release: 0.3.0

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/hakurei/command.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"io"
 	"log"
@@ -19,8 +18,8 @@ import (
 	"hakurei.app/container/fhs"
 	"hakurei.app/hst"
 	"hakurei.app/internal"
-	"hakurei.app/internal/app"
-	"hakurei.app/internal/app/state"
+	"hakurei.app/internal/env"
+	"hakurei.app/internal/outcome"
 	"hakurei.app/message"
 	"hakurei.app/system/dbus"
 )
@@ -51,7 +50,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 		Flag(&flagVerbose, "v", command.BoolFlag(false), "Increase log verbosity").
 		Flag(&flagJSON, "json", command.BoolFlag(false), "Serialise output in JSON when applicable")
 
-	c.Command("shim", command.UsageInternal, func([]string) error { app.ShimMain(); return errSuccess })
+	c.Command("shim", command.UsageInternal, func([]string) error { outcome.Shim(msg); return errSuccess })
 
 	c.Command("app", "Load and start container from configuration file", func(args []string) error {
 		if len(args) < 1 {
@@ -64,7 +63,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 			config.Container.Args = append(config.Container.Args, args[1:]...)
 		}
 
-		app.Main(ctx, msg, config)
+		outcome.Main(ctx, msg, config)
 		panic("unreachable")
 	})
 
@@ -81,11 +80,13 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 			flagHomeDir  string
 			flagUserName string
 
+			flagPrivateRuntime, flagPrivateTmpdir bool
+
 			flagWayland, flagX11, flagDBus, flagPulse bool
 		)
 
 		c.NewCommand("run", "Configure and start a permissive container", func(args []string) error {
-			if flagIdentity < hst.IdentityMin || flagIdentity > hst.IdentityMax {
+			if flagIdentity < hst.IdentityStart || flagIdentity > hst.IdentityEnd {
 				log.Fatalf("identity %d out of range", flagIdentity)
 			}
 
@@ -94,7 +95,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				passwd     *user.User
 				passwdOnce sync.Once
 				passwdFunc = func() {
-					us := strconv.Itoa(app.HsuUid(new(app.Hsu).MustIDMsg(msg), flagIdentity))
+					us := strconv.Itoa(hst.ToUser(new(outcome.Hsu).MustID(msg), flagIdentity))
 					if u, err := user.LookupId(us); err != nil {
 						msg.Verbosef("cannot look up uid %s", us)
 						passwd = &user.User{
@@ -147,11 +148,6 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				Enablements: hst.NewEnablements(et),
 
 				Container: &hst.ContainerConfig{
-					Userns:       true,
-					HostNet:      true,
-					Tty:          true,
-					HostAbstract: true,
-
 					Filesystem: []hst.FilesystemConfigJSON{
 						// autoroot, includes the home directory
 						{FilesystemConfig: &hst.FSBind{
@@ -167,6 +163,8 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 
 					Path: progPath,
 					Args: args,
+
+					Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty,
 				},
 			}
 
@@ -214,6 +212,13 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
+			if !flagPrivateRuntime {
+				config.Container.Flags |= hst.FShareRuntime
+			}
+			if !flagPrivateTmpdir {
+				config.Container.Flags |= hst.FShareTmpdir
+			}
+
 			// parse D-Bus config file from flags if applicable
 			if flagDBus {
 				if flagDBusConfigSession == "builtin" {
@@ -221,8 +226,11 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				} else {
 					if f, err := os.Open(flagDBusConfigSession); err != nil {
 						log.Fatal(err.Error())
-					} else if err = json.NewDecoder(f).Decode(&config.SessionBus); err != nil {
-						log.Fatalf("cannot load session bus proxy config from %q: %s", flagDBusConfigSession, err)
+					} else {
+						decodeJSON(log.Fatal, "load session bus proxy config", f, &config.SessionBus)
+						if err = f.Close(); err != nil {
+							log.Fatal(err.Error())
+						}
 					}
 				}
 
@@ -230,8 +238,11 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				if flagDBusConfigSystem != "nil" {
 					if f, err := os.Open(flagDBusConfigSystem); err != nil {
 						log.Fatal(err.Error())
-					} else if err = json.NewDecoder(f).Decode(&config.SystemBus); err != nil {
-						log.Fatalf("cannot load system bus proxy config from %q: %s", flagDBusConfigSystem, err)
+					} else {
+						decodeJSON(log.Fatal, "load system bus proxy config", f, &config.SystemBus)
+						if err = f.Close(); err != nil {
+							log.Fatal(err.Error())
+						}
 					}
 				}
 
@@ -246,7 +257,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
-			app.Main(ctx, msg, config)
+			outcome.Main(ctx, msg, config)
 			panic("unreachable")
 		}).
 			Flag(&flagDBusConfigSession, "dbus-config", command.StringFlag("builtin"),
@@ -267,6 +278,10 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				"Container home directory").
 			Flag(&flagUserName, "u", command.StringFlag("chronos"),
 				"Passwd user name within sandbox").
+			Flag(&flagPrivateRuntime, "private-runtime", command.BoolFlag(false),
+				"Do not share XDG_RUNTIME_DIR between containers under the same identity").
+			Flag(&flagPrivateTmpdir, "private-tmpdir", command.BoolFlag(false),
+				"Do not share TMPDIR between containers under the same identity").
 			Flag(&flagWayland, "wayland", command.BoolFlag(false),
 				"Enable connection to Wayland via security-context-v1").
 			Flag(&flagX11, "X", command.BoolFlag(false),
@@ -278,7 +293,10 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 	}
 
 	{
-		var flagShort bool
+		var (
+			flagShort   bool
+			flagNoStore bool
+		)
 		c.NewCommand("show", "Show live or local app configuration", func(args []string) error {
 			switch len(args) {
 			case 0: // system
@@ -286,10 +304,23 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 
 			case 1: // instance
 				name := args[0]
-				config, entry := tryShort(msg, name)
-				if config == nil {
-					config = tryPath(msg, name)
+
+				var (
+					config *hst.Config
+					entry  *hst.State
+				)
+				if !flagNoStore {
+					var sc hst.Paths
+					env.CopyPaths().Copy(&sc, new(outcome.Hsu).MustID(nil))
+					entry = tryIdentifier(msg, name, outcome.NewStore(&sc))
 				}
+
+				if entry == nil {
+					config = tryPath(msg, name)
+				} else {
+					config = entry.Config
+				}
+
 				if !printShowInstance(os.Stdout, time.Now().UTC(), entry, config, flagShort, flagJSON) {
 					os.Exit(1)
 				}
@@ -298,22 +329,24 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				log.Fatal("show requires 1 argument")
 			}
 			return errSuccess
-		}).Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information")
+		}).
+			Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information").
+			Flag(&flagNoStore, "no-store", command.BoolFlag(false), "Do not attempt to match from active instances")
 	}
 
 	{
 		var flagShort bool
 		c.NewCommand("ps", "List active instances", func(args []string) error {
 			var sc hst.Paths
-			app.CopyPaths().Copy(&sc, new(app.Hsu).MustID())
-			printPs(os.Stdout, time.Now().UTC(), state.NewMulti(msg, sc.RunDirPath.String()), flagShort, flagJSON)
+			env.CopyPaths().Copy(&sc, new(outcome.Hsu).MustID(nil))
+			printPs(msg, os.Stdout, time.Now().UTC(), outcome.NewStore(&sc), flagShort, flagJSON)
 			return errSuccess
 		}).Flag(&flagShort, "short", command.BoolFlag(false), "Print instance id")
 	}
 
 	c.Command("version", "Display version information", func(args []string) error { fmt.Println(internal.Version()); return errSuccess })
 	c.Command("license", "Show full license text", func(args []string) error { fmt.Println(license); return errSuccess })
-	c.Command("template", "Produce a config template", func(args []string) error { printJSON(os.Stdout, false, hst.Template()); return errSuccess })
+	c.Command("template", "Produce a config template", func(args []string) error { encodeJSON(log.Fatal, os.Stdout, false, hst.Template()); return errSuccess })
 	c.Command("help", "Show this help message", func([]string) error { c.PrintHelp(); return errSuccess })
 
 	return c

cmd/hakurei/command_test.go

@@ -36,7 +36,7 @@ Commands:
 		},
 		{
 			"run", []string{"run", "-h"}, `
-Usage:	hakurei run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--wayland] [-X] [--dbus] [--pulse] COMMAND [OPTIONS]
+Usage:	hakurei run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--private-runtime] [--private-tmpdir] [--wayland] [-X] [--dbus] [--pulse] COMMAND [OPTIONS]
 
 Flags:
   -X	Enable direct connection to X11
@@ -58,6 +58,10 @@ Flags:
     	Reverse-DNS style Application identifier, leave empty to inherit instance identifier
   -mpris
     	Allow owning MPRIS D-Bus path, has no effect if custom config is available
+  -private-runtime
+    	Do not share XDG_RUNTIME_DIR between containers under the same identity
+  -private-tmpdir
+    	Do not share TMPDIR between containers under the same identity
   -pulse
     	Enable direct connection to PulseAudio
   -u string
@@ -73,7 +77,7 @@ Flags:
 			t.Parallel()
 
 			out := new(bytes.Buffer)
-			c := buildCommand(t.Context(), message.NewMsg(nil), new(earlyHardeningErrs), out)
+			c := buildCommand(t.Context(), message.New(nil), new(earlyHardeningErrs), out)
 			if err := c.Parse(tc.args); !errors.Is(err, command.ErrHelp) && !errors.Is(err, flag.ErrHelp) {
 				t.Errorf("Parse: error = %v; want %v",
 					err, command.ErrHelp)

cmd/hakurei/json.go

@@ -0,0 +1,60 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"strconv"
+)
+
+// decodeJSON decodes json from r and stores it in v. A non-nil error results in a call to fatal.
+func decodeJSON(fatal func(v ...any), op string, r io.Reader, v any) {
+	err := json.NewDecoder(r).Decode(v)
+	if err == nil {
+		return
+	}
+
+	var (
+		syntaxError        *json.SyntaxError
+		unmarshalTypeError *json.UnmarshalTypeError
+
+		msg string
+	)
+
+	switch {
+	case errors.As(err, &syntaxError) && syntaxError != nil:
+		msg = syntaxError.Error() +
+			" at byte " + strconv.FormatInt(syntaxError.Offset, 10)
+
+	case errors.As(err, &unmarshalTypeError) && unmarshalTypeError != nil:
+		msg = "inappropriate " + unmarshalTypeError.Value +
+			" at byte " + strconv.FormatInt(unmarshalTypeError.Offset, 10)
+
+	default:
+		// InvalidUnmarshalError: incorrect usage, does not need to be handled
+		// io.ErrUnexpectedEOF: no additional error information available
+		msg = err.Error()
+	}
+
+	fatal("cannot " + op + ": " + msg)
+}
+
+// encodeJSON encodes v to output. A non-nil error results in a call to fatal.
+func encodeJSON(fatal func(v ...any), output io.Writer, short bool, v any) {
+	encoder := json.NewEncoder(output)
+	if !short {
+		encoder.SetIndent("", "  ")
+	}
+
+	if err := encoder.Encode(v); err != nil {
+		var marshalerError *json.MarshalerError
+		if errors.As(err, &marshalerError) && marshalerError != nil {
+			// this likely indicates an implementation error in hst
+			fatal("cannot encode json for " + marshalerError.Type.String() + ": " + marshalerError.Err.Error())
+			return
+		}
+
+		// UnsupportedTypeError, UnsupportedValueError: incorrect usage, does not need to be handled
+		fatal("cannot write json: " + err.Error())
+	}
+}

cmd/hakurei/json_test.go

@@ -0,0 +1,107 @@
+package main_test
+
+import (
+	"io"
+	"reflect"
+	"strings"
+	"testing"
+	_ "unsafe"
+
+	"hakurei.app/container/stub"
+)
+
+//go:linkname decodeJSON hakurei.app/cmd/hakurei.decodeJSON
+func decodeJSON(fatal func(v ...any), op string, r io.Reader, v any)
+
+func TestDecodeJSON(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		t    reflect.Type
+		data string
+		want any
+		msg  string
+	}{
+		{"success", reflect.TypeFor[uintptr](), "3735928559\n", uintptr(0xdeadbeef), ""},
+
+		{"syntax", reflect.TypeFor[*int](), "\x00", nil,
+			`cannot load sample: invalid character '\x00' looking for beginning of value at byte 1`},
+		{"type", reflect.TypeFor[uintptr](), "-1", nil,
+			`cannot load sample: inappropriate number -1 at byte 2`},
+		{"default", reflect.TypeFor[*int](), "{", nil,
+			"cannot load sample: unexpected EOF"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var (
+				gotP   = reflect.New(tc.t)
+				gotMsg *string
+			)
+			decodeJSON(func(v ...any) {
+				if gotMsg != nil {
+					t.Fatal("fatal called twice")
+				}
+				msg := v[0].(string)
+				gotMsg = &msg
+			}, "load sample", strings.NewReader(tc.data), gotP.Interface())
+			if tc.msg != "" {
+				if gotMsg == nil {
+					t.Errorf("decodeJSON: success, want fatal %q", tc.msg)
+				} else if *gotMsg != tc.msg {
+					t.Errorf("decodeJSON: fatal = %q, want %q", *gotMsg, tc.msg)
+				}
+			} else if gotMsg != nil {
+				t.Errorf("decodeJSON: fatal = %q", *gotMsg)
+			} else if !reflect.DeepEqual(gotP.Elem().Interface(), tc.want) {
+				t.Errorf("decodeJSON: %#v, want %#v", gotP.Elem().Interface(), tc.want)
+			}
+		})
+	}
+}
+
+//go:linkname encodeJSON hakurei.app/cmd/hakurei.encodeJSON
+func encodeJSON(fatal func(v ...any), output io.Writer, short bool, v any)
+
+func TestEncodeJSON(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		v    any
+		want string
+	}{
+		{"marshaler", errorJSONMarshaler{},
+			`cannot encode json for main_test.errorJSONMarshaler: unique error 3735928559 injected by the test suite`},
+		{"default", func() {},
+			`cannot write json: json: unsupported type: func()`},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var called bool
+			encodeJSON(func(v ...any) {
+				if called {
+					t.Fatal("fatal called twice")
+				}
+				called = true
+
+				if v[0].(string) != tc.want {
+					t.Errorf("encodeJSON: fatal = %q, want %q", v[0].(string), tc.want)
+				}
+			}, nil, false, tc.v)
+
+			if !called {
+				t.Errorf("encodeJSON: success, want fatal %q", tc.want)
+			}
+		})
+	}
+}
+
+// errorJSONMarshaler implements json.Marshaler.
+type errorJSONMarshaler struct{}
+
+func (errorJSONMarshaler) MarshalJSON() ([]byte, error) { return nil, stub.UniqueError(0xdeadbeef) }

cmd/hakurei/main.go

@@ -32,7 +32,7 @@ func main() {
 
 	log.SetPrefix("hakurei: ")
 	log.SetFlags(0)
-	msg := message.NewMsg(log.Default())
+	msg := message.New(log.Default())
 
 	early := earlyHardeningErrs{
 		yamaLSM:  container.SetPtracer(0),

cmd/hakurei/parse.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"encoding/json"
+	"encoding/hex"
 	"errors"
 	"io"
 	"log"
@@ -11,13 +11,15 @@ import (
 	"syscall"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/app"
-	"hakurei.app/internal/app/state"
+	"hakurei.app/internal/store"
 	"hakurei.app/message"
 )
 
+// tryPath attempts to read [hst.Config] from multiple sources.
+// tryPath reads from [os.Stdin] if name has value "-".
+// Otherwise, name is passed to tryFd, and if that returns nil, name is passed to [os.Open].
 func tryPath(msg message.Msg, name string) (config *hst.Config) {
-	var r io.Reader
+	var r io.ReadCloser
 	config = new(hst.Config)
 
 	if name != "-" {
@@ -26,29 +28,24 @@ func tryPath(msg message.Msg, name string) (config *hst.Config) {
 			msg.Verbose("load configuration from file")
 
 			if f, err := os.Open(name); err != nil {
-				log.Fatalf("cannot access configuration file %q: %s", name, err)
+				log.Fatal(err.Error())
+				return
 			} else {
-				// finalizer closes f
 				r = f
 			}
-		} else {
-			defer func() {
-				if err := r.(io.ReadCloser).Close(); err != nil {
-					log.Printf("cannot close config fd: %v", err)
-				}
-			}()
 		}
 	} else {
 		r = os.Stdin
 	}
 
-	if err := json.NewDecoder(r).Decode(&config); err != nil {
-		log.Fatalf("cannot load configuration: %v", err)
+	decodeJSON(log.Fatal, "load configuration", r, &config)
+	if err := r.Close(); err != nil {
+		log.Fatal(err.Error())
 	}
-
 	return
 }
 
+// tryFd returns a [io.ReadCloser] if name represents an integer corresponding to a valid file descriptor.
 func tryFd(msg message.Msg, name string) io.ReadCloser {
 	if v, err := strconv.Atoi(name); err != nil {
 		if !errors.Is(err, strconv.ErrSyntax) {
@@ -68,10 +65,29 @@ func tryFd(msg message.Msg, name string) io.ReadCloser {
 	}
 }
 
-func tryShort(msg message.Msg, name string) (config *hst.Config, entry *state.State) {
-	likePrefix := false
-	if len(name) <= 32 {
-		likePrefix = true
+// shortLengthMin is the minimum length a short form identifier can have and still be interpreted as an identifier.
+const shortLengthMin = 1 << 3
+
+// shortIdentifier returns an eight character short representation of [hst.ID] from its random bytes.
+func shortIdentifier(id *hst.ID) string {
+	return shortIdentifierString(id.String())
+}
+
+// shortIdentifierString implements shortIdentifier on an arbitrary string.
+func shortIdentifierString(s string) string {
+	return s[len(hst.ID{}) : len(hst.ID{})+shortLengthMin]
+}
+
+// tryIdentifier attempts to match [hst.State] from a [hex] representation of [hst.ID] or a prefix of its lower half.
+func tryIdentifier(msg message.Msg, name string, s *store.Store) *hst.State {
+	const (
+		likeShort = 1 << iota
+		likeFull
+	)
+
+	var likely uintptr
+	if len(name) >= shortLengthMin && len(name) <= len(hst.ID{}) { // half the hex representation
+		// cannot safely decode here due to unknown alignment
 		for _, c := range name {
 			if c >= '0' && c <= '9' {
 				continue
@@ -79,35 +95,68 @@ func tryShort(msg message.Msg, name string) (config *hst.Config, entry *state.St
 			if c >= 'a' && c <= 'f' {
 				continue
 			}
-			likePrefix = false
-			break
+			return nil
 		}
+		likely |= likeShort
+	} else if len(name) == hex.EncodedLen(len(hst.ID{})) {
+		likely |= likeFull
 	}
 
-	// try to match from state store
-	if likePrefix && len(name) >= 8 {
-		msg.Verbose("argument looks like prefix")
+	if likely == 0 {
+		return nil
+	}
 
-		var sc hst.Paths
-		app.CopyPaths().Copy(&sc, new(app.Hsu).MustID())
-		s := state.NewMulti(msg, sc.RunDirPath.String())
-		if entries, err := state.Join(s); err != nil {
-			log.Printf("cannot join store: %v", err)
-			// drop to fetch from file
-		} else {
-			for id := range entries {
-				v := id.String()
-				if strings.HasPrefix(v, name) {
-					// match, use config from this state entry
-					entry = entries[id]
-					config = entry.Config
-					break
+	entries, copyError := s.All()
+	defer func() {
+		if err := copyError(); err != nil {
+			msg.GetLogger().Println(getMessage("cannot iterate over store:", err))
+		}
+	}()
+
+	switch {
+	case likely&likeShort != 0:
+		msg.Verbose("argument looks like short identifier")
+		for eh := range entries {
+			if eh.DecodeErr != nil {
+				msg.Verbose(getMessage("skipping instance:", eh.DecodeErr))
+				continue
+			}
+
+			if strings.HasPrefix(eh.ID.String()[len(hst.ID{}):], name) {
+				var entry hst.State
+				if _, err := eh.Load(&entry); err != nil {
+					msg.GetLogger().Println(getMessage("cannot load state entry:", err))
+					continue
 				}
-
-				msg.Verbosef("instance %s skipped", v)
+				return &entry
 			}
 		}
-	}
+		return nil
 
-	return
+	case likely&likeFull != 0:
+		var likelyID hst.ID
+		if likelyID.UnmarshalText([]byte(name)) != nil {
+			return nil
+		}
+		msg.Verbose("argument looks like identifier")
+		for eh := range entries {
+			if eh.DecodeErr != nil {
+				msg.Verbose(getMessage("skipping instance:", eh.DecodeErr))
+				continue
+			}
+
+			if eh.ID == likelyID {
+				var entry hst.State
+				if _, err := eh.Load(&entry); err != nil {
+					msg.GetLogger().Println(getMessage("cannot load state entry:", err))
+					continue
+				}
+				return &entry
+			}
+		}
+		return nil
+
+	default:
+		panic("unreachable")
+	}
 }

cmd/hakurei/parse_test.go

@@ -0,0 +1,117 @@
+package main
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+	"time"
+
+	"hakurei.app/container/check"
+	"hakurei.app/hst"
+	"hakurei.app/internal/store"
+	"hakurei.app/message"
+)
+
+func TestShortIdentifier(t *testing.T) {
+	t.Parallel()
+	id := hst.ID{
+		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
+	}
+
+	const want = "fedcba98"
+	if got := shortIdentifier(&id); got != want {
+		t.Errorf("shortIdentifier: %q, want %q", got, want)
+	}
+}
+
+func TestTryIdentifier(t *testing.T) {
+	t.Parallel()
+
+	msg := message.New(nil)
+	id := hst.ID{
+		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
+	}
+	withBase := func(extra ...hst.State) []hst.State {
+		return append([]hst.State{
+			{ID: (hst.ID)(bytes.Repeat([]byte{0xaa}, len(hst.ID{}))), PID: 0xbeef, ShimPID: 0xcafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef0)},
+			{ID: (hst.ID)(bytes.Repeat([]byte{0xab}, len(hst.ID{}))), PID: 0x1beef, ShimPID: 0x1cafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef1)},
+			{ID: (hst.ID)(bytes.Repeat([]byte{0xf0}, len(hst.ID{}))), PID: 0x2beef, ShimPID: 0x2cafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef2)},
+
+			{ID: (hst.ID)(bytes.Repeat([]byte{0xfe}, len(hst.ID{}))), PID: 0xbed, ShimPID: 0xfff, Config: func() *hst.Config {
+				template := hst.Template()
+				template.Identity = hst.IdentityEnd
+				return template
+			}(), Time: time.Unix(0, 0xcafebabe0)},
+			{ID: (hst.ID)(bytes.Repeat([]byte{0xfc}, len(hst.ID{}))), PID: 0x1bed, ShimPID: 0x1fff, Config: func() *hst.Config {
+				template := hst.Template()
+				template.Identity = 0xfc
+				return template
+			}(), Time: time.Unix(0, 0xcafebabe1)},
+			{ID: (hst.ID)(bytes.Repeat([]byte{0xce}, len(hst.ID{}))), PID: 0x2bed, ShimPID: 0x2fff, Config: func() *hst.Config {
+				template := hst.Template()
+				template.Identity = 0xce
+				return template
+			}(), Time: time.Unix(0, 0xcafebabe2)},
+		}, extra...)
+	}
+	sampleEntry := hst.State{
+		ID:      id,
+		PID:     0xcafe,
+		ShimPID: 0xdead,
+		Config:  hst.Template(),
+	}
+
+	testCases := []struct {
+		name string
+		s    string
+		data []hst.State
+		want *hst.State
+	}{
+		{"likely entries fault", "ffffffff", nil, nil},
+
+		{"likely short too short", "ff", nil, nil},
+		{"likely short too long", "fffffffffffffffff", nil, nil},
+		{"likely short invalid lower", "fffffff\x00", nil, nil},
+		{"likely short invalid higher", "0000000\xff", nil, nil},
+		{"short no match", "fedcba98", withBase(), nil},
+		{"short match", "fedcba98", withBase(sampleEntry), &sampleEntry},
+		{"short match single", "fedcba98", []hst.State{sampleEntry}, &sampleEntry},
+		{"short match longer", "fedcba98765", withBase(sampleEntry), &sampleEntry},
+
+		{"likely long invalid", "0123456789abcdeffedcba987654321\x00", nil, nil},
+		{"long no match", "0123456789abcdeffedcba9876543210", withBase(), nil},
+		{"long match", "0123456789abcdeffedcba9876543210", withBase(sampleEntry), &sampleEntry},
+		{"long match single", "0123456789abcdeffedcba9876543210", []hst.State{sampleEntry}, &sampleEntry},
+	}
+	for _, tc := range testCases {
+		base := check.MustAbs(t.TempDir()).Append("store")
+		s := store.New(base)
+		for i := range tc.data {
+			if h, err := s.Handle(tc.data[i].Identity); err != nil {
+				t.Fatalf("Handle: error = %v", err)
+			} else {
+				var unlock func()
+				if unlock, err = h.Lock(); err != nil {
+					t.Fatalf("Lock: error = %v", err)
+				}
+				_, err = h.Save(&tc.data[i])
+				unlock()
+				if err != nil {
+					t.Fatalf("Save: error = %v", err)
+				}
+			}
+		}
+
+		// store must not be written to beyond this point
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := tryIdentifier(msg, tc.s, store.New(base))
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("tryIdentifier: %#v, want %#v", got, tc.want)
+			}
+		})
+	}
+}

cmd/hakurei/print.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"encoding/json"
+	"bytes"
 	"fmt"
 	"io"
 	"log"
@@ -12,23 +12,27 @@ import (
 	"time"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/app"
-	"hakurei.app/internal/app/state"
+	"hakurei.app/internal"
+	"hakurei.app/internal/env"
+	"hakurei.app/internal/outcome"
+	"hakurei.app/internal/store"
 	"hakurei.app/message"
 )
 
+// printShowSystem populates and writes a representation of [hst.Info] to output.
 func printShowSystem(output io.Writer, short, flagJSON bool) {
 	t := newPrinter(output)
 	defer t.MustFlush()
 
-	info := &hst.Info{User: new(app.Hsu).MustID()}
-	app.CopyPaths().Copy(&info.Paths, info.User)
+	info := &hst.Info{Version: internal.Version(), User: new(outcome.Hsu).MustID(nil)}
+	env.CopyPaths().Copy(&info.Paths, info.User)
 
 	if flagJSON {
-		printJSON(output, short, info)
+		encodeJSON(log.Fatal, output, short, info)
 		return
 	}
 
+	t.Printf("Version:\t%s\n", info.Version)
 	t.Printf("User:\t%d\n", info.User)
 	t.Printf("TempDir:\t%s\n", info.TempDir)
 	t.Printf("SharePath:\t%s\n", info.SharePath)
@@ -36,17 +40,19 @@ func printShowSystem(output io.Writer, short, flagJSON bool) {
 	t.Printf("RunDirPath:\t%s\n", info.RunDirPath)
 }
 
+// printShowInstance writes a representation of [hst.State] or [hst.Config] to output.
 func printShowInstance(
 	output io.Writer, now time.Time,
-	instance *state.State, config *hst.Config,
-	short, flagJSON bool) (valid bool) {
+	instance *hst.State, config *hst.Config,
+	short, flagJSON bool,
+) (valid bool) {
 	valid = true
 
 	if flagJSON {
 		if instance != nil {
-			printJSON(output, short, instance)
+			encodeJSON(log.Fatal, output, short, instance)
 		} else {
-			printJSON(output, short, config)
+			encodeJSON(log.Fatal, output, short, config)
 		}
 		return
 	}
@@ -61,9 +67,14 @@ func printShowInstance(
 		}
 	}
 
+	if config == nil {
+		// nothing to print
+		return
+	}
+
 	if instance != nil {
 		t.Printf("State\n")
-		t.Printf(" Instance:\t%s (%d)\n", instance.ID.String(), instance.PID)
+		t.Printf(" Instance:\t%s (%d -> %d)\n", instance.ID.String(), instance.PID, instance.ShimPID)
 		t.Printf(" Uptime:\t%s\n", now.Sub(instance.Time).Round(time.Second).String())
 		t.Printf("\n")
 	}
@@ -79,37 +90,31 @@ func printShowInstance(
 		t.Printf(" Groups:\t%s\n", strings.Join(config.Groups, ", "))
 	}
 	if config.Container != nil {
-		params := config.Container
-		if params.Home != nil {
-			t.Printf(" Home:\t%s\n", params.Home)
+		if config.Container.Home != nil {
+			t.Printf(" Home:\t%s\n", config.Container.Home)
 		}
-		if params.Hostname != "" {
-			t.Printf(" Hostname:\t%s\n", params.Hostname)
+		if config.Container.Hostname != "" {
+			t.Printf(" Hostname:\t%s\n", config.Container.Hostname)
 		}
-		flags := make([]string, 0, 7)
-		writeFlag := func(name string, value bool) {
-			if value {
-				flags = append(flags, name)
+		flags := config.Container.Flags.String()
+
+		// this is included in the upper hst.Config struct but is relevant here
+		const flagDirectWayland = "directwl"
+		if config.DirectWayland {
+			// hardcoded value when every flag is unset
+			if flags == "none" {
+				flags = flagDirectWayland
+			} else {
+				flags += ", " + flagDirectWayland
 			}
 		}
-		writeFlag("userns", params.Userns)
-		writeFlag("devel", params.Devel)
-		writeFlag("net", params.HostNet)
-		writeFlag("abstract", params.HostAbstract)
-		writeFlag("device", params.Device)
-		writeFlag("tty", params.Tty)
-		writeFlag("mapuid", params.MapRealUID)
-		writeFlag("directwl", config.DirectWayland)
-		if len(flags) == 0 {
-			flags = append(flags, "none")
-		}
-		t.Printf(" Flags:\t%s\n", strings.Join(flags, " "))
+		t.Printf(" Flags:\t%s\n", flags)
 
-		if params.Path != nil {
-			t.Printf(" Path:\t%s\n", params.Path)
+		if config.Container.Path != nil {
+			t.Printf(" Path:\t%s\n", config.Container.Path)
 		}
-		if len(params.Args) > 0 {
-			t.Printf(" Arguments:\t%s\n", strings.Join(params.Args, " "))
+		if len(config.Container.Args) > 0 {
+			t.Printf(" Arguments:\t%s\n", strings.Join(config.Container.Args, " "))
 		}
 	}
 	t.Printf("\n")
@@ -129,11 +134,8 @@ func printShowInstance(
 		}
 		if len(config.ExtraPerms) > 0 {
 			t.Printf("Extra ACL\n")
-			for _, p := range config.ExtraPerms {
-				if p == nil {
-					continue
-				}
-				t.Printf(" %s\n", p.String())
+			for i := range config.ExtraPerms {
+				t.Printf(" %s\n", config.ExtraPerms[i].String())
 			}
 			t.Printf("\n")
 		}
@@ -171,57 +173,53 @@ func printShowInstance(
 	return
 }
 
-func printPs(output io.Writer, now time.Time, s state.Store, short, flagJSON bool) {
-	var entries state.Entries
-	if e, err := state.Join(s); err != nil {
-		log.Fatalf("cannot join store: %v", err)
-	} else {
-		entries = e
-	}
-	if err := s.Close(); err != nil {
-		log.Printf("cannot close store: %v", err)
+// printPs writes a representation of active instances to output.
+func printPs(msg message.Msg, output io.Writer, now time.Time, s *store.Store, short, flagJSON bool) {
+	f := func(a func(eh *store.EntryHandle)) {
+		entries, copyError := s.All()
+		for eh := range entries {
+			a(eh)
+		}
+		if err := copyError(); err != nil {
+			msg.GetLogger().Println(getMessage("cannot iterate over store:", err))
+		}
 	}
 
-	if !short && flagJSON {
-		es := make(map[string]*state.State, len(entries))
-		for id, instance := range entries {
-			es[id.String()] = instance
+	if short { // short output requires identifier only
+		var identifiers []*hst.ID
+		f(func(eh *store.EntryHandle) {
+			if _, err := eh.Load(nil); err != nil { // passes through decode error
+				msg.GetLogger().Println(getMessage("cannot validate state entry header:", err))
+				return
+			}
+			identifiers = append(identifiers, &eh.ID)
+		})
+		slices.SortFunc(identifiers, func(a, b *hst.ID) int { return bytes.Compare(a[:], b[:]) })
+
+		if flagJSON {
+			encodeJSON(log.Fatal, output, short, identifiers)
+		} else {
+			for _, id := range identifiers {
+				mustPrintln(output, shortIdentifier(id))
+			}
 		}
-		printJSON(output, short, es)
 		return
 	}
 
-	// sort state entries by id string to ensure consistency between runs
-	exp := make([]*expandedStateEntry, 0, len(entries))
-	for id, instance := range entries {
-		// gracefully skip nil states
-		if instance == nil {
-			log.Printf("got invalid state entry %s", id.String())
-			continue
+	// long output requires full instance state
+	var instances []*hst.State
+	f(func(eh *store.EntryHandle) {
+		var state hst.State
+		if _, err := eh.Load(&state); err != nil { // passes through decode error
+			msg.GetLogger().Println(getMessage("cannot load state entry:", err))
+			return
 		}
+		instances = append(instances, &state)
+	})
+	slices.SortFunc(instances, func(a, b *hst.State) int { return bytes.Compare(a.ID[:], b.ID[:]) })
 
-		// gracefully skip inconsistent states
-		if id != instance.ID {
-			log.Printf("possible store corruption: entry %s has id %s",
-				id.String(), instance.ID.String())
-			continue
-		}
-		exp = append(exp, &expandedStateEntry{s: id.String(), State: instance})
-	}
-	slices.SortFunc(exp, func(a, b *expandedStateEntry) int { return a.Time.Compare(b.Time) })
-
-	if short {
-		if flagJSON {
-			v := make([]string, len(exp))
-			for i, e := range exp {
-				v[i] = e.s
-			}
-			printJSON(output, short, v)
-		} else {
-			for _, e := range exp {
-				mustPrintln(output, e.s[:8])
-			}
-		}
+	if flagJSON {
+		encodeJSON(log.Fatal, output, short, instances)
 		return
 	}
 
@@ -229,61 +227,48 @@ func printPs(output io.Writer, now time.Time, s state.Store, short, flagJSON boo
 	defer t.MustFlush()
 
 	t.Println("\tInstance\tPID\tApplication\tUptime")
-	for _, e := range exp {
-		if len(e.s) != 1<<5 {
-			// unreachable
-			log.Printf("possible store corruption: invalid instance string %s", e.s)
-			continue
-		}
-
+	for _, instance := range instances {
 		as := "(No configuration information)"
-		if e.Config != nil {
-			as = strconv.Itoa(e.Config.Identity)
-			id := e.Config.ID
+		if instance.Config != nil {
+			as = strconv.Itoa(instance.Config.Identity)
+			id := instance.Config.ID
 			if id == "" {
-				id = "app.hakurei." + e.s[:8]
+				id = "app.hakurei." + shortIdentifier(&instance.ID)
 			}
 			as += " (" + id + ")"
 		}
 		t.Printf("\t%s\t%d\t%s\t%s\n",
-			e.s[:8], e.PID, as, now.Sub(e.Time).Round(time.Second).String())
-	}
-}
-
-type expandedStateEntry struct {
-	s string
-	*state.State
-}
-
-func printJSON(output io.Writer, short bool, v any) {
-	encoder := json.NewEncoder(output)
-	if !short {
-		encoder.SetIndent("", "  ")
-	}
-	if err := encoder.Encode(v); err != nil {
-		log.Fatalf("cannot serialise: %v", err)
+			shortIdentifier(&instance.ID), instance.PID, as, now.Sub(instance.Time).Round(time.Second).String())
 	}
 }
 
+// newPrinter returns a configured, wrapped [tabwriter.Writer].
 func newPrinter(output io.Writer) *tp { return &tp{tabwriter.NewWriter(output, 0, 1, 4, ' ', 0)} }
 
+// tp wraps [tabwriter.Writer] to provide additional formatting methods.
 type tp struct{ *tabwriter.Writer }
 
+// Printf calls [fmt.Fprintf] on the underlying [tabwriter.Writer].
 func (p *tp) Printf(format string, a ...any) {
 	if _, err := fmt.Fprintf(p, format, a...); err != nil {
 		log.Fatalf("cannot write to tabwriter: %v", err)
 	}
 }
+
+// Println calls [fmt.Fprintln] on the underlying [tabwriter.Writer].
 func (p *tp) Println(a ...any) {
 	if _, err := fmt.Fprintln(p, a...); err != nil {
 		log.Fatalf("cannot write to tabwriter: %v", err)
 	}
 }
+
+// MustFlush calls the Flush method of [tabwriter.Writer] and calls [log.Fatalf] on a non-nil error.
 func (p *tp) MustFlush() {
 	if err := p.Writer.Flush(); err != nil {
 		log.Fatalf("cannot flush tabwriter: %v", err)
 	}
 }
+
 func mustPrint(output io.Writer, a ...any) {
 	if _, err := fmt.Fprint(output, a...); err != nil {
 		log.Fatalf("cannot print: %v", err)
@@ -294,3 +279,11 @@ func mustPrintln(output io.Writer, a ...any) {
 		log.Fatalf("cannot print: %v", err)
 	}
 }
+
+// getMessage returns a [message.Error] message if available, or err prefixed with fallback otherwise.
+func getMessage(fallback string, err error) string {
+	if m, ok := message.GetMessage(err); ok {
+		return m
+	}
+	return fmt.Sprintln(fallback, err)
+}

cmd/hakurei/print_test.go

@@ -1,26 +1,48 @@
 package main
 
 import (
+	"bytes"
+	"log"
 	"strings"
 	"testing"
 	"time"
 
+	"hakurei.app/container/check"
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
+	"hakurei.app/internal/store"
+	"hakurei.app/message"
 )
 
 var (
-	testID = state.ID{
+	testID = hst.ID{
 		0x8e, 0x2c, 0x76, 0xb0,
 		0x66, 0xda, 0xbe, 0x57,
 		0x4c, 0xf0, 0x73, 0xbd,
 		0xb4, 0x6e, 0xb5, 0xc1,
 	}
-	testState = &state.State{
-		ID:     testID,
-		PID:    0xDEADBEEF,
-		Config: hst.Template(),
-		Time:   testAppTime,
+	testState = hst.State{
+		ID:      testID,
+		PID:     0xcafe,
+		ShimPID: 0xdead,
+		Config:  hst.Template(),
+		Time:    testAppTime,
+	}
+	testStateSmall = hst.State{
+		ID:      (hst.ID)(bytes.Repeat([]byte{0xaa}, len(hst.ID{}))),
+		PID:     0xbeef,
+		ShimPID: 0xcafe,
+		Config: &hst.Config{
+			Enablements: hst.NewEnablements(hst.EWayland | hst.EPulse),
+			Identity:    1,
+			Container: &hst.ContainerConfig{
+				Shell: check.MustAbs("/bin/sh"),
+				Home:  check.MustAbs("/data/data/uk.gensokyo.cat"),
+				Path:  check.MustAbs("/usr/bin/cat"),
+				Args:  []string{"cat"},
+				Flags: hst.FUserns,
+			},
+		},
+		Time: time.Unix(0, 0xdeadbeef).UTC(),
 	}
 	testTime    = time.Unix(3752, 1).UTC()
 	testAppTime = time.Unix(0, 9).UTC()
@@ -31,19 +53,20 @@ func TestPrintShowInstance(t *testing.T) {
 
 	testCases := []struct {
 		name        string
-		instance    *state.State
+		instance    *hst.State
 		config      *hst.Config
 		short, json bool
 		want        string
 		valid       bool
 	}{
+		{"nil", nil, nil, false, false, "Error: invalid configuration!\n\n", false},
 		{"config", nil, hst.Template(), false, false, `App
  Identity:       9 (org.chromium.Chromium)
  Enablements:    wayland, dbus, pulseaudio
  Groups:         video, dialout, plugdev
  Home:           /data/data/org.chromium.Chromium
  Hostname:       localhost
- Flags:          userns devel net abstract device tty mapuid
+ Flags:          multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, runtime, tmpdir
  Path:           /run/current-system/sw/bin/chromium
  Arguments:      chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
 
@@ -88,7 +111,23 @@ App
  Flags:          none
 
 `, false},
-		{"config nil entries", nil, &hst.Config{Container: &hst.ContainerConfig{Filesystem: make([]hst.FilesystemConfigJSON, 1)}, ExtraPerms: make([]*hst.ExtraPermConfig, 1)}, false, false, `Error: container configuration missing path to home directory!
+		{"config flag none directwl", nil, &hst.Config{DirectWayland: true, Container: new(hst.ContainerConfig)}, false, false, `Error: container configuration missing path to home directory!
+
+App
+ Identity:       0
+ Enablements:    (no enablements)
+ Flags:          directwl
+
+`, false},
+		{"config flag directwl", nil, &hst.Config{DirectWayland: true, Container: &hst.ContainerConfig{Flags: hst.FMultiarch}}, false, false, `Error: container configuration missing path to home directory!
+
+App
+ Identity:       0
+ Enablements:    (no enablements)
+ Flags:          multiarch, directwl
+
+`, false},
+		{"config nil entries", nil, &hst.Config{Container: &hst.ContainerConfig{Filesystem: make([]hst.FilesystemConfigJSON, 1)}, ExtraPerms: make([]hst.ExtraPermConfig, 1)}, false, false, `Error: container configuration missing path to home directory!
 
