seccomp: install output atomically

Signed-off-by: Ophestra <cat@gensokyo.uk>

seccomp/export_test.go

@@ -4,7 +4,6 @@ import (
 	"crypto/sha512"
 	"errors"
 	"io"
-	"log"
 	"slices"
 	"syscall"
 	"testing"
@@ -79,8 +78,9 @@ func TestExport(t *testing.T) {
 	buf := make([]byte, 8)
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			seccomp.CPrintln = log.Println
-			t.Cleanup(func() { seccomp.CPrintln = nil })
+			oldF := seccomp.GetOutput()
+			seccomp.SetOutput(t.Log)
+			t.Cleanup(func() { seccomp.SetOutput(oldF) })
 
 			e := seccomp.New(tc.opts)
 			digest := sha512.New()

seccomp/output.go

@@ -0,0 +1,30 @@
+package seccomp
+
+import "C"
+import "sync/atomic"
+
+var printlnP atomic.Pointer[func(v ...any)]
+
+func SetOutput(f func(v ...any)) {
+	if f == nil {
+		// avoid storing nil function
+		printlnP.Store(nil)
+	} else {
+		printlnP.Store(&f)
+	}
+}
+
+func GetOutput() func(v ...any) {
+	if fp := printlnP.Load(); fp == nil {
+		return nil
+	} else {
+		return *fp
+	}
+}
+
+//export F_println
+func F_println(v *C.char) {
+	if fp := printlnP.Load(); fp != nil {
+		(*fp)(C.GoString(v))
+	}
+}

seccomp/seccomp.go

@@ -13,8 +13,6 @@ import (
 	"syscall"
 )
 
-var CPrintln func(v ...any)
-
 // LibraryError represents a libseccomp error.
 type LibraryError struct {
 	Prefix  string
@@ -99,7 +97,7 @@ func buildFilter(fd int, opts SyscallOpts) error {
 
 	// this removes repeated transitions between C and Go execution
 	// when producing log output via F_println and CPrintln is nil
-	if CPrintln != nil {
+	if fp := printlnP.Load(); fp != nil {
 		opts |= flagVerbose
 	}
 
@@ -114,10 +112,3 @@ func buildFilter(fd int, opts SyscallOpts) error {
 	}
 	return err
 }
-
-//export F_println
-func F_println(v *C.char) {
-	if CPrintln != nil {
-		CPrintln(C.GoString(v))
-	}
-}