"cannot install SIGCONT handler: %v", []any{syscall.ENOTRECOVERABLE}}, nil, nil),
@@ -251,7 +252,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"sigaction strange", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, stub.UniqueError(8)),
 			call("fatalf", stub.ExpectArgs{"cannot set up exit request: %v", []any{stub.UniqueError(8)}}, nil, nil),
@@ -260,7 +261,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"prctl", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -276,7 +277,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"toContainer", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
@@ -297,7 +298,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"bad ops", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", func() outcomeState {
@@ -318,7 +319,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"start", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -342,7 +343,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"start logger signalread", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -366,7 +367,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"serve", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -389,7 +390,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"seccomp", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -413,7 +414,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"exited closesetup earlyrequested", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -440,7 +441,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"exited requested", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -467,7 +468,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"canceled orphaned", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -493,7 +494,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"strangewait invalidmsg", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
@@ -520,7 +521,7 @@ func TestShimEntrypoint(t *testing.T) {
 		{"success", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
 			call("getMsg", stub.ExpectArgs{}, nil, nil),
 			call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
-			call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
+			call("setDumpable", stub.ExpectArgs{uintptr(ext.SUID_DUMP_DISABLE)}, nil, nil),
 			call("getppid", stub.ExpectArgs{}, 0xbad, nil),
 			call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),
 			call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),

internal/outcome/spaccount.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"syscall"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/internal/validate"
 )
 

internal/outcome/spaccount_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 
 	"hakurei.app/container"
-	"hakurei.app/container/stub"
 	"hakurei.app/hst"
+	"hakurei.app/internal/stub"
 )
 
 func TestSpAccountOp(t *testing.T) {

internal/outcome/spcontainer.go

@@ -10,11 +10,11 @@ import (
 	"strconv"
 	"syscall"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/dbus"

internal/outcome/spcontainer_test.go

@@ -7,15 +7,15 @@ import (
 	"syscall"
 	"testing"
 
+	"hakurei.app/check"
 	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/std"
-	"hakurei.app/container/stub"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/dbus"
+	"hakurei.app/internal/stub"
 	"hakurei.app/internal/system"
 )
 

internal/outcome/spdbus.go

@@ -3,7 +3,7 @@ package outcome
 import (
 	"encoding/gob"
 
-	"hakurei.app/container/fhs"
+	"hakurei.app/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/dbus"

internal/outcome/spdbus_test.go

@@ -5,11 +5,11 @@ import (
 	"testing"
 
 	"hakurei.app/container"
-	"hakurei.app/container/stub"
 	"hakurei.app/hst"
 	"hakurei.app/internal/acl"
 	"hakurei.app/internal/dbus"
 	"hakurei.app/internal/helper"
+	"hakurei.app/internal/stub"
 	"hakurei.app/internal/system"
 	"hakurei.app/message"
 )