 App
  Identity:       0
@@ -99,6 +138,7 @@ Filesystem
  <invalid>
 
 Extra ACL
+ <invalid>
 
 `, false},
 		{"config pd dbus see", nil, &hst.Config{SessionBus: &hst.BusConfig{See: []string{"org.example.test"}}}, false, false, `Error: configuration missing container state!
@@ -113,8 +153,8 @@ Session bus
 
 `, false},
 
-		{"instance", testState, hst.Template(), false, false, `State
- Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (3735928559)
+		{"instance", &testState, hst.Template(), false, false, `State
+ Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (51966 -> 57005)
  Uptime:      1h2m32s
 
 App
@@ -123,7 +163,7 @@ App
  Groups:         video, dialout, plugdev
  Home:           /data/data/org.chromium.Chromium
  Hostname:       localhost
- Flags:          userns devel net abstract device tty mapuid
+ Flags:          multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, runtime, tmpdir
  Path:           /run/current-system/sw/bin/chromium
  Arguments:      chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
 
@@ -153,10 +193,10 @@ System bus
  Talk:      ["org.bluez" "org.freedesktop.Avahi" "org.freedesktop.UPower"]
 
 `, true},
-		{"instance pd", testState, new(hst.Config), false, false, `Error: configuration missing container state!
+		{"instance pd", &testState, new(hst.Config), false, false, `Error: configuration missing container state!
 
 State
- Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (3735928559)
+ Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (51966 -> 57005)
  Uptime:      1h2m32s
 
 App
@@ -167,172 +207,156 @@ App
 
 		{"json nil", nil, nil, false, true, `null
 `, true},
-		{"json instance", testState, nil, false, true, `{
-  "instance": [
-    142,
-    44,
-    118,
-    176,
-    102,
-    218,
-    190,
-    87,
-    76,
-    240,
-    115,
-    189,
-    180,
-    110,
-    181,
-    193
+		{"json instance", &testState, nil, false, true, `{
+  "instance": "8e2c76b066dabe574cf073bdb46eb5c1",
+  "pid": 51966,
+  "shim_pid": 57005,
+  "id": "org.chromium.Chromium",
+  "enablements": {
+    "wayland": true,
+    "dbus": true,
+    "pulse": true
+  },
+  "session_bus": {
+    "see": null,
+    "talk": [
+      "org.freedesktop.Notifications",
+      "org.freedesktop.FileManager1",
+      "org.freedesktop.ScreenSaver",
+      "org.freedesktop.secrets",
+      "org.kde.kwalletd5",
+      "org.kde.kwalletd6",
+      "org.gnome.SessionManager"
+    ],
+    "own": [
+      "org.chromium.Chromium.*",
+      "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+      "org.mpris.MediaPlayer2.chromium.*"
+    ],
+    "call": {
+      "org.freedesktop.portal.*": "*"
+    },
+    "broadcast": {
+      "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
+    },
+    "filter": true
+  },
+  "system_bus": {
+    "see": null,
+    "talk": [
+      "org.bluez",
+      "org.freedesktop.Avahi",
+      "org.freedesktop.UPower"
+    ],
+    "own": null,
+    "call": null,
+    "broadcast": null,
+    "filter": true
+  },
+  "extra_perms": [
+    {
+      "ensure": true,
+      "path": "/var/lib/hakurei/u0",
+      "x": true
+    },
+    {
+      "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
+      "r": true,
+      "w": true,
+      "x": true
+    }
   ],
-  "pid": 3735928559,
-  "config": {
-    "id": "org.chromium.Chromium",
-    "enablements": {
-      "wayland": true,
-      "dbus": true,
-      "pulse": true
+  "identity": 9,
+  "groups": [
+    "video",
+    "dialout",
+    "plugdev"
+  ],
+  "container": {
+    "hostname": "localhost",
+    "wait_delay": -1,
+    "env": {
+      "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
+      "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
+      "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
     },
-    "session_bus": {
-      "see": null,
-      "talk": [
-        "org.freedesktop.Notifications",
-        "org.freedesktop.FileManager1",
-        "org.freedesktop.ScreenSaver",
-        "org.freedesktop.secrets",
-        "org.kde.kwalletd5",
-        "org.kde.kwalletd6",
-        "org.gnome.SessionManager"
-      ],
-      "own": [
-        "org.chromium.Chromium.*",
-        "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-        "org.mpris.MediaPlayer2.chromium.*"
-      ],
-      "call": {
-        "org.freedesktop.portal.*": "*"
-      },
-      "broadcast": {
-        "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
-      },
-      "filter": true
-    },
-    "system_bus": {
-      "see": null,
-      "talk": [
-        "org.bluez",
-        "org.freedesktop.Avahi",
-        "org.freedesktop.UPower"
-      ],
-      "own": null,
-      "call": null,
-      "broadcast": null,
-      "filter": true
-    },
-    "extra_perms": [
+    "filesystem": [
       {
-        "ensure": true,
-        "path": "/var/lib/hakurei/u0",
-        "x": true
+        "type": "bind",
+        "dst": "/",
+        "src": "/var/lib/hakurei/base/org.debian",
+        "write": true,
+        "special": true
       },
       {
-        "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
-        "r": true,
-        "w": true,
-        "x": true
+        "type": "bind",
+        "dst": "/etc/",
+        "src": "/etc/",
+        "special": true
+      },
+      {
+        "type": "ephemeral",
+        "dst": "/tmp/",
+        "write": true,
+        "perm": 493
+      },
+      {
+        "type": "overlay",
+        "dst": "/nix/store",
+        "lower": [
+          "/var/lib/hakurei/base/org.nixos/ro-store"
+        ],
+        "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
+        "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
+      },
+      {
+        "type": "link",
+        "dst": "/run/current-system",
+        "linkname": "/run/current-system",
+        "dereference": true
+      },
+      {
+        "type": "link",
+        "dst": "/run/opengl-driver",
+        "linkname": "/run/opengl-driver",
+        "dereference": true
+      },
+      {
+        "type": "bind",
+        "dst": "/data/data/org.chromium.Chromium",
+        "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
+        "write": true,
+        "ensure": true
+      },
+      {
+        "type": "bind",
+        "src": "/dev/dri",
+        "dev": true,
+        "optional": true
       }
     ],
-    "identity": 9,
-    "groups": [
-      "video",
-      "dialout",
-      "plugdev"
+    "username": "chronos",
+    "shell": "/run/current-system/sw/bin/zsh",
+    "home": "/data/data/org.chromium.Chromium",
+    "path": "/run/current-system/sw/bin/chromium",
+    "args": [
+      "chromium",
+      "--ignore-gpu-blocklist",
+      "--disable-smooth-scrolling",
+      "--enable-features=UseOzonePlatform",
+      "--ozone-platform=wayland"
     ],
-    "container": {
-      "hostname": "localhost",
-      "wait_delay": -1,
-      "seccomp_compat": true,
-      "devel": true,
-      "userns": true,
-      "host_net": true,
-      "host_abstract": true,
-      "tty": true,
-      "multiarch": true,
-      "env": {
-        "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
-        "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
-        "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
-      },
-      "map_real_uid": true,
-      "device": true,
-      "filesystem": [
-        {
-          "type": "bind",
-          "dst": "/",
-          "src": "/var/lib/hakurei/base/org.debian",
-          "write": true,
-          "special": true
-        },
-        {
-          "type": "bind",
-          "dst": "/etc/",
-          "src": "/etc/",
-          "special": true
-        },
-        {
-          "type": "ephemeral",
-          "dst": "/tmp/",
-          "write": true,
-          "perm": 493
-        },
-        {
-          "type": "overlay",
-          "dst": "/nix/store",
-          "lower": [
-            "/var/lib/hakurei/base/org.nixos/ro-store"
-          ],
-          "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
-          "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
-        },
-        {
-          "type": "link",
-          "dst": "/run/current-system",
-          "linkname": "/run/current-system",
-          "dereference": true
-        },
-        {
-          "type": "link",
-          "dst": "/run/opengl-driver",
-          "linkname": "/run/opengl-driver",
-          "dereference": true
-        },
-        {
-          "type": "bind",
-          "dst": "/data/data/org.chromium.Chromium",
-          "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
-          "write": true,
-          "ensure": true
-        },
-        {
-          "type": "bind",
-          "src": "/dev/dri",
-          "dev": true,
-          "optional": true
-        }
-      ],
-      "username": "chronos",
-      "shell": "/run/current-system/sw/bin/zsh",
-      "home": "/data/data/org.chromium.Chromium",
-      "path": "/run/current-system/sw/bin/chromium",
-      "args": [
-        "chromium",
-        "--ignore-gpu-blocklist",
-        "--disable-smooth-scrolling",
-        "--enable-features=UseOzonePlatform",
-        "--ozone-platform=wayland"
-      ]
-    }
+    "seccomp_compat": true,
+    "devel": true,
+    "userns": true,
+    "host_net": true,
+    "host_abstract": true,
+    "tty": true,
+    "multiarch": true,
+    "map_real_uid": true,
+    "device": true,
+    "share_runtime": true,
+    "share_tmpdir": true
   },
   "time": "1970-01-01T00:00:00.000000009Z"
 }
@@ -402,20 +426,11 @@ App
   "container": {
     "hostname": "localhost",
     "wait_delay": -1,
-    "seccomp_compat": true,
-    "devel": true,
-    "userns": true,
-    "host_net": true,
-    "host_abstract": true,
-    "tty": true,
-    "multiarch": true,
     "env": {
       "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
       "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
       "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
     },
-    "map_real_uid": true,
-    "device": true,
     "filesystem": [
       {
         "type": "bind",
@@ -481,7 +496,18 @@ App
       "--disable-smooth-scrolling",
       "--enable-features=UseOzonePlatform",
       "--ozone-platform=wayland"
-    ]
+    ],
+    "seccomp_compat": true,
+    "devel": true,
+    "userns": true,
+    "host_net": true,
+    "host_abstract": true,
+    "tty": true,
+    "multiarch": true,
+    "map_real_uid": true,
+    "device": true,
+    "share_runtime": true,
+    "share_tmpdir": true
   }
 }
 `, true},
@@ -509,218 +535,243 @@ func TestPrintPs(t *testing.T) {
 
 	testCases := []struct {
 		name        string
-		entries     state.Entries
+		data        []hst.State
 		short, json bool
-		want        string
+		want, log   string
 	}{
-		{"no entries", make(state.Entries), false, false, "    Instance    PID    Application    Uptime\n"},
-		{"no entries short", make(state.Entries), true, false, ""},
-		{"nil instance", state.Entries{testID: nil}, false, false, "    Instance    PID    Application    Uptime\n"},
-		{"state corruption", state.Entries{state.ID{}: testState}, false, false, "    Instance    PID    Application    Uptime\n"},
+		{"no entries", []hst.State{}, false, false, "    Instance    PID    Application    Uptime\n", ""},
+		{"no entries short", []hst.State{}, true, false, "", ""},
 
-		{"valid pd", state.Entries{testID: &state.State{ID: testID, PID: 1 << 8, Config: new(hst.Config), Time: testAppTime}}, false, false, `    Instance    PID    Application                 Uptime
-    8e2c76b0    256    0 (app.hakurei.8e2c76b0)    1h2m32s
-`},
+		{"invalid config", []hst.State{{ID: testID, PID: 1 << 8, Config: new(hst.Config), Time: testAppTime}}, false, false, "    Instance    PID    Application    Uptime\n", "check: configuration missing container state\n"},
 
-		{"valid", state.Entries{testID: testState}, false, false, `    Instance    PID           Application                  Uptime
-    8e2c76b0    3735928559    9 (org.chromium.Chromium)    1h2m32s
-`},
-		{"valid short", state.Entries{testID: testState}, true, false, "8e2c76b0\n"},
-		{"valid json", state.Entries{testID: testState}, false, true, `{
-  "8e2c76b066dabe574cf073bdb46eb5c1": {
-    "instance": [
-      142,
-      44,
-      118,
-      176,
-      102,
-      218,
-      190,
-      87,
-      76,
-      240,
-      115,
-      189,
-      180,
-      110,
-      181,
-      193
+		{"valid", []hst.State{testStateSmall, testState}, false, false, `    Instance    PID      Application                  Uptime
+    4cf073bd    51966    9 (org.chromium.Chromium)    1h2m32s
+    aaaaaaaa    48879    1 (app.hakurei.aaaaaaaa)     1h2m28s
+`, ""},
+		{"valid single", []hst.State{testState}, false, false, `    Instance    PID      Application                  Uptime
+    4cf073bd    51966    9 (org.chromium.Chromium)    1h2m32s
+`, ""},
+
+		{"valid short", []hst.State{testStateSmall, testState}, true, false, "4cf073bd\naaaaaaaa\n", ""},
+		{"valid short single", []hst.State{testState}, true, false, "4cf073bd\n", ""},
+
+		{"valid json", []hst.State{testState, testStateSmall}, false, true, `[
+  {
+    "instance": "8e2c76b066dabe574cf073bdb46eb5c1",
+    "pid": 51966,
+    "shim_pid": 57005,
+    "id": "org.chromium.Chromium",
+    "enablements": {
+      "wayland": true,
+      "dbus": true,
+      "pulse": true
+    },
+    "session_bus": {
+      "see": null,
+      "talk": [
+        "org.freedesktop.Notifications",
+        "org.freedesktop.FileManager1",
+        "org.freedesktop.ScreenSaver",
+        "org.freedesktop.secrets",
+        "org.kde.kwalletd5",
+        "org.kde.kwalletd6",
+        "org.gnome.SessionManager"
+      ],
+      "own": [
+        "org.chromium.Chromium.*",
+        "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+        "org.mpris.MediaPlayer2.chromium.*"
+      ],
+      "call": {
+        "org.freedesktop.portal.*": "*"
+      },
+      "broadcast": {
+        "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
+      },
+      "filter": true
+    },
+    "system_bus": {
+      "see": null,
+      "talk": [
+        "org.bluez",
+        "org.freedesktop.Avahi",
+        "org.freedesktop.UPower"
+      ],
+      "own": null,
+      "call": null,
+      "broadcast": null,
+      "filter": true
+    },
+    "extra_perms": [
+      {
+        "ensure": true,
+        "path": "/var/lib/hakurei/u0",
+        "x": true
+      },
+      {
+        "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
+        "r": true,
+        "w": true,
+        "x": true
+      }
     ],
-    "pid": 3735928559,
-    "config": {
-      "id": "org.chromium.Chromium",
-      "enablements": {
-        "wayland": true,
-        "dbus": true,
-        "pulse": true
+    "identity": 9,
+    "groups": [
+      "video",
+      "dialout",
+      "plugdev"
+    ],
+    "container": {
+      "hostname": "localhost",
+      "wait_delay": -1,
+      "env": {
+        "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
+        "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
+        "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
       },
-      "session_bus": {
-        "see": null,
-        "talk": [
-          "org.freedesktop.Notifications",
-          "org.freedesktop.FileManager1",
-          "org.freedesktop.ScreenSaver",
-          "org.freedesktop.secrets",
-          "org.kde.kwalletd5",
-          "org.kde.kwalletd6",
-          "org.gnome.SessionManager"
-        ],
-        "own": [
-          "org.chromium.Chromium.*",
-          "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-          "org.mpris.MediaPlayer2.chromium.*"
-        ],
-        "call": {
-          "org.freedesktop.portal.*": "*"
-        },
-        "broadcast": {
-          "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
-        },
-        "filter": true
-      },
-      "system_bus": {
-        "see": null,
-        "talk": [
-          "org.bluez",
-          "org.freedesktop.Avahi",
-          "org.freedesktop.UPower"
-        ],
-        "own": null,
-        "call": null,
-        "broadcast": null,
-        "filter": true
-      },
-      "extra_perms": [
+      "filesystem": [
         {
-          "ensure": true,
-          "path": "/var/lib/hakurei/u0",
-          "x": true
+          "type": "bind",
+          "dst": "/",
+          "src": "/var/lib/hakurei/base/org.debian",
+          "write": true,
+          "special": true
         },
         {
-          "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
-          "r": true,
-          "w": true,
-          "x": true
+          "type": "bind",
+          "dst": "/etc/",
+          "src": "/etc/",
+          "special": true
+        },
+        {
+          "type": "ephemeral",
+          "dst": "/tmp/",
+          "write": true,
+          "perm": 493
+        },
+        {
+          "type": "overlay",
+          "dst": "/nix/store",
+          "lower": [
+            "/var/lib/hakurei/base/org.nixos/ro-store"
+          ],
+          "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
+          "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
+        },
+        {
+          "type": "link",
+          "dst": "/run/current-system",
+          "linkname": "/run/current-system",
+          "dereference": true
+        },
+        {
+          "type": "link",
+          "dst": "/run/opengl-driver",
+          "linkname": "/run/opengl-driver",
+          "dereference": true
+        },
+        {
+          "type": "bind",
+          "dst": "/data/data/org.chromium.Chromium",
+          "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
+          "write": true,
+          "ensure": true
+        },
+        {
+          "type": "bind",
+          "src": "/dev/dri",
+          "dev": true,
+          "optional": true
         }
       ],
-      "identity": 9,
-      "groups": [
-        "video",
-        "dialout",
-        "plugdev"
+      "username": "chronos",
+      "shell": "/run/current-system/sw/bin/zsh",
+      "home": "/data/data/org.chromium.Chromium",
+      "path": "/run/current-system/sw/bin/chromium",
+      "args": [
+        "chromium",
+        "--ignore-gpu-blocklist",
+        "--disable-smooth-scrolling",
+        "--enable-features=UseOzonePlatform",
+        "--ozone-platform=wayland"
       ],
-      "container": {
-        "hostname": "localhost",
-        "wait_delay": -1,
-        "seccomp_compat": true,
-        "devel": true,
-        "userns": true,
-        "host_net": true,
-        "host_abstract": true,
-        "tty": true,
-        "multiarch": true,
-        "env": {
-          "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
-          "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
-          "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
-        },
-        "map_real_uid": true,
-        "device": true,
-        "filesystem": [
-          {
-            "type": "bind",
-            "dst": "/",
-            "src": "/var/lib/hakurei/base/org.debian",
-            "write": true,
-            "special": true
-          },
-          {
-            "type": "bind",
-            "dst": "/etc/",
-            "src": "/etc/",
-            "special": true
-          },
-          {
-            "type": "ephemeral",
-            "dst": "/tmp/",
-            "write": true,
-            "perm": 493
-          },
-          {
-            "type": "overlay",
-            "dst": "/nix/store",
-            "lower": [
-              "/var/lib/hakurei/base/org.nixos/ro-store"
-            ],
-            "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
-            "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
-          },
-          {
-            "type": "link",
-            "dst": "/run/current-system",
-            "linkname": "/run/current-system",
-            "dereference": true
-          },
-          {
-            "type": "link",
-            "dst": "/run/opengl-driver",
-            "linkname": "/run/opengl-driver",
-            "dereference": true
-          },
-          {
-            "type": "bind",
-            "dst": "/data/data/org.chromium.Chromium",
-            "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
-            "write": true,
-            "ensure": true
-          },
-          {
-            "type": "bind",
-            "src": "/dev/dri",
-            "dev": true,
-            "optional": true
-          }
-        ],
-        "username": "chronos",
-        "shell": "/run/current-system/sw/bin/zsh",
-        "home": "/data/data/org.chromium.Chromium",
-        "path": "/run/current-system/sw/bin/chromium",
-        "args": [
-          "chromium",
-          "--ignore-gpu-blocklist",
-          "--disable-smooth-scrolling",
-          "--enable-features=UseOzonePlatform",
-          "--ozone-platform=wayland"
-        ]
-      }
+      "seccomp_compat": true,
+      "devel": true,
+      "userns": true,
+      "host_net": true,
+      "host_abstract": true,
+      "tty": true,
+      "multiarch": true,
+      "map_real_uid": true,
+      "device": true,
+      "share_runtime": true,
+      "share_tmpdir": true
     },
     "time": "1970-01-01T00:00:00.000000009Z"
+  },
+  {
+    "instance": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "pid": 48879,
+    "shim_pid": 51966,
+    "enablements": {
+      "wayland": true,
+      "pulse": true
+    },
+    "identity": 1,
+    "groups": null,
+    "container": {
+      "env": null,
+      "filesystem": null,
+      "shell": "/bin/sh",
+      "home": "/data/data/uk.gensokyo.cat",
+      "path": "/usr/bin/cat",
+      "args": [
+        "cat"
+      ],
+      "userns": true,
+      "map_real_uid": false
+    },
+    "time": "1970-01-01T00:00:03.735928559Z"
   }
-}
-`},
-		{"valid short json", state.Entries{testID: testState}, true, true, `["8e2c76b066dabe574cf073bdb46eb5c1"]
-`},
+]
+`, ""},
+		{"valid short json", []hst.State{testStateSmall, testState}, true, true, `["8e2c76b066dabe574cf073bdb46eb5c1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"]
+`, ""},
 	}
 
 	for _, tc := range testCases {
+		s := store.New(check.MustAbs(t.TempDir()).Append("store"))
+		for i := range tc.data {
+			if h, err := s.Handle(tc.data[i].Identity); err != nil {
+				t.Fatalf("Handle: error = %v", err)
+			} else {
+				var unlock func()
+				if unlock, err = h.Lock(); err != nil {
+					t.Fatalf("Lock: error = %v", err)
+				}
+				_, err = h.Save(&tc.data[i])
+				unlock()
+				if err != nil {
+					t.Fatalf("Save: error = %v", err)
+				}
+			}
+		}
+
+		// store must not be written to beyond this point
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			output := new(strings.Builder)
-			printPs(output, testTime, stubStore(tc.entries), tc.short, tc.json)
-			if got := output.String(); got != tc.want {
-				t.Errorf("printPs: got\n%s\nwant\n%s",
-					got, tc.want)
+			var printBuf, logBuf bytes.Buffer
+			msg := message.New(log.New(&logBuf, "check: ", 0))
+			msg.SwapVerbose(true)
+			printPs(msg, &printBuf, testTime, s, tc.short, tc.json)
+			if got := printBuf.String(); got != tc.want {
+				t.Errorf("printPs:\n%s\nwant\n%s", got, tc.want)
 				return
 			}
+			if got := logBuf.String(); got != tc.log {
+				t.Errorf("msg:\n%s\nwant\n%s", got, tc.log)
+			}
 		})
 	}
 }
-
-// stubStore implements [state.Store] and returns test samples via [state.Joiner].
-type stubStore state.Entries
-
-func (s stubStore) Join() (state.Entries, error)               { return state.Entries(s), nil }
-func (s stubStore) Do(int, func(c state.Cursor)) (bool, error) { panic("unreachable") }
-func (s stubStore) List() ([]int, error)                       { panic("unreachable") }
-func (s stubStore) Close() error                               { return nil }

cmd/hpkg/app.go

@@ -76,15 +76,7 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *check.Absolute, argv []
 		Groups:   app.Groups,
 
 		Container: &hst.ContainerConfig{
-			Hostname:     formatHostname(app.Name),
-			Devel:        app.Devel,
-			Userns:       app.Userns,
-			HostNet:      app.HostNet,
-			HostAbstract: app.HostAbstract,
-			Device:       app.Device,
-			Tty:          app.Tty || flagDropShell,
-			MapRealUID:   app.MapRealUID,
-			Multiarch:    app.Multiarch,
+			Hostname: formatHostname(app.Name),
 			Filesystem: []hst.FilesystemConfigJSON{
 				{FilesystemConfig: &hst.FSBind{Target: fhs.AbsEtc, Source: pathSet.cacheDir.Append("etc"), Special: true}},
 				{FilesystemConfig: &hst.FSBind{Source: pathSet.nixPath.Append("store"), Target: pathNixStore}},
@@ -108,11 +100,37 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *check.Absolute, argv []
 			Path: pathname,
 			Args: argv,
 		},
-		ExtraPerms: []*hst.ExtraPermConfig{
+		ExtraPerms: []hst.ExtraPermConfig{
 			{Path: dataHome, Execute: true},
 			{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
 		},
 	}
+
+	if app.Devel {
+		config.Container.Flags |= hst.FDevel
+	}
+	if app.Userns {
+		config.Container.Flags |= hst.FUserns
+	}
+	if app.HostNet {
+		config.Container.Flags |= hst.FHostNet
+	}
+	if app.HostAbstract {
+		config.Container.Flags |= hst.FHostAbstract
+	}
+	if app.Device {
+		config.Container.Flags |= hst.FDevice
+	}
+	if app.Tty || flagDropShell {
+		config.Container.Flags |= hst.FTty
+	}
+	if app.MapRealUID {
+		config.Container.Flags |= hst.FMapRealUID
+	}
+	if app.Multiarch {
+		config.Container.Flags |= hst.FMultiarch
+	}
+	config.Container.Flags |= hst.FShareRuntime | hst.FShareTmpdir
 	return config
 }
 

cmd/hpkg/main.go

@@ -24,7 +24,7 @@ var (
 func main() {
 	log.SetPrefix("hpkg: ")
 	log.SetFlags(0)
-	msg := message.NewMsg(log.Default())
+	msg := message.New(log.Default())
 
 	if err := os.Setenv("SHELL", pathShell.String()); err != nil {
 		log.Fatalf("cannot set $SHELL: %v", err)

cmd/hpkg/proc.go

@@ -14,7 +14,7 @@ import (
 	"hakurei.app/message"
 )
 
-var hakureiPath = internal.MustHakureiPath()
+var hakureiPathVal = internal.MustHakureiPath().String()
 
 func mustRunApp(ctx context.Context, msg message.Msg, config *hst.Config, beforeFail func()) {
 	var (
@@ -27,9 +27,9 @@ func mustRunApp(ctx context.Context, msg message.Msg, config *hst.Config, before
 		log.Fatalf("cannot pipe: %v", err)
 	} else {
 		if msg.IsVerbose() {
-			cmd = exec.CommandContext(ctx, hakureiPath.String(), "-v", "app", "3")
+			cmd = exec.CommandContext(ctx, hakureiPathVal, "-v", "app", "3")
 		} else {
-			cmd = exec.CommandContext(ctx, hakureiPath.String(), "app", "3")
+			cmd = exec.CommandContext(ctx, hakureiPathVal, "app", "3")
 		}
 		cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 		cmd.ExtraFiles = []*os.File{r}

cmd/hpkg/test/test.py

@@ -58,15 +58,13 @@ def check_state(name, enablements):
     instances = json.loads(machine.succeed("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei --json ps"))
     if len(instances) != 1:
         raise Exception(f"unexpected state length {len(instances)}")
-    instance = next(iter(instances.values()))
+    instance = instances[0]
 
-    config = instance['config']
+    if len(instance['container']['args']) != 1 or not (instance['container']['args'][0].startswith("/nix/store/")) or f"hakurei-{name}-" not in (instance['container']['args'][0]):
+        raise Exception(f"unexpected args {instance['container']['args']}")
 
-    if len(config['container']['args']) != 1 or not (config['container']['args'][0].startswith("/nix/store/")) or f"hakurei-{name}-" not in (config['container']['args'][0]):
-        raise Exception(f"unexpected args {config['container']['args']}")
-
-    if config['enablements'] != enablements:
-        raise Exception(f"unexpected enablements {config['enablements']}")
+    if instance['enablements'] != enablements:
+        raise Exception(f"unexpected enablements {instance['enablements']}")
 
 
 start_all()
@@ -94,15 +92,19 @@ machine.wait_for_file("/tmp/hakurei.0/tmpdir/2/success-client")
 collect_state_ui("app_wayland")
 check_state("foot", {"wayland": True, "dbus": True, "pulse": True})
 # Verify acl on XDG_RUNTIME_DIR:
-print(machine.succeed("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 1000002"))
+print(machine.succeed("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 10002"))
 machine.send_chars("exit\n")
 machine.wait_until_fails("pgrep foot")
 # Verify acl cleanup on XDG_RUNTIME_DIR:
-machine.wait_until_fails("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 1000002")
+machine.wait_until_fails("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 10002")
 
 # Exit Sway and verify process exit status 0:
 swaymsg("exit", succeed=False)
 machine.wait_for_file("/tmp/sway-exit-ok")
 
-# Print hakurei runDir contents:
+# Print hakurei share and rundir contents:
+print(machine.succeed("find /tmp/hakurei.0 "
+    + "-path '/tmp/hakurei.0/runtime/*/*' -prune -o "
+    + "-path '/tmp/hakurei.0/tmpdir/*/*' -prune -o "
+    + "-print"))
 print(machine.succeed("find /run/user/1000/hakurei"))

cmd/hpkg/with.go

@@ -17,10 +17,18 @@ func withNixDaemon(
 	action string, command []string, net bool, updateConfig func(config *hst.Config) *hst.Config,
 	app *appInfo, pathSet *appPathSet, dropShell bool, beforeFail func(),
 ) {
+	flags := hst.FMultiarch | hst.FUserns // nix sandbox requires userns
+	if net {
+		flags |= hst.FHostNet
+	}
+	if dropShell {
+		flags |= hst.FTty
+	}
+
 	mustRunAppDropShell(ctx, msg, updateConfig(&hst.Config{
 		ID: app.ID,
 
-		ExtraPerms: []*hst.ExtraPermConfig{
+		ExtraPerms: []hst.ExtraPermConfig{
 			{Path: dataHome, Execute: true},
 			{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
 		},
@@ -28,11 +36,8 @@ func withNixDaemon(
 		Identity: app.Identity,
 
 		Container: &hst.ContainerConfig{
-			Hostname:  formatHostname(app.Name) + "-" + action,
-			Userns:    true, // nix sandbox requires userns
-			HostNet:   net,
-			Multiarch: true,
-			Tty:       dropShell,
+			Hostname: formatHostname(app.Name) + "-" + action,
+
 			Filesystem: []hst.FilesystemConfigJSON{
 				{FilesystemConfig: &hst.FSBind{Target: fhs.AbsEtc, Source: pathSet.cacheDir.Append("etc"), Special: true}},
 				{FilesystemConfig: &hst.FSBind{Source: pathSet.nixPath, Target: pathNix, Write: true}},
@@ -58,6 +63,8 @@ func withNixDaemon(
 				// terminate nix-daemon
 				" && pkill nix-daemon",
 			},
+
+			Flags: flags,
 		},
 	}), dropShell, beforeFail)
 }
@@ -66,11 +73,17 @@ func withCacheDir(
 	ctx context.Context,
 	msg message.Msg,
 	action string, command []string, workDir *check.Absolute,
-	app *appInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) {
+	app *appInfo, pathSet *appPathSet, dropShell bool, beforeFail func(),
+) {
+	flags := hst.FMultiarch
+	if dropShell {
+		flags |= hst.FTty
+	}
+
 	mustRunAppDropShell(ctx, msg, &hst.Config{
 		ID: app.ID,
 
-		ExtraPerms: []*hst.ExtraPermConfig{
+		ExtraPerms: []hst.ExtraPermConfig{
 			{Path: dataHome, Execute: true},
 			{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
 			{Path: workDir, Execute: true},
@@ -79,9 +92,8 @@ func withCacheDir(
 		Identity: app.Identity,
 
 		Container: &hst.ContainerConfig{
-			Hostname:  formatHostname(app.Name) + "-" + action,
-			Multiarch: true,
-			Tty:       dropShell,
+			Hostname: formatHostname(app.Name) + "-" + action,
+
 			Filesystem: []hst.FilesystemConfigJSON{
 				{FilesystemConfig: &hst.FSBind{Target: fhs.AbsEtc, Source: workDir.Append(fhs.Etc), Special: true}},
 				{FilesystemConfig: &hst.FSBind{Source: workDir.Append("nix"), Target: pathNix}},
@@ -98,6 +110,8 @@ func withCacheDir(
 
 			Path: pathShell,
 			Args: []string{bash, "-lc", strings.Join(command, " && ")},
+
+			Flags: flags,
 		},
 	}, dropShell, beforeFail)
 }

cmd/hsu/hst.go

@@ -0,0 +1,16 @@
+package main
+
+/* copied from hst and must never be changed */
+
+const (
+	userOffset = 100000
+	rangeSize  = userOffset / 10
+
+	identityStart = 0
+	identityEnd   = appEnd - appStart
+
+	appStart = rangeSize * 1
+	appEnd   = appStart + rangeSize - 1
+)
+
+func toUser(userid, appid uint32) uint32 { return userid*userOffset + appStart + appid }

cmd/hsu/main.go

@@ -8,6 +8,7 @@ import (
 	"log"
 	"os"
 	"path"
+	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -15,18 +16,23 @@ import (
 )
 
 const (
-	hsuConfFile = "/etc/hsurc"
-	envShim     = "HAKUREI_SHIM"
-	envIdentity = "HAKUREI_IDENTITY"
-	envGroups   = "HAKUREI_GROUPS"
-
-	PR_SET_NO_NEW_PRIVS = 0x26
-
-	identityMin = 0
-	identityMax = 9999
+	// envIdentity is the name of the environment variable holding a
+	// single byte representing the shim setup pipe file descriptor.
+	envShim = "HAKUREI_SHIM"
+	// envGroups holds a ' ' separated list of string representations of
+	// supplementary group gid. Membership requirements are enforced.
+	envGroups = "HAKUREI_GROUPS"
 )
 
+// hakureiPath is the absolute path to Hakurei.
+//
+// This is set by the linker.
+var hakureiPath string
+
 func main() {
+	const PR_SET_NO_NEW_PRIVS = 0x26
+	runtime.LockOSThread()
+
 	log.SetFlags(0)
 	log.SetPrefix("hsu: ")
 	log.SetOutput(os.Stderr)
@@ -43,25 +49,25 @@ func main() {
 		log.Fatal("this program must not be started by root")
 	}
 
+	if !path.IsAbs(hakureiPath) {
+		log.Fatal("this program is compiled incorrectly")
+		return
+	}
+
 	var toolPath string
 	pexe := path.Join("/proc", strconv.Itoa(os.Getppid()), "exe")
 	if p, err := os.Readlink(pexe); err != nil {
 		log.Fatalf("cannot read parent executable path: %v", err)
 	} else if strings.HasSuffix(p, " (deleted)") {
 		log.Fatal("hakurei executable has been deleted")
-	} else if p != mustCheckPath(hmain) {
+	} else if p != hakureiPath {
 		log.Fatal("this program must be started by hakurei")
 	} else {
 		toolPath = p
 	}
 
-	// uid = 1000000 +
-	//    id * 10000 +
-	//      identity
-	uid := 1000000
-
 	// refuse to run if hsurc is not protected correctly
-	if s, err := os.Stat(hsuConfFile); err != nil {
+	if s, err := os.Stat(hsuConfPath); err != nil {
 		log.Fatal(err)
 	} else if s.Mode().Perm() != 0400 {
 		log.Fatal("bad hsurc perm")
@@ -70,25 +76,13 @@ func main() {
 	}
 
 	// authenticate before accepting user input
-	var id int
-	if f, err := os.Open(hsuConfFile); err != nil {
-		log.Fatal(err)
-	} else if v, ok := mustParseConfig(f, puid); !ok {
-		log.Fatalf("uid %d is not in the hsurc file", puid)
-	} else {
-		id = v
-		if err = f.Close(); err != nil {
-			log.Fatal(err)
-		}
-
-		uid += id * 10000
-	}
+	userid := mustParseConfig(puid)
 
 	// pass through setup fd to shim
 	var shimSetupFd string
 	if s, ok := os.LookupEnv(envShim); !ok {
 		// hakurei requests hsurc user id
-		fmt.Print(id)
+		fmt.Print(userid)
 		os.Exit(0)
 	} else if len(s) != 1 || s[0] > '9' || s[0] < '3' {
 		log.Fatal("HAKUREI_SHIM holds an invalid value")
@@ -96,13 +90,22 @@ func main() {
 		shimSetupFd = s
 	}
 
-	// allowed identity range 0 to 9999
-	if as, ok := os.LookupEnv(envIdentity); !ok {
-		log.Fatal("HAKUREI_IDENTITY not set")
-	} else if identity, err := parseUint32Fast(as); err != nil || identity < identityMin || identity > identityMax {
-		log.Fatal("invalid identity")
-	} else {
-		uid += identity
+	// start is going ahead at this point
+	identity := mustReadIdentity()
+
+	const (
+		// first possible uid outcome
+		uidStart = 10000
+		// last possible uid outcome
+		uidEnd = 999919999
+	)
+
+	// cast to int for use with library functions
+	uid := int(toUser(userid, identity))
+
+	// final bounds check to catch any bugs
+	if uid < uidStart || uid >= uidEnd {
+		panic("uid out of bounds")
 	}
 
 	// supplementary groups
@@ -132,11 +135,6 @@ func main() {
 		suppGroups = []int{uid}
 	}
 
-	// final bounds check to catch any bugs
-	if uid < 1000000 || uid >= 2000000 {
-		panic("uid out of bounds")
-	}
-
 	// careful! users in the allowlist is effectively allowed to drop groups via hsu
 
 	if err := syscall.Setresgid(uid, uid, uid); err != nil {

cmd/hsu/package.nix

@@ -19,5 +19,5 @@ buildGoModule {
   ldflags = lib.attrsets.foldlAttrs (
     ldflags: name: value:
     ldflags ++ [ "-X main.${name}=${value}" ]
-  ) [ "-s -w" ] { hmain = "${hakurei}/libexec/hakurei"; };
+  ) [ "-s -w" ] { hakureiPath = "${hakurei}/libexec/hakurei"; };
 }

cmd/hsu/parse.go

@@ -6,62 +6,128 @@ import (
 	"fmt"
 	"io"
 	"log"
+	"math"
+	"os"
 	"strings"
 )
 
-func parseUint32Fast(s string) (int, error) {
+const (
+	// useridStart is the first userid.
+	useridStart = 0
+	// useridEnd is the last userid.
+	useridEnd = useridStart + rangeSize - 1
+)
+
+// parseUint32Fast parses a string representation of an unsigned 32-bit integer value
+// using the fast path only. This limits the range of values it is defined in.
+func parseUint32Fast(s string) (uint32, error) {
 	sLen := len(s)
 	if sLen < 1 {
-		return -1, errors.New("zero length string")
+		return 0, errors.New("zero length string")
 	}
 	if sLen > 10 {
-		return -1, errors.New("string too long")
+		return 0, errors.New("string too long")
 	}
 
-	n := 0
+	var n uint32
 	for i, ch := range []byte(s) {
 		ch -= '0'
 		if ch > 9 {
-			return -1, fmt.Errorf("invalid character '%s' at index %d", string(ch+'0'), i)
+			return 0, fmt.Errorf("invalid character '%s' at index %d", string(ch+'0'), i)
 		}
-		n = n*10 + int(ch)
+		n = n*10 + uint32(ch)
 	}
 	return n, nil
 }
 
-func parseConfig(r io.Reader, puid int) (fid int, ok bool, err error) {
+// parseConfig reads a list of allowed users from r until it encounters puid or [io.EOF].
+//
+// Each line of the file specifies a hakurei userid to kernel uid mapping. A line consists
+// of the string representation of the uid of the user wishing to start hakurei containers,
+// followed by a space, followed by the string representation of its userid. Duplicate uid
+// entries are ignored, with the first occurrence taking effect.
+//
+// All string representations are parsed by calling parseUint32Fast.
+func parseConfig(r io.Reader, puid uint32) (userid uint32, ok bool, err error) {
 	s := bufio.NewScanner(r)
-	var line, puid0 int
+	var (
+		line  uintptr
+		puid0 uint32
+	)
 	for s.Scan() {
 		line++
 
