hst/container: optional runtime and tmpdir sharing

Sharing and persisting these directories do not always make sense. Make it optional here.

Closes #16.

Signed-off-by: Ophestra <cat@gensokyo.uk>

.clang-format

@@ -1,2 +0,0 @@
-ColumnLimit: 0
-IndentWidth: 4

.gitea/workflows/test.yml

@@ -2,6 +2,7 @@ name: Test
 
 on:
   - push
+  - pull_request
 
 jobs:
   hakurei:

cmd/hakurei/command.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"log"
@@ -11,24 +12,21 @@ import (
 	"strconv"
 	"sync"
 	"time"
-	_ "unsafe" // for go:linkname
+	_ "unsafe"
 
 	"hakurei.app/command"
 	"hakurei.app/container/check"
 	"hakurei.app/container/fhs"
 	"hakurei.app/hst"
-	"hakurei.app/internal/dbus"
-	"hakurei.app/internal/env"
-	"hakurei.app/internal/info"
-	"hakurei.app/internal/outcome"
+	"hakurei.app/internal"
+	"hakurei.app/internal/app"
+	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
+	"hakurei.app/system/dbus"
 )
 
-// optionalErrorUnwrap calls [errors.Unwrap] and returns the resulting value
-// if it is not nil, or the original value if it is.
-//
 //go:linkname optionalErrorUnwrap hakurei.app/container.optionalErrorUnwrap
-func optionalErrorUnwrap(err error) error
+func optionalErrorUnwrap(_ error) error
 
 func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErrs, out io.Writer) command.Command {
 	var (
@@ -53,28 +51,22 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 		Flag(&flagVerbose, "v", command.BoolFlag(false), "Increase log verbosity").
 		Flag(&flagJSON, "json", command.BoolFlag(false), "Serialise output in JSON when applicable")
 
-	c.Command("shim", command.UsageInternal, func([]string) error { outcome.Shim(msg); return errSuccess })
+	c.Command("shim", command.UsageInternal, func([]string) error { app.ShimMain(); return errSuccess })
 
-	{
-		var (
-			flagIdentifierFile int
-		)
-		c.NewCommand("app", "Load and start container from configuration file", func(args []string) error {
-			if len(args) < 1 {
-				log.Fatal("app requires at least 1 argument")
-			}
+	c.Command("app", "Load and start container from configuration file", func(args []string) error {
+		if len(args) < 1 {
+			log.Fatal("app requires at least 1 argument")
+		}
 
-			config := tryPath(msg, args[0])
-			if config != nil && config.Container != nil {
-				config.Container.Args = append(config.Container.Args, args[1:]...)
-			}
+		// config extraArgs...
+		config := tryPath(msg, args[0])
+		if config != nil && config.Container != nil {
+			config.Container.Args = append(config.Container.Args, args[1:]...)
+		}
 
-			outcome.Main(ctx, msg, config, flagIdentifierFile)
-			panic("unreachable")
-		}).
-			Flag(&flagIdentifierFile, "identifier-fd", command.IntFlag(-1),
-				"Write identifier of current instance to fd after successful startup")
-	}
+		app.Main(ctx, msg, config)
+		panic("unreachable")
+	})
 
 	{
 		var (
@@ -91,11 +83,11 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 
 			flagPrivateRuntime, flagPrivateTmpdir bool
 
-			flagWayland, flagX11, flagDBus, flagPipeWire, flagPulse bool
+			flagWayland, flagX11, flagDBus, flagPulse bool
 		)
 
 		c.NewCommand("run", "Configure and start a permissive container", func(args []string) error {
-			if flagIdentity < hst.IdentityStart || flagIdentity > hst.IdentityEnd {
+			if flagIdentity < hst.IdentityMin || flagIdentity > hst.IdentityMax {
 				log.Fatalf("identity %d out of range", flagIdentity)
 			}
 
@@ -104,7 +96,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				passwd     *user.User
 				passwdOnce sync.Once
 				passwdFunc = func() {
-					us := strconv.Itoa(hst.ToUser(new(outcome.Hsu).MustID(msg), flagIdentity))
+					us := strconv.Itoa(app.HsuUid(new(app.Hsu).MustID(msg), flagIdentity))
 					if u, err := user.LookupId(us); err != nil {
 						msg.Verbosef("cannot look up uid %s", us)
 						passwd = &user.User{
@@ -146,8 +138,8 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 			if flagDBus {
 				et |= hst.EDBus
 			}
-			if flagPipeWire || flagPulse {
-				et |= hst.EPipeWire
+			if flagPulse {
+				et |= hst.EPulse
 			}
 
 			config := &hst.Config{
@@ -235,11 +227,8 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				} else {
 					if f, err := os.Open(flagDBusConfigSession); err != nil {
 						log.Fatal(err.Error())
-					} else {
-						decodeJSON(log.Fatal, "load session bus proxy config", f, &config.SessionBus)
-						if err = f.Close(); err != nil {
-							log.Fatal(err.Error())
-						}
+					} else if err = json.NewDecoder(f).Decode(&config.SessionBus); err != nil {
+						log.Fatalf("cannot load session bus proxy config from %q: %s", flagDBusConfigSession, err)
 					}
 				}
 
