hst/config: remove seccomp bit fields

These serve little purpose and are not friendly for use from other languages.

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/hakurei/print_test.go

@@ -259,8 +259,6 @@ App
     "container": {
       "hostname": "localhost",
       "wait_delay": -1,
-      "seccomp_flags": 1,
-      "seccomp_presets": 1,
       "seccomp_compat": true,
       "devel": true,
       "userns": true,
@@ -415,8 +413,6 @@ App
   "container": {
     "hostname": "localhost",
     "wait_delay": -1,
-    "seccomp_flags": 1,
-    "seccomp_presets": 1,
     "seccomp_compat": true,
     "devel": true,
     "userns": true,
@@ -625,8 +621,6 @@ func Test_printPs(t *testing.T) {
       "container": {
         "hostname": "localhost",
         "wait_delay": -1,
-        "seccomp_flags": 1,
-        "seccomp_presets": 1,
         "seccomp_compat": true,
         "devel": true,
         "userns": true,

cmd/hpkg/app.go

@@ -6,7 +6,6 @@ import (
 	"os"
 
 	"hakurei.app/container"
-	"hakurei.app/container/seccomp"
 	"hakurei.app/hst"
 	"hakurei.app/system/dbus"
 )
@@ -92,6 +91,7 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *container.Absolute, arg
 			Device:       app.Device,
 			Tty:          app.Tty || flagDropShell,
 			MapRealUID:   app.MapRealUID,
+			Multiarch:    app.Multiarch,
 			Filesystem: []hst.FilesystemConfigJSON{
 				{FilesystemConfig: &hst.FSBind{Target: container.AbsFHSEtc, Source: pathSet.cacheDir.Append("etc"), Special: true}},
 				{FilesystemConfig: &hst.FSBind{Source: pathSet.nixPath.Append("store"), Target: pathNixStore}},
@@ -113,12 +113,6 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *container.Absolute, arg
 			{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
 		},
 	}
-	if app.Multiarch {
-		config.Container.SeccompFlags |= seccomp.AllowMultiarch
-	}
-	if app.Bluetooth {
-		config.Container.SeccompFlags |= seccomp.AllowBluetooth
-	}
 	return config
 }
 

cmd/hpkg/with.go

@@ -6,7 +6,6 @@ import (
 	"strings"
 
 	"hakurei.app/container"
-	"hakurei.app/container/seccomp"
 	"hakurei.app/hst"
 )
 
@@ -46,7 +45,7 @@ func withNixDaemon(
 			Hostname:  formatHostname(app.Name) + "-" + action,
 			Userns:    true, // nix sandbox requires userns
 			HostNet:   net,
-			SeccompFlags: seccomp.AllowMultiarch,
+			Multiarch: true,
 			Tty:       dropShell,
 			Filesystem: []hst.FilesystemConfigJSON{
 				{FilesystemConfig: &hst.FSBind{Target: container.AbsFHSEtc, Source: pathSet.cacheDir.Append("etc"), Special: true}},
@@ -84,7 +83,7 @@ func withCacheDir(
 
 		Container: &hst.ContainerConfig{
 			Hostname:  formatHostname(app.Name) + "-" + action,
-			SeccompFlags: seccomp.AllowMultiarch,
+			Multiarch: true,
 			Tty:       dropShell,
 			Filesystem: []hst.FilesystemConfigJSON{
 				{FilesystemConfig: &hst.FSBind{Target: container.AbsFHSEtc, Source: workDir.Append(container.FHSEtc), Special: true}},

hst/config.go

@@ -4,7 +4,6 @@ import (
 	"time"
 
 	"hakurei.app/container"
-	"hakurei.app/container/seccomp"
 	"hakurei.app/system/dbus"
 )
 
@@ -66,10 +65,6 @@ type (
 		// a negative value causes the container to be terminated immediately on cancellation
 		WaitDelay time.Duration `json:"wait_delay,omitempty"`
 
-		// extra seccomp flags
-		SeccompFlags seccomp.ExportFlag `json:"seccomp_flags"`
-		// extra seccomp presets
-		SeccompPresets seccomp.FilterPreset `json:"seccomp_presets"`
 		// disable project-specific filter extensions
 		SeccompCompat bool `json:"seccomp_compat,omitempty"`
 		// allow ptrace and friends

hst/hst.go

@@ -7,7 +7,6 @@ import (
 	"os"
 
 	"hakurei.app/container"
-	"hakurei.app/container/seccomp"
 	"hakurei.app/system/dbus"
 )
 
@@ -113,8 +112,6 @@ func Template() *Config {
 			HostAbstract:  true,
 			Device:        true,
 			WaitDelay:     -1,
-			SeccompFlags:   seccomp.AllowMultiarch,
-			SeccompPresets: seccomp.PresetExt,
 			SeccompCompat: true,
 			Tty:           true,
 			Multiarch:     true,

hst/hst_test.go

@@ -166,8 +166,6 @@ func TestTemplate(t *testing.T) {
 	"container": {
 		"hostname": "localhost",
 		"wait_delay": -1,
-		"seccomp_flags": 1,
-		"seccomp_presets": 1,
 		"seccomp_compat": true,
 		"devel": true,
 		"userns": true,

internal/app/container.go

@@ -33,8 +33,6 @@ func newContainer(
 
 	params := &container.Params{
 		Hostname:      s.Hostname,
-		SeccompFlags:   s.SeccompFlags,
-		SeccompPresets: s.SeccompPresets,
 		RetainSession: s.Tty,
 		HostNet:       s.HostNet,
 		HostAbstract:  s.HostAbstract,