-		// <puid> <fid>
+		// <puid> <userid>
 		lf := strings.SplitN(s.Text(), " ", 2)
 		if len(lf) != 2 {
-			return -1, false, fmt.Errorf("invalid entry on line %d", line)
+			return useridEnd + 1, false, fmt.Errorf("invalid entry on line %d", line)
 		}
 
 		puid0, err = parseUint32Fast(lf[0])
 		if err != nil || puid0 < 1 {
-			return -1, false, fmt.Errorf("invalid parent uid on line %d", line)
+			return useridEnd + 1, false, fmt.Errorf("invalid parent uid on line %d", line)
 		}
 
 		ok = puid0 == puid
 		if ok {
-			// allowed fid range 0 to 99
-			if fid, err = parseUint32Fast(lf[1]); err != nil || fid < 0 || fid > 99 {
-				return -1, false, fmt.Errorf("invalid identity on line %d", line)
+			// userid bound to a range, uint32 size allows this to be increased if needed
+			if userid, err = parseUint32Fast(lf[1]); err != nil ||
+				userid < useridStart || userid > useridEnd {
+				return useridEnd + 1, false, fmt.Errorf("invalid userid on line %d", line)
 			}
 			return
 		}
 	}
-	return -1, false, s.Err()
+	return useridEnd + 1, false, s.Err()
 }
 
-func mustParseConfig(r io.Reader, puid int) (int, bool) {
-	fid, ok, err := parseConfig(r, puid)
-	if err != nil {
+// hsuConfPath is an absolute pathname to the hsu configuration file.
+// Its contents are interpreted by parseConfig.
+const hsuConfPath = "/etc/hsurc"
+
+// mustParseConfig calls parseConfig to interpret the contents of hsuConfPath,
+// terminating the program if an error is encountered, the syntax is incorrect,
+// or the current user is not authorised to use hsu because its uid is missing.
+//
+// Therefore, code after this function call can assume an authenticated state.
+//
+// mustParseConfig returns the userid value of the current user.
+func mustParseConfig(puid int) (userid uint32) {
+	if puid > math.MaxUint32 {
+		log.Fatalf("got impossible uid %d", puid)
+	}
+
+	var ok bool
+	if f, err := os.Open(hsuConfPath); err != nil {
+		log.Fatal(err)
+	} else if userid, ok, err = parseConfig(f, uint32(puid)); err != nil {
+		log.Fatal(err)
+	} else if err = f.Close(); err != nil {
 		log.Fatal(err)
 	}
-	return fid, ok
+	if !ok {
+		log.Fatalf("uid %d is not in the hsurc file", puid)
+	}
+
+	return
+}
+
+// envIdentity is the name of the environment variable holding a
+// string representation of the current application identity.
+var envIdentity = "HAKUREI_IDENTITY"
+
+// mustReadIdentity calls parseUint32Fast to interpret the value stored in envIdentity,
+// terminating the program if the value is not set, malformed, or out of bounds.
+func mustReadIdentity() uint32 {
+	// ranges defined in hst and copied to this package to avoid importing hst
+	if as, ok := os.LookupEnv(envIdentity); !ok {
+		log.Fatal("HAKUREI_IDENTITY not set")
+		panic("unreachable")
+	} else if identity, err := parseUint32Fast(as); err != nil ||
+		identity < identityStart || identity > identityEnd {
+		log.Fatal("invalid identity")
+		panic("unreachable")
+	} else {
+		return identity
+	}
 }

cmd/hsu/parse_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"math"
 	"strconv"
 	"testing"
 )
@@ -36,36 +37,32 @@ func TestParseUint32Fast(t *testing.T) {
 		}
 	})
 
-	t.Run("full range", func(t *testing.T) {
+	t.Run("range", func(t *testing.T) {
 		t.Parallel()
 
-		testRange := func(i, end int) {
+		testRange := func(i, end uint32) {
 			for ; i < end; i++ {
-				s := strconv.Itoa(i)
+				s := strconv.Itoa(int(i))
 				w := i
 				t.Run("parse "+s, func(t *testing.T) {
 					t.Parallel()
 
 					v, err := parseUint32Fast(s)
 					if err != nil {
-						t.Errorf("parseUint32Fast(%q): error = %v",
-							s, err)
+						t.Errorf("parseUint32Fast(%q): error = %v", s, err)
 						return
 					}
 					if v != w {
-						t.Errorf("parseUint32Fast(%q): got %v",
-							s, v)
+						t.Errorf("parseUint32Fast(%q): got %v", s, v)
 						return
 					}
 				})
 			}
 		}
 
-		testRange(0, 5000)
-		testRange(105000, 110000)
-		testRange(23005000, 23010000)
-		testRange(456005000, 456010000)
-		testRange(7890005000, 7890010000)
+		testRange(0, 2500)
+		testRange(23002500, 23005000)
+		testRange(math.MaxUint32-2500, math.MaxUint32)
 	})
 }
 
@@ -74,14 +71,14 @@ func TestParseConfig(t *testing.T) {
 
 	testCases := []struct {
 		name       string
-		puid, want int
+		puid, want uint32
 		wantErr    string
 		rc         string
 	}{
-		{"empty", 0, -1, "", ``},
-		{"invalid field", 0, -1, "invalid entry on line 1", `9`},
-		{"invalid puid", 0, -1, "invalid parent uid on line 1", `f 9`},
-		{"invalid fid", 1000, -1, "invalid identity on line 1", `1000 f`},
+		{"empty", 0, useridEnd + 1, "", ``},
+		{"invalid field", 0, useridEnd + 1, "invalid entry on line 1", `9`},
+		{"invalid puid", 0, useridEnd + 1, "invalid parent uid on line 1", `f 9`},
+		{"invalid userid", 1000, useridEnd + 1, "invalid userid on line 1", `1000 f`},
 		{"match", 1000, 0, "", `1000 0`},
 	}
 
@@ -89,25 +86,21 @@ func TestParseConfig(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			fid, ok, err := parseConfig(bytes.NewBufferString(tc.rc), tc.puid)
+			userid, ok, err := parseConfig(bytes.NewBufferString(tc.rc), tc.puid)
 			if err == nil && tc.wantErr != "" {
-				t.Errorf("parseConfig: error = %v; wantErr %q",
-					err, tc.wantErr)
+				t.Errorf("parseConfig: error = %v; want %q", err, tc.wantErr)
 				return
 			}
 			if err != nil && err.Error() != tc.wantErr {
-				t.Errorf("parseConfig: error = %q; wantErr %q",
-					err, tc.wantErr)
+				t.Errorf("parseConfig: error = %q; want %q", err, tc.wantErr)
 				return
 			}
-			if ok == (tc.want == -1) {
-				t.Errorf("parseConfig: ok = %v; want %v",
-					ok, tc.want)
+			if ok == (tc.want == useridEnd+1) {
+				t.Errorf("parseConfig: ok = %v; want %v", ok, tc.want)
 				return
 			}
-			if fid != tc.want {
-				t.Errorf("parseConfig: fid = %v; want %v",
-					fid, tc.want)
+			if userid != tc.want {
+				t.Errorf("parseConfig: %v; want %v", userid, tc.want)
 			}
 		})
 	}

cmd/hsu/path.go

@@ -1,20 +0,0 @@
-package main
-
-import (
-	"log"
-	"path"
-)
-
-const compPoison = "INVALIDINVALIDINVALIDINVALIDINVALID"
-
-var (
-	hmain = compPoison
-)
-
-func mustCheckPath(p string) string {
-	if p != compPoison && p != "" && path.IsAbs(p) {
-		return p
-	}
-	log.Fatal("this program is compiled incorrectly")
-	return compPoison
-}

container/autoroot_test.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"testing"
 
-	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
+	"hakurei.app/container/std"
 	"hakurei.app/container/stub"
 	"hakurei.app/message"
 )
@@ -23,14 +23,14 @@ func TestAutoRootOp(t *testing.T) {
 	checkOpBehaviour(t, []opBehaviourTestCase{
 		{"readdir", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir(), stub.UniqueError(2)),
 		}, stub.UniqueError(2), nil, nil},
 
 		{"early", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
 				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
@@ -39,7 +39,7 @@ func TestAutoRootOp(t *testing.T) {
 
 		{"apply", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
 				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
@@ -60,7 +60,7 @@ func TestAutoRootOp(t *testing.T) {
 
 		{"success pd", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
 				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
@@ -127,10 +127,10 @@ func TestAutoRootOp(t *testing.T) {
 	})
 
 	checkOpsBuilder(t, []opsBuilderTestCase{
-		{"pd", new(Ops).Root(check.MustAbs("/"), bits.BindWritable), Ops{
+		{"pd", new(Ops).Root(check.MustAbs("/"), std.BindWritable), Ops{
 			&AutoRootOp{
 				Host:  check.MustAbs("/"),
-				Flags: bits.BindWritable,
+				Flags: std.BindWritable,
 			},
 		}},
 	})
@@ -140,42 +140,42 @@ func TestAutoRootOp(t *testing.T) {
 
 		{"internal ne", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, &AutoRootOp{
 			Host:     check.MustAbs("/"),
-			Flags:    bits.BindWritable,
+			Flags:    std.BindWritable,
 			resolved: []*BindMountOp{new(BindMountOp)},
 		}, true},
 
 		{"flags differs", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable | bits.BindDevice,
+			Flags: std.BindWritable | std.BindDevice,
 		}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, false},
 
 		{"host differs", &AutoRootOp{
 			Host:  check.MustAbs("/tmp/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, false},
 
 		{"equals", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, true},
 	})
 
 	checkOpMeta(t, []opMetaTestCase{
 		{"root", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}, "setting up", `auto root "/" flags 0x2`},
 	})
 }

container/bits/bits.go

@@ -1,13 +0,0 @@
-// Package bits contains constants for configuring the container.
-package bits
-
-const (
-	// BindOptional skips nonexistent host paths.
-	BindOptional = 1 << iota
-	// BindWritable mounts filesystem read-write.
-	BindWritable
-	// BindDevice allows access to devices (special files) on this filesystem.
-	BindDevice
-	// BindEnsure attempts to create the host path if it does not exist.
-	BindEnsure
-)

container/capability.go

@@ -49,41 +49,10 @@ func capset(hdrp *capHeader, datap *[2]capData) error {
 }
 
 // capBoundingSetDrop drops a capability from the calling thread's capability bounding set.
-func capBoundingSetDrop(cap uintptr) error {
-	r, _, errno := syscall.Syscall(
-		syscall.SYS_PRCTL,
-		syscall.PR_CAPBSET_DROP,
-		cap, 0,
-	)
-	if r != 0 {
-		return errno
-	}
-	return nil
-}
+func capBoundingSetDrop(cap uintptr) error { return Prctl(syscall.PR_CAPBSET_DROP, cap, 0) }
 
 // capAmbientClearAll clears the ambient capability set of the calling thread.
-func capAmbientClearAll() error {
-	r, _, errno := syscall.Syscall(
-		syscall.SYS_PRCTL,
-		PR_CAP_AMBIENT,
-		PR_CAP_AMBIENT_CLEAR_ALL, 0,
-	)
-	if r != 0 {
-		return errno
-	}
-	return nil
-}
+func capAmbientClearAll() error { return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0) }
 
 // capAmbientRaise adds to the ambient capability set of the calling thread.
-func capAmbientRaise(cap uintptr) error {
-	r, _, errno := syscall.Syscall(
-		syscall.SYS_PRCTL,
-		PR_CAP_AMBIENT,
-		PR_CAP_AMBIENT_RAISE,
-		cap,
-	)
-	if r != 0 {
-		return errno
-	}
-	return nil
-}
+func capAmbientRaise(cap uintptr) error { return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap) }

container/check/absolute_test.go

@@ -147,7 +147,7 @@ func TestAbsoluteIs(t *testing.T) {
 
 type sCheck struct {
 	Pathname *Absolute `json:"val"`
-	Magic    int       `json:"magic"`
+	Magic    uint64    `json:"magic"`
 }
 
 func TestCodecAbsolute(t *testing.T) {
@@ -169,19 +169,19 @@ func TestCodecAbsolute(t *testing.T) {
 		{"good", MustAbs("/etc"),
 			nil,
 			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\b\xff\x80\x00\x04/etc",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x10\xff\x84\x01\x04/etc\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x04/etc\x01\xfc\xc0\xed\x00\x00\x00",
 
 			`"/etc"`, `{"val":"/etc","magic":3236757504}`},
 		{"not absolute", nil,
 			&AbsoluteError{Pathname: "etc"},
 			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\a\xff\x80\x00\x03etc",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
 
 			`"etc"`, `{"val":"etc","magic":3236757504}`},
 		{"zero", nil,
 			new(AbsoluteError),
 			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x04\xff\x80\x00\x00",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
 			`""`, `{"val":"","magic":3236757504}`},
 	}
 

container/container.go

@@ -14,17 +14,20 @@ import (
 	. "syscall"
 	"time"
 
-	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
 	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
+	"hakurei.app/container/std"
 	"hakurei.app/message"
 )
 
 const (
 	// CancelSignal is the signal expected by container init on context cancel.
 	// A custom [Container.Cancel] function must eventually deliver this signal.
-	CancelSignal = SIGTERM
+	CancelSignal = SIGUSR2
+
+	// Timeout for writing initParams to Container.setup.
+	initSetupTimeout = 5 * time.Second
 )
 
 type (
@@ -37,8 +40,8 @@ type (
 		// with behaviour identical to its [exec.Cmd] counterpart.
 		ExtraFiles []*os.File
 
-		// param encoder for shim and init
-		setup *gob.Encoder
+		// param pipe for shim and init
+		setup *os.File
 		// cancels cmd
 		cancel context.CancelFunc
 		// closed after Wait returns
@@ -82,11 +85,11 @@ type (
 		*Ops
 
 		// Seccomp system call filter rules.
-		SeccompRules []seccomp.NativeRule
+		SeccompRules []std.NativeRule
 		// Extra seccomp flags.
 		SeccompFlags seccomp.ExportFlag
 		// Seccomp presets. Has no effect unless SeccompRules is zero-length.
-		SeccompPresets bits.FilterPreset
+		SeccompPresets std.FilterPreset
 		// Do not load seccomp program.
 		SeccompDisable bool
 
@@ -174,7 +177,7 @@ func (p *Container) Start() error {
 	}
 
 	if !p.RetainSession {
-		p.SeccompPresets |= bits.PresetDenyTTY
+		p.SeccompPresets |= std.PresetDenyTTY
 	}
 
 	if p.AdoptWaitDelay == 0 {
@@ -228,10 +231,10 @@ func (p *Container) Start() error {
 	}
 
 	// place setup pipe before user supplied extra files, this is later restored by init
-	if fd, e, err := Setup(&p.cmd.ExtraFiles); err != nil {
+	if fd, f, err := Setup(&p.cmd.ExtraFiles); err != nil {
 		return &StartError{true, "set up params stream", err, false, false}
 	} else {
-		p.setup = e
+		p.setup = f
 		p.cmd.Env = []string{setupEnv + "=" + strconv.Itoa(fd)}
 	}
 	p.cmd.ExtraFiles = append(p.cmd.ExtraFiles, p.ExtraFiles...)
@@ -310,6 +313,9 @@ func (p *Container) Serve() error {
 
 	setup := p.setup
 	p.setup = nil
+	if err := setup.SetDeadline(time.Now().Add(initSetupTimeout)); err != nil {
+		return &StartError{true, "set init pipe deadline", err, false, true}
+	}
 
 	if p.Path == nil {
 		p.cancel()
@@ -321,18 +327,17 @@ func (p *Container) Serve() error {
 		p.Dir = fhs.AbsRoot
 	}
 	if p.SeccompRules == nil {
-		p.SeccompRules = make([]seccomp.NativeRule, 0)
+		p.SeccompRules = make([]std.NativeRule, 0)
 	}
 
-	err := setup.Encode(
-		&initParams{
-			p.Params,
-			Getuid(),
-			Getgid(),
-			len(p.ExtraFiles),
-			p.msg.IsVerbose(),
-		},
-	)
+	err := gob.NewEncoder(setup).Encode(&initParams{
+		p.Params,
+		Getuid(),
+		Getgid(),
+		len(p.ExtraFiles),
+		p.msg.IsVerbose(),
+	})
+	_ = setup.Close()
 	if err != nil {
 		p.cancel()
 	}
@@ -399,7 +404,7 @@ func (p *Container) ProcessState() *os.ProcessState {
 // New returns the address to a new instance of [Container] that requires further initialisation before use.
 func New(ctx context.Context, msg message.Msg) *Container {
 	if msg == nil {
-		msg = message.NewMsg(nil)
+		msg = message.New(nil)
 	}
 
 	p := &Container{ctx: ctx, msg: msg, Params: Params{Ops: new(Ops)}}

container/container_test.go

@@ -20,9 +20,9 @@ import (
 
 	"hakurei.app/command"
 	"hakurei.app/container"
-	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
 	"hakurei.app/container/seccomp"
+	"hakurei.app/container/std"
 	"hakurei.app/container/vfs"
 	"hakurei.app/hst"
 	"hakurei.app/ldd"
@@ -204,22 +204,22 @@ var containerTestCases = []struct {
 	uid int
 	gid int
 
-	rules   []seccomp.NativeRule
+	rules   []std.NativeRule
 	flags   seccomp.ExportFlag
-	presets bits.FilterPreset
+	presets std.FilterPreset
 }{
 	{"minimal", true, false, false, true,
 		emptyOps, emptyMnt,
-		1000, 100, nil, 0, bits.PresetStrict},
+		1000, 100, nil, 0, std.PresetStrict},
 	{"allow", true, true, true, false,
 		emptyOps, emptyMnt,
-		1000, 100, nil, 0, bits.PresetExt | bits.PresetDenyDevel},
+		1000, 100, nil, 0, std.PresetExt | std.PresetDenyDevel},
 	{"no filter", false, true, true, true,
 		emptyOps, emptyMnt,
-		1000, 100, nil, 0, bits.PresetExt},
+		1000, 100, nil, 0, std.PresetExt},
 	{"custom rules", true, true, true, false,
 		emptyOps, emptyMnt,
-		1, 31, []seccomp.NativeRule{{Syscall: seccomp.ScmpSyscall(syscall.SYS_SETUID), Errno: seccomp.ScmpErrno(syscall.EPERM)}}, 0, bits.PresetExt},
+		1, 31, []std.NativeRule{{Syscall: std.ScmpSyscall(syscall.SYS_SETUID), Errno: std.ScmpErrno(syscall.EPERM)}}, 0, std.PresetExt},
 
 	{"tmpfs", true, false, false, true,
 		earlyOps(new(container.Ops).
@@ -228,7 +228,7 @@ var containerTestCases = []struct {
 		earlyMnt(
 			ent("/", hst.PrivateTmp, "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", ignore),
 		),
-		9, 9, nil, 0, bits.PresetStrict},
+		9, 9, nil, 0, std.PresetStrict},
 
 	{"dev", true, true /* go test output is not a tty */, false, false,
 		earlyOps(new(container.Ops).
@@ -246,7 +246,7 @@ var containerTestCases = []struct {
 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
-		1971, 100, nil, 0, bits.PresetStrict},
+		1971, 100, nil, 0, std.PresetStrict},
 
 	{"dev no mqueue", true, true /* go test output is not a tty */, false, false,
 		earlyOps(new(container.Ops).
@@ -263,7 +263,7 @@ var containerTestCases = []struct {
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
-		1971, 100, nil, 0, bits.PresetStrict},
+		1971, 100, nil, 0, std.PresetStrict},
 
 	{"overlay", true, false, false, true,
 		func(t *testing.T) (*container.Ops, context.Context) {
@@ -300,7 +300,7 @@ var containerTestCases = []struct {
 						",redirect_dir=nofollow,uuid=on,userxattr"),
 			}
 		},
-		1 << 3, 1 << 14, nil, 0, bits.PresetStrict},
+		1 << 3, 1 << 14, nil, 0, std.PresetStrict},
 
 	{"overlay ephemeral", true, false, false, true,
 		func(t *testing.T) (*container.Ops, context.Context) {
@@ -324,7 +324,7 @@ var containerTestCases = []struct {
 				ent("/", hst.PrivateTmp, "rw", "overlay", "overlay", ignore),
 			}
 		},
-		1 << 3, 1 << 14, nil, 0, bits.PresetStrict},
+		1 << 3, 1 << 14, nil, 0, std.PresetStrict},
 
 	{"overlay readonly", true, false, false, true,
 		func(t *testing.T) (*container.Ops, context.Context) {
@@ -352,7 +352,7 @@ var containerTestCases = []struct {
 						",redirect_dir=nofollow,userxattr"),
 			}
 		},
-		1 << 3, 1 << 14, nil, 0, bits.PresetStrict},
+		1 << 3, 1 << 14, nil, 0, std.PresetStrict},
 }
 
 func TestContainer(t *testing.T) {
@@ -556,13 +556,13 @@ func testContainerCancel(
 
 func TestContainerString(t *testing.T) {
 	t.Parallel()
-	msg := message.NewMsg(nil)
+	msg := message.New(nil)
 	c := container.NewCommand(t.Context(), msg, check.MustAbs("/run/current-system/sw/bin/ldd"), "ldd", "/usr/bin/env")
 	c.SeccompFlags |= seccomp.AllowMultiarch
 	c.SeccompRules = seccomp.Preset(
-		bits.PresetExt|bits.PresetDenyNS|bits.PresetDenyTTY,
+		std.PresetExt|std.PresetDenyNS|std.PresetDenyTTY,
 		c.SeccompFlags)
-	c.SeccompPresets = bits.PresetStrict
+	c.SeccompPresets = std.PresetStrict
 	want := `argv: ["ldd" "/usr/bin/env"], filter: true, rules: 65, flags: 0x1, presets: 0xf`
 	if got := c.String(); got != want {
 		t.Errorf("String: %s, want %s", got, want)
@@ -576,14 +576,13 @@ const (
 func init() {
 	helperCommands = append(helperCommands, func(c command.Command) {
 		c.Command("block", command.UsageInternal, func(args []string) error {
+			sig := make(chan os.Signal, 1)
+			signal.Notify(sig, os.Interrupt)
+			go func() { <-sig; os.Exit(blockExitCodeInterrupt) }()
+
 			if _, err := os.NewFile(3, "sync").Write([]byte{0}); err != nil {
 				return fmt.Errorf("write to sync pipe: %v", err)
 			}
-			{
-				sig := make(chan os.Signal, 1)
-				signal.Notify(sig, os.Interrupt)
-				go func() { <-sig; os.Exit(blockExitCodeInterrupt) }()
-			}
 			select {}
 		})
 
@@ -722,7 +721,7 @@ func TestMain(m *testing.M) {
 }
 
 func helperNewContainerLibPaths(ctx context.Context, libPaths *[]*check.Absolute, args ...string) (c *container.Container) {
-	msg := message.NewMsg(nil)
+	msg := message.New(nil)
 	c = container.NewCommand(ctx, msg, absHelperInnerPath, "helper", args...)
 	c.Env = append(c.Env, envDoCheck+"=1")
 	c.Bind(check.MustAbs(os.Args[0]), absHelperInnerPath, 0)

container/dispatcher.go

@@ -11,6 +11,7 @@ import (
 	"syscall"
 
 	"hakurei.app/container/seccomp"
+	"hakurei.app/container/std"
 	"hakurei.app/message"
 )
 
@@ -62,7 +63,7 @@ type syscallDispatcher interface {
 	ensureFile(name string, perm, pperm os.FileMode) error
 
 	// seccompLoad provides [seccomp.Load].
-	seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error
+	seccompLoad(rules []std.NativeRule, flags seccomp.ExportFlag) error
 	// notify provides [signal.Notify].
 	notify(c chan<- os.Signal, sig ...os.Signal)
 	// start starts [os/exec.Cmd].
@@ -164,7 +165,7 @@ func (direct) ensureFile(name string, perm, pperm os.FileMode) error {
 	return ensureFile(name, perm, pperm)
 }
 
-func (direct) seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error {
+func (direct) seccompLoad(rules []std.NativeRule, flags seccomp.ExportFlag) error {
 	return seccomp.Load(rules, flags)
 }
 func (direct) notify(c chan<- os.Signal, sig ...os.Signal) { signal.Notify(c, sig...) }

container/dispatcher_test.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"hakurei.app/container/seccomp"
+	"hakurei.app/container/std"
 	"hakurei.app/container/stub"
 	"hakurei.app/message"
 )
@@ -456,7 +457,7 @@ func (k *kstub) ensureFile(name string, perm, pperm os.FileMode) error {
 		stub.CheckArg(k.Stub, "pperm", pperm, 2))
 }
 
-func (k *kstub) seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error {
+func (k *kstub) seccompLoad(rules []std.NativeRule, flags seccomp.ExportFlag) error {
 	k.Helper()
 	return k.Expects("seccompLoad").Error(
 		stub.CheckArgReflect(k.Stub, "rules", rules, 0),

container/errors_test.go

@@ -46,8 +46,8 @@ func TestMessageFromError(t *testing.T) {
 		{"state", OpStateError("overlay"),
 			"impossible overlay state reached", true},
 
-		{"vfs parse", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
-			`cannot parse mountinfo at line 3735928559: numeric field "meow" invalid syntax`, true},
+		{"vfs parse", &vfs.DecoderError{Op: "parse", Line: 0xdead, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
+			`cannot parse mountinfo at line 57005: numeric field "meow" invalid syntax`, true},
 
 		{"tmpfs", TmpfsSizeError(-1),
 			"tmpfs size -1 out of bounds", true},

container/executable.go

@@ -1,6 +1,8 @@
 package container
 
 import (
+	"fmt"
+	"log"
 	"os"
 	"sync"
 
@@ -14,8 +16,13 @@ var (
 
 func copyExecutable(msg message.Msg) {
 	if name, err := os.Executable(); err != nil {
-		msg.BeforeExit()
-		msg.GetLogger().Fatalf("cannot read executable path: %v", err)
+		m := fmt.Sprintf("cannot read executable path: %v", err)
+		if msg != nil {
+			msg.BeforeExit()
+			msg.GetLogger().Fatal(m)
+		} else {
+			log.Fatal(m)
+		}
 	} else {
 		executable = name
 	}

container/executable_test.go

@@ -11,7 +11,7 @@ import (
 func TestExecutable(t *testing.T) {
 	t.Parallel()
 	for i := 0; i < 16; i++ {
-		if got := container.MustExecutable(message.NewMsg(nil)); got != os.Args[0] {
+		if got := container.MustExecutable(message.New(nil)); got != os.Args[0] {
 			t.Errorf("MustExecutable: %q, want %q", got, os.Args[0])
 		}
 	}

container/init.go

@@ -96,16 +96,15 @@ type initParams struct {
 }
 
 // Init is called by [TryArgv0] if the current process is the container init.
-func Init(msg message.Msg) {
-	if msg == nil {
-		panic("attempting to call initEntrypoint with nil msg")
-	}
-	initEntrypoint(direct{}, msg)
-}
+func Init(msg message.Msg) { initEntrypoint(direct{}, msg) }
 
 func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	k.lockOSThread()
 
+	if msg == nil {
+		panic("attempting to call initEntrypoint with nil msg")
+	}
+
 	if k.getpid() != 1 {
 		k.fatal(msg, "this process must run as pid 1")
 	}
@@ -342,7 +341,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	if err := k.start(cmd); err != nil {
 		k.fatalf(msg, "%v", err)
 	}
-	msg.Suspend()
 
 	if err := closeSetup(); err != nil {
 		k.printf(msg, "cannot close setup pipe: %v", err)
@@ -353,10 +351,14 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		wpid    int
 		wstatus WaitStatus
 	}
+
+	// info is closed as the wait4 thread terminates
+	// when there are no longer any processes left to reap
 	info := make(chan winfo, 1)
-	done := make(chan struct{})
 
 	k.new(func(k syscallDispatcher) {
+		k.lockOSThread()
+
 		var (
 			err     error
 			wpid    = -2
@@ -382,12 +384,13 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 			k.printf(msg, "unexpected wait4 response: %v", err)
 		}
 
-		close(done)
+		close(info)
 	})
 
 	// handle signals to dump withheld messages
 	sig := make(chan os.Signal, 2)
-	k.notify(sig, os.Interrupt, CancelSignal)
+	k.notify(sig, CancelSignal,
+		os.Interrupt, SIGTERM, SIGQUIT)
 
 	// closed after residualProcessTimeout has elapsed after initial process death
 	timeout := make(chan struct{})
@@ -396,11 +399,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	for {
 		select {
 		case s := <-sig:
-			if msg.Resume() {
-				msg.Verbosef("%s after process start", s.String())
-			} else {
-				msg.Verbosef("got %s", s.String())
-			}
 			if s == CancelSignal && params.ForwardCancel && cmd.Process != nil {
 				msg.Verbose("forwarding context cancellation")
 				if err := k.signal(cmd, os.Interrupt); err != nil {
@@ -408,14 +406,27 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 				}
 				continue
 			}
+
+			if s == SIGTERM || s == SIGQUIT {
+				msg.Verbosef("got %s, forwarding to initial process", s.String())
+				if err := k.signal(cmd, s); err != nil {
+					k.printf(msg, "cannot forward signal: %v", err)
+				}
+				continue
+			}
+
+			msg.Verbosef("got %s", s.String())
 			msg.BeforeExit()
 			k.exit(0)
 
-		case w := <-info:
-			if w.wpid == cmd.Process.Pid {
-				// initial process exited, output is most likely available again
-				msg.Resume()
+		case w, ok := <-info:
+			if !ok {
+				msg.BeforeExit()
+				k.exit(r)
+				continue // unreachable
+			}
 
+			if w.wpid == cmd.Process.Pid {
 				switch {
 				case w.wstatus.Exited():
 					r = w.wstatus.ExitStatus()
@@ -433,10 +444,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
 			}
 
-		case <-done:
-			msg.BeforeExit()
-			k.exit(r)
-
 		case <-timeout:
 			k.printf(msg, "timeout exceeded waiting for lingering processes")
 			msg.BeforeExit()
@@ -445,6 +452,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 }
 
+// initName is the prefix used by log.std in the init process.
 const initName = "init"
 
 // TryArgv0 calls [Init] if the last element of argv0 is "init".
@@ -453,7 +461,7 @@ func TryArgv0(msg message.Msg) {
 	if msg == nil {
 		log.SetPrefix(initName + ": ")
 		log.SetFlags(0)
-		msg = message.NewMsg(log.Default())
+		msg = message.New(log.Default())
 	}
 
 	if len(os.Args) > 0 && path.Base(os.Args[0]) == initName {

container/initbind.go

@@ -6,8 +6,8 @@ import (
 	"os"
 	"syscall"
 
-	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
+	"hakurei.app/container/std"
 )
 
 func init() { gob.Register(new(BindMountOp)) }
@@ -29,18 +29,18 @@ type BindMountOp struct {
 func (b *BindMountOp) Valid() bool {
 	return b != nil &&
 		b.Source != nil && b.Target != nil &&
-		b.Flags&(bits.BindOptional|bits.BindEnsure) != (bits.BindOptional|bits.BindEnsure)
+		b.Flags&(std.BindOptional|std.BindEnsure) != (std.BindOptional|std.BindEnsure)
 }
 
 func (b *BindMountOp) early(_ *setupState, k syscallDispatcher) error {
-	if b.Flags&bits.BindEnsure != 0 {
+	if b.Flags&std.BindEnsure != 0 {
 		if err := k.mkdirAll(b.Source.String(), 0700); err != nil {
 			return err
 		}
 	}
 
 	if pathname, err := k.evalSymlinks(b.Source.String()); err != nil {
-		if os.IsNotExist(err) && b.Flags&bits.BindOptional != 0 {
+		if os.IsNotExist(err) && b.Flags&std.BindOptional != 0 {
 			// leave sourceFinal as nil
 			return nil
 		}
@@ -53,7 +53,7 @@ func (b *BindMountOp) early(_ *setupState, k syscallDispatcher) error {
 
 func (b *BindMountOp) apply(state *setupState, k syscallDispatcher) error {
 	if b.sourceFinal == nil {
-		if b.Flags&bits.BindOptional == 0 {
+		if b.Flags&std.BindOptional == 0 {
 			// unreachable
 			return OpStateError("bind")
 		}
@@ -76,10 +76,10 @@ func (b *BindMountOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 
 	var flags uintptr = syscall.MS_REC
-	if b.Flags&bits.BindWritable == 0 {
+	if b.Flags&std.BindWritable == 0 {
 		flags |= syscall.MS_RDONLY
 	}
-	if b.Flags&bits.BindDevice == 0 {
+	if b.Flags&std.BindDevice == 0 {
 		flags |= syscall.MS_NODEV
 	}
 

container/initbind_test.go

@@ -6,8 +6,8 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
+	"hakurei.app/container/std"
 	"hakurei.app/container/stub"
 )
 
@@ -25,7 +25,7 @@ func TestBindMountOp(t *testing.T) {
 		{"skip optional", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/bin/"),
-			Flags:  bits.BindOptional,
+			Flags:  std.BindOptional,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "", syscall.ENOENT),
 		}, nil, nil, nil},
@@ -33,7 +33,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success optional", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/bin/"),
-			Flags:  bits.BindOptional,
+			Flags:  std.BindOptional,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
 		}, nil, []stub.Call{
@@ -46,7 +46,7 @@ func TestBindMountOp(t *testing.T) {
 		{"ensureFile device", new(Params), &BindMountOp{
 			Source: check.MustAbs("/dev/null"),
 			Target: check.MustAbs("/dev/null"),
-			Flags:  bits.BindWritable | bits.BindDevice,
+			Flags:  std.BindWritable | std.BindDevice,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
 		}, nil, []stub.Call{
@@ -57,7 +57,7 @@ func TestBindMountOp(t *testing.T) {
 		{"mkdirAll ensure", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/bin/"),
-			Flags:  bits.BindEnsure,
+			Flags:  std.BindEnsure,
 		}, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/bin/", os.FileMode(0700)}, nil, stub.UniqueError(4)),
 		}, stub.UniqueError(4), nil, nil},
@@ -65,7 +65,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success ensure", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/usr/bin/"),
-			Flags:  bits.BindEnsure,
+			Flags:  std.BindEnsure,
 		}, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/bin/", os.FileMode(0700)}, nil, nil),
 			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
@@ -79,7 +79,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success device ro", new(Params), &BindMountOp{
 			Source: check.MustAbs("/dev/null"),
 			Target: check.MustAbs("/dev/null"),
-			Flags:  bits.BindDevice,
+			Flags:  std.BindDevice,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
 		}, nil, []stub.Call{
@@ -92,7 +92,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success device", new(Params), &BindMountOp{
 			Source: check.MustAbs("/dev/null"),
 			Target: check.MustAbs("/dev/null"),
-			Flags:  bits.BindWritable | bits.BindDevice,
+			Flags:  std.BindWritable | std.BindDevice,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
 		}, nil, []stub.Call{
@@ -182,7 +182,7 @@ func TestBindMountOp(t *testing.T) {
 		{"zero", new(BindMountOp), false},
 		{"nil source", &BindMountOp{Target: check.MustAbs("/")}, false},
 		{"nil target", &BindMountOp{Source: check.MustAbs("/")}, false},
-		{"flag optional ensure", &BindMountOp{Source: check.MustAbs("/"), Target: check.MustAbs("/"), Flags: bits.BindOptional | bits.BindEnsure}, false},
+		{"flag optional ensure", &BindMountOp{Source: check.MustAbs("/"), Target: check.MustAbs("/"), Flags: std.BindOptional | std.BindEnsure}, false},
 		{"valid", &BindMountOp{Source: check.MustAbs("/"), Target: check.MustAbs("/")}, true},
 	})
 
@@ -217,7 +217,7 @@ func TestBindMountOp(t *testing.T) {
 		}, &BindMountOp{
 			Source: check.MustAbs("/etc/"),
 			Target: check.MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
-			Flags:  bits.BindOptional,
+			Flags:  std.BindOptional,
 		}, false},
 
 		{"source differs", &BindMountOp{
@@ -256,7 +256,7 @@ func TestBindMountOp(t *testing.T) {
 		{"hostdev", &BindMountOp{
 			Source: check.MustAbs("/dev/"),
 			Target: check.MustAbs("/dev/"),
-			Flags:  bits.BindWritable | bits.BindDevice,
+			Flags:  std.BindWritable | std.BindDevice,
 		}, "mounting", `"/dev/" flags 0x6`},
 	})
 }

container/landlock.go

@@ -5,7 +5,7 @@ import (
 	"syscall"
 	"unsafe"
 
-	"hakurei.app/container/seccomp"
+	"hakurei.app/container/std"
 )
 
 // include/uapi/linux/landlock.h
@@ -14,7 +14,8 @@ const (
 	LANDLOCK_CREATE_RULESET_VERSION = 1 << iota
 )
 
-type LandlockAccessFS uintptr
+// LandlockAccessFS is bitmask of handled filesystem actions.
+type LandlockAccessFS uint64
 
 const (
 	LANDLOCK_ACCESS_FS_EXECUTE LandlockAccessFS = 1 << iota
@@ -105,7 +106,8 @@ func (f LandlockAccessFS) String() string {
 	}
 }
 
-type LandlockAccessNet uintptr
+// LandlockAccessNet is bitmask of handled network actions.
+type LandlockAccessNet uint64
 
 const (
 	LANDLOCK_ACCESS_NET_BIND_TCP LandlockAccessNet = 1 << iota
@@ -140,7 +142,8 @@ func (f LandlockAccessNet) String() string {
 	}
 }
 
-type LandlockScope uintptr
+// LandlockScope is bitmask of scopes restricting a Landlock domain from accessing outside resources.
+type LandlockScope uint64
 
 const (
 	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET LandlockScope = 1 << iota
@@ -175,6 +178,7 @@ func (f LandlockScope) String() string {
 	}
 }
 
+// RulesetAttr is equivalent to struct landlock_ruleset_attr.
 type RulesetAttr struct {
 	// Bitmask of handled filesystem actions.
 	HandledAccessFS LandlockAccessFS
@@ -212,7 +216,7 @@ func (rulesetAttr *RulesetAttr) Create(flags uintptr) (fd int, err error) {
 		size = unsafe.Sizeof(*rulesetAttr)
 	}
 
-	rulesetFd, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags)
+	rulesetFd, _, errno := syscall.Syscall(std.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags)
 	fd = int(rulesetFd)
 	err = errno
 
@@ -231,7 +235,7 @@ func LandlockGetABI() (int, error) {
 }
 
 func LandlockRestrictSelf(rulesetFd int, flags uintptr) error {
-	r, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0)
+	r, _, errno := syscall.Syscall(std.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0)
 	if r != 0 {
 		return errno
 	}

container/mount_test.go

@@ -69,8 +69,8 @@ func TestRemount(t *testing.T) {
 403 397 0:63 / /host/run/user/1000 rw,nosuid,nodev,relatime master:295 - tmpfs tmpfs rw,size=401060k,nr_inodes=100265,mode=700,uid=1000,gid=100
 404 254 0:46 / /host/mnt/cwd rw,relatime master:96 - overlay overlay rw,lowerdir=/mnt/.ro-cwd,upperdir=/tmp/.cwd/upper,workdir=/tmp/.cwd/work
 405 254 0:47 / /host/mnt/src rw,relatime master:99 - overlay overlay rw,lowerdir=/nix/store/ihcrl3zwvp2002xyylri2wz0drwajx4z-ns0pa7q2b1jpx9pbf1l9352x6rniwxjn-source,upperdir=/tmp/.src/upper,workdir=/tmp/.src/work
-407 253 0:65 / / rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=1000000,gid=1000000
-408 407 0:65 /sysroot /sysroot rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=1000000,gid=1000000
+407 253 0:65 / / rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=10000,gid=10000
+408 407 0:65 /sysroot /sysroot rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=10000,gid=10000
 409 408 253:0 /bin /sysroot/bin rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
 410 408 253:0 /home /sysroot/home rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
 411 408 253:0 /lib64 /sysroot/lib64 rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
@@ -91,24 +91,24 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, stub.UniqueError(5)),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, stub.UniqueError(5)),
 		}}, &os.PathError{Op: "open", Path: "/sysroot/nix", Err: stub.UniqueError(5)}},
 