@@ -247,11 +236,8 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				if flagDBusConfigSystem != "nil" {
 					if f, err := os.Open(flagDBusConfigSystem); err != nil {
 						log.Fatal(err.Error())
-					} else {
-						decodeJSON(log.Fatal, "load system bus proxy config", f, &config.SystemBus)
-						if err = f.Close(); err != nil {
-							log.Fatal(err.Error())
-						}
+					} else if err = json.NewDecoder(f).Decode(&config.SystemBus); err != nil {
+						log.Fatalf("cannot load system bus proxy config from %q: %s", flagDBusConfigSystem, err)
 					}
 				}
 
@@ -266,7 +252,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
-			outcome.Main(ctx, msg, config, -1)
+			app.Main(ctx, msg, config)
 			panic("unreachable")
 		}).
 			Flag(&flagDBusConfigSession, "dbus-config", command.StringFlag("builtin"),
@@ -297,17 +283,12 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				"Enable direct connection to X11").
 			Flag(&flagDBus, "dbus", command.BoolFlag(false),
 				"Enable proxied connection to D-Bus").
-			Flag(&flagPipeWire, "pipewire", command.BoolFlag(false),
-				"Enable connection to PipeWire via SecurityContext").
 			Flag(&flagPulse, "pulse", command.BoolFlag(false),
-				"Enable PulseAudio compatibility daemon")
+				"Enable direct connection to PulseAudio")
 	}
 
 	{
-		var (
-			flagShort   bool
-			flagNoStore bool
-		)
+		var flagShort bool
 		c.NewCommand("show", "Show live or local app configuration", func(args []string) error {
 			switch len(args) {
 			case 0: // system
@@ -315,23 +296,10 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 
 			case 1: // instance
 				name := args[0]
-
-				var (
-					config *hst.Config
-					entry  *hst.State
-				)
-				if !flagNoStore {
-					var sc hst.Paths
-					env.CopyPaths().Copy(&sc, new(outcome.Hsu).MustID(nil))
-					entry = tryIdentifier(msg, name, outcome.NewStore(&sc))
-				}
-
-				if entry == nil {
+				config, entry := tryShort(msg, name)
+				if config == nil {
 					config = tryPath(msg, name)
-				} else {
-					config = entry.Config
 				}
-
 				if !printShowInstance(os.Stdout, time.Now().UTC(), entry, config, flagShort, flagJSON) {
 					os.Exit(1)
 				}
@@ -340,24 +308,22 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				log.Fatal("show requires 1 argument")
 			}
 			return errSuccess
-		}).
-			Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information").
-			Flag(&flagNoStore, "no-store", command.BoolFlag(false), "Do not attempt to match from active instances")
+		}).Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information")
 	}
 
 	{
 		var flagShort bool
 		c.NewCommand("ps", "List active instances", func(args []string) error {
 			var sc hst.Paths
-			env.CopyPaths().Copy(&sc, new(outcome.Hsu).MustID(nil))
-			printPs(msg, os.Stdout, time.Now().UTC(), outcome.NewStore(&sc), flagShort, flagJSON)
+			app.CopyPaths().Copy(&sc, new(app.Hsu).MustID(nil))
+			printPs(os.Stdout, time.Now().UTC(), state.NewMulti(msg, sc.RunDirPath.String()), flagShort, flagJSON)
 			return errSuccess
 		}).Flag(&flagShort, "short", command.BoolFlag(false), "Print instance id")
 	}
 
-	c.Command("version", "Display version information", func(args []string) error { fmt.Println(info.Version()); return errSuccess })
+	c.Command("version", "Display version information", func(args []string) error { fmt.Println(internal.Version()); return errSuccess })
 	c.Command("license", "Show full license text", func(args []string) error { fmt.Println(license); return errSuccess })
-	c.Command("template", "Produce a config template", func(args []string) error { encodeJSON(log.Fatal, os.Stdout, false, hst.Template()); return errSuccess })
+	c.Command("template", "Produce a config template", func(args []string) error { printJSON(os.Stdout, false, hst.Template()); return errSuccess })
 	c.Command("help", "Show this help message", func([]string) error { c.PrintHelp(); return errSuccess })
 
 	return c

cmd/hakurei/command_test.go

@@ -36,7 +36,7 @@ Commands:
 		},
 		{
 			"run", []string{"run", "-h"}, `
-Usage:	hakurei run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--private-runtime] [--private-tmpdir] [--wayland] [-X] [--dbus] [--pipewire] [--pulse] COMMAND [OPTIONS]
+Usage:	hakurei run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--private-runtime] [--private-tmpdir] [--wayland] [-X] [--dbus] [--pulse] COMMAND [OPTIONS]
 
 Flags:
   -X	Enable direct connection to X11
@@ -58,14 +58,12 @@ Flags:
     	Reverse-DNS style Application identifier, leave empty to inherit instance identifier
   -mpris
     	Allow owning MPRIS D-Bus path, has no effect if custom config is available
-  -pipewire
-    	Enable connection to PipeWire via SecurityContext
   -private-runtime
     	Do not share XDG_RUNTIME_DIR between containers under the same identity
   -private-tmpdir
     	Do not share TMPDIR between containers under the same identity
   -pulse
-    	Enable PulseAudio compatibility daemon
+    	Enable direct connection to PulseAudio
   -u string
     	Passwd user name within sandbox (default "chronos")
   -wayland
@@ -79,7 +77,7 @@ Flags:
 			t.Parallel()
 
 			out := new(bytes.Buffer)
-			c := buildCommand(t.Context(), message.New(nil), new(earlyHardeningErrs), out)
+			c := buildCommand(t.Context(), message.NewMsg(nil), new(earlyHardeningErrs), out)
 			if err := c.Parse(tc.args); !errors.Is(err, command.ErrHelp) && !errors.Is(err, flag.ErrHelp) {
 				t.Errorf("Parse: error = %v; want %v",
 					err, command.ErrHelp)

cmd/hakurei/json.go

@@ -1,60 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"io"
-	"strconv"
-)
-
-// decodeJSON decodes json from r and stores it in v. A non-nil error results in a call to fatal.
-func decodeJSON(fatal func(v ...any), op string, r io.Reader, v any) {
-	err := json.NewDecoder(r).Decode(v)
-	if err == nil {
-		return
-	}
-
-	var (
-		syntaxError        *json.SyntaxError
-		unmarshalTypeError *json.UnmarshalTypeError
-
-		msg string
-	)
-
-	switch {
-	case errors.As(err, &syntaxError) && syntaxError != nil:
-		msg = syntaxError.Error() +
-			" at byte " + strconv.FormatInt(syntaxError.Offset, 10)
-
-	case errors.As(err, &unmarshalTypeError) && unmarshalTypeError != nil:
-		msg = "inappropriate " + unmarshalTypeError.Value +
-			" at byte " + strconv.FormatInt(unmarshalTypeError.Offset, 10)
-
-	default:
-		// InvalidUnmarshalError: incorrect usage, does not need to be handled
-		// io.ErrUnexpectedEOF: no additional error information available
-		msg = err.Error()
-	}
-
-	fatal("cannot " + op + ": " + msg)
-}
-
-// encodeJSON encodes v to output. A non-nil error results in a call to fatal.
-func encodeJSON(fatal func(v ...any), output io.Writer, short bool, v any) {
-	encoder := json.NewEncoder(output)
-	if !short {
-		encoder.SetIndent("", "  ")
-	}
-
-	if err := encoder.Encode(v); err != nil {
-		var marshalerError *json.MarshalerError
-		if errors.As(err, &marshalerError) && marshalerError != nil {
-			// this likely indicates an implementation error in hst
-			fatal("cannot encode json for " + marshalerError.Type.String() + ": " + marshalerError.Err.Error())
-			return
-		}
-
-		// UnsupportedTypeError, UnsupportedValueError: incorrect usage, does not need to be handled
-		fatal("cannot write json: " + err.Error())
-	}
-}

cmd/hakurei/json_test.go

@@ -1,99 +0,0 @@
-package main
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-
-	"hakurei.app/container/stub"
-)
-
-func TestDecodeJSON(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name string
-		t    reflect.Type
-		data string
-		want any
-		msg  string
-	}{
-		{"success", reflect.TypeFor[uintptr](), "3735928559\n", uintptr(0xdeadbeef), ""},
-
-		{"syntax", reflect.TypeFor[*int](), "\x00", nil,
-			`cannot load sample: invalid character '\x00' looking for beginning of value at byte 1`},
-		{"type", reflect.TypeFor[uintptr](), "-1", nil,
-			`cannot load sample: inappropriate number -1 at byte 2`},
-		{"default", reflect.TypeFor[*int](), "{", nil,
-			"cannot load sample: unexpected EOF"},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var (
-				gotP   = reflect.New(tc.t)
-				gotMsg *string
-			)
-			decodeJSON(func(v ...any) {
-				if gotMsg != nil {
-					t.Fatal("fatal called twice")
-				}
-				msg := v[0].(string)
-				gotMsg = &msg
-			}, "load sample", strings.NewReader(tc.data), gotP.Interface())
-			if tc.msg != "" {
-				if gotMsg == nil {
-					t.Errorf("decodeJSON: success, want fatal %q", tc.msg)
-				} else if *gotMsg != tc.msg {
-					t.Errorf("decodeJSON: fatal = %q, want %q", *gotMsg, tc.msg)
-				}
-			} else if gotMsg != nil {
-				t.Errorf("decodeJSON: fatal = %q", *gotMsg)
-			} else if !reflect.DeepEqual(gotP.Elem().Interface(), tc.want) {
-				t.Errorf("decodeJSON: %#v, want %#v", gotP.Elem().Interface(), tc.want)
-			}
-		})
-	}
-}
-
-func TestEncodeJSON(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name string
-		v    any
-		want string
-	}{
-		{"marshaler", errorJSONMarshaler{},
-			`cannot encode json for main.errorJSONMarshaler: unique error 3735928559 injected by the test suite`},
-		{"default", func() {},
-			`cannot write json: json: unsupported type: func()`},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			var called bool
-			encodeJSON(func(v ...any) {
-				if called {
-					t.Fatal("fatal called twice")
-				}
-				called = true
-
-				if v[0].(string) != tc.want {
-					t.Errorf("encodeJSON: fatal = %q, want %q", v[0].(string), tc.want)
-				}
-			}, nil, false, tc.v)
-
-			if !called {
-				t.Errorf("encodeJSON: success, want fatal %q", tc.want)
-			}
-		})
-	}
-}
-
-// errorJSONMarshaler implements json.Marshaler.
-type errorJSONMarshaler struct{}
-
-func (errorJSONMarshaler) MarshalJSON() ([]byte, error) { return nil, stub.UniqueError(0xdeadbeef) }