 		{"readlink", func(k *kstub) error {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", stub.UniqueError(4)),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", stub.UniqueError(4)),
 		}}, stub.UniqueError(4)},
 
 		{"close", func(k *kstub) error {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, stub.UniqueError(3)),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, stub.UniqueError(3)),
 		}}, &os.PathError{Op: "close", Path: "/sysroot/nix", Err: stub.UniqueError(3)}},
 
 		{"mountinfo no match", func(k *kstub) error {
@@ -116,9 +116,9 @@ func TestRemount(t *testing.T) {
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/.hakurei", nil),
 			call("verbosef", stub.ExpectArgs{"target resolves to %q", []any{"/sysroot/.hakurei"}}, nil, nil),
-			call("open", stub.ExpectArgs{"/sysroot/.hakurei", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/.hakurei", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/.hakurei", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/.hakurei", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 		}}, &vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/sysroot/.hakurei")}},
 
@@ -126,9 +126,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile("\x00"), nil),
 		}}, &vfs.DecoderError{Op: "parse", Line: 0, Err: vfs.ErrMountInfoFields}},
 
@@ -136,9 +136,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, stub.UniqueError(2)),
 		}}, stub.UniqueError(2)},
@@ -147,9 +147,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, stub.UniqueError(1)),
@@ -170,9 +170,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, syscall.EACCES),
@@ -183,9 +183,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 		}}, nil},
@@ -194,9 +194,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, nil),
@@ -208,9 +208,9 @@ func TestRemount(t *testing.T) {
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/.nix"}, "/sysroot/NIX", nil),
 			call("verbosef", stub.ExpectArgs{"target resolves to %q", []any{"/sysroot/NIX"}}, nil, nil),
-			call("open", stub.ExpectArgs{"/sysroot/NIX", 0x280000, uint32(0)}, 0xdeadbeef, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/NIX", 0x280000, uint32(0)}, 0xdead, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdead}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, nil),

container/params.go

@@ -9,13 +9,13 @@ import (
 )
 
 // Setup appends the read end of a pipe for setup params transmission and returns its fd.
-func Setup(extraFiles *[]*os.File) (int, *gob.Encoder, error) {
+func Setup(extraFiles *[]*os.File) (int, *os.File, error) {
 	if r, w, err := os.Pipe(); err != nil {
 		return -1, nil, err
 	} else {
 		fd := 3 + len(*extraFiles)
 		*extraFiles = append(*extraFiles, r)
-		return fd, gob.NewEncoder(w), nil
+		return fd, w, nil
 	}
 }
 

container/params_test.go

@@ -1,6 +1,7 @@
 package container_test
 
 import (
+	"encoding/gob"
 	"errors"
 	"os"
 	"slices"
@@ -55,16 +56,20 @@ func TestSetupReceive(t *testing.T) {
 	t.Run("setup receive", func(t *testing.T) {
 		check := func(t *testing.T, useNilFdp bool) {
 			const key = "TEST_SETUP_RECEIVE"
-			payload := []int{syscall.MS_MGC_VAL, syscall.MS_MGC_MSK, syscall.MS_ASYNC, syscall.MS_ACTIVE}
+			payload := []uint64{syscall.MS_MGC_VAL, syscall.MS_MGC_MSK, syscall.MS_ASYNC, syscall.MS_ACTIVE}
 
 			encoderDone := make(chan error, 1)
 			extraFiles := make([]*os.File, 0, 1)
-			if fd, encoder, err := container.Setup(&extraFiles); err != nil {
+			deadline, _ := t.Deadline()
+			if fd, f, err := container.Setup(&extraFiles); err != nil {
 				t.Fatalf("Setup: error = %v", err)
 			} else if fd != 3 {
 				t.Fatalf("Setup: fd = %d, want 3", fd)
 			} else {
-				go func() { encoderDone <- encoder.Encode(payload) }()
+				if err = f.SetDeadline(deadline); err != nil {
+					t.Fatal(err.Error())
+				}
+				go func() { encoderDone <- gob.NewEncoder(f).Encode(payload) }()
 			}
 
 			if len(extraFiles) != 1 {
@@ -81,7 +86,7 @@ func TestSetupReceive(t *testing.T) {
 			}
 
 			var (
-				gotPayload []int
+				gotPayload []uint64
 				fdp        *uintptr
 			)
 			if !useNilFdp {

container/path_test.go

@@ -173,8 +173,8 @@ func TestProcPaths(t *testing.T) {
 			}
 		})
 		t.Run("fd", func(t *testing.T) {
-			want := "/host/proc/self/fd/9223372036854775807"
-			if got := hostProc.fd(math.MaxInt64); got != want {
+			want := "/host/proc/self/fd/2147483647"
+			if got := hostProc.fd(math.MaxInt32); got != want {
 				t.Errorf("stdout: %q, want %q", got, want)
 			}
 		})

container/seccomp/libseccomp-helper.c

@@ -9,14 +9,16 @@
 
 #define LEN(arr) (sizeof(arr) / sizeof((arr)[0]))
 
-int32_t hakurei_export_filter(int *ret_p, int fd, uint32_t arch,
-                              uint32_t multiarch,
-                              struct hakurei_syscall_rule *rules,
-                              size_t rules_sz, hakurei_export_flag flags) {
+int32_t hakurei_scmp_make_filter(int *ret_p, uintptr_t allocate_p,
+                                 uint32_t arch, uint32_t multiarch,
+                                 struct hakurei_syscall_rule *rules,
+                                 size_t rules_sz, hakurei_export_flag flags) {
   int i;
   int last_allowed_family;
   int disallowed;
   struct hakurei_syscall_rule *rule;
+  void *buf;
+  size_t len = 0;
 
   int32_t res = 0; /* refer to resPrefix for message */
 
@@ -108,14 +110,26 @@ int32_t hakurei_export_filter(int *ret_p, int fd, uint32_t arch,
   seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EAFNOSUPPORT), SCMP_SYS(socket), 1,
                          SCMP_A0(SCMP_CMP_GE, last_allowed_family + 1));
 
-  if (fd < 0) {
+  if (allocate_p == 0) {
     *ret_p = seccomp_load(ctx);
     if (*ret_p != 0) {
       res = 7;
       goto out;
     }
   } else {
-    *ret_p = seccomp_export_bpf(ctx, fd);
+    *ret_p = seccomp_export_bpf_mem(ctx, NULL, &len);
+    if (*ret_p != 0) {
+      res = 6;
+      goto out;
+    }
+
+    buf = hakurei_scmp_allocate(allocate_p, len);
+    if (buf == NULL) {
+      res = 4;
+      goto out;
+    }
+
+    *ret_p = seccomp_export_bpf_mem(ctx, buf, &len);
     if (*ret_p != 0) {
       res = 6;
       goto out;

container/seccomp/libseccomp-helper.h

@@ -18,7 +18,8 @@ struct hakurei_syscall_rule {
   struct scmp_arg_cmp *arg;
 };
 
-int32_t hakurei_export_filter(int *ret_p, int fd, uint32_t arch,
-                              uint32_t multiarch,
-                              struct hakurei_syscall_rule *rules,
-                              size_t rules_sz, hakurei_export_flag flags);
+extern void *hakurei_scmp_allocate(uintptr_t f, size_t len);
+int32_t hakurei_scmp_make_filter(int *ret_p, uintptr_t allocate_p,
+                                 uint32_t arch, uint32_t multiarch,
+                                 struct hakurei_syscall_rule *rules,
+                                 size_t rules_sz, hakurei_export_flag flags);

container/seccomp/libseccomp.go

@@ -3,7 +3,7 @@ package seccomp
 /*
 #cgo linux pkg-config: --static libseccomp
 
-#include <libseccomp-helper.h>
+#include "libseccomp-helper.h"
 #include <sys/personality.h>
 */
 import "C"
@@ -11,24 +11,24 @@ import (
 	"errors"
 	"fmt"
 	"runtime"
+	"runtime/cgo"
 	"syscall"
 	"unsafe"
+
+	"hakurei.app/container/std"
 )
 
-const (
-	PER_LINUX   = C.PER_LINUX
-	PER_LINUX32 = C.PER_LINUX32
-)
-
-var (
-	ErrInvalidRules = errors.New("invalid native rules slice")
-)
+// ErrInvalidRules is returned for a zero-length rules slice.
+var ErrInvalidRules = errors.New("invalid native rules slice")
 
 // LibraryError represents a libseccomp error.
 type LibraryError struct {
-	Prefix  string
+	// User facing description of the libseccomp function returning the error.
+	Prefix string
+	// Negated errno value returned by libseccomp.
 	Seccomp syscall.Errno
-	Errno   error
+	// Global errno value on return.
+	Errno error
 }
 
 func (e *LibraryError) Error() string {
@@ -56,20 +56,16 @@ func (e *LibraryError) Is(err error) bool {
 }
 
 type (
-	ScmpSyscall = C.int
-	ScmpErrno   = C.int
+	// scmpUint is equivalent to [std.ScmpUint].
+	scmpUint = C.uint
+	// scmpInt is equivalent to [std.ScmpInt].
+	scmpInt = C.int
+
+	// syscallRule is equivalent to [std.NativeRule].
+	syscallRule = C.struct_hakurei_syscall_rule
 )
 
-// A NativeRule specifies an arch-specific action taken by seccomp under certain conditions.
-type NativeRule struct {
-	// Syscall is the arch-dependent syscall number to act against.
-	Syscall ScmpSyscall
-	// Errno is the errno value to return when the condition is satisfied.
-	Errno ScmpErrno
-	// Arg is the optional struct scmp_arg_cmp passed to libseccomp.
-	Arg *ScmpArgCmp
-}
-
+// ExportFlag configures filter behaviour that are not implemented as rules.
 type ExportFlag = C.hakurei_export_flag
 
 const (
@@ -88,12 +84,23 @@ var resPrefix = [...]string{
 	3: "seccomp_arch_add failed (multiarch)",
 	4: "internal libseccomp failure",
 	5: "seccomp_rule_add failed",
-	6: "seccomp_export_bpf failed",
+	6: "seccomp_export_bpf_mem failed",
 	7: "seccomp_load failed",
 }
 
-// Export streams filter contents to fd, or installs it to the current process if fd < 0.
-func Export(fd int, rules []NativeRule, flags ExportFlag) error {
+// cbAllocateBuffer is the function signature for the function handle passed to hakurei_export_filter
+// which allocates the buffer that the resulting bpf program is copied into, and writes its slice header
+// to a value held by the caller.
+type cbAllocateBuffer = func(len C.size_t) (buf unsafe.Pointer)
+
+//export hakurei_scmp_allocate
+func hakurei_scmp_allocate(f C.uintptr_t, len C.size_t) (buf unsafe.Pointer) {
+	return cgo.Handle(f).Value().(cbAllocateBuffer)(len)
+}
+
+// makeFilter generates a bpf program from a slice of [std.NativeRule] and writes the resulting byte slice to p.
+// The filter is installed to the current process if p is nil.
+func makeFilter(rules []std.NativeRule, flags ExportFlag, p *[]byte) error {
 	if len(rules) == 0 {
 		return ErrInvalidRules
 	}
@@ -117,36 +124,66 @@ func Export(fd int, rules []NativeRule, flags ExportFlag) error {
 
 	var ret C.int
 
-	var rulesPinner runtime.Pinner
+	var scmpPinner runtime.Pinner
 	for i := range rules {
 		rule := &rules[i]
-		rulesPinner.Pin(rule)
+		scmpPinner.Pin(rule)
 		if rule.Arg != nil {
-			rulesPinner.Pin(rule.Arg)
+			scmpPinner.Pin(rule.Arg)
 		}
 	}
-	res, err := C.hakurei_export_filter(
-		&ret, C.int(fd),
+
+	var allocateP cgo.Handle
+	if p != nil {
+		allocateP = cgo.NewHandle(func(len C.size_t) (buf unsafe.Pointer) {
+			// this is so the slice header gets a Go pointer
+			*p = make([]byte, len)
+
+			buf = unsafe.Pointer(unsafe.SliceData(*p))
+			scmpPinner.Pin(buf)
+			return
+		})
+	}
+
+	res, err := C.hakurei_scmp_make_filter(
+		&ret, C.uintptr_t(allocateP),
 		arch, multiarch,
-		(*C.struct_hakurei_syscall_rule)(unsafe.Pointer(&rules[0])),
+		(*syscallRule)(unsafe.Pointer(&rules[0])),
 		C.size_t(len(rules)),
 		flags,
 	)
-	rulesPinner.Unpin()
+	scmpPinner.Unpin()
+	if p != nil {
+		allocateP.Delete()
+	}
 
 	if prefix := resPrefix[res]; prefix != "" {
-		return &LibraryError{
-			prefix,
-			-syscall.Errno(ret),
-			err,
-		}
+		return &LibraryError{prefix, syscall.Errno(-ret), err}
 	}
 	return err
 }
 
-// ScmpCompare is the equivalent of scmp_compare;
-// Comparison operators
-type ScmpCompare = C.enum_scmp_compare
+// Export generates a bpf program from a slice of [std.NativeRule].
+// Errors returned by libseccomp is wrapped in [LibraryError].
+func Export(rules []std.NativeRule, flags ExportFlag) (data []byte, err error) {
+	err = makeFilter(rules, flags, &data)
+	return
+}
+
+// Load generates a bpf program from a slice of [std.NativeRule] and enforces it on the current process.
+// Errors returned by libseccomp is wrapped in [LibraryError].
+func Load(rules []std.NativeRule, flags ExportFlag) error { return makeFilter(rules, flags, nil) }
+
+type (
+	// Comparison operators.
+	scmpCompare = C.enum_scmp_compare
+
+	// Argument datum.
+	scmpDatum = C.scmp_datum_t
+
+	// Argument / Value comparison definition.
+	scmpArgCmp = C.struct_scmp_arg_cmp
+)
 
 const (
 	_SCMP_CMP_MIN = C._SCMP_CMP_MIN
@@ -169,25 +206,19 @@ const (
 	_SCMP_CMP_MAX = C._SCMP_CMP_MAX
 )
 
-// ScmpDatum is the equivalent of scmp_datum_t;
-// Argument datum
-type ScmpDatum uint64
+const (
+	// PersonaLinux is passed in a [std.ScmpDatum] for filtering calls to syscall.SYS_PERSONALITY.
+	PersonaLinux = C.PER_LINUX
+	// PersonaLinux32 is passed in a [std.ScmpDatum] for filtering calls to syscall.SYS_PERSONALITY.
+	PersonaLinux32 = C.PER_LINUX32
+)
 
-// ScmpArgCmp is the equivalent of struct scmp_arg_cmp;
-// Argument / Value comparison definition
-type ScmpArgCmp struct {
-	// argument number, starting at 0
-	Arg C.uint
-	// the comparison op, e.g. SCMP_CMP_*
-	Op ScmpCompare
-
-	DatumA, DatumB ScmpDatum
-}
-
-// only used for testing
-func syscallResolveName(s string) (trap int) {
+// syscallResolveName resolves a syscall number by name via seccomp_syscall_resolve_name.
+// This function is only for testing the lookup tables and included here for convenience.
+func syscallResolveName(s string) (trap int, ok bool) {
 	v := C.CString(s)
 	trap = int(C.seccomp_syscall_resolve_name(v))
 	C.free(unsafe.Pointer(v))
+	ok = trap != C.__NR_SCMP_ERROR
 	return
 }

container/seccomp/libseccomp_test.go

@@ -3,15 +3,74 @@ package seccomp_test
 import (
 	"crypto/sha512"
 	"errors"
-	"io"
-	"slices"
 	"syscall"
 	"testing"
 
-	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
+	. "hakurei.app/container/std"
 )
 
+func TestLibraryError(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name    string
+		sample  *LibraryError
+		want    string
+		wantIs  bool
+		compare error
+	}{
+		{
+			"full",
+			&LibraryError{Prefix: "seccomp_export_bpf failed", Seccomp: syscall.ECANCELED, Errno: syscall.EBADF},
+			"seccomp_export_bpf failed: operation canceled (bad file descriptor)",
+			true,
+			&LibraryError{Prefix: "seccomp_export_bpf failed", Seccomp: syscall.ECANCELED, Errno: syscall.EBADF},
+		},
+		{
+			"errno only",
+			&LibraryError{Prefix: "seccomp_init failed", Errno: syscall.ENOMEM},
+			"seccomp_init failed: cannot allocate memory",
+			false,
+			nil,
+		},
+		{
+			"seccomp only",
+			&LibraryError{Prefix: "internal libseccomp failure", Seccomp: syscall.EFAULT},
+			"internal libseccomp failure: bad address",
+			true,
+			syscall.EFAULT,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if errors.Is(tc.sample, tc.compare) != tc.wantIs {
+				t.Errorf("errors.Is(%#v, %#v) did not return %v",
+					tc.sample, tc.compare, tc.wantIs)
+			}
+
+			if got := tc.sample.Error(); got != tc.want {
+				t.Errorf("Error: %q, want %q",
+					got, tc.want)
+			}
+		})
+	}
+
+	t.Run("invalid", func(t *testing.T) {
+		t.Parallel()
+
+		wantPanic := "invalid libseccomp error"
+		defer func() {
+			if r := recover(); r != wantPanic {
+				t.Errorf("panic: %q, want %q", r, wantPanic)
+			}
+		}()
+		_ = new(LibraryError).Error()
+	})
+}
+
 func TestExport(t *testing.T) {
 	t.Parallel()
 
@@ -38,61 +97,34 @@ func TestExport(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			e := New(Preset(tc.presets, tc.flags), tc.flags)
 			want := bpfExpected[bpfPreset{tc.flags, tc.presets}]
-			digest := sha512.New()
-
-			if _, err := io.Copy(digest, e); (err != nil) != tc.wantErr {
-				t.Errorf("Exporter: error = %v, wantErr %v", err, tc.wantErr)
+			if data, err := Export(Preset(tc.presets, tc.flags), tc.flags); (err != nil) != tc.wantErr {
+				t.Errorf("Export: error = %v, wantErr %v", err, tc.wantErr)
 				return
-			}
-			if err := e.Close(); err != nil {
-				t.Errorf("Close: error = %v", err)
-			}
-			if got := digest.Sum(nil); !slices.Equal(got, want) {
-				t.Fatalf("Export: hash = %x, want %x",
-					got, want)
+			} else if got := sha512.Sum512(data); got != want {
+				t.Fatalf("Export: hash = %x, want %x", got, want)
 				return
 			}
 		})
 	}
-
-	t.Run("close without use", func(t *testing.T) {
-		e := New(Preset(0, 0), 0)
-		if err := e.Close(); !errors.Is(err, syscall.EINVAL) {
-			t.Errorf("Close: error = %v", err)
-			return
-		}
-	})
-
-	t.Run("close partial read", func(t *testing.T) {
-		e := New(Preset(0, 0), 0)
-		if _, err := e.Read(nil); err != nil {
-			t.Errorf("Read: error = %v", err)
-			return
-		}
-		// the underlying implementation uses buffered io, so the outcome of this is nondeterministic;
-		// that is not harmful however, so both outcomes are checked for here
-		if err := e.Close(); err != nil &&
-			(!errors.Is(err, syscall.ECANCELED) || !errors.Is(err, syscall.EBADF)) {
-			t.Errorf("Close: error = %v", err)
-			return
-		}
-	})
 }
 
 func BenchmarkExport(b *testing.B) {
-	buf := make([]byte, 8)
+	const exportFlags = AllowMultiarch | AllowCAN | AllowBluetooth
+	const presetFlags = PresetExt | PresetDenyNS | PresetDenyTTY | PresetDenyDevel | PresetLinux32
+	var want = bpfExpected[bpfPreset{exportFlags, presetFlags}]
+
 	for b.Loop() {
-		e := New(
-			Preset(PresetExt|PresetDenyNS|PresetDenyTTY|PresetDenyDevel|PresetLinux32,
-				AllowMultiarch|AllowCAN|AllowBluetooth),
-			AllowMultiarch|AllowCAN|AllowBluetooth)
-		if _, err := io.CopyBuffer(io.Discard, e, buf); err != nil {
-			b.Fatalf("cannot export: %v", err)
+		data, err := Export(Preset(presetFlags, exportFlags), exportFlags)
+
+		b.StopTimer()
+		if err != nil {
+			b.Fatalf("Export: error = %v", err)
 		}
-		if err := e.Close(); err != nil {
-			b.Fatalf("cannot close exporter: %v", err)
+		if got := sha512.Sum512(data); got != want {
+			b.Fatalf("Export: hash = %x, want %x", got, want)
+			return
 		}
+		b.StartTimer()
 	}
 }

container/seccomp/presets.go

@@ -5,32 +5,32 @@ package seccomp
 import (
 	. "syscall"
 
-	"hakurei.app/container/bits"
+	. "hakurei.app/container/std"
 )
 
-func Preset(presets bits.FilterPreset, flags ExportFlag) (rules []NativeRule) {
-	allowedPersonality := PER_LINUX
-	if presets&bits.PresetLinux32 != 0 {
-		allowedPersonality = PER_LINUX32
+func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
+	allowedPersonality := PersonaLinux
+	if presets&PresetLinux32 != 0 {
+		allowedPersonality = PersonaLinux32
 	}
 	presetDevelFinal := presetDevel(ScmpDatum(allowedPersonality))
 
 	l := len(presetCommon)
-	if presets&bits.PresetDenyNS != 0 {
+	if presets&PresetDenyNS != 0 {
 		l += len(presetNamespace)
 	}
-	if presets&bits.PresetDenyTTY != 0 {
+	if presets&PresetDenyTTY != 0 {
 		l += len(presetTTY)
 	}
-	if presets&bits.PresetDenyDevel != 0 {
+	if presets&PresetDenyDevel != 0 {
 		l += len(presetDevelFinal)
 	}
 	if flags&AllowMultiarch == 0 {
 		l += len(presetEmu)
 	}
-	if presets&bits.PresetExt != 0 {
+	if presets&PresetExt != 0 {
 		l += len(presetCommonExt)
-		if presets&bits.PresetDenyNS != 0 {
+		if presets&PresetDenyNS != 0 {
 			l += len(presetNamespaceExt)
 		}
 		if flags&AllowMultiarch == 0 {
@@ -40,21 +40,21 @@ func Preset(presets bits.FilterPreset, flags ExportFlag) (rules []NativeRule) {
 
 	rules = make([]NativeRule, 0, l)
 	rules = append(rules, presetCommon...)
-	if presets&bits.PresetDenyNS != 0 {
+	if presets&PresetDenyNS != 0 {
 		rules = append(rules, presetNamespace...)
 	}
-	if presets&bits.PresetDenyTTY != 0 {
+	if presets&PresetDenyTTY != 0 {
 		rules = append(rules, presetTTY...)
 	}
-	if presets&bits.PresetDenyDevel != 0 {
+	if presets&PresetDenyDevel != 0 {
 		rules = append(rules, presetDevelFinal...)
 	}
 	if flags&AllowMultiarch == 0 {
 		rules = append(rules, presetEmu...)
 	}
-	if presets&bits.PresetExt != 0 {
+	if presets&PresetExt != 0 {
 		rules = append(rules, presetCommonExt...)
-		if presets&bits.PresetDenyNS != 0 {
+		if presets&PresetDenyNS != 0 {
 			rules = append(rules, presetNamespaceExt...)
 		}
 		if flags&AllowMultiarch == 0 {

container/seccomp/presets_386_test.go

@@ -0,0 +1,27 @@
+package seccomp_test
+
+import (
+	. "hakurei.app/container/seccomp"
+	. "hakurei.app/container/std"
+)
+
+var bpfExpected = bpfLookup{
+	{AllowMultiarch | AllowCAN |
+		AllowBluetooth, PresetExt |
+		PresetDenyNS | PresetDenyTTY | PresetDenyDevel |
+		PresetLinux32}: toHash(
+		"e67735d24caba42b6801e829ea4393727a36c5e37b8a51e5648e7886047e8454484ff06872aaef810799c29cbd0c1b361f423ad0ef518e33f68436372cc90eb1"),
+
+	{0, 0}: toHash(
+		"5dbcc08a4a1ccd8c12dd0cf6d9817ea6d4f40246e1db7a60e71a50111c4897d69f6fb6d710382d70c18910c2e4fa2d2aeb2daed835dd2fabe3f71def628ade59"),
+	{0, PresetExt}: toHash(
+		"d6c0f130dbb5c793d1c10f730455701875778138bd2d03ca009d674842fd97a10815a8c539b76b7801a73de19463938701216b756c053ec91cfe304cba04a0ed"),
+	{0, PresetStrict}: toHash(
+		"af7d7b66f2e83f9a850472170c1b83d1371426faa9d0dee4e85b179d3ec75ca92828cb8529eb3012b559497494b2eab4d4b140605e3a26c70dfdbe5efe33c105"),
+	{0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash(
+		"adfb4397e6eeae8c477d315d58204aae854d60071687b8df4c758e297780e02deee1af48328cef80e16e4d6ab1a66ef13e42247c3475cf447923f15cbc17a6a6"),
+	{0, PresetExt | PresetDenyDevel}: toHash(
+		"5d641321460cf54a7036a40a08e845082e1f6d65b9dee75db85ef179f2732f321b16aee2258b74273b04e0d24562e8b1e727930a7e787f41eb5c8aaa0bc22793"),
+	{0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash(
+		"b1f802d39de5897b1e4cb0e82a199f53df0a803ea88e2fd19491fb8c90387c9e2eaa7e323f565fecaa0202a579eb050531f22e6748e04cfd935b8faac35983ec"),
+}

container/seccomp/presets_amd64_test.go

@@ -1,8 +1,8 @@
 package seccomp_test
 
 import (
-	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
+	. "hakurei.app/container/std"
 )
 
 var bpfExpected = bpfLookup{

container/seccomp/presets_arm64_test.go

@@ -1,8 +1,8 @@
 package seccomp_test
 
 import (
-	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
+	. "hakurei.app/container/std"
 )
 
 var bpfExpected = bpfLookup{

container/seccomp/presets_test.go

@@ -1,29 +1,30 @@
 package seccomp_test
 
 import (
+	"crypto/sha512"
 	"encoding/hex"
 
-	"hakurei.app/container/bits"
 	"hakurei.app/container/seccomp"
+	"hakurei.app/container/std"
 )
 
 type (
 	bpfPreset = struct {
 		seccomp.ExportFlag
-		bits.FilterPreset
+		std.FilterPreset
 	}
-	bpfLookup map[bpfPreset][]byte
+	bpfLookup map[bpfPreset][sha512.Size]byte
 )
 
-func toHash(s string) []byte {
-	if len(s) != 128 {
+func toHash(s string) [sha512.Size]byte {
+	if len(s) != sha512.Size*2 {
 		panic("bad sha512 string length")
 	}
 	if v, err := hex.DecodeString(s); err != nil {
 		panic(err.Error())
-	} else if len(v) != 64 {
+	} else if len(v) != sha512.Size {
 		panic("unreachable")
 	} else {
-		return v
+		return ([sha512.Size]byte)(v)
 	}
 }

container/seccomp/proc.go

@@ -1,72 +0,0 @@
-package seccomp
-
-import (
-	"context"
-	"errors"
-	"syscall"
-
-	"hakurei.app/helper/proc"
-)
-
-// New returns an inactive Encoder instance.
-func New(rules []NativeRule, flags ExportFlag) *Encoder { return &Encoder{newExporter(rules, flags)} }
-
-// Load loads a filter into the kernel.
-func Load(rules []NativeRule, flags ExportFlag) error { return Export(-1, rules, flags) }
-
-/*
-An Encoder writes a BPF program to an output stream.
-
-Methods of Encoder are not safe for concurrent use.
-
-An Encoder must not be copied after first use.
-*/
-type Encoder struct{ *exporter }
-
-func (e *Encoder) Read(p []byte) (n int, err error) {
-	if err = e.prepare(); err != nil {
-		return
-	}
-	return e.r.Read(p)
-}
-
-func (e *Encoder) Close() error {
-	if e.r == nil {
-		return syscall.EINVAL
-	}
-
-	// this hangs if the cgo thread fails to exit
-	return errors.Join(e.closeWrite(), <-e.exportErr)
-}
-
-// NewFile returns an instance of exporter implementing [proc.File].
-func NewFile(rules []NativeRule, flags ExportFlag) proc.File {
-	return &File{rules: rules, flags: flags}
-}
-
-// File implements [proc.File] and provides access to the read end of exporter pipe.
-type File struct {
-	rules []NativeRule
-	flags ExportFlag
-	proc.BaseFile
-}
-
-func (f *File) ErrCount() int { return 2 }
-func (f *File) Fulfill(ctx context.Context, dispatchErr func(error)) error {
-	e := newExporter(f.rules, f.flags)
-	if err := e.prepare(); err != nil {
-		return err
-	}
-	f.Set(e.r)
-	go func() {
-		select {
-		case err := <-e.exportErr:
-			dispatchErr(nil)
-			dispatchErr(err)
-		case <-ctx.Done():
-			dispatchErr(e.closeWrite())
-			dispatchErr(<-e.exportErr)
-		}
-	}()
-	return nil
-}

container/seccomp/seccomp.go

@@ -1,60 +0,0 @@
-// Package seccomp provides high level wrappers around libseccomp.
-package seccomp
-
-import (
-	"os"
-	"runtime"
-	"sync"
-)
-
-type exporter struct {
-	rules []NativeRule
-	flags ExportFlag
-	r, w  *os.File
-
-	prepareOnce sync.Once
-	prepareErr  error
-	closeOnce   sync.Once
-	closeErr    error
-	exportErr   <-chan error
-}
-
-func (e *exporter) prepare() error {
-	e.prepareOnce.Do(func() {
-		if r, w, err := os.Pipe(); err != nil {
-			e.prepareErr = err
-			return
-		} else {
-			e.r, e.w = r, w
-		}
-
-		ec := make(chan error, 1)
-		go func(fd uintptr) {
-			ec <- Export(int(fd), e.rules, e.flags)
-			close(ec)
-			_ = e.closeWrite()
-			runtime.KeepAlive(e.w)
-		}(e.w.Fd())
-		e.exportErr = ec
-		runtime.SetFinalizer(e, (*exporter).closeWrite)
-	})
-	return e.prepareErr
-}
-
-func (e *exporter) closeWrite() error {
-	e.closeOnce.Do(func() {
-		if e.w == nil {
-			panic("closeWrite called on invalid exporter")
-		}
-		e.closeErr = e.w.Close()
-
-		// no need for a finalizer anymore
-		runtime.SetFinalizer(e, nil)
-	})
-
-	return e.closeErr
-}
-
-func newExporter(rules []NativeRule, flags ExportFlag) *exporter {
-	return &exporter{rules: rules, flags: flags}
-}

container/seccomp/seccomp_test.go

@@ -1,71 +0,0 @@
-package seccomp_test
-
-import (
-	"errors"
-	"runtime"
-	"syscall"
-	"testing"
-
-	"hakurei.app/container/seccomp"
-)
-
-func TestLibraryError(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name    string
-		sample  *seccomp.LibraryError
-		want    string
-		wantIs  bool
-		compare error
-	}{
-		{
-			"full",
-			&seccomp.LibraryError{Prefix: "seccomp_export_bpf failed", Seccomp: syscall.ECANCELED, Errno: syscall.EBADF},
-			"seccomp_export_bpf failed: operation canceled (bad file descriptor)",
-			true,
-			&seccomp.LibraryError{Prefix: "seccomp_export_bpf failed", Seccomp: syscall.ECANCELED, Errno: syscall.EBADF},
-		},
-		{
-			"errno only",
-			&seccomp.LibraryError{Prefix: "seccomp_init failed", Errno: syscall.ENOMEM},
-			"seccomp_init failed: cannot allocate memory",
-			false,
-			nil,
-		},
-		{
-			"seccomp only",
-			&seccomp.LibraryError{Prefix: "internal libseccomp failure", Seccomp: syscall.EFAULT},
-			"internal libseccomp failure: bad address",
-			true,
-			syscall.EFAULT,
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			if errors.Is(tc.sample, tc.compare) != tc.wantIs {
-				t.Errorf("errors.Is(%#v, %#v) did not return %v",
-					tc.sample, tc.compare, tc.wantIs)
-			}
-
-			if got := tc.sample.Error(); got != tc.want {
-				t.Errorf("Error: %q, want %q",
-					got, tc.want)
-			}
-		})
-	}
-
-	t.Run("invalid", func(t *testing.T) {
-		t.Parallel()
-
-		wantPanic := "invalid libseccomp error"
-		defer func() {
-			if r := recover(); r != wantPanic {
-				t.Errorf("panic: %q, want %q", r, wantPanic)
-			}
-		}()
-		runtime.KeepAlive(new(seccomp.LibraryError).Error())
-	})
-}

container/seccomp/std_test.go

@@ -0,0 +1,63 @@
+package seccomp
+
+import (
+	"reflect"
+	"testing"
+	"unsafe"
+
+	"hakurei.app/container/std"
+)
+
+func TestSyscallResolveName(t *testing.T) {
+	t.Parallel()
+
+	for name, want := range std.Syscalls() {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			// this checks the std implementation against libseccomp.
+			if got, ok := syscallResolveName(name); !ok || got != want {
+				t.Errorf("syscallResolveName(%q) = %d, want %d", name, got, want)
+			}
+		})
+	}
+}
+
+func TestRuleType(t *testing.T) {
+	assertKind[std.ScmpUint, scmpUint](t)
+	assertKind[std.ScmpInt, scmpInt](t)
+
+	assertSize[std.NativeRule, syscallRule](t)
+	assertKind[std.ScmpDatum, scmpDatum](t)
+	assertKind[std.ScmpCompare, scmpCompare](t)
+	assertSize[std.ScmpArgCmp, scmpArgCmp](t)
+}
+
+// assertSize asserts that native and equivalent are of the same size.
+func assertSize[native, equivalent any](t *testing.T) {
+	t.Helper()
+
+	got, want := unsafe.Sizeof(*new(native)), unsafe.Sizeof(*new(equivalent))
+	if got != want {
+		t.Fatalf("%s: %d, want %d", reflect.TypeFor[native]().Name(), got, want)
+	}
+}
+
+// assertKind asserts that native and equivalent are of the same kind.
+func assertKind[native, equivalent any](t *testing.T) {
+	t.Helper()
+
+	assertSize[native, equivalent](t)
+	nativeType, equivalentType := reflect.TypeFor[native](), reflect.TypeFor[equivalent]()
+	got, want := nativeType.Kind(), equivalentType.Kind()
+
+	if got == reflect.Invalid || want == reflect.Invalid {
+		t.Fatalf("%s: invalid call to assertKind", nativeType.Name())
+	}
+	if got == reflect.Struct {
+		t.Fatalf("%s: struct is unsupported by assertKind", nativeType.Name())
+	}
+	if got != want {
+		t.Fatalf("%s: %s, want %s", nativeType.Name(), nativeType.Kind(), equivalentType.Kind())
+	}
+}

container/seccomp/syscall_extra_linux_amd64.go

@@ -1,48 +0,0 @@
-package seccomp
-
-/*
-#cgo linux pkg-config: --static libseccomp
-
-#include <seccomp.h>
-*/
-import "C"
-
-var syscallNumExtra = map[string]int{
-	"umount":          SYS_UMOUNT,
-	"subpage_prot":    SYS_SUBPAGE_PROT,
-	"switch_endian":   SYS_SWITCH_ENDIAN,
-	"vm86":            SYS_VM86,
-	"vm86old":         SYS_VM86OLD,
-	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
-	"clock_settime64": SYS_CLOCK_SETTIME64,
-	"chown32":         SYS_CHOWN32,
-	"fchown32":        SYS_FCHOWN32,
-	"lchown32":        SYS_LCHOWN32,
-	"setgid32":        SYS_SETGID32,
-	"setgroups32":     SYS_SETGROUPS32,
-	"setregid32":      SYS_SETREGID32,
-	"setresgid32":     SYS_SETRESGID32,
-	"setresuid32":     SYS_SETRESUID32,
-	"setreuid32":      SYS_SETREUID32,
-	"setuid32":        SYS_SETUID32,
-}
-
-const (
-	SYS_UMOUNT          = C.__SNR_umount
-	SYS_SUBPAGE_PROT    = C.__SNR_subpage_prot
-	SYS_SWITCH_ENDIAN   = C.__SNR_switch_endian
-	SYS_VM86            = C.__SNR_vm86
-	SYS_VM86OLD         = C.__SNR_vm86old
-	SYS_CLOCK_ADJTIME64 = C.__SNR_clock_adjtime64
-	SYS_CLOCK_SETTIME64 = C.__SNR_clock_settime64
-	SYS_CHOWN32         = C.__SNR_chown32
-	SYS_FCHOWN32        = C.__SNR_fchown32
-	SYS_LCHOWN32        = C.__SNR_lchown32
-	SYS_SETGID32        = C.__SNR_setgid32
-	SYS_SETGROUPS32     = C.__SNR_setgroups32
-	SYS_SETREGID32      = C.__SNR_setregid32
-	SYS_SETRESGID32     = C.__SNR_setresgid32
-	SYS_SETRESUID32     = C.__SNR_setresuid32
-	SYS_SETREUID32      = C.__SNR_setreuid32
-	SYS_SETUID32        = C.__SNR_setuid32
-)

container/seccomp/syscall_extra_linux_arm64.go

@@ -1,61 +0,0 @@
-package seccomp
-
-/*
-#cgo linux pkg-config: --static libseccomp
-
-#include <seccomp.h>
-*/
-import "C"
-import "syscall"
-
-const (
-	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
-)
-
-var syscallNumExtra = map[string]int{
-	"uselib":          SYS_USELIB,
-	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
-	"clock_settime64": SYS_CLOCK_SETTIME64,
-	"umount":          SYS_UMOUNT,
-	"chown":           SYS_CHOWN,
-	"chown32":         SYS_CHOWN32,
-	"fchown32":        SYS_FCHOWN32,
-	"lchown":          SYS_LCHOWN,
-	"lchown32":        SYS_LCHOWN32,
-	"setgid32":        SYS_SETGID32,
-	"setgroups32":     SYS_SETGROUPS32,
-	"setregid32":      SYS_SETREGID32,
-	"setresgid32":     SYS_SETRESGID32,
-	"setresuid32":     SYS_SETRESUID32,
-	"setreuid32":      SYS_SETREUID32,
-	"setuid32":        SYS_SETUID32,
-	"modify_ldt":      SYS_MODIFY_LDT,
-	"subpage_prot":    SYS_SUBPAGE_PROT,
-	"switch_endian":   SYS_SWITCH_ENDIAN,
-	"vm86":            SYS_VM86,
-	"vm86old":         SYS_VM86OLD,
-}
-
-const (
-	SYS_USELIB          = C.__SNR_uselib
-	SYS_CLOCK_ADJTIME64 = C.__SNR_clock_adjtime64
-	SYS_CLOCK_SETTIME64 = C.__SNR_clock_settime64
-	SYS_UMOUNT          = C.__SNR_umount
-	SYS_CHOWN           = C.__SNR_chown
-	SYS_CHOWN32         = C.__SNR_chown32
-	SYS_FCHOWN32        = C.__SNR_fchown32
-	SYS_LCHOWN          = C.__SNR_lchown
-	SYS_LCHOWN32        = C.__SNR_lchown32
-	SYS_SETGID32        = C.__SNR_setgid32
-	SYS_SETGROUPS32     = C.__SNR_setgroups32
-	SYS_SETREGID32      = C.__SNR_setregid32
-	SYS_SETRESGID32     = C.__SNR_setresgid32
-	SYS_SETRESUID32     = C.__SNR_setresuid32
-	SYS_SETREUID32      = C.__SNR_setreuid32
-	SYS_SETUID32        = C.__SNR_setuid32
-	SYS_MODIFY_LDT      = C.__SNR_modify_ldt
-	SYS_SUBPAGE_PROT    = C.__SNR_subpage_prot
-	SYS_SWITCH_ENDIAN   = C.__SNR_switch_endian
-	SYS_VM86            = C.__SNR_vm86
-	SYS_VM86OLD         = C.__SNR_vm86old
-)

container/seccomp/syscall_test.go

@@ -1,22 +0,0 @@
-package seccomp
-
-import (
-	"testing"
-)
-
-func TestSyscallResolveName(t *testing.T) {
-	t.Parallel()
-
-	for name, want := range Syscalls() {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if got := syscallResolveName(name); got != want {
-				t.Errorf("syscallResolveName(%q) = %d, want %d", name, got, want)
-			}
-			if got, ok := SyscallResolveName(name); !ok || got != want {
-				t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want)
-			}
-		})
-	}
-}

container/std/bits.go

@@ -1,4 +1,16 @@
-package bits
+// Package std contains constants from container packages without depending on cgo.
+package std
+
+const (
+	// BindOptional skips nonexistent host paths.
+	BindOptional = 1 << iota
+	// BindWritable mounts filesystem read-write.
+	BindWritable
+	// BindDevice allows access to devices (special files) on this filesystem.
+	BindDevice
+	// BindEnsure attempts to create the host path if it does not exist.
+	BindEnsure
+)
 
 // FilterPreset specifies parts of the syscall filter preset to enable.
 type FilterPreset int

container/std/mksysnum_linux.pl

@@ -9,6 +9,7 @@ use POSIX ();
 my $command = "mksysnum_linux.pl ". join(' ', @ARGV);
 my $uname_arch = (POSIX::uname)[4];
 my %syscall_cutoff_arch = (
+	"x86" => 340,
 	"x86_64" => 302,
 	"aarch64" => 281,
 );
@@ -17,7 +18,7 @@ print <<EOF;
 // $command
 // Code generated by the command above; DO NOT EDIT.
 