cmd/hakurei/main.go

@@ -32,7 +32,7 @@ func main() {
 
 	log.SetPrefix("hakurei: ")
 	log.SetFlags(0)
-	msg := message.New(log.Default())
+	msg := message.NewMsg(log.Default())
 
 	early := earlyHardeningErrs{
 		yamaLSM:  container.SetPtracer(0),

cmd/hakurei/parse.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"io"
 	"log"
@@ -11,16 +11,13 @@ import (
 	"syscall"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/outcome"
-	"hakurei.app/internal/store"
+	"hakurei.app/internal/app"
+	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 )
 
-// tryPath attempts to read [hst.Config] from multiple sources.
-// tryPath reads from [os.Stdin] if name has value "-".
-// Otherwise, name is passed to tryFd, and if that returns nil, name is passed to [os.Open].
 func tryPath(msg message.Msg, name string) (config *hst.Config) {
-	var r io.ReadCloser
+	var r io.Reader
 	config = new(hst.Config)
 
 	if name != "-" {
@@ -29,24 +26,29 @@ func tryPath(msg message.Msg, name string) (config *hst.Config) {
 			msg.Verbose("load configuration from file")
 
 			if f, err := os.Open(name); err != nil {
-				log.Fatal(err.Error())
-				return
+				log.Fatalf("cannot access configuration file %q: %s", name, err)
 			} else {
+				// finalizer closes f
 				r = f
 			}
+		} else {
+			defer func() {
+				if err := r.(io.ReadCloser).Close(); err != nil {
+					log.Printf("cannot close config fd: %v", err)
+				}
+			}()
 		}
 	} else {
 		r = os.Stdin
 	}
 
-	decodeJSON(log.Fatal, "load configuration", r, &config)
-	if err := r.Close(); err != nil {
-		log.Fatal(err.Error())
+	if err := json.NewDecoder(r).Decode(&config); err != nil {
+		log.Fatalf("cannot load configuration: %v", err)
 	}
+
 	return
 }
 
-// tryFd returns a [io.ReadCloser] if name represents an integer corresponding to a valid file descriptor.
 func tryFd(msg message.Msg, name string) io.ReadCloser {
 	if v, err := strconv.Atoi(name); err != nil {
 		if !errors.Is(err, strconv.ErrSyntax) {
@@ -54,50 +56,22 @@ func tryFd(msg message.Msg, name string) io.ReadCloser {
 		}
 		return nil
 	} else {
-		if v < 3 { // reject standard streams
-			return nil
-		}
-
 		msg.Verbosef("trying config stream from %d", v)
 		fd := uintptr(v)
 		if _, _, errno := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_GETFD, 0); errno != 0 {
-			if errors.Is(errno, syscall.EBADF) { // reject bad fd
+			if errors.Is(errno, syscall.EBADF) {
 				return nil
 			}
 			log.Fatalf("cannot get fd %d: %v", fd, errno)
 		}
-
-		if outcome.IsPollDescriptor(fd) { // reject runtime internals
-			log.Fatalf("invalid config stream %d", fd)
-		}
-
 		return os.NewFile(fd, strconv.Itoa(v))
 	}
 }
 
-// shortLengthMin is the minimum length a short form identifier can have and still be interpreted as an identifier.
-const shortLengthMin = 1 << 3
-
-// shortIdentifier returns an eight character short representation of [hst.ID] from its random bytes.
-func shortIdentifier(id *hst.ID) string {
-	return shortIdentifierString(id.String())
-}
-
-// shortIdentifierString implements shortIdentifier on an arbitrary string.
-func shortIdentifierString(s string) string {
-	return s[len(hst.ID{}) : len(hst.ID{})+shortLengthMin]
-}
-
-// tryIdentifier attempts to match [hst.State] from a [hex] representation of [hst.ID] or a prefix of its lower half.
-func tryIdentifier(msg message.Msg, name string, s *store.Store) *hst.State {
-	const (
-		likeShort = 1 << iota
-		likeFull
-	)
-
-	var likely uintptr
-	if len(name) >= shortLengthMin && len(name) <= len(hst.ID{}) { // half the hex representation
-		// cannot safely decode here due to unknown alignment
+func tryShort(msg message.Msg, name string) (config *hst.Config, entry *state.State) {
+	likePrefix := false
+	if len(name) <= 32 {
+		likePrefix = true
 		for _, c := range name {
 			if c >= '0' && c <= '9' {
 				continue
@@ -105,68 +79,35 @@ func tryIdentifier(msg message.Msg, name string, s *store.Store) *hst.State {
 			if c >= 'a' && c <= 'f' {
 				continue
 			}
-			return nil
+			likePrefix = false
+			break
 		}
-		likely |= likeShort
-	} else if len(name) == hex.EncodedLen(len(hst.ID{})) {
-		likely |= likeFull
 	}
 
-	if likely == 0 {
-		return nil
-	}
+	// try to match from state store
+	if likePrefix && len(name) >= 8 {
+		msg.Verbose("argument looks like prefix")
 
-	entries, copyError := s.All()
-	defer func() {
-		if err := copyError(); err != nil {
-			msg.GetLogger().Println(getMessage("cannot iterate over store:", err))
-		}
-	}()
-
-	switch {
-	case likely&likeShort != 0:
-		msg.Verbose("argument looks like short identifier")
-		for eh := range entries {
-			if eh.DecodeErr != nil {
-				msg.Verbose(getMessage("skipping instance:", eh.DecodeErr))
-				continue
-			}
-
-			if strings.HasPrefix(eh.ID.String()[len(hst.ID{}):], name) {
-				var entry hst.State
-				if _, err := eh.Load(&entry); err != nil {
-					msg.GetLogger().Println(getMessage("cannot load state entry:", err))
-					continue
+		var sc hst.Paths
+		app.CopyPaths().Copy(&sc, new(app.Hsu).MustID(nil))
+		s := state.NewMulti(msg, sc.RunDirPath.String())
+		if entries, err := state.Join(s); err != nil {
+			log.Printf("cannot join store: %v", err)
+			// drop to fetch from file
+		} else {
+			for id := range entries {
+				v := id.String()
+				if strings.HasPrefix(v, name) {
+					// match, use config from this state entry
+					entry = entries[id]
+					config = entry.Config
+					break
 				}
-				return &entry
+
+				msg.Verbosef("instance %s skipped", v)
 			}
 		}
-		return nil
-
-	case likely&likeFull != 0:
-		var likelyID hst.ID
-		if likelyID.UnmarshalText([]byte(name)) != nil {
-			return nil
-		}
-		msg.Verbose("argument looks like identifier")
-		for eh := range entries {
-			if eh.DecodeErr != nil {
-				msg.Verbose(getMessage("skipping instance:", eh.DecodeErr))
-				continue
-			}
-
-			if eh.ID == likelyID {
-				var entry hst.State
-				if _, err := eh.Load(&entry); err != nil {
-					msg.GetLogger().Println(getMessage("cannot load state entry:", err))
-					continue
-				}
-				return &entry
-			}
-		}
-		return nil
-
-	default:
-		panic("unreachable")
 	}
+
+	return
 }

cmd/hakurei/parse_test.go

@@ -1,117 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"reflect"
-	"testing"
-	"time"
-
-	"hakurei.app/container/check"
-	"hakurei.app/hst"
-	"hakurei.app/internal/store"
-	"hakurei.app/message"
-)
-
-func TestShortIdentifier(t *testing.T) {
-	t.Parallel()
-	id := hst.ID{
-		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
-		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
-	}
-
-	const want = "fedcba98"
-	if got := shortIdentifier(&id); got != want {
-		t.Errorf("shortIdentifier: %q, want %q", got, want)
-	}
-}
-
-func TestTryIdentifier(t *testing.T) {
-	t.Parallel()
-
-	msg := message.New(nil)
-	id := hst.ID{
-		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
-		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
-	}
-	withBase := func(extra ...hst.State) []hst.State {
-		return append([]hst.State{
-			{ID: (hst.ID)(bytes.Repeat([]byte{0xaa}, len(hst.ID{}))), PID: 0xbeef, ShimPID: 0xcafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef0)},
-			{ID: (hst.ID)(bytes.Repeat([]byte{0xab}, len(hst.ID{}))), PID: 0x1beef, ShimPID: 0x1cafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef1)},
-			{ID: (hst.ID)(bytes.Repeat([]byte{0xf0}, len(hst.ID{}))), PID: 0x2beef, ShimPID: 0x2cafe, Config: hst.Template(), Time: time.Unix(0, 0xdeadbeef2)},
-
-			{ID: (hst.ID)(bytes.Repeat([]byte{0xfe}, len(hst.ID{}))), PID: 0xbed, ShimPID: 0xfff, Config: func() *hst.Config {
-				template := hst.Template()
-				template.Identity = hst.IdentityEnd
-				return template
-			}(), Time: time.Unix(0, 0xcafebabe0)},
-			{ID: (hst.ID)(bytes.Repeat([]byte{0xfc}, len(hst.ID{}))), PID: 0x1bed, ShimPID: 0x1fff, Config: func() *hst.Config {
-				template := hst.Template()
-				template.Identity = 0xfc
-				return template
-			}(), Time: time.Unix(0, 0xcafebabe1)},
-			{ID: (hst.ID)(bytes.Repeat([]byte{0xce}, len(hst.ID{}))), PID: 0x2bed, ShimPID: 0x2fff, Config: func() *hst.Config {
-				template := hst.Template()
-				template.Identity = 0xce
-				return template
-			}(), Time: time.Unix(0, 0xcafebabe2)},
-		}, extra...)
-	}
-	sampleEntry := hst.State{
-		ID:      id,
-		PID:     0xcafe,
-		ShimPID: 0xdead,
-		Config:  hst.Template(),
-	}
-
-	testCases := []struct {
-		name string
-		s    string
-		data []hst.State
-		want *hst.State
-	}{
-		{"likely entries fault", "ffffffff", nil, nil},
-
-		{"likely short too short", "ff", nil, nil},
-		{"likely short too long", "fffffffffffffffff", nil, nil},
-		{"likely short invalid lower", "fffffff\x00", nil, nil},
-		{"likely short invalid higher", "0000000\xff", nil, nil},
-		{"short no match", "fedcba98", withBase(), nil},
-		{"short match", "fedcba98", withBase(sampleEntry), &sampleEntry},
-		{"short match single", "fedcba98", []hst.State{sampleEntry}, &sampleEntry},
-		{"short match longer", "fedcba98765", withBase(sampleEntry), &sampleEntry},
-
-		{"likely long invalid", "0123456789abcdeffedcba987654321\x00", nil, nil},
-		{"long no match", "0123456789abcdeffedcba9876543210", withBase(), nil},
-		{"long match", "0123456789abcdeffedcba9876543210", withBase(sampleEntry), &sampleEntry},
-		{"long match single", "0123456789abcdeffedcba9876543210", []hst.State{sampleEntry}, &sampleEntry},
-	}
-	for _, tc := range testCases {
-		base := check.MustAbs(t.TempDir()).Append("store")
-		s := store.New(base)
-		for i := range tc.data {
-			if h, err := s.Handle(tc.data[i].Identity); err != nil {
-				t.Fatalf("Handle: error = %v", err)
-			} else {
-				var unlock func()
-				if unlock, err = h.Lock(); err != nil {
-					t.Fatalf("Lock: error = %v", err)
-				}
-				_, err = h.Save(&tc.data[i])
-				unlock()
-				if err != nil {
-					t.Fatalf("Save: error = %v", err)
-				}
-			}
-		}
-
-		// store must not be written to beyond this point
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := tryIdentifier(msg, tc.s, store.New(base))
-			if !reflect.DeepEqual(got, tc.want) {
-				t.Errorf("tryIdentifier: %#v, want %#v", got, tc.want)
-			}
-		})
-	}
-}