-package seccomp
+package std
 
 import . "syscall"
 

container/std/pnr.go

@@ -0,0 +1,267 @@
+// Code generated from include/seccomp-syscalls.h; DO NOT EDIT.
+
+package std
+
+/*
+ * pseudo syscall definitions
+ */
+
+const (
+
+	/* socket syscalls */
+
+	__PNR_socket      = -101
+	__PNR_bind        = -102
+	__PNR_connect     = -103
+	__PNR_listen      = -104
+	__PNR_accept      = -105
+	__PNR_getsockname = -106
+	__PNR_getpeername = -107
+	__PNR_socketpair  = -108
+	__PNR_send        = -109
+	__PNR_recv        = -110
+	__PNR_sendto      = -111
+	__PNR_recvfrom    = -112
+	__PNR_shutdown    = -113
+	__PNR_setsockopt  = -114
+	__PNR_getsockopt  = -115
+	__PNR_sendmsg     = -116
+	__PNR_recvmsg     = -117
+	__PNR_accept4     = -118
+	__PNR_recvmmsg    = -119
+	__PNR_sendmmsg    = -120
+
+	/* ipc syscalls */
+
+	__PNR_semop      = -201
+	__PNR_semget     = -202
+	__PNR_semctl     = -203
+	__PNR_semtimedop = -204
+	__PNR_msgsnd     = -211
+	__PNR_msgrcv     = -212
+	__PNR_msgget     = -213
+	__PNR_msgctl     = -214
+	__PNR_shmat      = -221
+	__PNR_shmdt      = -222
+	__PNR_shmget     = -223
+	__PNR_shmctl     = -224
+
+	/* single syscalls */
+
+	__PNR_arch_prctl                   = -10001
+	__PNR_bdflush                      = -10002
+	__PNR_break                        = -10003
+	__PNR_chown32                      = -10004
+	__PNR_epoll_ctl_old                = -10005
+	__PNR_epoll_wait_old               = -10006
+	__PNR_fadvise64_64                 = -10007
+	__PNR_fchown32                     = -10008
+	__PNR_fcntl64                      = -10009
+	__PNR_fstat64                      = -10010
+	__PNR_fstatat64                    = -10011
+	__PNR_fstatfs64                    = -10012
+	__PNR_ftime                        = -10013
+	__PNR_ftruncate64                  = -10014
+	__PNR_getegid32                    = -10015
+	__PNR_geteuid32                    = -10016
+	__PNR_getgid32                     = -10017
+	__PNR_getgroups32                  = -10018
+	__PNR_getresgid32                  = -10019
+	__PNR_getresuid32                  = -10020
+	__PNR_getuid32                     = -10021
+	__PNR_gtty                         = -10022
+	__PNR_idle                         = -10023
+	__PNR_ipc                          = -10024
+	__PNR_lchown32                     = -10025
+	__PNR__llseek                      = -10026
+	__PNR_lock                         = -10027
+	__PNR_lstat64                      = -10028
+	__PNR_mmap2                        = -10029
+	__PNR_mpx                          = -10030
+	__PNR_newfstatat                   = -10031
+	__PNR__newselect                   = -10032
+	__PNR_nice                         = -10033
+	__PNR_oldfstat                     = -10034
+	__PNR_oldlstat                     = -10035
+	__PNR_oldolduname                  = -10036
+	__PNR_oldstat                      = -10037
+	__PNR_olduname                     = -10038
+	__PNR_prof                         = -10039
+	__PNR_profil                       = -10040
+	__PNR_readdir                      = -10041
+	__PNR_security                     = -10042
+	__PNR_sendfile64                   = -10043
+	__PNR_setfsgid32                   = -10044
+	__PNR_setfsuid32                   = -10045
+	__PNR_setgid32                     = -10046
+	__PNR_setgroups32                  = -10047
+	__PNR_setregid32                   = -10048
+	__PNR_setresgid32                  = -10049
+	__PNR_setresuid32                  = -10050
+	__PNR_setreuid32                   = -10051
+	__PNR_setuid32                     = -10052
+	__PNR_sgetmask                     = -10053
+	__PNR_sigaction                    = -10054
+	__PNR_signal                       = -10055
+	__PNR_sigpending                   = -10056
+	__PNR_sigprocmask                  = -10057
+	__PNR_sigreturn                    = -10058
+	__PNR_sigsuspend                   = -10059
+	__PNR_socketcall                   = -10060
+	__PNR_ssetmask                     = -10061
+	__PNR_stat64                       = -10062
+	__PNR_statfs64                     = -10063
+	__PNR_stime                        = -10064
+	__PNR_stty                         = -10065
+	__PNR_truncate64                   = -10066
+	__PNR_tuxcall                      = -10067
+	__PNR_ugetrlimit                   = -10068
+	__PNR_ulimit                       = -10069
+	__PNR_umount                       = -10070
+	__PNR_vm86                         = -10071
+	__PNR_vm86old                      = -10072
+	__PNR_waitpid                      = -10073
+	__PNR_create_module                = -10074
+	__PNR_get_kernel_syms              = -10075
+	__PNR_get_thread_area              = -10076
+	__PNR_nfsservctl                   = -10077
+	__PNR_query_module                 = -10078
+	__PNR_set_thread_area              = -10079
+	__PNR__sysctl                      = -10080
+	__PNR_uselib                       = -10081
+	__PNR_vserver                      = -10082
+	__PNR_arm_fadvise64_64             = -10083
+	__PNR_arm_sync_file_range          = -10084
+	__PNR_pciconfig_iobase             = -10086
+	__PNR_pciconfig_read               = -10087
+	__PNR_pciconfig_write              = -10088
+	__PNR_sync_file_range2             = -10089
+	__PNR_syscall                      = -10090
+	__PNR_afs_syscall                  = -10091
+	__PNR_fadvise64                    = -10092
+	__PNR_getpmsg                      = -10093
+	__PNR_ioperm                       = -10094
+	__PNR_iopl                         = -10095
+	__PNR_migrate_pages                = -10097
+	__PNR_modify_ldt                   = -10098
+	__PNR_putpmsg                      = -10099
+	__PNR_sync_file_range              = -10100
+	__PNR_select                       = -10101
+	__PNR_vfork                        = -10102
+	__PNR_cachectl                     = -10103
+	__PNR_cacheflush                   = -10104
+	__PNR_sysmips                      = -10106
+	__PNR_timerfd                      = -10107
+	__PNR_time                         = -10108
+	__PNR_getrandom                    = -10109
+	__PNR_memfd_create                 = -10110
+	__PNR_kexec_file_load              = -10111
+	__PNR_sysfs                        = -10145
+	__PNR_oldwait4                     = -10146
+	__PNR_access                       = -10147
+	__PNR_alarm                        = -10148
+	__PNR_chmod                        = -10149
+	__PNR_chown                        = -10150
+	__PNR_creat                        = -10151
+	__PNR_dup2                         = -10152
+	__PNR_epoll_create                 = -10153
+	__PNR_epoll_wait                   = -10154
+	__PNR_eventfd                      = -10155
+	__PNR_fork                         = -10156
+	__PNR_futimesat                    = -10157
+	__PNR_getdents                     = -10158
+	__PNR_getpgrp                      = -10159
+	__PNR_inotify_init                 = -10160
+	__PNR_lchown                       = -10161
+	__PNR_link                         = -10162
+	__PNR_lstat                        = -10163
+	__PNR_mkdir                        = -10164
+	__PNR_mknod                        = -10165
+	__PNR_open                         = -10166
+	__PNR_pause                        = -10167
+	__PNR_pipe                         = -10168
+	__PNR_poll                         = -10169
+	__PNR_readlink                     = -10170
+	__PNR_rename                       = -10171
+	__PNR_rmdir                        = -10172
+	__PNR_signalfd                     = -10173
+	__PNR_stat                         = -10174
+	__PNR_symlink                      = -10175
+	__PNR_unlink                       = -10176
+	__PNR_ustat                        = -10177
+	__PNR_utime                        = -10178
+	__PNR_utimes                       = -10179
+	__PNR_getrlimit                    = -10180
+	__PNR_mmap                         = -10181
+	__PNR_breakpoint                   = -10182
+	__PNR_set_tls                      = -10183
+	__PNR_usr26                        = -10184
+	__PNR_usr32                        = -10185
+	__PNR_multiplexer                  = -10186
+	__PNR_rtas                         = -10187
+	__PNR_spu_create                   = -10188
+	__PNR_spu_run                      = -10189
+	__PNR_swapcontext                  = -10190
+	__PNR_sys_debug_setcontext         = -10191
+	__PNR_switch_endian                = -10191
+	__PNR_get_mempolicy                = -10192
+	__PNR_move_pages                   = -10193
+	__PNR_mbind                        = -10194
+	__PNR_set_mempolicy                = -10195
+	__PNR_s390_runtime_instr           = -10196
+	__PNR_s390_pci_mmio_read           = -10197
+	__PNR_s390_pci_mmio_write          = -10198
+	__PNR_membarrier                   = -10199
+	__PNR_userfaultfd                  = -10200
+	__PNR_pkey_mprotect                = -10201
+	__PNR_pkey_alloc                   = -10202
+	__PNR_pkey_free                    = -10203
+	__PNR_get_tls                      = -10204
+	__PNR_s390_guarded_storage         = -10205
+	__PNR_s390_sthyi                   = -10206
+	__PNR_subpage_prot                 = -10207
+	__PNR_statx                        = -10208
+	__PNR_io_pgetevents                = -10209
+	__PNR_rseq                         = -10210
+	__PNR_setrlimit                    = -10211
+	__PNR_clock_adjtime64              = -10212
+	__PNR_clock_getres_time64          = -10213
+	__PNR_clock_gettime64              = -10214
+	__PNR_clock_nanosleep_time64       = -10215
+	__PNR_clock_settime64              = -10216
+	__PNR_clone3                       = -10217
+	__PNR_fsconfig                     = -10218
+	__PNR_fsmount                      = -10219
+	__PNR_fsopen                       = -10220
+	__PNR_fspick                       = -10221
+	__PNR_futex_time64                 = -10222
+	__PNR_io_pgetevents_time64         = -10223
+	__PNR_move_mount                   = -10224
+	__PNR_mq_timedreceive_time64       = -10225
+	__PNR_mq_timedsend_time64          = -10226
+	__PNR_open_tree                    = -10227
+	__PNR_pidfd_open                   = -10228
+	__PNR_pidfd_send_signal            = -10229
+	__PNR_ppoll_time64                 = -10230
+	__PNR_pselect6_time64              = -10231
+	__PNR_recvmmsg_time64              = -10232
+	__PNR_rt_sigtimedwait_time64       = -10233
+	__PNR_sched_rr_get_interval_time64 = -10234
+	__PNR_semtimedop_time64            = -10235
+	__PNR_timer_gettime64              = -10236
+	__PNR_timer_settime64              = -10237
+	__PNR_timerfd_gettime64            = -10238
+	__PNR_timerfd_settime64            = -10239
+	__PNR_utimensat_time64             = -10240
+	__PNR_ppoll                        = -10241
+	__PNR_renameat                     = -10242
+	__PNR_riscv_flush_icache           = -10243
+	__PNR_memfd_secret                 = -10244
+	__PNR_map_shadow_stack             = -10245
+	__PNR_fstat                        = -10246
+	__PNR_atomic_barrier               = -10247
+	__PNR_atomic_cmpxchg_32            = -10248
+	__PNR_getpagesize                  = -10249
+	__PNR_riscv_hwprobe                = -10250
+	__PNR_uretprobe                    = -10251
+)

container/std/seccomp.go

@@ -0,0 +1,76 @@
+package std
+
+import (
+	"encoding/json"
+	"strconv"
+)
+
+type (
+	// ScmpUint is equivalent to C.uint.
+	ScmpUint uint32
+	// ScmpInt is equivalent to C.int.
+	ScmpInt int32
+
+	// ScmpSyscall represents a syscall number passed to libseccomp via [NativeRule.Syscall].
+	ScmpSyscall ScmpInt
+	// ScmpErrno represents an errno value passed to libseccomp via [NativeRule.Errno].
+	ScmpErrno ScmpInt
+
+	// ScmpCompare is equivalent to enum scmp_compare;
+	ScmpCompare ScmpUint
+	// ScmpDatum is equivalent to scmp_datum_t.
+	ScmpDatum uint64
+
+	// ScmpArgCmp is equivalent to struct scmp_arg_cmp.
+	ScmpArgCmp struct {
+		// argument number, starting at 0
+		Arg ScmpUint `json:"arg"`
+		// the comparison op, e.g. SCMP_CMP_*
+		Op ScmpCompare `json:"op"`
+
+		DatumA ScmpDatum `json:"a,omitempty"`
+		DatumB ScmpDatum `json:"b,omitempty"`
+	}
+
+	// A NativeRule specifies an arch-specific action taken by seccomp under certain conditions.
+	NativeRule struct {
+		// Syscall is the arch-dependent syscall number to act against.
+		Syscall ScmpSyscall `json:"syscall"`
+		// Errno is the errno value to return when the condition is satisfied.
+		Errno ScmpErrno `json:"errno"`
+		// Arg is the optional struct scmp_arg_cmp passed to libseccomp.
+		Arg *ScmpArgCmp `json:"arg,omitempty"`
+	}
+)
+
+// MarshalJSON resolves the name of [ScmpSyscall] and encodes it as a [json] string.
+// If such a name does not exist, the syscall number is encoded instead.
+func (num *ScmpSyscall) MarshalJSON() ([]byte, error) {
+	n := int(*num)
+	for name, cur := range Syscalls() {
+		if cur == n {
+			return json.Marshal(name)
+		}
+	}
+	return json.Marshal(n)
+}
+
+// SyscallNameError is returned when trying to unmarshal an invalid syscall name into [ScmpSyscall].
+type SyscallNameError string
+
+func (e SyscallNameError) Error() string { return "invalid syscall name " + strconv.Quote(string(e)) }
+
+// UnmarshalJSON looks up the syscall number corresponding to name encoded in data
+// by calling [SyscallResolveName].
+func (num *ScmpSyscall) UnmarshalJSON(data []byte) error {
+	var name string
+	if err := json.Unmarshal(data, &name); err != nil {
+		return err
+	}
+	if n, ok := SyscallResolveName(name); !ok {
+		return SyscallNameError(name)
+	} else {
+		*num = ScmpSyscall(n)
+		return nil
+	}
+}

container/std/seccomp_test.go

@@ -0,0 +1,63 @@
+package std_test
+
+import (
+	"encoding/json"
+	"errors"
+	"math"
+	"reflect"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/std"
+)
+
+func TestScmpSyscall(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		data string
+		want std.ScmpSyscall
+		err  error
+	}{
+		{"select", `"select"`, syscall.SYS_SELECT, nil},
+		{"clone3", `"clone3"`, std.SYS_CLONE3, nil},
+
+		{"oob", `-2147483647`, -math.MaxInt32,
+			&json.UnmarshalTypeError{Value: "number", Type: reflect.TypeFor[string](), Offset: 11}},
+		{"name", `"nonexistent_syscall"`, -math.MaxInt32,
+			std.SyscallNameError("nonexistent_syscall")},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			t.Run("decode", func(t *testing.T) {
+				var got std.ScmpSyscall
+				if err := json.Unmarshal([]byte(tc.data), &got); !reflect.DeepEqual(err, tc.err) {
+					t.Fatalf("Unmarshal: error = %#v, want %#v", err, tc.err)
+				} else if err == nil && got != tc.want {
+					t.Errorf("Unmarshal: %v, want %v", got, tc.want)
+				}
+			})
+			if errors.As(tc.err, new(std.SyscallNameError)) {
+				return
+			}
+
+			t.Run("encode", func(t *testing.T) {
+				if got, err := json.Marshal(&tc.want); err != nil {
+					t.Fatalf("Marshal: error = %v", err)
+				} else if string(got) != tc.data {
+					t.Errorf("Marshal: %s, want %s", string(got), tc.data)
+				}
+			})
+		})
+	}
+
+	t.Run("error", func(t *testing.T) {
+		const want = `invalid syscall name "\x00"`
+		if got := std.SyscallNameError("\x00").Error(); got != want {
+			t.Fatalf("Error: %q, want %q", got, want)
+		}
+	})
+}

container/std/syscall.go

@@ -1,4 +1,4 @@
-package seccomp
+package std
 
 import "iter"
 

container/std/syscall_extra_linux_386.go

@@ -0,0 +1,13 @@
+package std
+
+var syscallNumExtra = map[string]int{
+	"kexec_file_load": SYS_KEXEC_FILE_LOAD,
+	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"switch_endian":   SYS_SWITCH_ENDIAN,
+}
+
+const (
+	SYS_KEXEC_FILE_LOAD = __PNR_kexec_file_load
+	SYS_SUBPAGE_PROT    = __PNR_subpage_prot
+	SYS_SWITCH_ENDIAN   = __PNR_switch_endian
+)

container/std/syscall_extra_linux_amd64.go

@@ -0,0 +1,41 @@
+package std
+
+var syscallNumExtra = map[string]int{
+	"umount":          SYS_UMOUNT,
+	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"vm86":            SYS_VM86,
+	"vm86old":         SYS_VM86OLD,
+	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
+	"clock_settime64": SYS_CLOCK_SETTIME64,
+	"chown32":         SYS_CHOWN32,
+	"fchown32":        SYS_FCHOWN32,
+	"lchown32":        SYS_LCHOWN32,
+	"setgid32":        SYS_SETGID32,
+	"setgroups32":     SYS_SETGROUPS32,
+	"setregid32":      SYS_SETREGID32,
+	"setresgid32":     SYS_SETRESGID32,
+	"setresuid32":     SYS_SETRESUID32,
+	"setreuid32":      SYS_SETREUID32,
+	"setuid32":        SYS_SETUID32,
+}
+
+const (
+	SYS_UMOUNT          = __PNR_umount
+	SYS_SUBPAGE_PROT    = __PNR_subpage_prot
+	SYS_SWITCH_ENDIAN   = __PNR_switch_endian
+	SYS_VM86            = __PNR_vm86
+	SYS_VM86OLD         = __PNR_vm86old
+	SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64
+	SYS_CLOCK_SETTIME64 = __PNR_clock_settime64
+	SYS_CHOWN32         = __PNR_chown32
+	SYS_FCHOWN32        = __PNR_fchown32
+	SYS_LCHOWN32        = __PNR_lchown32
+	SYS_SETGID32        = __PNR_setgid32
+	SYS_SETGROUPS32     = __PNR_setgroups32
+	SYS_SETREGID32      = __PNR_setregid32
+	SYS_SETRESGID32     = __PNR_setresgid32
+	SYS_SETRESUID32     = __PNR_setresuid32
+	SYS_SETREUID32      = __PNR_setreuid32
+	SYS_SETUID32        = __PNR_setuid32
+)

container/std/syscall_extra_linux_arm64.go

@@ -0,0 +1,55 @@
+package std
+
+import "syscall"
+
+const (
+	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
+)
+
+var syscallNumExtra = map[string]int{
+	"uselib":          SYS_USELIB,
+	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
+	"clock_settime64": SYS_CLOCK_SETTIME64,
+	"umount":          SYS_UMOUNT,
+	"chown":           SYS_CHOWN,
+	"chown32":         SYS_CHOWN32,
+	"fchown32":        SYS_FCHOWN32,
+	"lchown":          SYS_LCHOWN,
+	"lchown32":        SYS_LCHOWN32,
+	"setgid32":        SYS_SETGID32,
+	"setgroups32":     SYS_SETGROUPS32,
+	"setregid32":      SYS_SETREGID32,
+	"setresgid32":     SYS_SETRESGID32,
+	"setresuid32":     SYS_SETRESUID32,
+	"setreuid32":      SYS_SETREUID32,
+	"setuid32":        SYS_SETUID32,
+	"modify_ldt":      SYS_MODIFY_LDT,
+	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"vm86":            SYS_VM86,
+	"vm86old":         SYS_VM86OLD,
+}
+
+const (
+	SYS_USELIB          = __PNR_uselib
+	SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64
+	SYS_CLOCK_SETTIME64 = __PNR_clock_settime64
+	SYS_UMOUNT          = __PNR_umount
+	SYS_CHOWN           = __PNR_chown
+	SYS_CHOWN32         = __PNR_chown32
+	SYS_FCHOWN32        = __PNR_fchown32
+	SYS_LCHOWN          = __PNR_lchown
+	SYS_LCHOWN32        = __PNR_lchown32
+	SYS_SETGID32        = __PNR_setgid32
+	SYS_SETGROUPS32     = __PNR_setgroups32
+	SYS_SETREGID32      = __PNR_setregid32
+	SYS_SETRESGID32     = __PNR_setresgid32
+	SYS_SETRESUID32     = __PNR_setresuid32
+	SYS_SETREUID32      = __PNR_setreuid32
+	SYS_SETUID32        = __PNR_setuid32
+	SYS_MODIFY_LDT      = __PNR_modify_ldt
+	SYS_SUBPAGE_PROT    = __PNR_subpage_prot
+	SYS_SWITCH_ENDIAN   = __PNR_switch_endian
+	SYS_VM86            = __PNR_vm86
+	SYS_VM86OLD         = __PNR_vm86old
+)

container/std/syscall_linux_386.go

@@ -0,0 +1,579 @@
+// mksysnum_linux.pl /usr/include/asm/unistd_32.h
+// Code generated by the command above; DO NOT EDIT.
+
+package std
+
+import . "syscall"
+
+var syscallNum = map[string]int{
+	"restart_syscall":              SYS_RESTART_SYSCALL,
+	"exit":                         SYS_EXIT,
+	"fork":                         SYS_FORK,
+	"read":                         SYS_READ,
+	"write":                        SYS_WRITE,
+	"open":                         SYS_OPEN,
+	"close":                        SYS_CLOSE,
+	"waitpid":                      SYS_WAITPID,
+	"creat":                        SYS_CREAT,
+	"link":                         SYS_LINK,
+	"unlink":                       SYS_UNLINK,
+	"execve":                       SYS_EXECVE,
+	"chdir":                        SYS_CHDIR,
+	"time":                         SYS_TIME,
+	"mknod":                        SYS_MKNOD,
+	"chmod":                        SYS_CHMOD,
+	"lchown":                       SYS_LCHOWN,
+	"break":                        SYS_BREAK,
+	"oldstat":                      SYS_OLDSTAT,
+	"lseek":                        SYS_LSEEK,
+	"getpid":                       SYS_GETPID,
+	"mount":                        SYS_MOUNT,
+	"umount":                       SYS_UMOUNT,
+	"setuid":                       SYS_SETUID,
+	"getuid":                       SYS_GETUID,
+	"stime":                        SYS_STIME,
+	"ptrace":                       SYS_PTRACE,
+	"alarm":                        SYS_ALARM,
+	"oldfstat":                     SYS_OLDFSTAT,
+	"pause":                        SYS_PAUSE,
+	"utime":                        SYS_UTIME,
+	"stty":                         SYS_STTY,
+	"gtty":                         SYS_GTTY,
+	"access":                       SYS_ACCESS,
+	"nice":                         SYS_NICE,
+	"ftime":                        SYS_FTIME,
+	"sync":                         SYS_SYNC,
+	"kill":                         SYS_KILL,
+	"rename":                       SYS_RENAME,
+	"mkdir":                        SYS_MKDIR,
+	"rmdir":                        SYS_RMDIR,
+	"dup":                          SYS_DUP,
+	"pipe":                         SYS_PIPE,
+	"times":                        SYS_TIMES,
+	"prof":                         SYS_PROF,
+	"brk":                          SYS_BRK,
+	"setgid":                       SYS_SETGID,
+	"getgid":                       SYS_GETGID,
+	"signal":                       SYS_SIGNAL,
+	"geteuid":                      SYS_GETEUID,
+	"getegid":                      SYS_GETEGID,
+	"acct":                         SYS_ACCT,
+	"umount2":                      SYS_UMOUNT2,
+	"lock":                         SYS_LOCK,
+	"ioctl":                        SYS_IOCTL,
+	"fcntl":                        SYS_FCNTL,
+	"mpx":                          SYS_MPX,
+	"setpgid":                      SYS_SETPGID,
+	"ulimit":                       SYS_ULIMIT,
+	"oldolduname":                  SYS_OLDOLDUNAME,
+	"umask":                        SYS_UMASK,
+	"chroot":                       SYS_CHROOT,
+	"ustat":                        SYS_USTAT,
+	"dup2":                         SYS_DUP2,
+	"getppid":                      SYS_GETPPID,
+	"getpgrp":                      SYS_GETPGRP,
+	"setsid":                       SYS_SETSID,
+	"sigaction":                    SYS_SIGACTION,
+	"sgetmask":                     SYS_SGETMASK,
+	"ssetmask":                     SYS_SSETMASK,
+	"setreuid":                     SYS_SETREUID,
+	"setregid":                     SYS_SETREGID,
+	"sigsuspend":                   SYS_SIGSUSPEND,
+	"sigpending":                   SYS_SIGPENDING,
+	"sethostname":                  SYS_SETHOSTNAME,
+	"setrlimit":                    SYS_SETRLIMIT,
+	"getrlimit":                    SYS_GETRLIMIT,
+	"getrusage":                    SYS_GETRUSAGE,
+	"gettimeofday":                 SYS_GETTIMEOFDAY,
+	"settimeofday":                 SYS_SETTIMEOFDAY,
+	"getgroups":                    SYS_GETGROUPS,
+	"setgroups":                    SYS_SETGROUPS,
+	"select":                       SYS_SELECT,
+	"symlink":                      SYS_SYMLINK,
+	"oldlstat":                     SYS_OLDLSTAT,
+	"readlink":                     SYS_READLINK,
+	"uselib":                       SYS_USELIB,
+	"swapon":                       SYS_SWAPON,
+	"reboot":                       SYS_REBOOT,
+	"readdir":                      SYS_READDIR,
+	"mmap":                         SYS_MMAP,
+	"munmap":                       SYS_MUNMAP,
+	"truncate":                     SYS_TRUNCATE,
+	"ftruncate":                    SYS_FTRUNCATE,
+	"fchmod":                       SYS_FCHMOD,
+	"fchown":                       SYS_FCHOWN,
+	"getpriority":                  SYS_GETPRIORITY,
+	"setpriority":                  SYS_SETPRIORITY,
+	"profil":                       SYS_PROFIL,
+	"statfs":                       SYS_STATFS,
+	"fstatfs":                      SYS_FSTATFS,
+	"ioperm":                       SYS_IOPERM,
+	"socketcall":                   SYS_SOCKETCALL,
+	"syslog":                       SYS_SYSLOG,
+	"setitimer":                    SYS_SETITIMER,
+	"getitimer":                    SYS_GETITIMER,
+	"stat":                         SYS_STAT,
+	"lstat":                        SYS_LSTAT,
+	"fstat":                        SYS_FSTAT,
+	"olduname":                     SYS_OLDUNAME,
+	"iopl":                         SYS_IOPL,
+	"vhangup":                      SYS_VHANGUP,
+	"idle":                         SYS_IDLE,
+	"vm86old":                      SYS_VM86OLD,
+	"wait4":                        SYS_WAIT4,
+	"swapoff":                      SYS_SWAPOFF,
+	"sysinfo":                      SYS_SYSINFO,
+	"ipc":                          SYS_IPC,
+	"fsync":                        SYS_FSYNC,
+	"sigreturn":                    SYS_SIGRETURN,
+	"clone":                        SYS_CLONE,
+	"setdomainname":                SYS_SETDOMAINNAME,
+	"uname":                        SYS_UNAME,
+	"modify_ldt":                   SYS_MODIFY_LDT,
+	"adjtimex":                     SYS_ADJTIMEX,
+	"mprotect":                     SYS_MPROTECT,
+	"sigprocmask":                  SYS_SIGPROCMASK,
+	"create_module":                SYS_CREATE_MODULE,
+	"init_module":                  SYS_INIT_MODULE,
+	"delete_module":                SYS_DELETE_MODULE,
+	"get_kernel_syms":              SYS_GET_KERNEL_SYMS,
+	"quotactl":                     SYS_QUOTACTL,
+	"getpgid":                      SYS_GETPGID,
+	"fchdir":                       SYS_FCHDIR,
+	"bdflush":                      SYS_BDFLUSH,
+	"sysfs":                        SYS_SYSFS,
+	"personality":                  SYS_PERSONALITY,
+	"afs_syscall":                  SYS_AFS_SYSCALL,
+	"setfsuid":                     SYS_SETFSUID,
+	"setfsgid":                     SYS_SETFSGID,
+	"_llseek":                      SYS__LLSEEK,
+	"getdents":                     SYS_GETDENTS,
+	"_newselect":                   SYS__NEWSELECT,
+	"flock":                        SYS_FLOCK,
+	"msync":                        SYS_MSYNC,
+	"readv":                        SYS_READV,
+	"writev":                       SYS_WRITEV,
+	"getsid":                       SYS_GETSID,
+	"fdatasync":                    SYS_FDATASYNC,
+	"_sysctl":                      SYS__SYSCTL,
+	"mlock":                        SYS_MLOCK,
+	"munlock":                      SYS_MUNLOCK,
+	"mlockall":                     SYS_MLOCKALL,
+	"munlockall":                   SYS_MUNLOCKALL,
+	"sched_setparam":               SYS_SCHED_SETPARAM,
+	"sched_getparam":               SYS_SCHED_GETPARAM,
+	"sched_setscheduler":           SYS_SCHED_SETSCHEDULER,
+	"sched_getscheduler":           SYS_SCHED_GETSCHEDULER,
+	"sched_yield":                  SYS_SCHED_YIELD,
+	"sched_get_priority_max":       SYS_SCHED_GET_PRIORITY_MAX,
+	"sched_get_priority_min":       SYS_SCHED_GET_PRIORITY_MIN,
+	"sched_rr_get_interval":        SYS_SCHED_RR_GET_INTERVAL,
+	"nanosleep":                    SYS_NANOSLEEP,
+	"mremap":                       SYS_MREMAP,
+	"setresuid":                    SYS_SETRESUID,
+	"getresuid":                    SYS_GETRESUID,
+	"vm86":                         SYS_VM86,
+	"query_module":                 SYS_QUERY_MODULE,
+	"poll":                         SYS_POLL,
+	"nfsservctl":                   SYS_NFSSERVCTL,
+	"setresgid":                    SYS_SETRESGID,
+	"getresgid":                    SYS_GETRESGID,
+	"prctl":                        SYS_PRCTL,
+	"rt_sigreturn":                 SYS_RT_SIGRETURN,
+	"rt_sigaction":                 SYS_RT_SIGACTION,
+	"rt_sigprocmask":               SYS_RT_SIGPROCMASK,
+	"rt_sigpending":                SYS_RT_SIGPENDING,
+	"rt_sigtimedwait":              SYS_RT_SIGTIMEDWAIT,
+	"rt_sigqueueinfo":              SYS_RT_SIGQUEUEINFO,
+	"rt_sigsuspend":                SYS_RT_SIGSUSPEND,
+	"pread64":                      SYS_PREAD64,
+	"pwrite64":                     SYS_PWRITE64,
+	"chown":                        SYS_CHOWN,
+	"getcwd":                       SYS_GETCWD,
+	"capget":                       SYS_CAPGET,
+	"capset":                       SYS_CAPSET,
+	"sigaltstack":                  SYS_SIGALTSTACK,
+	"sendfile":                     SYS_SENDFILE,
+	"getpmsg":                      SYS_GETPMSG,
+	"putpmsg":                      SYS_PUTPMSG,
+	"vfork":                        SYS_VFORK,
+	"ugetrlimit":                   SYS_UGETRLIMIT,
+	"mmap2":                        SYS_MMAP2,
+	"truncate64":                   SYS_TRUNCATE64,
+	"ftruncate64":                  SYS_FTRUNCATE64,
+	"stat64":                       SYS_STAT64,
+	"lstat64":                      SYS_LSTAT64,
+	"fstat64":                      SYS_FSTAT64,
+	"lchown32":                     SYS_LCHOWN32,
+	"getuid32":                     SYS_GETUID32,
+	"getgid32":                     SYS_GETGID32,
+	"geteuid32":                    SYS_GETEUID32,
+	"getegid32":                    SYS_GETEGID32,
+	"setreuid32":                   SYS_SETREUID32,
+	"setregid32":                   SYS_SETREGID32,
+	"getgroups32":                  SYS_GETGROUPS32,
+	"setgroups32":                  SYS_SETGROUPS32,
+	"fchown32":                     SYS_FCHOWN32,
+	"setresuid32":                  SYS_SETRESUID32,
+	"getresuid32":                  SYS_GETRESUID32,
+	"setresgid32":                  SYS_SETRESGID32,
+	"getresgid32":                  SYS_GETRESGID32,
+	"chown32":                      SYS_CHOWN32,
+	"setuid32":                     SYS_SETUID32,
+	"setgid32":                     SYS_SETGID32,
+	"setfsuid32":                   SYS_SETFSUID32,
+	"setfsgid32":                   SYS_SETFSGID32,
+	"pivot_root":                   SYS_PIVOT_ROOT,
+	"mincore":                      SYS_MINCORE,
+	"madvise":                      SYS_MADVISE,
+	"getdents64":                   SYS_GETDENTS64,
+	"fcntl64":                      SYS_FCNTL64,
+	"gettid":                       SYS_GETTID,
+	"readahead":                    SYS_READAHEAD,
+	"setxattr":                     SYS_SETXATTR,
+	"lsetxattr":                    SYS_LSETXATTR,
+	"fsetxattr":                    SYS_FSETXATTR,
+	"getxattr":                     SYS_GETXATTR,
+	"lgetxattr":                    SYS_LGETXATTR,
+	"fgetxattr":                    SYS_FGETXATTR,
+	"listxattr":                    SYS_LISTXATTR,
+	"llistxattr":                   SYS_LLISTXATTR,
+	"flistxattr":                   SYS_FLISTXATTR,
+	"removexattr":                  SYS_REMOVEXATTR,
+	"lremovexattr":                 SYS_LREMOVEXATTR,
+	"fremovexattr":                 SYS_FREMOVEXATTR,
+	"tkill":                        SYS_TKILL,
+	"sendfile64":                   SYS_SENDFILE64,
+	"futex":                        SYS_FUTEX,
+	"sched_setaffinity":            SYS_SCHED_SETAFFINITY,
+	"sched_getaffinity":            SYS_SCHED_GETAFFINITY,
+	"set_thread_area":              SYS_SET_THREAD_AREA,
+	"get_thread_area":              SYS_GET_THREAD_AREA,
+	"io_setup":                     SYS_IO_SETUP,
+	"io_destroy":                   SYS_IO_DESTROY,
+	"io_getevents":                 SYS_IO_GETEVENTS,
+	"io_submit":                    SYS_IO_SUBMIT,
+	"io_cancel":                    SYS_IO_CANCEL,
+	"fadvise64":                    SYS_FADVISE64,
+	"exit_group":                   SYS_EXIT_GROUP,
+	"lookup_dcookie":               SYS_LOOKUP_DCOOKIE,
+	"epoll_create":                 SYS_EPOLL_CREATE,
+	"epoll_ctl":                    SYS_EPOLL_CTL,
+	"epoll_wait":                   SYS_EPOLL_WAIT,
+	"remap_file_pages":             SYS_REMAP_FILE_PAGES,
+	"set_tid_address":              SYS_SET_TID_ADDRESS,
+	"timer_create":                 SYS_TIMER_CREATE,
+	"timer_settime":                SYS_TIMER_SETTIME,
+	"timer_gettime":                SYS_TIMER_GETTIME,
+	"timer_getoverrun":             SYS_TIMER_GETOVERRUN,
+	"timer_delete":                 SYS_TIMER_DELETE,
+	"clock_settime":                SYS_CLOCK_SETTIME,
+	"clock_gettime":                SYS_CLOCK_GETTIME,
+	"clock_getres":                 SYS_CLOCK_GETRES,
+	"clock_nanosleep":              SYS_CLOCK_NANOSLEEP,
+	"statfs64":                     SYS_STATFS64,
+	"fstatfs64":                    SYS_FSTATFS64,
+	"tgkill":                       SYS_TGKILL,
+	"utimes":                       SYS_UTIMES,
+	"fadvise64_64":                 SYS_FADVISE64_64,
+	"vserver":                      SYS_VSERVER,
+	"mbind":                        SYS_MBIND,
+	"get_mempolicy":                SYS_GET_MEMPOLICY,
+	"set_mempolicy":                SYS_SET_MEMPOLICY,
+	"mq_open":                      SYS_MQ_OPEN,
+	"mq_unlink":                    SYS_MQ_UNLINK,
+	"mq_timedsend":                 SYS_MQ_TIMEDSEND,
+	"mq_timedreceive":              SYS_MQ_TIMEDRECEIVE,
+	"mq_notify":                    SYS_MQ_NOTIFY,
+	"mq_getsetattr":                SYS_MQ_GETSETATTR,
+	"kexec_load":                   SYS_KEXEC_LOAD,
+	"waitid":                       SYS_WAITID,
+	"add_key":                      SYS_ADD_KEY,
+	"request_key":                  SYS_REQUEST_KEY,
+	"keyctl":                       SYS_KEYCTL,
+	"ioprio_set":                   SYS_IOPRIO_SET,
+	"ioprio_get":                   SYS_IOPRIO_GET,
+	"inotify_init":                 SYS_INOTIFY_INIT,
+	"inotify_add_watch":            SYS_INOTIFY_ADD_WATCH,
+	"inotify_rm_watch":             SYS_INOTIFY_RM_WATCH,
+	"migrate_pages":                SYS_MIGRATE_PAGES,
+	"openat":                       SYS_OPENAT,
+	"mkdirat":                      SYS_MKDIRAT,
+	"mknodat":                      SYS_MKNODAT,
+	"fchownat":                     SYS_FCHOWNAT,
+	"futimesat":                    SYS_FUTIMESAT,
+	"fstatat64":                    SYS_FSTATAT64,
+	"unlinkat":                     SYS_UNLINKAT,
+	"renameat":                     SYS_RENAMEAT,
+	"linkat":                       SYS_LINKAT,
+	"symlinkat":                    SYS_SYMLINKAT,
+	"readlinkat":                   SYS_READLINKAT,
+	"fchmodat":                     SYS_FCHMODAT,
+	"faccessat":                    SYS_FACCESSAT,
+	"pselect6":                     SYS_PSELECT6,
+	"ppoll":                        SYS_PPOLL,
+	"unshare":                      SYS_UNSHARE,
+	"set_robust_list":              SYS_SET_ROBUST_LIST,
+	"get_robust_list":              SYS_GET_ROBUST_LIST,
+	"splice":                       SYS_SPLICE,
+	"sync_file_range":              SYS_SYNC_FILE_RANGE,
+	"tee":                          SYS_TEE,
+	"vmsplice":                     SYS_VMSPLICE,
+	"move_pages":                   SYS_MOVE_PAGES,
+	"getcpu":                       SYS_GETCPU,
+	"epoll_pwait":                  SYS_EPOLL_PWAIT,
+	"utimensat":                    SYS_UTIMENSAT,
+	"signalfd":                     SYS_SIGNALFD,
+	"timerfd_create":               SYS_TIMERFD_CREATE,
+	"eventfd":                      SYS_EVENTFD,
+	"fallocate":                    SYS_FALLOCATE,
+	"timerfd_settime":              SYS_TIMERFD_SETTIME,
+	"timerfd_gettime":              SYS_TIMERFD_GETTIME,
+	"signalfd4":                    SYS_SIGNALFD4,
+	"eventfd2":                     SYS_EVENTFD2,
+	"epoll_create1":                SYS_EPOLL_CREATE1,
+	"dup3":                         SYS_DUP3,
+	"pipe2":                        SYS_PIPE2,
+	"inotify_init1":                SYS_INOTIFY_INIT1,
+	"preadv":                       SYS_PREADV,
+	"pwritev":                      SYS_PWRITEV,
+	"rt_tgsigqueueinfo":            SYS_RT_TGSIGQUEUEINFO,
+	"perf_event_open":              SYS_PERF_EVENT_OPEN,
+	"recvmmsg":                     __PNR_recvmmsg,
+	"fanotify_init":                SYS_FANOTIFY_INIT,
+	"fanotify_mark":                SYS_FANOTIFY_MARK,
+	"prlimit64":                    SYS_PRLIMIT64,
+	"name_to_handle_at":            SYS_NAME_TO_HANDLE_AT,
+	"open_by_handle_at":            SYS_OPEN_BY_HANDLE_AT,
+	"clock_adjtime":                SYS_CLOCK_ADJTIME,
+	"syncfs":                       SYS_SYNCFS,
+	"sendmmsg":                     __PNR_sendmmsg,
+	"setns":                        SYS_SETNS,
+	"process_vm_readv":             SYS_PROCESS_VM_READV,
+	"process_vm_writev":            SYS_PROCESS_VM_WRITEV,
+	"kcmp":                         SYS_KCMP,
+	"finit_module":                 SYS_FINIT_MODULE,
+	"sched_setattr":                SYS_SCHED_SETATTR,
+	"sched_getattr":                SYS_SCHED_GETATTR,
+	"renameat2":                    SYS_RENAMEAT2,
+	"seccomp":                      SYS_SECCOMP,
+	"getrandom":                    SYS_GETRANDOM,
+	"memfd_create":                 SYS_MEMFD_CREATE,
+	"bpf":                          SYS_BPF,
+	"execveat":                     SYS_EXECVEAT,
+	"socket":                       __PNR_socket,
+	"socketpair":                   __PNR_socketpair,
+	"bind":                         __PNR_bind,
+	"connect":                      __PNR_connect,
+	"listen":                       __PNR_listen,
+	"accept4":                      __PNR_accept4,
+	"getsockopt":                   __PNR_getsockopt,
+	"setsockopt":                   __PNR_setsockopt,
+	"getsockname":                  __PNR_getsockname,
+	"getpeername":                  __PNR_getpeername,
+	"sendto":                       __PNR_sendto,
+	"sendmsg":                      __PNR_sendmsg,
+	"recvfrom":                     __PNR_recvfrom,
+	"recvmsg":                      __PNR_recvmsg,
+	"shutdown":                     __PNR_shutdown,
+	"userfaultfd":                  SYS_USERFAULTFD,
+	"membarrier":                   SYS_MEMBARRIER,
+	"mlock2":                       SYS_MLOCK2,
+	"copy_file_range":              SYS_COPY_FILE_RANGE,
+	"preadv2":                      SYS_PREADV2,
+	"pwritev2":                     SYS_PWRITEV2,
+	"pkey_mprotect":                SYS_PKEY_MPROTECT,
+	"pkey_alloc":                   SYS_PKEY_ALLOC,
+	"pkey_free":                    SYS_PKEY_FREE,
+	"statx":                        SYS_STATX,
+	"arch_prctl":                   SYS_ARCH_PRCTL,
+	"io_pgetevents":                SYS_IO_PGETEVENTS,
+	"rseq":                         SYS_RSEQ,
+	"semget":                       __PNR_semget,
+	"semctl":                       __PNR_semctl,
+	"shmget":                       __PNR_shmget,
+	"shmctl":                       __PNR_shmctl,
+	"shmat":                        __PNR_shmat,
+	"shmdt":                        __PNR_shmdt,
+	"msgget":                       __PNR_msgget,
+	"msgsnd":                       __PNR_msgsnd,
+	"msgrcv":                       __PNR_msgrcv,
+	"msgctl":                       __PNR_msgctl,
+	"clock_gettime64":              SYS_CLOCK_GETTIME64,
+	"clock_settime64":              SYS_CLOCK_SETTIME64,
+	"clock_adjtime64":              SYS_CLOCK_ADJTIME64,
+	"clock_getres_time64":          SYS_CLOCK_GETRES_TIME64,
+	"clock_nanosleep_time64":       SYS_CLOCK_NANOSLEEP_TIME64,
+	"timer_gettime64":              SYS_TIMER_GETTIME64,
+	"timer_settime64":              SYS_TIMER_SETTIME64,
+	"timerfd_gettime64":            SYS_TIMERFD_GETTIME64,
+	"timerfd_settime64":            SYS_TIMERFD_SETTIME64,
+	"utimensat_time64":             SYS_UTIMENSAT_TIME64,
+	"pselect6_time64":              SYS_PSELECT6_TIME64,
+	"ppoll_time64":                 SYS_PPOLL_TIME64,
+	"io_pgetevents_time64":         SYS_IO_PGETEVENTS_TIME64,
+	"recvmmsg_time64":              SYS_RECVMMSG_TIME64,
+	"mq_timedsend_time64":          SYS_MQ_TIMEDSEND_TIME64,
+	"mq_timedreceive_time64":       SYS_MQ_TIMEDRECEIVE_TIME64,
+	"semtimedop_time64":            SYS_SEMTIMEDOP_TIME64,
+	"rt_sigtimedwait_time64":       SYS_RT_SIGTIMEDWAIT_TIME64,
+	"futex_time64":                 SYS_FUTEX_TIME64,
+	"sched_rr_get_interval_time64": SYS_SCHED_RR_GET_INTERVAL_TIME64,
+	"pidfd_send_signal":            SYS_PIDFD_SEND_SIGNAL,
+	"io_uring_setup":               SYS_IO_URING_SETUP,
+	"io_uring_enter":               SYS_IO_URING_ENTER,
+	"io_uring_register":            SYS_IO_URING_REGISTER,
+	"open_tree":                    SYS_OPEN_TREE,
+	"move_mount":                   SYS_MOVE_MOUNT,
+	"fsopen":                       SYS_FSOPEN,
+	"fsconfig":                     SYS_FSCONFIG,
+	"fsmount":                      SYS_FSMOUNT,
+	"fspick":                       SYS_FSPICK,
+	"pidfd_open":                   SYS_PIDFD_OPEN,
+	"clone3":                       SYS_CLONE3,
+	"close_range":                  SYS_CLOSE_RANGE,
+	"openat2":                      SYS_OPENAT2,
+	"pidfd_getfd":                  SYS_PIDFD_GETFD,
+	"faccessat2":                   SYS_FACCESSAT2,
+	"process_madvise":              SYS_PROCESS_MADVISE,
+	"epoll_pwait2":                 SYS_EPOLL_PWAIT2,
+	"mount_setattr":                SYS_MOUNT_SETATTR,
+	"quotactl_fd":                  SYS_QUOTACTL_FD,
+	"landlock_create_ruleset":      SYS_LANDLOCK_CREATE_RULESET,
+	"landlock_add_rule":            SYS_LANDLOCK_ADD_RULE,
+	"landlock_restrict_self":       SYS_LANDLOCK_RESTRICT_SELF,
+	"memfd_secret":                 SYS_MEMFD_SECRET,
+	"process_mrelease":             SYS_PROCESS_MRELEASE,
+	"futex_waitv":                  SYS_FUTEX_WAITV,
+	"set_mempolicy_home_node":      SYS_SET_MEMPOLICY_HOME_NODE,
+	"cachestat":                    SYS_CACHESTAT,
+	"fchmodat2":                    SYS_FCHMODAT2,
+	"map_shadow_stack":             SYS_MAP_SHADOW_STACK,
+	"futex_wake":                   SYS_FUTEX_WAKE,
+	"futex_wait":                   SYS_FUTEX_WAIT,
+	"futex_requeue":                SYS_FUTEX_REQUEUE,
+	"statmount":                    SYS_STATMOUNT,
+	"listmount":                    SYS_LISTMOUNT,
+	"lsm_get_self_attr":            SYS_LSM_GET_SELF_ATTR,
+	"lsm_set_self_attr":            SYS_LSM_SET_SELF_ATTR,
+	"lsm_list_modules":             SYS_LSM_LIST_MODULES,
+	"mseal":                        SYS_MSEAL,
+}
+
+const (
+	SYS_NAME_TO_HANDLE_AT            = 341
+	SYS_OPEN_BY_HANDLE_AT            = 342
+	SYS_CLOCK_ADJTIME                = 343
+	SYS_SYNCFS                       = 344
+	SYS_SENDMMSG                     = 345
+	SYS_SETNS                        = 346
+	SYS_PROCESS_VM_READV             = 347
+	SYS_PROCESS_VM_WRITEV            = 348
+	SYS_KCMP                         = 349
+	SYS_FINIT_MODULE                 = 350
+	SYS_SCHED_SETATTR                = 351
+	SYS_SCHED_GETATTR                = 352
+	SYS_RENAMEAT2                    = 353
+	SYS_SECCOMP                      = 354
+	SYS_GETRANDOM                    = 355
+	SYS_MEMFD_CREATE                 = 356
+	SYS_BPF                          = 357
+	SYS_EXECVEAT                     = 358
+	SYS_SOCKET                       = 359
+	SYS_SOCKETPAIR                   = 360
+	SYS_BIND                         = 361
+	SYS_CONNECT                      = 362
+	SYS_LISTEN                       = 363
+	SYS_ACCEPT4                      = 364
+	SYS_GETSOCKOPT                   = 365
+	SYS_SETSOCKOPT                   = 366
+	SYS_GETSOCKNAME                  = 367
+	SYS_GETPEERNAME                  = 368
+	SYS_SENDTO                       = 369
+	SYS_SENDMSG                      = 370
+	SYS_RECVFROM                     = 371
+	SYS_RECVMSG                      = 372
+	SYS_SHUTDOWN                     = 373
+	SYS_USERFAULTFD                  = 374
+	SYS_MEMBARRIER                   = 375
+	SYS_MLOCK2                       = 376
+	SYS_COPY_FILE_RANGE              = 377
+	SYS_PREADV2                      = 378
+	SYS_PWRITEV2                     = 379
+	SYS_PKEY_MPROTECT                = 380
+	SYS_PKEY_ALLOC                   = 381
+	SYS_PKEY_FREE                    = 382
+	SYS_STATX                        = 383
+	SYS_ARCH_PRCTL                   = 384
+	SYS_IO_PGETEVENTS                = 385
+	SYS_RSEQ                         = 386
+	SYS_SEMGET                       = 393
+	SYS_SEMCTL                       = 394
+	SYS_SHMGET                       = 395
+	SYS_SHMCTL                       = 396
+	SYS_SHMAT                        = 397
+	SYS_SHMDT                        = 398
+	SYS_MSGGET                       = 399
+	SYS_MSGSND                       = 400
+	SYS_MSGRCV                       = 401
+	SYS_MSGCTL                       = 402
+	SYS_CLOCK_GETTIME64              = 403
+	SYS_CLOCK_SETTIME64              = 404
+	SYS_CLOCK_ADJTIME64              = 405
+	SYS_CLOCK_GETRES_TIME64          = 406
+	SYS_CLOCK_NANOSLEEP_TIME64       = 407
+	SYS_TIMER_GETTIME64              = 408
+	SYS_TIMER_SETTIME64              = 409
+	SYS_TIMERFD_GETTIME64            = 410
+	SYS_TIMERFD_SETTIME64            = 411
+	SYS_UTIMENSAT_TIME64             = 412
+	SYS_PSELECT6_TIME64              = 413
+	SYS_PPOLL_TIME64                 = 414
+	SYS_IO_PGETEVENTS_TIME64         = 416
+	SYS_RECVMMSG_TIME64              = 417
+	SYS_MQ_TIMEDSEND_TIME64          = 418
+	SYS_MQ_TIMEDRECEIVE_TIME64       = 419
+	SYS_SEMTIMEDOP_TIME64            = 420
+	SYS_RT_SIGTIMEDWAIT_TIME64       = 421
+	SYS_FUTEX_TIME64                 = 422
+	SYS_SCHED_RR_GET_INTERVAL_TIME64 = 423
+	SYS_PIDFD_SEND_SIGNAL            = 424
+	SYS_IO_URING_SETUP               = 425
+	SYS_IO_URING_ENTER               = 426
+	SYS_IO_URING_REGISTER            = 427
+	SYS_OPEN_TREE                    = 428
+	SYS_MOVE_MOUNT                   = 429
+	SYS_FSOPEN                       = 430
+	SYS_FSCONFIG                     = 431
+	SYS_FSMOUNT                      = 432
+	SYS_FSPICK                       = 433
+	SYS_PIDFD_OPEN                   = 434
+	SYS_CLONE3                       = 435
+	SYS_CLOSE_RANGE                  = 436
+	SYS_OPENAT2                      = 437
+	SYS_PIDFD_GETFD                  = 438
+	SYS_FACCESSAT2                   = 439
+	SYS_PROCESS_MADVISE              = 440
+	SYS_EPOLL_PWAIT2                 = 441
+	SYS_MOUNT_SETATTR                = 442
+	SYS_QUOTACTL_FD                  = 443
+	SYS_LANDLOCK_CREATE_RULESET      = 444
+	SYS_LANDLOCK_ADD_RULE            = 445
+	SYS_LANDLOCK_RESTRICT_SELF       = 446
+	SYS_MEMFD_SECRET                 = 447
+	SYS_PROCESS_MRELEASE             = 448
+	SYS_FUTEX_WAITV                  = 449
+	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
+	SYS_FCHMODAT2                    = 452
+	SYS_MAP_SHADOW_STACK             = 453
+	SYS_FUTEX_WAKE                   = 454
+	SYS_FUTEX_WAIT                   = 455
+	SYS_FUTEX_REQUEUE                = 456
+	SYS_STATMOUNT                    = 457
+	SYS_LISTMOUNT                    = 458
+	SYS_LSM_GET_SELF_ATTR            = 459
+	SYS_LSM_SET_SELF_ATTR            = 460
+	SYS_LSM_LIST_MODULES             = 461
+	SYS_MSEAL                        = 462
+)