cmd/hakurei/print.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"bytes"
+	"encoding/json"
 	"fmt"
 	"io"
 	"log"
@@ -12,43 +12,41 @@ import (
 	"time"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/outcome"
-	"hakurei.app/internal/store"
+	"hakurei.app/internal/app"
+	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 )
 
-// printShowSystem populates and writes a representation of [hst.Info] to output.
 func printShowSystem(output io.Writer, short, flagJSON bool) {
 	t := newPrinter(output)
 	defer t.MustFlush()
-	hi := outcome.Info()
+
+	info := &hst.Info{User: new(app.Hsu).MustID(nil)}
+	app.CopyPaths().Copy(&info.Paths, info.User)
 
 	if flagJSON {
-		encodeJSON(log.Fatal, output, short, hi)
+		printJSON(output, short, info)
 		return
 	}
 
-	t.Printf("Version:\t%s (libwayland %s)\n", hi.Version, hi.WaylandVersion)
-	t.Printf("User:\t%d\n", hi.User)
-	t.Printf("TempDir:\t%s\n", hi.TempDir)
-	t.Printf("SharePath:\t%s\n", hi.SharePath)
-	t.Printf("RuntimePath:\t%s\n", hi.RuntimePath)
-	t.Printf("RunDirPath:\t%s\n", hi.RunDirPath)
+	t.Printf("User:\t%d\n", info.User)
+	t.Printf("TempDir:\t%s\n", info.TempDir)
+	t.Printf("SharePath:\t%s\n", info.SharePath)
+	t.Printf("RuntimePath:\t%s\n", info.RuntimePath)
+	t.Printf("RunDirPath:\t%s\n", info.RunDirPath)
 }
 
-// printShowInstance writes a representation of [hst.State] or [hst.Config] to output.
 func printShowInstance(
 	output io.Writer, now time.Time,
-	instance *hst.State, config *hst.Config,
-	short, flagJSON bool,
-) (valid bool) {
+	instance *state.State, config *hst.Config,
+	short, flagJSON bool) (valid bool) {
 	valid = true
 
 	if flagJSON {
 		if instance != nil {
-			encodeJSON(log.Fatal, output, short, instance)
+			printJSON(output, short, instance)
 		} else {
-			encodeJSON(log.Fatal, output, short, config)
+			printJSON(output, short, config)
 		}
 		return
 	}
@@ -63,14 +61,9 @@ func printShowInstance(
 		}
 	}
 
-	if config == nil {
-		// nothing to print
-		return
-	}
-
 	if instance != nil {
 		t.Printf("State\n")
-		t.Printf(" Instance:\t%s (%d -> %d)\n", instance.ID.String(), instance.PID, instance.ShimPID)
+		t.Printf(" Instance:\t%s (%d)\n", instance.ID.String(), instance.PID)
 		t.Printf(" Uptime:\t%s\n", now.Sub(instance.Time).Round(time.Second).String())
 		t.Printf("\n")
 	}
@@ -86,31 +79,37 @@ func printShowInstance(
 		t.Printf(" Groups:\t%s\n", strings.Join(config.Groups, ", "))
 	}
 	if config.Container != nil {
-		flags := config.Container.Flags.String()
-
-		// this is included in the upper hst.Config struct but is relevant here
-		const flagDirectWayland = "directwl"
-		if config.DirectWayland {
-			// hardcoded value when every flag is unset
-			if flags == "none" {
-				flags = flagDirectWayland
-			} else {
-				flags += ", " + flagDirectWayland
+		params := config.Container
+		if params.Home != nil {
+			t.Printf(" Home:\t%s\n", params.Home)
+		}
+		if params.Hostname != "" {
+			t.Printf(" Hostname:\t%s\n", params.Hostname)
+		}
+		flags := make([]string, 0, 7)
+		writeFlag := func(name string, flag uintptr, force bool) {
+			if params.Flags&flag != 0 || force {
+				flags = append(flags, name)
 			}
 		}
-		t.Printf(" Flags:\t%s\n", flags)
+		writeFlag("userns", hst.FUserns, false)
+		writeFlag("devel", hst.FDevel, false)
+		writeFlag("net", hst.FHostNet, false)
+		writeFlag("abstract", hst.FHostAbstract, false)
+		writeFlag("device", hst.FDevice, false)
+		writeFlag("tty", hst.FTty, false)
+		writeFlag("mapuid", hst.FMapRealUID, false)
+		writeFlag("directwl", 0, config.DirectWayland)
+		if len(flags) == 0 {
+			flags = append(flags, "none")
+		}
+		t.Printf(" Flags:\t%s\n", strings.Join(flags, " "))
 