container/std/syscall_linux_amd64.go

@@ -1,7 +1,7 @@
 // mksysnum_linux.pl /usr/include/asm/unistd_64.h
 // Code generated by the command above; DO NOT EDIT.
 
-package seccomp
+package std
 
 import . "syscall"
 

container/std/syscall_linux_arm64.go

@@ -1,7 +1,7 @@
 // mksysnum_linux.pl /usr/include/asm/unistd_64.h
 // Code generated by the command above; DO NOT EDIT.
 
-package seccomp
+package std
 
 import . "syscall"
 

container/std/syscall_test.go

@@ -0,0 +1,21 @@
+package std_test
+
+import (
+	"testing"
+
+	"hakurei.app/container/std"
+)
+
+func TestSyscallResolveName(t *testing.T) {
+	t.Parallel()
+
+	for name, want := range std.Syscalls() {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if got, ok := std.SyscallResolveName(name); !ok || got != want {
+				t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want)
+			}
+		})
+	}
+}

container/stub/errors.go

@@ -13,7 +13,7 @@ var (
 type UniqueError uintptr
 
 func (e UniqueError) Error() string {
-	return "unique error " + strconv.Itoa(int(e)) + " injected by the test suite"
+	return "unique error " + strconv.FormatUint(uint64(e), 10) + " injected by the test suite"
 }
 
 func (e UniqueError) Is(target error) bool {

container/stub/exit.go

@@ -3,10 +3,10 @@ package stub
 import "testing"
 
 // PanicExit is a magic panic value treated as a simulated exit.
-const PanicExit = 0xdeadbeef
+const PanicExit = 0xdead
 
 const (
-	panicFailNow = 0xcafe0000 + iota
+	panicFailNow = 0xcafe0 + iota
 	panicFatal
 	panicFatalf
 )

container/stub/exit_test.go

@@ -53,7 +53,7 @@ func TestHandleExit(t *testing.T) {
 				}
 			}()
 			defer stub.HandleExit(ot)
-			panic(0xcafe0000)
+			panic(0xcafe0)
 		})
 
 		t.Run("Fail", func(t *testing.T) {
@@ -66,7 +66,7 @@ func TestHandleExit(t *testing.T) {
 				}
 			}()
 			defer handleExitNew(ot)
-			panic(0xcafe0000)
+			panic(0xcafe0)
 		})
 	})
 
@@ -82,14 +82,14 @@ func TestHandleExit(t *testing.T) {
 			t.Parallel()
 
 			defer func() {
-				want := 0xcafebabe
+				want := 0xcafe
 				if r := recover(); r != want {
 					t.Errorf("recover: %v, want %v", r, want)
 				}
 
 			}()
 			defer stub.HandleExit(t)
-			panic(0xcafebabe)
+			panic(0xcafe)
 		})
 
 		t.Run("new", func(t *testing.T) {

container/syscall.go

@@ -1,50 +1,41 @@
 package container
 
 import (
-	"syscall"
+	. "syscall"
 	"unsafe"
 )
 
-// SetPtracer allows processes to ptrace(2) the calling process.
-func SetPtracer(pid uintptr) error {
-	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_PTRACER, pid, 0)
-	if errno == 0 {
-		return nil
+// Prctl manipulates various aspects of the behavior of the calling thread or process.
+func Prctl(op, arg2, arg3 uintptr) error {
+	r, _, errno := Syscall(SYS_PRCTL, op, arg2, arg3)
+	if r < 0 {
+		return errno
 	}
-	return errno
+	return nil
 }
 
+// SetPtracer allows processes to ptrace(2) the calling process.
+func SetPtracer(pid uintptr) error { return Prctl(PR_SET_PTRACER, pid, 0) }
+
+// linux/sched/coredump.h
 const (
 	SUID_DUMP_DISABLE = iota
 	SUID_DUMP_USER
 )
 
 // SetDumpable sets the "dumpable" attribute of the calling process.
-func SetDumpable(dumpable uintptr) error {
-	// linux/sched/coredump.h
-	if _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 {
-		return errno
-	}
-
-	return nil
-}
+func SetDumpable(dumpable uintptr) error { return Prctl(PR_SET_DUMPABLE, dumpable, 0) }
 
 // SetNoNewPrivs sets the calling thread's no_new_privs attribute.
-func SetNoNewPrivs() error {
-	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0)
-	if errno == 0 {
-		return nil
-	}
-	return errno
-}
+func SetNoNewPrivs() error { return Prctl(PR_SET_NO_NEW_PRIVS, 1, 0) }
 
 // Isatty tests whether a file descriptor refers to a terminal.
 func Isatty(fd int) bool {
 	var buf [8]byte
-	r, _, _ := syscall.Syscall(
-		syscall.SYS_IOCTL,
+	r, _, _ := Syscall(
+		SYS_IOCTL,
 		uintptr(fd),
-		syscall.TIOCGWINSZ,
+		TIOCGWINSZ,
 		uintptr(unsafe.Pointer(&buf[0])),
 	)
 	return r == 0
@@ -60,7 +51,7 @@ func Isatty(fd int) bool {
 func IgnoringEINTR(fn func() error) error {
 	for {
 		err := fn()
-		if err != syscall.EINTR {
+		if err != EINTR {
 			return err
 		}
 	}

container/syscall_386.go

@@ -0,0 +1,7 @@
+package container
+
+const (
+	O_PATH = 0x200000
+
+	PR_SET_NO_NEW_PRIVS = 0x26
+)

container/vfs/mountinfo_test.go

@@ -26,11 +26,11 @@ func TestDecoderError(t *testing.T) {
 		target  error
 		targetF error
 	}{
-		{"errno", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: syscall.ENOTRECOVERABLE},
-			"parse mountinfo at line 3735928559: state not recoverable", syscall.ENOTRECOVERABLE, syscall.EROFS},
+		{"errno", &vfs.DecoderError{Op: "parse", Line: 0xdead, Err: syscall.ENOTRECOVERABLE},
+			"parse mountinfo at line 57005: state not recoverable", syscall.ENOTRECOVERABLE, syscall.EROFS},
 
-		{"strconv", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
-			`parse mountinfo at line 3735928559: numeric field "meow" invalid syntax`, strconv.ErrSyntax, os.ErrInvalid},
+		{"strconv", &vfs.DecoderError{Op: "parse", Line: 0xdead, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
+			`parse mountinfo at line 57005: numeric field "meow" invalid syntax`, strconv.ErrSyntax, os.ErrInvalid},
 
 		{"unfold", &vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/proc/nonexistent")},
 			"unfold mountinfo: mount point /proc/nonexistent never appeared in mountinfo", vfs.UnfoldTargetError("/proc/nonexistent"), os.ErrNotExist},

dist/comp/_hakurei

@@ -12,6 +12,8 @@ _hakurei_run() {
     '-g[Groups inherited by all container processes]: :_groups' \
     '-d[Container home directory]: :_files -/' \
     '-u[Passwd user name within sandbox]: :_users' \
+    '--private-runtime[Do not share XDG_RUNTIME_DIR between containers under the same identity]' \
+    '--private-tmpdir[Do not share TMPDIR between containers under the same identity]' \
     '--wayland[Enable connection to Wayland via security-context-v1]' \
     '-X[Enable direct connection to X11]' \
     '--dbus[Enable proxied connection to D-Bus]' \

dist/release.sh

@@ -10,10 +10,10 @@ cp -rv "dist/comp" "${out}"
 
 go generate ./...
 go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w -buildid= -extldflags '-static'
-  -X hakurei.app/internal.version=${VERSION}
-  -X hakurei.app/internal.hmain=/usr/bin/hakurei
-  -X hakurei.app/internal.hsu=/usr/bin/hsu
-  -X main.hmain=/usr/bin/hakurei" ./...
+  -X hakurei.app/internal.buildVersion=${VERSION}
+  -X hakurei.app/internal.hakureiPath=/usr/bin/hakurei
+  -X hakurei.app/internal.hsuPath=/usr/bin/hsu
+  -X main.hakureiPath=/usr/bin/hakurei" ./...
 
 rm -f "./${out}.tar.gz" && tar -C dist -czf "${out}.tar.gz" "${pname}"
 rm -rf "./${out}"

flake.nix

@@ -244,10 +244,10 @@
               shellHook = "exec ${pkgs.writeShellScript "generate-syscall-table" ''
                 set -e
                 ${pkgs.perl}/bin/perl \
-                  container/seccomp/mksysnum_linux.pl \
+                  container/std/mksysnum_linux.pl \
                   ${pkgs.linuxHeaders}/include/asm/unistd_64.h | \
                   ${pkgs.go}/bin/gofmt > \
-                  container/seccomp/syscall_linux_${GOARCH.${system}}.go
+                  container/std/syscall_linux_${GOARCH.${system}}.go
               ''}";
             };
         }

helper/args.go

@@ -35,7 +35,7 @@ func (a argsWt) String() string {
 }
 
 // NewCheckedArgs returns a checked null-terminated argument writer for a copy of args.
-func NewCheckedArgs(args []string) (wt io.WriterTo, err error) {
+func NewCheckedArgs(args ...string) (wt io.WriterTo, err error) {
 	a := make(argsWt, len(args))
 	for i, arg := range args {
 		a[i], err = syscall.ByteSliceFromString(arg)
@@ -49,8 +49,8 @@ func NewCheckedArgs(args []string) (wt io.WriterTo, err error) {
 
 // MustNewCheckedArgs returns a checked null-terminated argument writer for a copy of args.
 // If s contains a NUL byte this function panics instead of returning an error.
-func MustNewCheckedArgs(args []string) io.WriterTo {
-	a, err := NewCheckedArgs(args)
+func MustNewCheckedArgs(args ...string) io.WriterTo {
+	a, err := NewCheckedArgs(args...)
 	if err != nil {
 		panic(err.Error())
 	}

helper/args_test.go

@@ -22,7 +22,7 @@ func TestNewCheckedArgs(t *testing.T) {
 	t.Parallel()
 
 	args := []string{"\x00"}
-	if _, err := helper.NewCheckedArgs(args); !errors.Is(err, syscall.EINVAL) {
+	if _, err := helper.NewCheckedArgs(args...); !errors.Is(err, syscall.EINVAL) {
 		t.Errorf("NewCheckedArgs: error = %v, wantErr %v", err, syscall.EINVAL)
 	}
 
@@ -36,6 +36,6 @@ func TestNewCheckedArgs(t *testing.T) {
 				t.Errorf("MustNewCheckedArgs: panic = %v, wantPanic %v", r, wantPanic)
 			}
 		}()
-		helper.MustNewCheckedArgs(badPayload)
+		helper.MustNewCheckedArgs(badPayload...)
 	})
 }

helper/helper_test.go

@@ -27,7 +27,7 @@ var (
 	}
 
 	wantPayload = strings.Join(wantArgs, "\x00") + "\x00"
-	argsWt      = helper.MustNewCheckedArgs(wantArgs)
+	argsWt      = helper.MustNewCheckedArgs(wantArgs...)
 )
 
 func argF(argsFd, statFd int) []string {

hst/config.go

@@ -3,122 +3,41 @@ package hst
 import (
 	"errors"
 	"strconv"
-	"time"
+	"strings"
 
 	"hakurei.app/container/check"
 )
 
-// PrivateTmp is a private writable path in a hakurei container.
-const PrivateTmp = "/.hakurei"
+// Config configures an application container, implemented in internal/app.
+type Config struct {
+	// Reverse-DNS style configured arbitrary identifier string.
+	// Passed to wayland security-context-v1 and used as part of defaults in dbus session proxy.
+	ID string `json:"id,omitempty"`
 
-// AbsPrivateTmp is a [check.Absolute] representation of [PrivateTmp].
-var AbsPrivateTmp = check.MustAbs(PrivateTmp)
+	// System services to make available in the container.
+	Enablements *Enablements `json:"enablements,omitempty"`
 
-const (
-	// WaitDelayDefault is used when WaitDelay has its zero value.
-	WaitDelayDefault = 5 * time.Second
-	// WaitDelayMax is used if WaitDelay exceeds its value.
-	WaitDelayMax = 30 * time.Second
+	// Session D-Bus proxy configuration.
+	// If set to nil, session bus proxy assume built-in defaults.
+	SessionBus *BusConfig `json:"session_bus,omitempty"`
+	// System D-Bus proxy configuration.
+	// If set to nil, system bus proxy is disabled.
+	SystemBus *BusConfig `json:"system_bus,omitempty"`
+	// Direct access to wayland socket, no attempt is made to attach security-context-v1
+	// and the bare socket is made available to the container.
+	DirectWayland bool `json:"direct_wayland,omitempty"`
 
-	// IdentityMin is the minimum value of [Config.Identity]. This is enforced by cmd/hsu.
-	IdentityMin = 0
-	// IdentityMax is the maximum value of [Config.Identity]. This is enforced by cmd/hsu.
-	IdentityMax = 9999
+	// Extra acl updates to perform before setuid.
+	ExtraPerms []ExtraPermConfig `json:"extra_perms,omitempty"`
 
-	// ShimExitRequest is returned when the priv side process requests shim exit.
-	ShimExitRequest = 254
-	// ShimExitOrphan is returned when the shim is orphaned before priv side delivers a signal.
-	ShimExitOrphan = 3
-)
+	// Numerical application id, passed to hsu, used to derive init user namespace credentials.
+	Identity int `json:"identity"`
+	// Init user namespace supplementary groups inherited by all container processes.
+	Groups []string `json:"groups"`
 
-type (
-	// Config configures an application container, implemented in internal/app.
-	Config struct {
-		// Reverse-DNS style configured arbitrary identifier string.
-		// Passed to wayland security-context-v1 and used as part of defaults in dbus session proxy.
-		ID string `json:"id"`
-
-		// System services to make available in the container.
-		Enablements *Enablements `json:"enablements,omitempty"`
-
-		// Session D-Bus proxy configuration.
-		// If set to nil, session bus proxy assume built-in defaults.
-		SessionBus *BusConfig `json:"session_bus,omitempty"`
-		// System D-Bus proxy configuration.
-		// If set to nil, system bus proxy is disabled.
-		SystemBus *BusConfig `json:"system_bus,omitempty"`
-		// Direct access to wayland socket, no attempt is made to attach security-context-v1
-		// and the bare socket is made available to the container.
-		DirectWayland bool `json:"direct_wayland,omitempty"`
-
-		// Extra acl update ops to perform before setuid.
-		ExtraPerms []*ExtraPermConfig `json:"extra_perms,omitempty"`
-
-		// Numerical application id, passed to hsu, used to derive init user namespace credentials.
-		Identity int `json:"identity"`
-		// Init user namespace supplementary groups inherited by all container processes.
-		Groups []string `json:"groups"`
-
-		// High level configuration applied to the underlying [container].
-		Container *ContainerConfig `json:"container"`
-	}
-
-	// ContainerConfig describes the container configuration to be applied to an underlying [container].
-	ContainerConfig struct {
-		// Container UTS namespace hostname.
-		Hostname string `json:"hostname,omitempty"`
-
-		// Duration in nanoseconds to wait for after interrupting the initial process.
-		// Defaults to [WaitDelayDefault] if zero, or [WaitDelayMax] if greater than [WaitDelayMax].
-		// Values lesser than zero is equivalent to zero, bypassing [WaitDelayDefault].
-		WaitDelay time.Duration `json:"wait_delay,omitempty"`
-
-		// Emit Flatpak-compatible seccomp filter programs.
-		SeccompCompat bool `json:"seccomp_compat,omitempty"`
-		// Allow ptrace and friends.
-		Devel bool `json:"devel,omitempty"`
-		// Allow userns creation and container setup syscalls.
-		Userns bool `json:"userns,omitempty"`
-		// Share host net namespace.
-		HostNet bool `json:"host_net,omitempty"`
-		// Share abstract unix socket scope.
-		HostAbstract bool `json:"host_abstract,omitempty"`
-		// Allow dangerous terminal I/O (faking input).
-		Tty bool `json:"tty,omitempty"`
-		// Allow multiarch.
-		Multiarch bool `json:"multiarch,omitempty"`
-
-		// Initial process environment variables.
-		Env map[string]string `json:"env"`
-
-		/* Map target user uid to privileged user uid in the container user namespace.
-
-		Some programs fail to connect to dbus session running as a different uid,
-		this option works around it by mapping priv-side caller uid in container. */
-		MapRealUID bool `json:"map_real_uid"`
-
-		// Mount /dev/ from the init mount namespace as-is in the container mount namespace.
-		Device bool `json:"device,omitempty"`
-
-		/* Container mount points.
-
-		If the first element targets /, it is inserted early and excluded from path hiding. */
-		Filesystem []FilesystemConfigJSON `json:"filesystem"`
-
-		// String used as the username of the emulated user, validated against the default NAME_REGEX from adduser.
-		// Defaults to passwd name of target uid or chronos.
-		Username string `json:"username,omitempty"`
-		// Pathname of shell in the container filesystem to use for the emulated user.
-		Shell *check.Absolute `json:"shell"`
-		// Directory in the container filesystem to enter and use as the home directory of the emulated user.
-		Home *check.Absolute `json:"home"`
-
-		// Pathname to executable file in the container filesystem.
-		Path *check.Absolute `json:"path,omitempty"`
-		// Final args passed to the initial program.
-		Args []string `json:"args"`
-	}
-)
+	// High level configuration applied to the underlying [container].
+	Container *ContainerConfig `json:"container"`
+}
 
 var (
 	// ErrConfigNull is returned by [Config.Validate] for an invalid configuration that contains a null value for any
@@ -127,6 +46,9 @@ var (
 
 	// ErrIdentityBounds is returned by [Config.Validate] for an out of bounds [Config.Identity] value.
 	ErrIdentityBounds = errors.New("identity out of bounds")
+
+	// ErrEnviron is returned by [Config.Validate] if an environment variable name contains '=' or NUL.
+	ErrEnviron = errors.New("invalid environment variable name")
 )
 
 // Validate checks [Config] and returns [AppError] if an invalid value is encountered.
@@ -137,7 +59,7 @@ func (config *Config) Validate() error {
 	}
 
 	// this is checked again in hsu
-	if config.Identity < IdentityMin || config.Identity > IdentityMax {
+	if config.Identity < IdentityStart || config.Identity > IdentityEnd {
 		return &AppError{Step: "validate configuration", Err: ErrIdentityBounds,
 			Msg: "identity " + strconv.Itoa(config.Identity) + " out of range"}
 	}
@@ -165,18 +87,32 @@ func (config *Config) Validate() error {
 		return &AppError{Step: "validate configuration", Err: ErrConfigNull,
 			Msg: "container configuration missing path to initial program"}
 	}
+
+	for key := range config.Container.Env {
+		if strings.IndexByte(key, '=') != -1 || strings.IndexByte(key, 0) != -1 {
+			return &AppError{Step: "validate configuration", Err: ErrEnviron,
+				Msg: "invalid environment variable " + strconv.Quote(key)}
+		}
+	}
+
 	return nil
 }
 
-// ExtraPermConfig describes an acl update op.
+// ExtraPermConfig describes an acl update to perform before setuid.
 type ExtraPermConfig struct {
-	Ensure  bool            `json:"ensure,omitempty"`
-	Path    *check.Absolute `json:"path"`
-	Read    bool            `json:"r,omitempty"`
-	Write   bool            `json:"w,omitempty"`
-	Execute bool            `json:"x,omitempty"`
+	// Whether to create Path as a directory if it does not exist.
+	Ensure bool `json:"ensure,omitempty"`
+	// Pathname to act on.
+	Path *check.Absolute `json:"path"`
+	// Whether to set ACL_READ for the target user.
+	Read bool `json:"r,omitempty"`
+	// Whether to set ACL_WRITE for the target user.
+	Write bool `json:"w,omitempty"`
+	// Whether to set ACL_EXECUTE for the target user.
+	Execute bool `json:"x,omitempty"`
 }
 
+// String returns a checked string representation of [ExtraPermConfig].
 func (e *ExtraPermConfig) String() string {
 	if e == nil || e.Path == nil {
 		return "<invalid>"

hst/config_test.go

@@ -39,6 +39,20 @@ func TestConfigValidate(t *testing.T) {
 			Shell: fhs.AbsTmp,
 		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrConfigNull,
 			Msg: "container configuration missing path to initial program"}},
+		{"env equals", &hst.Config{Container: &hst.ContainerConfig{
+			Home:  fhs.AbsTmp,
+			Shell: fhs.AbsTmp,
+			Path:  fhs.AbsTmp,
+			Env:   map[string]string{"TERM=": ""},
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrEnviron,
+			Msg: `invalid environment variable "TERM="`}},
+		{"env NUL", &hst.Config{Container: &hst.ContainerConfig{
+			Home:  fhs.AbsTmp,
+			Shell: fhs.AbsTmp,
+			Path:  fhs.AbsTmp,
+			Env:   map[string]string{"TERM\x00": ""},
+		}}, &hst.AppError{Step: "validate configuration", Err: hst.ErrEnviron,
+			Msg: `invalid environment variable "TERM\x00"`}},
 		{"valid", &hst.Config{Container: &hst.ContainerConfig{
 			Home:  fhs.AbsTmp,
 			Shell: fhs.AbsTmp,

hst/container.go

@@ -0,0 +1,252 @@
+package hst
+
+import (
+	"encoding/json"
+	"strings"
+	"syscall"
+	"time"
+
+	"hakurei.app/container/check"
+)
+
+// PrivateTmp is a private writable path in a hakurei container.
+const PrivateTmp = "/.hakurei"
+
+// AbsPrivateTmp is a [check.Absolute] representation of [PrivateTmp].
+var AbsPrivateTmp = check.MustAbs(PrivateTmp)
+
+const (
+	// WaitDelayDefault is used when WaitDelay has its zero value.
+	WaitDelayDefault = 5 * time.Second
+	// WaitDelayMax is used if WaitDelay exceeds its value.
+	WaitDelayMax = 30 * time.Second
+)
+
+const (
+	// ExitFailure is returned if the container fails to start.
+	ExitFailure = iota + 1
+	// ExitCancel is returned if the container is terminated by a shim-directed signal which cancels its context.
+	ExitCancel
+	// ExitOrphan is returned when the shim is orphaned before priv side delivers a signal.
+	ExitOrphan
+
+	// ExitRequest is returned when the priv side process requests shim exit.
+	ExitRequest = 254
+)
+
+// Flags are options held by [ContainerConfig].
+type Flags uintptr
+
+const (
+	// FMultiarch unblocks syscalls required for multiarch to work on applicable targets.
+	FMultiarch Flags = 1 << iota
+
+	// FSeccompCompat changes emitted seccomp filter programs to be identical to that of Flatpak.
+	FSeccompCompat
+	// FDevel unblocks ptrace and friends.
+	FDevel
+	// FUserns unblocks userns creation and container setup syscalls.
+	FUserns
+	// FHostNet skips net namespace creation.
+	FHostNet
+	// FHostAbstract skips setting up abstract unix socket scope.
+	FHostAbstract
+	// FTty unblocks dangerous terminal I/O (faking input).
+	FTty
+
+	// FMapRealUID maps the target user uid to the privileged user uid in the container user namespace.
+	//	Some programs fail to connect to dbus session running as a different uid,
+	//	this option works around it by mapping priv-side caller uid in container.
+	FMapRealUID
+
+	// FDevice mount /dev/ from the init mount namespace as-is in the container mount namespace.
+	FDevice
+
+	// FShareRuntime shares XDG_RUNTIME_DIR between containers under the same identity.
+	FShareRuntime
+	// FShareTmpdir shares TMPDIR between containers under the same identity.
+	FShareTmpdir
+
+	fMax
+
+	// FAll is [ContainerConfig.Flags] with all currently defined bits set.
+	FAll = fMax - 1
+)
+
+func (flags Flags) String() string {
+	switch flags {
+	case FMultiarch:
+		return "multiarch"
+	case FSeccompCompat:
+		return "compat"
+	case FDevel:
+		return "devel"
+	case FUserns:
+		return "userns"
+	case FHostNet:
+		return "net"
+	case FHostAbstract:
+		return "abstract"
+	case FTty:
+		return "tty"
+	case FMapRealUID:
+		return "mapuid"
+	case FDevice:
+		return "device"
+	case FShareRuntime:
+		return "runtime"
+	case FShareTmpdir:
+		return "tmpdir"
+
+	default:
+		s := make([]string, 0, 1<<4)
+		for f := Flags(1); f < fMax; f <<= 1 {
+			if flags&f != 0 {
+				s = append(s, f.String())
+			}
+		}
+		if len(s) == 0 {
+			return "none"
+		}
+		return strings.Join(s, ", ")
+	}
+}
+
+// ContainerConfig describes the container configuration to be applied to an underlying [container].
+type ContainerConfig struct {
+	// Container UTS namespace hostname.
+	Hostname string `json:"hostname,omitempty"`
+
+	// Duration in nanoseconds to wait for after interrupting the initial process.
+	// Defaults to [WaitDelayDefault] if zero, or [WaitDelayMax] if greater than [WaitDelayMax].
+	// Values lesser than zero is equivalent to zero, bypassing [WaitDelayDefault].
+	WaitDelay time.Duration `json:"wait_delay,omitempty"`
+
+	// Initial process environment variables.
+	Env map[string]string `json:"env"`
+
+	/* Container mount points.
+
+	If the first element targets /, it is inserted early and excluded from path hiding. */
+	Filesystem []FilesystemConfigJSON `json:"filesystem"`
+
+	// String used as the username of the emulated user, validated against the default NAME_REGEX from adduser.
+	// Defaults to passwd name of target uid or chronos.
+	Username string `json:"username,omitempty"`
+	// Pathname of shell in the container filesystem to use for the emulated user.
+	Shell *check.Absolute `json:"shell"`
+	// Directory in the container filesystem to enter and use as the home directory of the emulated user.
+	Home *check.Absolute `json:"home"`
+
+	// Pathname to executable file in the container filesystem.
+	Path *check.Absolute `json:"path,omitempty"`
+	// Final args passed to the initial program.
+	Args []string `json:"args"`
+
+	// Flags holds boolean options of [ContainerConfig].
+	Flags Flags `json:"-"`
+}
+
+// ContainerConfigF is [ContainerConfig] stripped of its methods.
+// The [ContainerConfig.Flags] field does not survive a [json] round trip.
+type ContainerConfigF ContainerConfig
+
+// containerConfigJSON is the [json] representation of [ContainerConfig].
+type containerConfigJSON = struct {
+	*ContainerConfigF
+
+	// Corresponds to [FSeccompCompat].
+	SeccompCompat bool `json:"seccomp_compat,omitempty"`
+	// Corresponds to [FDevel].
+	Devel bool `json:"devel,omitempty"`
+	// Corresponds to [FUserns].
+	Userns bool `json:"userns,omitempty"`
+	// Corresponds to [FHostNet].
+	HostNet bool `json:"host_net,omitempty"`
+	// Corresponds to [FHostAbstract].
+	HostAbstract bool `json:"host_abstract,omitempty"`
+	// Corresponds to [FTty].
+	Tty bool `json:"tty,omitempty"`
+
+	// Corresponds to [FMultiarch].
+	Multiarch bool `json:"multiarch,omitempty"`
+
+	// Corresponds to [FMapRealUID].
+	MapRealUID bool `json:"map_real_uid"`
+
+	// Corresponds to [FDevice].
+	Device bool `json:"device,omitempty"`
+
+	// Corresponds to [FShareRuntime].
+	ShareRuntime bool `json:"share_runtime,omitempty"`
+	// Corresponds to [FShareTmpdir]
+	ShareTmpdir bool `json:"share_tmpdir,omitempty"`
+}
+
+func (c *ContainerConfig) MarshalJSON() ([]byte, error) {
+	if c == nil {
+		return nil, syscall.EINVAL
+	}
+	return json.Marshal(&containerConfigJSON{
+		ContainerConfigF: (*ContainerConfigF)(c),
+
+		SeccompCompat: c.Flags&FSeccompCompat != 0,
+		Devel:         c.Flags&FDevel != 0,
+		Userns:        c.Flags&FUserns != 0,
+		HostNet:       c.Flags&FHostNet != 0,
+		HostAbstract:  c.Flags&FHostAbstract != 0,
+		Tty:           c.Flags&FTty != 0,
+		Multiarch:     c.Flags&FMultiarch != 0,
+		MapRealUID:    c.Flags&FMapRealUID != 0,
+		Device:        c.Flags&FDevice != 0,
+		ShareRuntime:  c.Flags&FShareRuntime != 0,
+		ShareTmpdir:   c.Flags&FShareTmpdir != 0,
+	})
+}
+
+func (c *ContainerConfig) UnmarshalJSON(data []byte) error {
+	if c == nil {
+		return syscall.EINVAL
+	}
+
+	v := new(containerConfigJSON)
+	if err := json.Unmarshal(data, &v); err != nil {
+		return err
+	}
+
+	*c = *(*ContainerConfig)(v.ContainerConfigF)
+	if v.SeccompCompat {
+		c.Flags |= FSeccompCompat
+	}
+	if v.Devel {
+		c.Flags |= FDevel
+	}
+	if v.Userns {
+		c.Flags |= FUserns
+	}
+	if v.HostNet {
+		c.Flags |= FHostNet
+	}
+	if v.HostAbstract {
+		c.Flags |= FHostAbstract
+	}
+	if v.Tty {
+		c.Flags |= FTty
+	}
+	if v.Multiarch {
+		c.Flags |= FMultiarch
+	}
+	if v.MapRealUID {
+		c.Flags |= FMapRealUID
+	}
+	if v.Device {
+		c.Flags |= FDevice
+	}
+	if v.ShareRuntime {
+		c.Flags |= FShareRuntime
+	}
+	if v.ShareTmpdir {
+		c.Flags |= FShareTmpdir
+	}
+	return nil
+}

hst/container_test.go

@@ -0,0 +1,101 @@
+package hst_test
+
+import (
+	"encoding/json"
+	"errors"
+	"math"
+	"reflect"
+	"syscall"
+	"testing"
+
+	"hakurei.app/hst"
+)
+
+func TestFlagsString(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name  string
+		flags hst.Flags
+		want  string
+	}{
+		{"none", 0, "none"},
+		{"none high", hst.FAll + 1, "none"},
+		{"all", hst.FAll, "multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, runtime, tmpdir"},
+		{"all high", math.MaxUint, "multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, runtime, tmpdir"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := tc.flags.String(); got != tc.want {
+				t.Errorf("String(%#b): %q, want %q", tc.flags, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestContainerConfig(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		c    *hst.ContainerConfig
+		data string
+	}{
+		{"nil", nil, "null"},
+		{"zero", new(hst.ContainerConfig),
+			`{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"map_real_uid":false}`},
+		{"seccomp compat", &hst.ContainerConfig{Flags: hst.FSeccompCompat},
+			`{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"seccomp_compat":true,"map_real_uid":false}`},
+		{"hostnet hostabstract", &hst.ContainerConfig{Flags: hst.FHostNet | hst.FHostAbstract},
+			`{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"host_net":true,"host_abstract":true,"map_real_uid":false}`},
+		{"hostnet hostabstract mapuid", &hst.ContainerConfig{Flags: hst.FHostNet | hst.FHostAbstract | hst.FMapRealUID},
+			`{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"host_net":true,"host_abstract":true,"map_real_uid":true}`},
+		{"all", &hst.ContainerConfig{Flags: hst.FAll},
+			`{"env":null,"filesystem":null,"shell":null,"home":null,"args":null,"seccomp_compat":true,"devel":true,"userns":true,"host_net":true,"host_abstract":true,"tty":true,"multiarch":true,"map_real_uid":true,"device":true,"share_runtime":true,"share_tmpdir":true}`},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			t.Run("marshal", func(t *testing.T) {
+				t.Parallel()
+				if got, err := json.Marshal(tc.c); err != nil {
+					t.Fatalf("Marshal: error = %v", err)
+				} else if string(got) != tc.data {
+					t.Errorf("Marshal:\n%s, want\n%s", string(got), tc.data)
+				}
+			})
+
+			t.Run("unmarshal", func(t *testing.T) {
+				t.Parallel()
+
+				{
+					got := new(hst.ContainerConfig)
+					if err := json.Unmarshal([]byte(tc.data), &got); err != nil {
+						t.Fatalf("Unmarshal: error = %v", err)
+					}
+					if !reflect.DeepEqual(got, tc.c) {
+						t.Errorf("Unmarshal: %v, want %v", got, tc.c)
+					}
+				}
+			})
+		})
+	}
+
+	t.Run("passthrough", func(t *testing.T) {
+		t.Parallel()
+
+		if _, err := (*hst.ContainerConfig)(nil).MarshalJSON(); !errors.Is(err, syscall.EINVAL) {
+			t.Errorf("MarshalJSON: error = %v", err)
+		}
+		if err := (*hst.ContainerConfig)(nil).UnmarshalJSON(nil); !errors.Is(err, syscall.EINVAL) {
+			t.Errorf("UnmarshalJSON: error = %v", err)
+		}
+		if err := new(hst.ContainerConfig).UnmarshalJSON([]byte{}); err == nil {
+			t.Errorf("UnmarshalJSON: error = %v", err)
+		}
+	})
+}

hst/enablement_test.go

@@ -80,7 +80,7 @@ func TestEnablements(t *testing.T) {
 
 				if got, err := json.Marshal(struct {
 					Value *hst.Enablements `json:"value"`
-					Magic int              `json:"magic"`
+					Magic uint64           `json:"magic"`
 				}{tc.e, syscall.MS_MGC_VAL}); err != nil {
 					t.Fatalf("Marshal: error = %v", err)
 				} else if string(got) != tc.sData {
@@ -108,7 +108,7 @@ func TestEnablements(t *testing.T) {
 				{
 					got := *(new(struct {
 						Value *hst.Enablements `json:"value"`
-						Magic int              `json:"magic"`
+						Magic uint64           `json:"magic"`
 					}))
 					if err := json.Unmarshal([]byte(tc.sData), &got); err != nil {
 						t.Fatalf("Unmarshal: error = %v", err)

hst/fs_test.go

@@ -241,7 +241,7 @@ func (s stubFS) String() string          { return "<invalid " + s.typeName + ">"
 
 type sCheck struct {
 	FS    hst.FilesystemConfigJSON `json:"fs"`
-	Magic int                      `json:"magic"`
+	Magic uint64                   `json:"magic"`
 }
 
 type fsTestCase struct {

hst/fsbind.go

@@ -4,9 +4,9 @@ import (
 	"encoding/gob"
 	"strings"
 
-	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
 	"hakurei.app/container/fhs"
+	"hakurei.app/container/std"
 )
 
 func init() { gob.Register(new(FSBind)) }
@@ -97,16 +97,16 @@ func (b *FSBind) Apply(z *ApplyState) {
 	}
 	var flags int
 	if b.Write {
-		flags |= bits.BindWritable
+		flags |= std.BindWritable
 	}
 	if b.Device {
-		flags |= bits.BindDevice | bits.BindWritable
+		flags |= std.BindDevice | std.BindWritable
 	}
 	if b.Ensure {
-		flags |= bits.BindEnsure
+		flags |= std.BindEnsure
 	}
 	if b.Optional {
-		flags |= bits.BindOptional
+		flags |= std.BindOptional
 	}
 
 	switch {

hst/fsbind_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"hakurei.app/container"
-	"hakurei.app/container/bits"
+	"hakurei.app/container/std"
 	"hakurei.app/hst"
 )
 
@@ -24,7 +24,7 @@ func TestFSBind(t *testing.T) {
 		}, true, container.Ops{&container.BindMountOp{
 			Source: m("/mnt/dev"),
 			Target: m("/dev"),
-			Flags:  bits.BindWritable | bits.BindDevice | bits.BindOptional,
+			Flags:  std.BindWritable | std.BindDevice | std.BindOptional,
 		}}, m("/dev"), ms("/mnt/dev"),
 			"d+/mnt/dev:/dev"},
 
@@ -36,7 +36,7 @@ func TestFSBind(t *testing.T) {
 		}, true, container.Ops{&container.BindMountOp{
 			Source: m("/mnt/dev"),
 			Target: m("/dev"),
-			Flags:  bits.BindWritable | bits.BindDevice | bits.BindEnsure,
+			Flags:  std.BindWritable | std.BindDevice | std.BindEnsure,
 		}}, m("/dev"), ms("/mnt/dev"),
 			"d-/mnt/dev:/dev"},
 
@@ -48,7 +48,7 @@ func TestFSBind(t *testing.T) {
 		}, true, container.Ops{&container.BindMountOp{
 			Source: m("/mnt/dev"),
 			Target: m("/dev"),
-			Flags:  bits.BindWritable | bits.BindDevice,
+			Flags:  std.BindWritable | std.BindDevice,
 		}}, m("/dev"), ms("/mnt/dev"),
 			"d*/mnt/dev:/dev"},
 
@@ -59,7 +59,7 @@ func TestFSBind(t *testing.T) {
 		}, true, container.Ops{&container.BindMountOp{
 			Source: m("/mnt/tmp"),
 			Target: m("/tmp"),
-			Flags:  bits.BindWritable,
+			Flags:  std.BindWritable,
 		}}, m("/tmp"), ms("/mnt/tmp"),
 			"w*/mnt/tmp:/tmp"},
 
@@ -98,7 +98,7 @@ func TestFSBind(t *testing.T) {
 			Special: true,
 		}, true, container.Ops{&container.AutoRootOp{
 			Host:  m("/"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}}, m("/"), ms("/"), "autoroot:w"},
 
 		{"autoroot silly", &hst.FSBind{
@@ -108,7 +108,7 @@ func TestFSBind(t *testing.T) {
 			Special: true,
 		}, true, container.Ops{&container.AutoRootOp{
 			Host:  m("/etc"),
-			Flags: bits.BindWritable,
+			Flags: std.BindWritable,
 		}}, m("/"), ms("/etc"), "autoroot:w:/etc"},
 
 		{"autoetc", &hst.FSBind{

hst/grp_pwd.go

@@ -0,0 +1,61 @@
+package hst
+
+import (
+	"fmt"
+	"strconv"
+)
+
+const (
+	// UserOffset is the offset for UID and GID ranges for each user.
+	UserOffset = 100000
+	// RangeSize is the size of each UID and GID range.
+	RangeSize = UserOffset / 10
+
+	// IdentityStart is the first [Config.Identity] value. This is enforced in cmd/hsu.
+	IdentityStart = 0
+	// IdentityEnd is the last [Config.Identity] value. This is enforced in cmd/hsu.
+	IdentityEnd = AppEnd - AppStart
+
+	// AppStart is the first app user UID and GID.
+	AppStart = RangeSize * 1
+	// AppEnd is the last app user UID and GID.
+	AppEnd = AppStart + RangeSize - 1
+
+	/* these are for Rosa OS: use the ranges below to determine whether a process is isolated */
+
+	// IsolatedStart is the start of UID and GID for fully isolated sandboxed processes.
+	IsolatedStart = RangeSize * 9
+	// IsolatedEnd is the end of UID and GID for fully isolated sandboxed processes.
+	IsolatedEnd = IsolatedStart + RangeSize - 1
+)
+
+// A UID represents a kernel uid in the init namespace.
+type UID uint32
+
+// String returns the username corresponding to this uid.
+//
+// Not safe against untrusted input.
+func (uid UID) String() string {
+	appid := uid % UserOffset
+	userid := uid / UserOffset
+	if appid >= IsolatedStart && appid <= IsolatedEnd {
+		return fmt.Sprintf("u%d_i%d", userid, appid-IsolatedStart)
+	} else if appid >= AppStart && appid <= AppEnd {
+		return fmt.Sprintf("u%d_a%d", userid, appid-AppStart)
+	} else {
+		return strconv.Itoa(int(uid))
+	}
+}
+
+// A GID represents a kernel gid in the init namespace.
+type GID uint32
+
+// String returns the group name corresponding to this gid.
+//
+// Not safe against untrusted input.
+func (gid GID) String() string { return UID(gid).String() }
+
+// ToUser returns a [hst.UID] value from userid and appid.
+//
+// Not safe against untrusted input.
+func ToUser[U int | uint32](userid, appid U) U { return userid*UserOffset + AppStart + appid }

hst/grp_pwd_test.go

@@ -0,0 +1,40 @@
+package hst_test
+
+import (
+	"strconv"
+	"testing"
+
+	"hakurei.app/hst"
+)
+
+func TestUIDString(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		val  uint32
+		want string
+	}{
+		{hst.AppStart + hst.IdentityStart, "u0_a0"},                           // uidStart
+		{hst.ToUser[uint32](hst.RangeSize-1, hst.IdentityEnd), "u9999_a9999"}, // uidEnd
+
+		{hst.IsolatedStart + hst.IdentityStart, "u0_i0"},                    // isolatedStart
+		{(hst.RangeSize-1)*hst.UserOffset + hst.IsolatedEnd, "u9999_i9999"}, // isolatedEnd
+
+		{hst.ToUser[uint32](10, 127), "u10_a127"},
+		{hst.ToUser[uint32](11, 127), "u11_a127"},
+
+		{0, "0"}, // out of bounds
+	}
+	for _, tc := range testCases {
+		t.Run(strconv.Itoa(int(tc.val)), func(t *testing.T) {
+			t.Parallel()
+
+			if got := hst.UID(tc.val).String(); got != tc.want {
+				t.Fatalf("UID.String: %q, want %q", got, tc.want)
+			}
+			if got := hst.GID(tc.val).String(); got != tc.want {
+				t.Fatalf("GID.String: %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

hst/hst.go

@@ -3,6 +3,7 @@ package hst
 
 import (
 	"errors"
+	"math"
 	"net"
 	"os"
 
@@ -15,7 +16,7 @@ type AppError struct {
 	// A user-facing description of where the error occurred.
 	Step string `json:"step"`
 	// The underlying error value.
-	Err error
+	Err error `json:"err"`
 	// An arbitrary error message, overriding the return value of Message if not empty.
 	Msg string `json:"message,omitempty"`
 }
@@ -51,7 +52,10 @@ type Paths struct {
 	RunDirPath *check.Absolute `json:"run_dir_path"`
 }
 
+// Info holds basic system information collected from the implementation.
 type Info struct {
+	// Version is a hardcoded version string.
+	Version string `json:"version"`
 	// User is the userid according to hsu.
 	User int `json:"user"`
 
@@ -87,7 +91,7 @@ func Template() *Config {
 		},
 		DirectWayland: false,
 
-		ExtraPerms: []*ExtraPermConfig{
+		ExtraPerms: []ExtraPermConfig{
 			{Path: fhs.AbsVarLib.Append("hakurei/u0"), Ensure: true, Execute: true},
 			{Path: fhs.AbsVarLib.Append("hakurei/u0/org.chromium.Chromium"), Read: true, Write: true, Execute: true},
 		},
@@ -96,17 +100,8 @@ func Template() *Config {
 		Groups:   []string{"video", "dialout", "plugdev"},
 
 		Container: &ContainerConfig{
-			Hostname:      "localhost",
-			Devel:         true,
-			Userns:        true,
-			HostNet:       true,
-			HostAbstract:  true,
-			Device:        true,
-			WaitDelay:     -1,
-			SeccompCompat: true,
-			Tty:           true,
-			Multiarch:     true,
-			MapRealUID:    true,
+			Hostname:  "localhost",
+			WaitDelay: -1,
 			// example API credentials pulled from Google Chrome
 			// DO NOT USE THESE IN A REAL BROWSER
 			Env: map[string]string{
@@ -143,6 +138,9 @@ func Template() *Config {
 				"--enable-features=UseOzonePlatform",
 				"--ozone-platform=wayland",
 			},
+
+			// Set all bits here so new flags trip the template test.
+			Flags: math.MaxUint,
 		},
 	}
 }

hst/hst_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"os"
+	"reflect"
 	"syscall"
 	"testing"
 
@@ -164,20 +165,11 @@ func TestTemplate(t *testing.T) {
 	"container": {
 		"hostname": "localhost",
 		"wait_delay": -1,
-		"seccomp_compat": true,
-		"devel": true,
-		"userns": true,
-		"host_net": true,
-		"host_abstract": true,
-		"tty": true,
-		"multiarch": true,
 		"env": {
 			"GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
 			"GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
 			"GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
 		},
-		"map_real_uid": true,
-		"device": true,
 		"filesystem": [
 			{
 				"type": "bind",
@@ -243,14 +235,43 @@ func TestTemplate(t *testing.T) {
 			"--disable-smooth-scrolling",
 			"--enable-features=UseOzonePlatform",
 			"--ozone-platform=wayland"
-		]
+		],
+		"seccomp_compat": true,
+		"devel": true,
+		"userns": true,
+		"host_net": true,
+		"host_abstract": true,
+		"tty": true,
+		"multiarch": true,
+		"map_real_uid": true,
+		"device": true,
+		"share_runtime": true,
+		"share_tmpdir": true
 	}
 }`
 
-	if p, err := json.MarshalIndent(hst.Template(), "", "\t"); err != nil {
-		t.Fatalf("cannot marshal: %v", err)
-	} else if s := string(p); s != want {
-		t.Fatalf("Template:\n%s\nwant:\n%s",
-			s, want)
-	}
+	t.Run("marshal", func(t *testing.T) {
+		t.Parallel()
+		if p, err := json.MarshalIndent(hst.Template(), "", "\t"); err != nil {
+			t.Fatalf("cannot marshal: %v", err)
+		} else if s := string(p); s != want {
+			t.Fatalf("Template:\n%s\nwant:\n%s",
+				s, want)
+		}
+	})
+
+	t.Run("unmarshal", func(t *testing.T) {
+		t.Parallel()
+
+		var got *hst.Config
+		if err := json.Unmarshal([]byte(want), &got); err != nil {
+			t.Fatalf("Unmarshal: error = %v", err)
+		}
+
+		wantVal := hst.Template()
+		wantVal.Container.Flags = hst.FAll
+		if !reflect.DeepEqual(got, wantVal) {
+			t.Fatalf("Unmarshal: %#v, want %#v", got, wantVal)
+		}
+	})
 }

hst/instance.go

@@ -0,0 +1,87 @@
+package hst
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// An ID is a unique identifier held by a running hakurei container.
+type ID [16]byte
+
+// ErrIdentifierLength is returned when encountering a [hex] representation of [ID] with unexpected length.
+var ErrIdentifierLength = errors.New("identifier string has unexpected length")
+
+// IdentifierDecodeError is returned by [ID.UnmarshalText] to provide relevant error descriptions.
+type IdentifierDecodeError struct{ Err error }
+
+func (e IdentifierDecodeError) Unwrap() error { return e.Err }
+func (e IdentifierDecodeError) Error() string {
+	var invalidByteError hex.InvalidByteError
+	switch {
+	case errors.As(e.Err, &invalidByteError):
+		return fmt.Sprintf("got invalid byte %#U in identifier", rune(invalidByteError))
+	case errors.Is(e.Err, hex.ErrLength):
+		return "odd length identifier hex string"
+
+	default:
+		return e.Err.Error()
+	}
+}
+
+// String returns the [hex] string representation of [ID].
+func (a *ID) String() string { return hex.EncodeToString(a[:]) }
+
+// CreationTime returns the point in time [ID] was created.
+func (a *ID) CreationTime() time.Time {
+	return time.Unix(0, int64(binary.BigEndian.Uint64(a[:8]))).UTC()
+}
+
+// NewInstanceID creates a new unique [ID].
+func NewInstanceID(id *ID) error { return newInstanceID(id, uint64(time.Now().UnixNano())) }
+
+// newInstanceID creates a new unique [ID] with the specified timestamp.
+func newInstanceID(id *ID, p uint64) error {
+	binary.BigEndian.PutUint64(id[:8], p)
+	_, err := rand.Read(id[8:])
+	return err
+}
+
+// MarshalText encodes the [hex] representation of [ID].
+func (a *ID) MarshalText() (text []byte, err error) {
+	text = make([]byte, hex.EncodedLen(len(a)))
+	hex.Encode(text, a[:])
+	return
+}
+
+// UnmarshalText decodes a [hex] representation of [ID].
+func (a *ID) UnmarshalText(text []byte) error {
+	dl := hex.DecodedLen(len(text))
+	if dl != len(a) {
+		return IdentifierDecodeError{ErrIdentifierLength}
+	}
+	_, err := hex.Decode(a[:], text)
+	if err == nil {
+		return nil
+	}
+	return IdentifierDecodeError{err}
+}
+
+// A State describes a running hakurei container.
+type State struct {
+	// Unique instance id, created by [NewInstanceID].
+	ID ID `json:"instance"`
+	// Monitoring process pid. Runs as the priv user.
+	PID int `json:"pid"`
+	// Shim process pid. Runs as the target user.
+	ShimPID int `json:"shim_pid"`
+
+	// Configuration used to start the container.
+	*Config
+
+	// Point in time the shim process was created.
+	Time time.Time `json:"time"`
+}

hst/instance_test.go

@@ -0,0 +1,113 @@
+package hst_test
+
+import (
+	"encoding/hex"
+	"errors"
+	"reflect"
+	"testing"
+	"time"
+	_ "unsafe"
+
+	"hakurei.app/hst"
+)
+
+//go:linkname newInstanceID hakurei.app/hst.newInstanceID
+func newInstanceID(id *hst.ID, p uint64) error
+
+func TestIdentifierDecodeError(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{"invalid byte", hst.IdentifierDecodeError{Err: hex.InvalidByteError(0)},
+			"got invalid byte U+0000 in identifier"},
+		{"odd length", hst.IdentifierDecodeError{Err: hex.ErrLength},
+			"odd length identifier hex string"},
+		{"passthrough", hst.IdentifierDecodeError{Err: hst.ErrIdentifierLength},
+			hst.ErrIdentifierLength.Error()},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := tc.err.Error(); got != tc.want {
+				t.Errorf("Error: %q, want %q", got, tc.want)
+			}
+		})
+	}
+
+	t.Run("unwrap", func(t *testing.T) {
+		t.Parallel()
+
+		err := hst.IdentifierDecodeError{Err: hst.ErrIdentifierLength}
+		if !errors.Is(err, hst.ErrIdentifierLength) {
+			t.Errorf("Is unexpected false")
+		}
+	})
+}
+
+func TestID(t *testing.T) {
+	t.Parallel()
+
+	var randomID hst.ID
+	if err := hst.NewInstanceID(&randomID); err != nil {
+		t.Fatalf("NewInstanceID: error = %v", err)
+	}
+
+	testCases := []struct {
+		name string
+		data string
+		want hst.ID
+		err  error
+	}{
+		{"bad length", "meow", hst.ID{},
+			hst.IdentifierDecodeError{Err: hst.ErrIdentifierLength}},
+		{"invalid byte", "02bc7f8936b2af6\x00\x00e2535cd71ef0bb7", hst.ID{},
+			hst.IdentifierDecodeError{Err: hex.InvalidByteError(0)}},
+
+		{"zero", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hst.ID{}, nil},
+		{"random", randomID.String(), randomID, nil},
+		{"sample", "ba21c9bd33d9d37917288281a2a0d239", hst.ID{
+			0xba, 0x21, 0xc9, 0xbd,
+			0x33, 0xd9, 0xd3, 0x79,
+			0x17, 0x28, 0x82, 0x81,
+			0xa2, 0xa0, 0xd2, 0x39}, nil},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var got hst.ID
+			if err := got.UnmarshalText([]byte(tc.data)); !reflect.DeepEqual(err, tc.err) {
+				t.Errorf("UnmarshalText: error = %#v, want %#v", err, tc.err)
+			}
+
+			if tc.err == nil {
+				if gotString := got.String(); gotString != tc.data {
+					t.Errorf("String: %q, want %q", gotString, tc.data)
+				}
+				if gotData, _ := got.MarshalText(); string(gotData) != tc.data {
+					t.Errorf("MarshalText: %q, want %q", string(gotData), tc.data)
+				}
+			}
+		})
+	}
+
+	t.Run("time", func(t *testing.T) {
+		t.Parallel()
+		var id hst.ID
+
+		now := time.Now()
+		if err := newInstanceID(&id, uint64(now.UnixNano())); err != nil {
+			t.Fatalf("newInstanceID: error = %v", err)
+		}
+
+		got := id.CreationTime()
+		if !got.Equal(now) {
+			t.Fatalf("CreationTime(%q): %s, want %s", id.String(), got, now)
+		}
+	})
+}

internal/app/app.go

@@ -1,29 +0,0 @@
-// Package app implements high-level hakurei container behaviour.
-package app
-
-import (
-	"context"
-	"log"
-	"os"
-
-	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
-	"hakurei.app/message"
-)
-
-// Main runs an app according to [hst.Config] and terminates. Main does not return.
-func Main(ctx context.Context, msg message.Msg, config *hst.Config) {
-	var id state.ID
-	if err := state.NewAppID(&id); err != nil {
-		log.Fatal(err)
-	}
-
-	seal := outcome{syscallDispatcher: direct{}}
-	if err := seal.finalise(ctx, msg, &id, config); err != nil {
-		printMessageError("cannot seal app:", err)
-		os.Exit(1)
-	}
-
-	seal.main(msg)
-	panic("unreachable")
-}