-		if config.Container.Home != nil {
-			t.Printf(" Home:\t%s\n", config.Container.Home)
+		if params.Path != nil {
+			t.Printf(" Path:\t%s\n", params.Path)
 		}
-		if config.Container.Hostname != "" {
-			t.Printf(" Hostname:\t%s\n", config.Container.Hostname)
-		}
-		if config.Container.Path != nil {
-			t.Printf(" Path:\t%s\n", config.Container.Path)
-		}
-		if len(config.Container.Args) > 0 {
-			t.Printf(" Arguments:\t%s\n", strings.Join(config.Container.Args, " "))
+		if len(params.Args) > 0 {
+			t.Printf(" Arguments:\t%s\n", strings.Join(params.Args, " "))
 		}
 	}
 	t.Printf("\n")
@@ -169,53 +168,57 @@ func printShowInstance(
 	return
 }
 
-// printPs writes a representation of active instances to output.
-func printPs(msg message.Msg, output io.Writer, now time.Time, s *store.Store, short, flagJSON bool) {
-	f := func(a func(eh *store.EntryHandle)) {
-		entries, copyError := s.All()
-		for eh := range entries {
-			a(eh)
-		}
-		if err := copyError(); err != nil {
-			msg.GetLogger().Println(getMessage("cannot iterate over store:", err))
-		}
+func printPs(output io.Writer, now time.Time, s state.Store, short, flagJSON bool) {
+	var entries state.Entries
+	if e, err := state.Join(s); err != nil {
+		log.Fatalf("cannot join store: %v", err)
+	} else {
+		entries = e
+	}
+	if err := s.Close(); err != nil {
+		log.Printf("cannot close store: %v", err)
 	}
 
-	if short { // short output requires identifier only
-		var identifiers []*hst.ID
-		f(func(eh *store.EntryHandle) {
-			if _, err := eh.Load(nil); err != nil { // passes through decode error
-				msg.GetLogger().Println(getMessage("cannot validate state entry header:", err))
-				return
-			}
-			identifiers = append(identifiers, &eh.ID)
-		})
-		slices.SortFunc(identifiers, func(a, b *hst.ID) int { return bytes.Compare(a[:], b[:]) })
-
-		if flagJSON {
-			encodeJSON(log.Fatal, output, short, identifiers)
-		} else {
-			for _, id := range identifiers {
-				mustPrintln(output, shortIdentifier(id))
-			}
+	if !short && flagJSON {
+		es := make(map[string]*state.State, len(entries))
+		for id, instance := range entries {
+			es[id.String()] = instance
 		}
+		printJSON(output, short, es)
 		return
 	}
 
-	// long output requires full instance state
-	var instances []*hst.State
-	f(func(eh *store.EntryHandle) {
-		var state hst.State
-		if _, err := eh.Load(&state); err != nil { // passes through decode error
-			msg.GetLogger().Println(getMessage("cannot load state entry:", err))
-			return
+	// sort state entries by id string to ensure consistency between runs
+	exp := make([]*expandedStateEntry, 0, len(entries))
+	for id, instance := range entries {
+		// gracefully skip nil states
+		if instance == nil {
+			log.Printf("got invalid state entry %s", id.String())
+			continue
 		}
-		instances = append(instances, &state)
-	})
-	slices.SortFunc(instances, func(a, b *hst.State) int { return bytes.Compare(a.ID[:], b.ID[:]) })
 
-	if flagJSON {
-		encodeJSON(log.Fatal, output, short, instances)
+		// gracefully skip inconsistent states
+		if id != instance.ID {
+			log.Printf("possible store corruption: entry %s has id %s",
+				id.String(), instance.ID.String())
+			continue
+		}
+		exp = append(exp, &expandedStateEntry{s: id.String(), State: instance})
+	}
+	slices.SortFunc(exp, func(a, b *expandedStateEntry) int { return a.Time.Compare(b.Time) })
+
+	if short {
+		if flagJSON {
+			v := make([]string, len(exp))
+			for i, e := range exp {
+				v[i] = e.s
+			}
+			printJSON(output, short, v)
+		} else {
+			for _, e := range exp {
+				mustPrintln(output, e.s[:8])
+			}
+		}
 		return
 	}
 