internal/app/app_test.go

@@ -1,754 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"encoding/gob"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"log"
-	"os/exec"
-	"os/user"
-	"reflect"
-	"syscall"
-	"testing"
-	"time"
-
-	"hakurei.app/container"
-	"hakurei.app/container/bits"
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
-	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
-	"hakurei.app/message"
-	"hakurei.app/system"
-	"hakurei.app/system/acl"
-)
-
-func TestApp(t *testing.T) {
-	t.Parallel()
-	msg := message.NewMsg(nil)
-	msg.SwapVerbose(testing.Verbose())
-
-	testCases := []struct {
-		name       string
-		k          syscallDispatcher
-		config     *hst.Config
-		id         state.ID
-		wantSys    *system.I
-		wantParams *container.Params
-	}{
-		{
-			"nixos permissive defaults no enablements", new(stubNixOS),
-			&hst.Config{Container: &hst.ContainerConfig{
-				Userns: true, HostNet: true, HostAbstract: true, Tty: true,
-
-				Filesystem: []hst.FilesystemConfigJSON{
-					{FilesystemConfig: &hst.FSBind{
-						Target:  fhs.AbsRoot,
-						Source:  fhs.AbsRoot,
-						Write:   true,
-						Special: true,
-					}},
-					{FilesystemConfig: &hst.FSBind{
-						Source:   fhs.AbsDev.Append("kvm"),
-						Device:   true,
-						Optional: true,
-					}},
-					{FilesystemConfig: &hst.FSBind{
-						Target:  fhs.AbsEtc,
-						Source:  fhs.AbsEtc,
-						Special: true,
-					}},
-				},
-
-				Username: "chronos",
-				Shell:    m("/run/current-system/sw/bin/zsh"),
-				Home:     m("/home/chronos"),
-
-				Path: m("/run/current-system/sw/bin/zsh"),
-				Args: []string{"/run/current-system/sw/bin/zsh"},
-			}},
-			state.ID{
-				0x4a, 0x45, 0x0b, 0x65,
-				0x96, 0xd7, 0xbc, 0x15,
-				0xbd, 0x01, 0x78, 0x0e,
-				0xb9, 0xa6, 0x07, 0xac,
-			},
-			system.New(t.Context(), msg, 1000000).
-				Ensure(m("/tmp/hakurei.0"), 0711).
-				Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
-				Ensure(m("/tmp/hakurei.0/runtime/0"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read, acl.Write, acl.Execute).
-				Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
-				Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read, acl.Write, acl.Execute),
-			&container.Params{
-				Dir:  m("/home/chronos"),
-				Path: m("/run/current-system/sw/bin/zsh"),
-				Args: []string{"/run/current-system/sw/bin/zsh"},
-				Env: []string{
-					"HOME=/home/chronos",
-					"SHELL=/run/current-system/sw/bin/zsh",
-					"TERM=xterm-256color",
-					"USER=chronos",
-					"XDG_RUNTIME_DIR=/run/user/65534",
-					"XDG_SESSION_CLASS=user",
-					"XDG_SESSION_TYPE=tty",
-				},
-				Ops: new(container.Ops).
-					Root(m("/"), bits.BindWritable).
-					Proc(m("/proc/")).
-					Tmpfs(hst.AbsPrivateTmp, 4096, 0755).
-					DevWritable(m("/dev/"), true).
-					Tmpfs(m("/dev/shm"), 0, 01777).
-					Bind(m("/dev/kvm"), m("/dev/kvm"), bits.BindWritable|bits.BindDevice|bits.BindOptional).
-					Etc(m("/etc/"), "4a450b6596d7bc15bd01780eb9a607ac").
-					Tmpfs(m("/run/user/1971"), 8192, 0755).
-					Tmpfs(m("/run/nscd"), 8192, 0755).
-					Tmpfs(m("/run/dbus"), 8192, 0755).
-					Remount(m("/dev/"), syscall.MS_RDONLY).
-					Tmpfs(m("/run/user/"), 4096, 0755).
-					Bind(m("/tmp/hakurei.0/runtime/0"), m("/run/user/65534"), bits.BindWritable).
-					Bind(m("/tmp/hakurei.0/tmpdir/0"), m("/tmp/"), bits.BindWritable).
-					Place(m("/etc/passwd"), []byte("chronos:x:65534:65534:Hakurei:/home/chronos:/run/current-system/sw/bin/zsh\n")).
-					Place(m("/etc/group"), []byte("hakurei:x:65534:\n")).
-					Remount(m("/"), syscall.MS_RDONLY),
-				SeccompPresets: bits.PresetExt | bits.PresetDenyDevel,
-				HostNet:        true,
-				HostAbstract:   true,
-				RetainSession:  true,
-				ForwardCancel:  true,
-			},
-		},
-		{
-			"nixos permissive defaults chromium", new(stubNixOS),
-			&hst.Config{
-				ID:       "org.chromium.Chromium",
-				Identity: 9,
-				Groups:   []string{"video"},
-				SessionBus: &hst.BusConfig{
-					Talk: []string{
-						"org.freedesktop.Notifications",
-						"org.freedesktop.FileManager1",
-						"org.freedesktop.ScreenSaver",
-						"org.freedesktop.secrets",
-						"org.kde.kwalletd5",
-						"org.kde.kwalletd6",
-						"org.gnome.SessionManager",
-					},
-					Own: []string{
-						"org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.chromium.*",
-					},
-					Call: map[string]string{
-						"org.freedesktop.portal.*": "*",
-					},
-					Broadcast: map[string]string{
-						"org.freedesktop.portal.*": "@/org/freedesktop/portal/*",
-					},
-					Filter: true,
-				},
-				SystemBus: &hst.BusConfig{
-					Talk: []string{
-						"org.bluez",
-						"org.freedesktop.Avahi",
-						"org.freedesktop.UPower",
-					},
-					Filter: true,
-				},
-				Enablements: hst.NewEnablements(hst.EWayland | hst.EDBus | hst.EPulse),
-
-				Container: &hst.ContainerConfig{
-					Userns: true, HostNet: true, HostAbstract: true, Tty: true,
-
-					Filesystem: []hst.FilesystemConfigJSON{
-						{FilesystemConfig: &hst.FSBind{
-							Target:  fhs.AbsRoot,
-							Source:  fhs.AbsRoot,
-							Write:   true,
-							Special: true,
-						}},
-						{FilesystemConfig: &hst.FSBind{
-							Source:   fhs.AbsDev.Append("dri"),
-							Device:   true,
-							Optional: true,
-						}},
-						{FilesystemConfig: &hst.FSBind{
-							Source:   fhs.AbsDev.Append("kvm"),
-							Device:   true,
-							Optional: true,
-						}},
-						{FilesystemConfig: &hst.FSBind{
-							Target:  fhs.AbsEtc,
-							Source:  fhs.AbsEtc,
-							Special: true,
-						}},
-					},
-
-					Username: "chronos",
-					Shell:    m("/run/current-system/sw/bin/zsh"),
-					Home:     m("/home/chronos"),
-
-					Path: m("/run/current-system/sw/bin/zsh"),
-					Args: []string{"zsh", "-c", "exec chromium "},
-				},
-			},
-			state.ID{
-				0xeb, 0xf0, 0x83, 0xd1,
-				0xb1, 0x75, 0x91, 0x17,
-				0x82, 0xd4, 0x13, 0x36,
-				0x9b, 0x64, 0xce, 0x7c,
-			},
-			system.New(t.Context(), msg, 1000009).
-				Ensure(m("/tmp/hakurei.0"), 0711).
-				Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
-				Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute).
-				Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
-				Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute).
-				Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711).
-				Wayland(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
-				Ensure(m("/run/user/1971/hakurei"), 0700).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
-				Ensure(m("/run/user/1971"), 0700).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
-				Ephemeral(system.Process, m("/run/user/1971/hakurei/ebf083d1b175911782d413369b64ce7c"), 0700).UpdatePermType(system.Process, m("/run/user/1971/hakurei/ebf083d1b175911782d413369b64ce7c"), acl.Execute).
-				Link(m("/run/user/1971/pulse/native"), m("/run/user/1971/hakurei/ebf083d1b175911782d413369b64ce7c/pulse")).
-				MustProxyDBus(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), &hst.BusConfig{
-					Talk: []string{
-						"org.freedesktop.Notifications",
-						"org.freedesktop.FileManager1",
-						"org.freedesktop.ScreenSaver",
-						"org.freedesktop.secrets",
-						"org.kde.kwalletd5",
-						"org.kde.kwalletd6",
-						"org.gnome.SessionManager",
-					},
-					Own: []string{
-						"org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.chromium.*",
-					},
-					Call: map[string]string{
-						"org.freedesktop.portal.*": "*",
-					},
-					Broadcast: map[string]string{
-						"org.freedesktop.portal.*": "@/org/freedesktop/portal/*",
-					},
-					Filter: true,
-				}, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), &hst.BusConfig{
-					Talk: []string{
-						"org.bluez",
-						"org.freedesktop.Avahi",
-						"org.freedesktop.UPower",
-					},
-					Filter: true,
-				}).
-				UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), acl.Read, acl.Write).
-				UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), acl.Read, acl.Write),
-			&container.Params{
-				Dir:  m("/home/chronos"),
-				Path: m("/run/current-system/sw/bin/zsh"),
-				Args: []string{"zsh", "-c", "exec chromium "},
-				Env: []string{
-					"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus",
-					"DBUS_SYSTEM_BUS_ADDRESS=unix:path=/var/run/dbus/system_bus_socket",
-					"HOME=/home/chronos",
-					"PULSE_COOKIE=" + hst.PrivateTmp + "/pulse-cookie",
-					"PULSE_SERVER=unix:/run/user/65534/pulse/native",
-					"SHELL=/run/current-system/sw/bin/zsh",
-					"TERM=xterm-256color",
-					"USER=chronos",
-					"WAYLAND_DISPLAY=wayland-0",
-					"XDG_RUNTIME_DIR=/run/user/65534",
-					"XDG_SESSION_CLASS=user",
-					"XDG_SESSION_TYPE=tty",
-				},
-				Ops: new(container.Ops).
-					Root(m("/"), bits.BindWritable).
-					Proc(m("/proc/")).
-					Tmpfs(hst.AbsPrivateTmp, 4096, 0755).
-					DevWritable(m("/dev/"), true).
-					Tmpfs(m("/dev/shm"), 0, 01777).
-					Bind(m("/dev/dri"), m("/dev/dri"), bits.BindWritable|bits.BindDevice|bits.BindOptional).
-					Bind(m("/dev/kvm"), m("/dev/kvm"), bits.BindWritable|bits.BindDevice|bits.BindOptional).
-					Etc(m("/etc/"), "ebf083d1b175911782d413369b64ce7c").
-					Tmpfs(m("/run/user/1971"), 8192, 0755).
-					Tmpfs(m("/run/nscd"), 8192, 0755).
-					Tmpfs(m("/run/dbus"), 8192, 0755).
-					Remount(m("/dev/"), syscall.MS_RDONLY).
-					Tmpfs(m("/run/user/"), 4096, 0755).
-					Bind(m("/tmp/hakurei.0/runtime/9"), m("/run/user/65534"), bits.BindWritable).
-					Bind(m("/tmp/hakurei.0/tmpdir/9"), m("/tmp/"), bits.BindWritable).
-					Place(m("/etc/passwd"), []byte("chronos:x:65534:65534:Hakurei:/home/chronos:/run/current-system/sw/bin/zsh\n")).
-					Place(m("/etc/group"), []byte("hakurei:x:65534:\n")).
-					Bind(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/65534/wayland-0"), 0).
-					Bind(m("/run/user/1971/hakurei/ebf083d1b175911782d413369b64ce7c/pulse"), m("/run/user/65534/pulse/native"), 0).
-					Place(m(hst.PrivateTmp+"/pulse-cookie"), bytes.Repeat([]byte{0}, pulseCookieSizeMax)).
-					Bind(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), m("/run/user/65534/bus"), 0).
-					Bind(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), m("/var/run/dbus/system_bus_socket"), 0).
-					Remount(m("/"), syscall.MS_RDONLY),
-				SeccompPresets: bits.PresetExt | bits.PresetDenyDevel,
-				HostNet:        true,
-				HostAbstract:   true,
-				RetainSession:  true,
-				ForwardCancel:  true,
-			},
-		},
-
-		{
-			"nixos chromium direct wayland", new(stubNixOS),
-			&hst.Config{
-				ID:          "org.chromium.Chromium",
-				Enablements: hst.NewEnablements(hst.EWayland | hst.EDBus | hst.EPulse),
-				Container: &hst.ContainerConfig{
-					Userns: true, HostNet: true, MapRealUID: true, Env: nil,
-					Filesystem: []hst.FilesystemConfigJSON{
-						f(&hst.FSBind{Source: m("/bin")}),
-						f(&hst.FSBind{Source: m("/usr/bin/")}),
-						f(&hst.FSBind{Source: m("/nix/store")}),
-						f(&hst.FSBind{Source: m("/run/current-system")}),
-						f(&hst.FSBind{Source: m("/sys/block"), Optional: true}),
-						f(&hst.FSBind{Source: m("/sys/bus"), Optional: true}),
-						f(&hst.FSBind{Source: m("/sys/class"), Optional: true}),
-						f(&hst.FSBind{Source: m("/sys/dev"), Optional: true}),
-						f(&hst.FSBind{Source: m("/sys/devices"), Optional: true}),
-						f(&hst.FSBind{Source: m("/run/opengl-driver")}),
-						f(&hst.FSBind{Source: m("/dev/dri"), Device: true, Optional: true}),
-						f(&hst.FSBind{Source: m("/etc/"), Target: m("/etc/"), Special: true}),
-						f(&hst.FSBind{Source: m("/var/lib/persist/module/hakurei/0/1"), Write: true, Ensure: true}),
-					},
-
-					Username: "u0_a1",
-					Shell:    m("/run/current-system/sw/bin/zsh"),
-					Home:     m("/var/lib/persist/module/hakurei/0/1"),
-
-					Path: m("/nix/store/yqivzpzzn7z5x0lq9hmbzygh45d8rhqd-chromium-start"),
-				},
-				SystemBus: &hst.BusConfig{
-					Talk:   []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"},
-					Filter: true,
-				},
-				SessionBus: &hst.BusConfig{
-					Talk: []string{
-						"org.freedesktop.FileManager1", "org.freedesktop.Notifications",
-						"org.freedesktop.ScreenSaver", "org.freedesktop.secrets",
-						"org.kde.kwalletd5", "org.kde.kwalletd6",
-					},
-					Own: []string{
-						"org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.chromium.*",
-					},
-					Call: map[string]string{}, Broadcast: map[string]string{},
-					Filter: true,
-				},
-				DirectWayland: true,
-
-				Identity: 1, Groups: []string{},
-			},
-			state.ID{
-				0x8e, 0x2c, 0x76, 0xb0,
-				0x66, 0xda, 0xbe, 0x57,
-				0x4c, 0xf0, 0x73, 0xbd,
-				0xb4, 0x6e, 0xb5, 0xc1,
-			},
-			system.New(t.Context(), msg, 1000001).
-				Ensure(m("/tmp/hakurei.0"), 0711).
-				Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
-				Ensure(m("/tmp/hakurei.0/runtime/1"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read, acl.Write, acl.Execute).
-				Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
-				Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read, acl.Write, acl.Execute).
-				Ensure(m("/run/user/1971/hakurei"), 0700).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
-				Ensure(m("/run/user/1971"), 0700).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
-				UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read, acl.Write, acl.Execute).
-				Ephemeral(system.Process, m("/run/user/1971/hakurei/8e2c76b066dabe574cf073bdb46eb5c1"), 0700).UpdatePermType(system.Process, m("/run/user/1971/hakurei/8e2c76b066dabe574cf073bdb46eb5c1"), acl.Execute).
-				Link(m("/run/user/1971/pulse/native"), m("/run/user/1971/hakurei/8e2c76b066dabe574cf073bdb46eb5c1/pulse")).
-				Ephemeral(system.Process, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1"), 0711).
-				MustProxyDBus(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), &hst.BusConfig{
-					Talk: []string{
-						"org.freedesktop.FileManager1", "org.freedesktop.Notifications",
-						"org.freedesktop.ScreenSaver", "org.freedesktop.secrets",
-						"org.kde.kwalletd5", "org.kde.kwalletd6",
-					},
-					Own: []string{
-						"org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-						"org.mpris.MediaPlayer2.chromium.*",
-					},
-					Call: map[string]string{}, Broadcast: map[string]string{},
-					Filter: true,
-				}, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), &hst.BusConfig{
-					Talk: []string{
-						"org.bluez",
-						"org.freedesktop.Avahi",
-						"org.freedesktop.UPower",
-					},
-					Filter: true,
-				}).
-				UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), acl.Read, acl.Write).
-				UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), acl.Read, acl.Write),
-			&container.Params{
-				Uid:  1971,
-				Gid:  100,
-				Dir:  m("/var/lib/persist/module/hakurei/0/1"),
-				Path: m("/nix/store/yqivzpzzn7z5x0lq9hmbzygh45d8rhqd-chromium-start"),
-				Args: []string{"/nix/store/yqivzpzzn7z5x0lq9hmbzygh45d8rhqd-chromium-start"},
-				Env: []string{
-					"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1971/bus",
-					"DBUS_SYSTEM_BUS_ADDRESS=unix:path=/var/run/dbus/system_bus_socket",
-					"HOME=/var/lib/persist/module/hakurei/0/1",
-					"PULSE_COOKIE=" + hst.PrivateTmp + "/pulse-cookie",
-					"PULSE_SERVER=unix:/run/user/1971/pulse/native",
-					"SHELL=/run/current-system/sw/bin/zsh",
-					"TERM=xterm-256color",
-					"USER=u0_a1",
-					"WAYLAND_DISPLAY=wayland-0",
-					"XDG_RUNTIME_DIR=/run/user/1971",
-					"XDG_SESSION_CLASS=user",
-					"XDG_SESSION_TYPE=tty",
-				},
-				Ops: new(container.Ops).
-					Proc(m("/proc/")).
-					Tmpfs(hst.AbsPrivateTmp, 4096, 0755).
-					DevWritable(m("/dev/"), true).
-					Tmpfs(m("/dev/shm"), 0, 01777).
-					Bind(m("/bin"), m("/bin"), 0).
-					Bind(m("/usr/bin/"), m("/usr/bin/"), 0).
-					Bind(m("/nix/store"), m("/nix/store"), 0).
-					Bind(m("/run/current-system"), m("/run/current-system"), 0).
-					Bind(m("/sys/block"), m("/sys/block"), bits.BindOptional).
-					Bind(m("/sys/bus"), m("/sys/bus"), bits.BindOptional).
-					Bind(m("/sys/class"), m("/sys/class"), bits.BindOptional).
-					Bind(m("/sys/dev"), m("/sys/dev"), bits.BindOptional).
-					Bind(m("/sys/devices"), m("/sys/devices"), bits.BindOptional).
-					Bind(m("/run/opengl-driver"), m("/run/opengl-driver"), 0).
-					Bind(m("/dev/dri"), m("/dev/dri"), bits.BindDevice|bits.BindWritable|bits.BindOptional).
-					Etc(m("/etc/"), "8e2c76b066dabe574cf073bdb46eb5c1").
-					Bind(m("/var/lib/persist/module/hakurei/0/1"), m("/var/lib/persist/module/hakurei/0/1"), bits.BindWritable|bits.BindEnsure).
-					Remount(m("/dev/"), syscall.MS_RDONLY).
-					Tmpfs(m("/run/user/"), 4096, 0755).
-					Bind(m("/tmp/hakurei.0/runtime/1"), m("/run/user/1971"), bits.BindWritable).
-					Bind(m("/tmp/hakurei.0/tmpdir/1"), m("/tmp/"), bits.BindWritable).
-					Place(m("/etc/passwd"), []byte("u0_a1:x:1971:100:Hakurei:/var/lib/persist/module/hakurei/0/1:/run/current-system/sw/bin/zsh\n")).
-					Place(m("/etc/group"), []byte("hakurei:x:100:\n")).
-					Bind(m("/run/user/1971/wayland-0"), m("/run/user/1971/wayland-0"), 0).
-					Bind(m("/run/user/1971/hakurei/8e2c76b066dabe574cf073bdb46eb5c1/pulse"), m("/run/user/1971/pulse/native"), 0).
-					Place(m(hst.PrivateTmp+"/pulse-cookie"), bytes.Repeat([]byte{0}, pulseCookieSizeMax)).
-					Bind(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), m("/run/user/1971/bus"), 0).
-					Bind(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), m("/var/run/dbus/system_bus_socket"), 0).
-					Remount(m("/"), syscall.MS_RDONLY),
-				SeccompPresets: bits.PresetExt | bits.PresetDenyTTY | bits.PresetDenyDevel,
-				HostNet:        true,
-				ForwardCancel:  true,
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			gr, gw := io.Pipe()
-
-			var gotSys *system.I
-			{
-				sPriv := newOutcomeState(tc.k, msg, &tc.id, tc.config, &Hsu{k: tc.k})
-				if err := sPriv.populateLocal(tc.k, msg); err != nil {
-					t.Fatalf("populateLocal: error = %#v", err)
-				}
-
-				gotSys = system.New(t.Context(), msg, sPriv.uid.unwrap())
-				if err := sPriv.newSys(tc.config, gotSys).toSystem(); err != nil {
-					t.Fatalf("toSystem: error = %#v", err)
-				}
-
-				go func() {
-					e := gob.NewEncoder(gw)
-					if err := errors.Join(e.Encode(&sPriv)); err != nil {
-						t.Errorf("Encode: error = %v", err)
-						panic("unexpected encode fault")
-					}
-				}()
-			}
-
-			var gotParams *container.Params
-			{
-				var sShim outcomeState
-
-				d := gob.NewDecoder(gr)
-				if err := errors.Join(d.Decode(&sShim)); err != nil {
-					t.Fatalf("Decode: error = %v", err)
-				}
-				if err := sShim.populateLocal(tc.k, msg); err != nil {
-					t.Fatalf("populateLocal: error = %#v", err)
-				}
-
-				stateParams := sShim.newParams()
-				for _, op := range sShim.Shim.Ops {
-					if err := op.toContainer(stateParams); err != nil {
-						t.Fatalf("toContainer: error = %#v", err)
-					}
-				}
-				gotParams = stateParams.params
-			}
-
-			t.Run("sys", func(t *testing.T) {
-				if !gotSys.Equal(tc.wantSys) {
-					t.Errorf("toSystem: sys = %#v, want %#v", gotSys, tc.wantSys)
-				}
-			})
-
-			t.Run("params", func(t *testing.T) {
-				if !reflect.DeepEqual(gotParams, tc.wantParams) {
-					t.Errorf("toContainer: params =\n%s\n, want\n%s", mustMarshal(gotParams), mustMarshal(tc.wantParams))
-				}
-			})
-		})
-	}
-}
-
-func mustMarshal(v any) string {
-	if b, err := json.Marshal(v); err != nil {
-		panic(err.Error())
-	} else {
-		return string(b)
-	}
-}
-
-func stubDirEntries(names ...string) (e []fs.DirEntry, err error) {
-	e = make([]fs.DirEntry, len(names))
-	for i, name := range names {
-		e[i] = stubDirEntryPath(name)
-	}
-	return
-}
-
-type stubDirEntryPath string
-
-func (p stubDirEntryPath) Name() string               { return string(p) }
-func (p stubDirEntryPath) IsDir() bool                { panic("attempted to call IsDir") }
-func (p stubDirEntryPath) Type() fs.FileMode          { panic("attempted to call Type") }
-func (p stubDirEntryPath) Info() (fs.FileInfo, error) { panic("attempted to call Info") }
-
-type stubFileInfoMode fs.FileMode
-
-func (s stubFileInfoMode) Name() string       { panic("attempted to call Name") }
-func (s stubFileInfoMode) Size() int64        { panic("attempted to call Size") }
-func (s stubFileInfoMode) Mode() fs.FileMode  { return fs.FileMode(s) }
-func (s stubFileInfoMode) ModTime() time.Time { panic("attempted to call ModTime") }
-func (s stubFileInfoMode) IsDir() bool        { panic("attempted to call IsDir") }
-func (s stubFileInfoMode) Sys() any           { panic("attempted to call Sys") }
-
-type stubFileInfoIsDir bool
-
-func (s stubFileInfoIsDir) Name() string       { panic("attempted to call Name") }
-func (s stubFileInfoIsDir) Size() int64        { panic("attempted to call Size") }
-func (s stubFileInfoIsDir) Mode() fs.FileMode  { panic("attempted to call Mode") }
-func (s stubFileInfoIsDir) ModTime() time.Time { panic("attempted to call ModTime") }
-func (s stubFileInfoIsDir) IsDir() bool        { return bool(s) }
-func (s stubFileInfoIsDir) Sys() any           { panic("attempted to call Sys") }
-
-type stubFileInfoPulseCookie struct{ stubFileInfoIsDir }
-
-func (s stubFileInfoPulseCookie) Size() int64 { return pulseCookieSizeMax }
-
-type stubOsFileReadCloser struct{ io.ReadCloser }
-
-func (s stubOsFileReadCloser) Name() string               { panic("attempting to call Name") }
-func (s stubOsFileReadCloser) Write([]byte) (int, error)  { panic("attempting to call Write") }
-func (s stubOsFileReadCloser) Stat() (fs.FileInfo, error) { panic("attempting to call Stat") }
-
-type stubNixOS struct {
-	usernameErr map[string]error
-}
-
-func (k *stubNixOS) new(func(k syscallDispatcher)) { panic("not implemented") }
-
-func (k *stubNixOS) getpid() int { return 0xdeadbeef }
-func (k *stubNixOS) getuid() int { return 1971 }
-func (k *stubNixOS) getgid() int { return 100 }
-
-func (k *stubNixOS) lookupEnv(key string) (string, bool) {
-	switch key {
-	case "SHELL":
-		return "/run/current-system/sw/bin/zsh", true
-	case "TERM":
-		return "xterm-256color", true
-	case "WAYLAND_DISPLAY":
-		return "wayland-0", true
-	case "PULSE_COOKIE":
-		return "", false
-	case "HOME":
-		return "/home/ophestra", true
-	case "XDG_RUNTIME_DIR":
-		return "/run/user/1971", true
-	case "XDG_CONFIG_HOME":
-		return "/home/ophestra/xdg/config", true
-	case "DBUS_SYSTEM_BUS_ADDRESS":
-		return "", false
-	default:
-		panic(fmt.Sprintf("attempted to access unexpected environment variable %q", key))
-	}
-}
-
-func (k *stubNixOS) stat(name string) (fs.FileInfo, error) {
-	switch name {
-	case "/var/run/nscd":
-		return nil, nil
-	case "/run/user/1971/pulse":
-		return nil, nil
-	case "/run/user/1971/pulse/native":
-		return stubFileInfoMode(0666), nil
-	case "/home/ophestra/.pulse-cookie":
-		return stubFileInfoIsDir(true), nil
-	case "/home/ophestra/xdg/config/pulse/cookie":
-		return stubFileInfoPulseCookie{false}, nil
-	default:
-		panic(fmt.Sprintf("attempted to stat unexpected path %q", name))
-	}
-}
-
-func (k *stubNixOS) open(name string) (osFile, error) {
-	switch name {
-	case "/home/ophestra/xdg/config/pulse/cookie":
-		return stubOsFileReadCloser{io.NopCloser(bytes.NewReader(bytes.Repeat([]byte{0}, pulseCookieSizeMax)))}, nil
-	default:
-		panic(fmt.Sprintf("attempted to open unexpected path %q", name))
-	}
-}
-
-func (k *stubNixOS) readdir(name string) ([]fs.DirEntry, error) {
-	switch name {
-	case "/":
-		return stubDirEntries("bin", "boot", "dev", "etc", "home", "lib",
-			"lib64", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var")
-
-	case "/run":
-		return stubDirEntries("agetty.reload", "binfmt", "booted-system",
-			"credentials", "cryptsetup", "current-system", "dbus", "host", "keys",
-			"libvirt", "libvirtd.pid", "lock", "log", "lvm", "mount", "NetworkManager",
-			"nginx", "nixos", "nscd", "opengl-driver", "pppd", "resolvconf", "sddm",
-			"store", "syncoid", "system", "systemd", "tmpfiles.d", "udev", "udisks2",
-			"user", "utmp", "virtlogd.pid", "wrappers", "zed.pid", "zed.state")
-
-	case "/etc":
-		return stubDirEntries("alsa", "bashrc", "binfmt.d", "dbus-1", "default",
-			"ethertypes", "fonts", "fstab", "fuse.conf", "group", "host.conf", "hostid",
-			"hostname", "hostname.CHECKSUM", "hosts", "inputrc", "ipsec.d", "issue", "kbd",
-			"libblockdev", "locale.conf", "localtime", "login.defs", "lsb-release", "lvm",
-			"machine-id", "man_db.conf", "modprobe.d", "modules-load.d", "mtab", "nanorc",
-			"netgroup", "NetworkManager", "nix", "nixos", "NIXOS", "nscd.conf", "nsswitch.conf",
-			"opensnitchd", "os-release", "pam", "pam.d", "passwd", "pipewire", "pki", "polkit-1",
-			"profile", "protocols", "qemu", "resolv.conf", "resolvconf.conf", "rpc", "samba",
-			"sddm.conf", "secureboot", "services", "set-environment", "shadow", "shells", "ssh",
-			"ssl", "static", "subgid", "subuid", "sudoers", "sysctl.d", "systemd", "terminfo",
-			"tmpfiles.d", "udev", "udisks2", "UPower", "vconsole.conf", "X11", "zfs", "zinputrc",
-			"zoneinfo", "zprofile", "zshenv", "zshrc")
-
-	default:
-		panic(fmt.Sprintf("attempted to read unexpected directory %q", name))
-	}
-}
-
-func (k *stubNixOS) tempdir() string { return "/tmp/" }
-
-func (k *stubNixOS) evalSymlinks(path string) (string, error) {
-	switch path {
-	case "/var/run/nscd":
-		return "/run/nscd", nil
-	case "/run/user/1971":
-		return "/run/user/1971", nil
-	case "/tmp/hakurei.0":
-		return "/tmp/hakurei.0", nil
-	case "/var/run/dbus":
-		return "/run/dbus", nil
-	case "/dev/kvm":
-		return "/dev/kvm", nil
-	case "/etc/":
-		return "/etc/", nil
-	case "/bin":
-		return "/bin", nil
-	case "/boot":
-		return "/boot", nil
-	case "/home":
-		return "/home", nil
-	case "/lib":
-		return "/lib", nil
-	case "/lib64":
-		return "/lib64", nil
-	case "/nix":
-		return "/nix", nil
-	case "/root":
-		return "/root", nil
-	case "/run":
-		return "/run", nil
-	case "/srv":
-		return "/srv", nil
-	case "/sys":
-		return "/sys", nil
-	case "/usr":
-		return "/usr", nil
-	case "/var":
-		return "/var", nil
-	case "/dev/dri":
-		return "/dev/dri", nil
-	case "/usr/bin/":
-		return "/usr/bin/", nil
-	case "/nix/store":
-		return "/nix/store", nil
-	case "/run/current-system":
-		return "/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-nixos-system-satori-25.05.99999999.aaaaaaa", nil
-	case "/sys/block":
-		return "/sys/block", nil
-	case "/sys/bus":
-		return "/sys/bus", nil
-	case "/sys/class":
-		return "/sys/class", nil
-	case "/sys/dev":
-		return "/sys/dev", nil
-	case "/sys/devices":
-		return "/sys/devices", nil
-	case "/run/opengl-driver":
-		return "/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-graphics-drivers", nil
-	case "/var/lib/persist/module/hakurei/0/1":
-		return "/var/lib/persist/module/hakurei/0/1", nil
-	default:
-		panic(fmt.Sprintf("attempted to evaluate unexpected path %q", path))
-	}
-}
-
-func (k *stubNixOS) lookupGroupId(name string) (string, error) {
-	switch name {
-	case "video":
-		return "26", nil
-	default:
-		return "", user.UnknownGroupError(name)
-	}
-}
-
-func (k *stubNixOS) cmdOutput(cmd *exec.Cmd) ([]byte, error) {
-	switch cmd.Path {
-	case "/proc/nonexistent/hsu":
-		return []byte{'0'}, nil
-	default:
-		panic(fmt.Sprintf("unexpected cmd %#v", cmd))
-	}
-}
-
-func (k *stubNixOS) overflowUid(message.Msg) int { return 65534 }
-func (k *stubNixOS) overflowGid(message.Msg) int { return 65534 }
-
-func (k *stubNixOS) mustHsuPath() *check.Absolute { return m("/proc/nonexistent/hsu") }
-
-func (k *stubNixOS) fatalf(format string, v ...any) { panic(fmt.Sprintf(format, v...)) }
-
-func (k *stubNixOS) isVerbose() bool                  { return true }
-func (k *stubNixOS) verbose(v ...any)                 { log.Print(v...) }
-func (k *stubNixOS) verbosef(format string, v ...any) { log.Printf(format, v...) }
-
-func m(pathname string) *check.Absolute {
-	return check.MustAbs(pathname)
-}
-
-func f(c hst.FilesystemConfig) hst.FilesystemConfigJSON {
-	return hst.FilesystemConfigJSON{FilesystemConfig: c}
-}

internal/app/dispatcher.go

@@ -1,102 +0,0 @@
-package app
-
-import (
-	"io"
-	"io/fs"
-	"log"
-	"os"
-	"os/exec"
-	"os/user"
-	"path/filepath"
-
-	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/internal"
-	"hakurei.app/message"
-)
-
-// osFile represents [os.File].
-type osFile interface {
-	Name() string
-	io.Writer
-	fs.File
-}
-
-// syscallDispatcher provides methods that make state-dependent system calls as part of their behaviour.
-type syscallDispatcher interface {
-	// new starts a goroutine with a new instance of syscallDispatcher.
-	// A syscallDispatcher must never be used in any goroutine other than the one owning it,
-	// just synchronising access is not enough, as this is for test instrumentation.
-	new(f func(k syscallDispatcher))
-
-	// getpid provides [os.Getpid].
-	getpid() int
-	// getuid provides [os.Getuid].
-	getuid() int
-	// getgid provides [os.Getgid].
-	getgid() int
-	// lookupEnv provides [os.LookupEnv].
-	lookupEnv(key string) (string, bool)
-	// stat provides [os.Stat].
-	stat(name string) (os.FileInfo, error)
-	// open provides [os.Open].
-	open(name string) (osFile, error)
-	// readdir provides [os.ReadDir].
-	readdir(name string) ([]os.DirEntry, error)
-	// tempdir provides [os.TempDir].
-	tempdir() string
-
-	// evalSymlinks provides [filepath.EvalSymlinks].
-	evalSymlinks(path string) (string, error)
-
-	// lookupGroupId calls [user.LookupGroup] and returns the Gid field of the resulting [user.Group] struct.
-	lookupGroupId(name string) (string, error)
-
-	// cmdOutput provides the Output method of [exec.Cmd].
-	cmdOutput(cmd *exec.Cmd) ([]byte, error)
-
-	// overflowUid provides [container.OverflowUid].
-	overflowUid(msg message.Msg) int
-	// overflowGid provides [container.OverflowGid].
-	overflowGid(msg message.Msg) int
-
-	// mustHsuPath provides [internal.MustHsuPath].
-	mustHsuPath() *check.Absolute
-
-	// fatalf provides [log.Fatalf].
-	fatalf(format string, v ...any)
-}
-
-// direct implements syscallDispatcher on the current kernel.
-type direct struct{}
-
-func (k direct) new(f func(k syscallDispatcher)) { go f(k) }
-
-func (direct) getpid() int                                { return os.Getpid() }
-func (direct) getuid() int                                { return os.Getuid() }
-func (direct) getgid() int                                { return os.Getgid() }
-func (direct) lookupEnv(key string) (string, bool)        { return os.LookupEnv(key) }
-func (direct) stat(name string) (os.FileInfo, error)      { return os.Stat(name) }
-func (direct) open(name string) (osFile, error)           { return os.Open(name) }
-func (direct) readdir(name string) ([]os.DirEntry, error) { return os.ReadDir(name) }
-func (direct) tempdir() string                            { return os.TempDir() }
-
-func (direct) evalSymlinks(path string) (string, error) { return filepath.EvalSymlinks(path) }
-
-func (direct) lookupGroupId(name string) (gid string, err error) {
-	var group *user.Group
-	group, err = user.LookupGroup(name)
-	if group != nil {
-		gid = group.Gid
-	}
-	return
-}
-
-func (direct) cmdOutput(cmd *exec.Cmd) ([]byte, error) { return cmd.Output() }
-
-func (direct) overflowUid(msg message.Msg) int { return container.OverflowUid(msg) }
-func (direct) overflowGid(msg message.Msg) int { return container.OverflowGid(msg) }
-
-func (direct) mustHsuPath() *check.Absolute { return internal.MustHsuPath() }
-
-func (direct) fatalf(format string, v ...any) { log.Fatalf(format, v...) }

internal/app/dispatcher_test.go

@@ -1,323 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"io/fs"
-	"log"
-	"os"
-	"os/exec"
-	"reflect"
-	"slices"
-	"testing"
-	"time"
-
-	"hakurei.app/container"
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
-	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
-	"hakurei.app/message"
-	"hakurei.app/system"
-)
-
-// call initialises a [stub.Call].
-// This keeps composites analysis happy without making the test cases too bloated.
-func call(name string, args stub.ExpectArgs, ret any, err error) stub.Call {
-	return stub.Call{Name: name, Args: args, Ret: ret, Err: err}
-}
-
-// checkExpectUid is the uid value used by checkOpBehaviour to initialise [system.I].
-const checkExpectUid = 0xcafebabe
-
-// wantAutoEtcPrefix is the autoetc prefix corresponding to checkExpectInstanceId.
-const wantAutoEtcPrefix = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-
-// checkExpectInstanceId is the [state.ID] value used by checkOpBehaviour to initialise outcomeState.
-var checkExpectInstanceId = *(*state.ID)(bytes.Repeat([]byte{0xaa}, len(state.ID{})))
-
-type opBehaviourTestCase struct {
-	name      string
-	newOp     func(isShim, clearUnexported bool) outcomeOp
-	newConfig func() *hst.Config
-
-	pStateSys     func(state *outcomeStateSys)
-	toSystem      []stub.Call
-	wantSys       *system.I
-	extraCheckSys func(t *testing.T, state *outcomeStateSys)
-	wantErrSystem error
-
-	pStateContainer  func(state *outcomeStateParams)
-	toContainer      []stub.Call
-	wantParams       *container.Params
-	extraCheckParams func(t *testing.T, state *outcomeStateParams)
-	wantErrContainer error
-}
-
-func checkOpBehaviour(t *testing.T, testCases []opBehaviourTestCase) {
-	t.Helper()
-
-	wantNewState := []stub.Call{
-		// newOutcomeState
-		call("getpid", stub.ExpectArgs{}, 0xdead, nil),
-		call("isVerbose", stub.ExpectArgs{}, true, nil),
-		call("mustHsuPath", stub.ExpectArgs{}, m(container.Nonexistent), nil),
-		call("cmdOutput", stub.ExpectArgs{container.Nonexistent, os.Stderr, []string{}, "/"}, []byte("0"), nil),
-		call("tempdir", stub.ExpectArgs{}, container.Nonexistent+"/tmp", nil),
-		call("lookupEnv", stub.ExpectArgs{"XDG_RUNTIME_DIR"}, container.Nonexistent+"/xdg_runtime_dir", nil),
-		call("getuid", stub.ExpectArgs{}, 1000, nil),
-		call("getgid", stub.ExpectArgs{}, 100, nil),
-
-		// populateLocal
-		call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{
-			m(container.Nonexistent + "/tmp/hakurei.0"),
-			m(container.Nonexistent + "/xdg_runtime_dir/hakurei"),
-		}}, nil, nil),
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Helper()
-			t.Parallel()
-
-			wantCallsFull := slices.Concat(wantNewState, tc.toSystem, []stub.Call{{Name: stub.CallSeparator}})
-			if tc.wantErrSystem == nil {
-				wantCallsFull = append(wantCallsFull, slices.Concat(wantNewState, tc.toContainer)...)
-			}
-
-			wantConfig := tc.newConfig()
-			k := &kstub{panicDispatcher{}, stub.New(t,
-				func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{panicDispatcher{}, s} },
-				stub.Expect{Calls: wantCallsFull},
-			)}
-			defer stub.HandleExit(t)
-
-			{
-				config := tc.newConfig()
-				s := newOutcomeState(k, k, &checkExpectInstanceId, config, &Hsu{k: k})
-				if err := s.populateLocal(k, k); err != nil {
-					t.Fatalf("populateLocal: error = %v", err)
-				}
-				stateSys := s.newSys(config, newI())
-				if tc.pStateSys != nil {
-					tc.pStateSys(stateSys)
-				}
-				op := tc.newOp(false, true)
-
-				if err := op.toSystem(stateSys); !reflect.DeepEqual(err, tc.wantErrSystem) {
-					t.Fatalf("toSystem: error = %#v, want %#v", err, tc.wantErrSystem)
-				}
-				k.Expects(stub.CallSeparator)
-				if !reflect.DeepEqual(config, wantConfig) {
-					t.Errorf("toSystem clobbered config: %#v, want %#v", config, wantConfig)
-				}
-
-				if tc.wantErrSystem != nil {
-					goto out
-				}
-
-				if !stateSys.sys.Equal(tc.wantSys) {
-					t.Errorf("toSystem: %#v, want %#v", stateSys.sys, tc.wantSys)
-				}
-				if tc.extraCheckSys != nil {
-					tc.extraCheckSys(t, stateSys)
-				}
-				if wantOpSys := tc.newOp(true, false); !reflect.DeepEqual(op, wantOpSys) {
-					t.Errorf("toSystem: op = %#v, want %#v", op, wantOpSys)
-				}
-			}
-
-			{
-				config := tc.newConfig()
-				s := newOutcomeState(k, k, &checkExpectInstanceId, config, &Hsu{k: k})
-				stateParams := s.newParams()
-				if err := s.populateLocal(k, k); err != nil {
-					t.Fatalf("populateLocal: error = %v", err)
-				}
-				if tc.pStateContainer != nil {
-					tc.pStateContainer(stateParams)
-				}
-				op := tc.newOp(true, true)
-
-				if err := op.toContainer(stateParams); !reflect.DeepEqual(err, tc.wantErrContainer) {
-					t.Fatalf("toContainer: error = %#v, want %#v", err, tc.wantErrContainer)
-				}
-
-				if tc.wantErrContainer != nil {
-					goto out
-				}
-
-				if !reflect.DeepEqual(stateParams.params, tc.wantParams) {
-					t.Errorf("toContainer:\n%s\nwant\n%s", mustMarshal(stateParams.params), mustMarshal(tc.wantParams))
-				}
-				if tc.extraCheckParams != nil {
-					tc.extraCheckParams(t, stateParams)
-				}
-			}
-
-		out:
-			k.VisitIncomplete(func(s *stub.Stub[syscallDispatcher]) {
-				count := k.Pos() - 1 // separator
-				if count-len(wantNewState) < len(tc.toSystem) {
-					t.Errorf("toSystem: %d calls, want %d", count-len(wantNewState), len(tc.toSystem))
-				} else {
-					t.Errorf("toContainer: %d calls, want %d", count-len(tc.toSystem)-2*len(wantNewState), len(tc.toContainer))
-				}
-			})
-		})
-	}
-}
-
-func newI() *system.I { return system.New(panicMsgContext{}, panicMsgContext{}, checkExpectUid) }
-
-type kstub struct {
-	panicDispatcher
-	*stub.Stub[syscallDispatcher]
-}
-
-func (k *kstub) getpid() int { k.Helper(); return k.Expects("getpid").Ret.(int) }
-func (k *kstub) getuid() int { k.Helper(); return k.Expects("getuid").Ret.(int) }
-func (k *kstub) getgid() int { k.Helper(); return k.Expects("getgid").Ret.(int) }
-func (k *kstub) lookupEnv(key string) (string, bool) {
-	k.Helper()
-	expect := k.Expects("lookupEnv")
-	if expect.Error(
-		stub.CheckArg(k.Stub, "key", key, 0)) != nil {
-		k.FailNow()
-	}
-	if expect.Ret == nil {
-		return "\x00", false
-	}
-	return expect.Ret.(string), true
-}
-func (k *kstub) readdir(name string) ([]os.DirEntry, error) {
-	k.Helper()
-	expect := k.Expects("readdir")
-	return expect.Ret.([]os.DirEntry), expect.Error(
-		stub.CheckArg(k.Stub, "name", name, 0))
-}
-func (k *kstub) tempdir() string { k.Helper(); return k.Expects("tempdir").Ret.(string) }
-func (k *kstub) evalSymlinks(path string) (string, error) {
-	k.Helper()
-	expect := k.Expects("evalSymlinks")
-	return expect.Ret.(string), expect.Error(
-		stub.CheckArg(k.Stub, "path", path, 0))
-}
-
-func (k *kstub) cmdOutput(cmd *exec.Cmd) ([]byte, error) {
-	k.Helper()
-	expect := k.Expects("cmdOutput")
-	return expect.Ret.([]byte), expect.Error(
-		stub.CheckArg(k.Stub, "cmd.Path", cmd.Path, 0),
-		stub.CheckArgReflect(k.Stub, "cmd.Stderr", cmd.Stderr, 1),
-		stub.CheckArgReflect(k.Stub, "cmd.Env", cmd.Env, 2),
-		stub.CheckArg(k.Stub, "cmd.Dir", cmd.Dir, 3))
-}
-
-func (k *kstub) mustHsuPath() *check.Absolute {
-	k.Helper()
-	return k.Expects("mustHsuPath").Ret.(*check.Absolute)
-}
-
-func (k *kstub) GetLogger() *log.Logger { panic("unreachable") }
-
-func (k *kstub) IsVerbose() bool { k.Helper(); return k.Expects("isVerbose").Ret.(bool) }
-func (k *kstub) SwapVerbose(verbose bool) bool {
-	k.Helper()
-	expect := k.Expects("swapVerbose")
-	if expect.Error(
-		stub.CheckArg(k.Stub, "verbose", verbose, 0)) != nil {
-		k.FailNow()
-	}
-	return expect.Ret.(bool)
-}
-
-// ignoreValue marks a value to be ignored by the test suite.
-type ignoreValue struct{}
-
-func (k *kstub) Verbose(v ...any) {
-	k.Helper()
-	expect := k.Expects("verbose")
-
-	// translate ignores in v
-	if want, ok := expect.Args[0].([]any); ok && len(v) == len(want) {
-		for i, a := range want {
-			if _, ok = a.(ignoreValue); ok {
-				v[i] = ignoreValue{}
-			}
-		}
-	}
-
-	if expect.Error(
-		stub.CheckArgReflect(k.Stub, "v", v, 0)) != nil {
-		k.FailNow()
-	}
-}
-
-func (k *kstub) Verbosef(format string, v ...any) {
-	k.Helper()
-	if k.Expects("verbosef").Error(
-		stub.CheckArg(k.Stub, "format", format, 0),
-		stub.CheckArgReflect(k.Stub, "v", v, 1)) != nil {
-		k.FailNow()
-	}
-}
-
-func (k *kstub) Suspend() bool { k.Helper(); return k.Expects("suspend").Ret.(bool) }
-func (k *kstub) Resume() bool  { k.Helper(); return k.Expects("resume").Ret.(bool) }
-func (k *kstub) BeforeExit()   { k.Helper(); k.Expects("beforeExit") }
-
-// stubDir returns a slice of [os.DirEntry] with only their Name method implemented.
-func stubDir(names ...string) []os.DirEntry {
-	d := make([]os.DirEntry, len(names))
-	for i, name := range names {
-		d[i] = nameDentry(name)
-	}
-	return d
-}
-
-// nameDentry implements the Name method on [os.DirEntry].
-type nameDentry string
-
-func (e nameDentry) Name() string             { return string(e) }
-func (nameDentry) IsDir() bool                { panic("unreachable") }
-func (nameDentry) Type() fs.FileMode          { panic("unreachable") }
-func (nameDentry) Info() (fs.FileInfo, error) { panic("unreachable") }
-
-// panicMsgContext implements [message.Msg] and [context.Context] with methods wrapping panic.
-// This should be assigned to test cases to be checked against.
-type panicMsgContext struct{}
-
-func (panicMsgContext) GetLogger() *log.Logger  { panic("unreachable") }
-func (panicMsgContext) IsVerbose() bool         { panic("unreachable") }
-func (panicMsgContext) SwapVerbose(bool) bool   { panic("unreachable") }
-func (panicMsgContext) Verbose(...any)          { panic("unreachable") }
-func (panicMsgContext) Verbosef(string, ...any) { panic("unreachable") }
-func (panicMsgContext) Suspend() bool           { panic("unreachable") }
-func (panicMsgContext) Resume() bool            { panic("unreachable") }
-func (panicMsgContext) BeforeExit()             { panic("unreachable") }
-
-func (panicMsgContext) Deadline() (time.Time, bool) { panic("unreachable") }
-func (panicMsgContext) Done() <-chan struct{}       { panic("unreachable") }
-func (panicMsgContext) Err() error                  { panic("unreachable") }
-func (panicMsgContext) Value(any) any               { panic("unreachable") }
-
-// panicDispatcher implements syscallDispatcher with methods wrapping panic.
-// This type is meant to be embedded in partial syscallDispatcher implementations.
-type panicDispatcher struct{}
-
-func (panicDispatcher) new(func(k syscallDispatcher))         { panic("unreachable") }
-func (panicDispatcher) getpid() int                           { panic("unreachable") }
-func (panicDispatcher) getuid() int                           { panic("unreachable") }
-func (panicDispatcher) getgid() int                           { panic("unreachable") }
-func (panicDispatcher) lookupEnv(string) (string, bool)       { panic("unreachable") }
-func (panicDispatcher) stat(string) (os.FileInfo, error)      { panic("unreachable") }
-func (panicDispatcher) open(string) (osFile, error)           { panic("unreachable") }
-func (panicDispatcher) readdir(string) ([]os.DirEntry, error) { panic("unreachable") }
-func (panicDispatcher) tempdir() string                       { panic("unreachable") }
-func (panicDispatcher) evalSymlinks(string) (string, error)   { panic("unreachable") }
-func (panicDispatcher) lookupGroupId(string) (string, error)  { panic("unreachable") }
-func (panicDispatcher) cmdOutput(*exec.Cmd) ([]byte, error)   { panic("unreachable") }
-func (panicDispatcher) overflowUid(message.Msg) int           { panic("unreachable") }
-func (panicDispatcher) overflowGid(message.Msg) int           { panic("unreachable") }
-func (panicDispatcher) mustHsuPath() *check.Absolute          { panic("unreachable") }
-func (panicDispatcher) fatalf(string, ...any)                 { panic("unreachable") }

internal/app/env.go

@@ -1,59 +0,0 @@
-package app
-
-import (
-	"strconv"
-
-	"hakurei.app/container/check"
-	"hakurei.app/hst"
-)
-
-// EnvPaths holds paths copied from the environment and is used to create [hst.Paths].
-type EnvPaths struct {
-	// TempDir is returned by [os.TempDir].
-	TempDir *check.Absolute
-	// RuntimePath is copied from $XDG_RUNTIME_DIR.
-	RuntimePath *check.Absolute
-}
-
-// Copy expands [EnvPaths] into [hst.Paths].
-func (env *EnvPaths) Copy(v *hst.Paths, userid int) {
-	if env == nil || env.TempDir == nil || v == nil {
-		panic("attempting to use an invalid EnvPaths")
-	}
-
-	v.TempDir = env.TempDir
-	v.SharePath = env.TempDir.Append("hakurei." + strconv.Itoa(userid))
-
-	if env.RuntimePath == nil {
-		// fall back to path in share since hakurei has no hard XDG dependency
-		v.RunDirPath = v.SharePath.Append("run")
-		v.RuntimePath = v.RunDirPath.Append("compat")
-	} else {
-		v.RuntimePath = env.RuntimePath
-		v.RunDirPath = env.RuntimePath.Append("hakurei")
-	}
-}
-
-// CopyPaths returns a populated [EnvPaths].
-func CopyPaths() *EnvPaths { return copyPaths(direct{}) }
-
-// copyPaths returns a populated [EnvPaths].
-func copyPaths(k syscallDispatcher) *EnvPaths {
-	const xdgRuntimeDir = "XDG_RUNTIME_DIR"
-
-	var env EnvPaths
-
-	if tempDir, err := check.NewAbs(k.tempdir()); err != nil {
-		k.fatalf("invalid TMPDIR: %v", err)
-		panic("unreachable")
-	} else {
-		env.TempDir = tempDir
-	}
-
-	r, _ := k.lookupEnv(xdgRuntimeDir)
-	if a, err := check.NewAbs(r); err == nil {
-		env.RuntimePath = a
-	}
-
-	return &env
-}