@@ -223,48 +226,61 @@ func printPs(msg message.Msg, output io.Writer, now time.Time, s *store.Store, s
 	defer t.MustFlush()
 
 	t.Println("\tInstance\tPID\tApplication\tUptime")
-	for _, instance := range instances {
+	for _, e := range exp {
+		if len(e.s) != 1<<5 {
+			// unreachable
+			log.Printf("possible store corruption: invalid instance string %s", e.s)
+			continue
+		}
+
 		as := "(No configuration information)"
-		if instance.Config != nil {
-			as = strconv.Itoa(instance.Config.Identity)
-			id := instance.Config.ID
+		if e.Config != nil {
+			as = strconv.Itoa(e.Config.Identity)
+			id := e.Config.ID
 			if id == "" {
-				id = "app.hakurei." + shortIdentifier(&instance.ID)
+				id = "app.hakurei." + e.s[:8]
 			}
 			as += " (" + id + ")"
 		}
 		t.Printf("\t%s\t%d\t%s\t%s\n",
-			shortIdentifier(&instance.ID), instance.PID, as, now.Sub(instance.Time).Round(time.Second).String())
+			e.s[:8], e.PID, as, now.Sub(e.Time).Round(time.Second).String())
+	}
+}
+
+type expandedStateEntry struct {
+	s string
+	*state.State
+}
+
+func printJSON(output io.Writer, short bool, v any) {
+	encoder := json.NewEncoder(output)
+	if !short {
+		encoder.SetIndent("", "  ")
+	}
+	if err := encoder.Encode(v); err != nil {
+		log.Fatalf("cannot serialise: %v", err)
 	}
 }
 
-// newPrinter returns a configured, wrapped [tabwriter.Writer].
 func newPrinter(output io.Writer) *tp { return &tp{tabwriter.NewWriter(output, 0, 1, 4, ' ', 0)} }
 
-// tp wraps [tabwriter.Writer] to provide additional formatting methods.
 type tp struct{ *tabwriter.Writer }
 
-// Printf calls [fmt.Fprintf] on the underlying [tabwriter.Writer].
 func (p *tp) Printf(format string, a ...any) {
 	if _, err := fmt.Fprintf(p, format, a...); err != nil {
 		log.Fatalf("cannot write to tabwriter: %v", err)
 	}
 }
-
-// Println calls [fmt.Fprintln] on the underlying [tabwriter.Writer].
 func (p *tp) Println(a ...any) {
 	if _, err := fmt.Fprintln(p, a...); err != nil {
 		log.Fatalf("cannot write to tabwriter: %v", err)
 	}
 }
-
-// MustFlush calls the Flush method of [tabwriter.Writer] and calls [log.Fatalf] on a non-nil error.
 func (p *tp) MustFlush() {
 	if err := p.Writer.Flush(); err != nil {
 		log.Fatalf("cannot flush tabwriter: %v", err)
 	}
 }
-
 func mustPrint(output io.Writer, a ...any) {
 	if _, err := fmt.Fprint(output, a...); err != nil {
 		log.Fatalf("cannot print: %v", err)
@@ -275,11 +291,3 @@ func mustPrintln(output io.Writer, a ...any) {
 		log.Fatalf("cannot print: %v", err)
 	}
 }
-
-// getMessage returns a [message.Error] message if available, or err prefixed with fallback otherwise.
-func getMessage(fallback string, err error) string {
-	if m, ok := message.GetMessage(err); ok {
-		return m
-	}
-	return fmt.Sprintln(fallback, err)
-}

cmd/hakurei/print_test.go

@@ -1,48 +1,26 @@
 package main
 
 import (
-	"bytes"
-	"log"
 	"strings"
 	"testing"
 	"time"
 
-	"hakurei.app/container/check"
 	"hakurei.app/hst"
-	"hakurei.app/internal/store"
-	"hakurei.app/message"
+	"hakurei.app/internal/app/state"
 )
 
 var (
-	testID = hst.ID{
+	testID = state.ID{
 		0x8e, 0x2c, 0x76, 0xb0,
 		0x66, 0xda, 0xbe, 0x57,
 		0x4c, 0xf0, 0x73, 0xbd,
 		0xb4, 0x6e, 0xb5, 0xc1,
 	}
-	testState = hst.State{
-		ID:      testID,
-		PID:     0xcafe,
-		ShimPID: 0xdead,
-		Config:  hst.Template(),
-		Time:    testAppTime,
-	}
-	testStateSmall = hst.State{
-		ID:      (hst.ID)(bytes.Repeat([]byte{0xaa}, len(hst.ID{}))),
-		PID:     0xbeef,
-		ShimPID: 0xcafe,
-		Config: &hst.Config{
-			Enablements: hst.NewEnablements(hst.EWayland | hst.EPipeWire),
-			Identity:    1,
-			Container: &hst.ContainerConfig{
-				Shell: check.MustAbs("/bin/sh"),
-				Home:  check.MustAbs("/data/data/uk.gensokyo.cat"),
-				Path:  check.MustAbs("/usr/bin/cat"),
-				Args:  []string{"cat"},
-				Flags: hst.FUserns,
-			},
-		},
-		Time: time.Unix(0, 0xdeadbeef).UTC(),
+	testState = &state.State{
+		ID:     testID,
+		PID:    0xDEADBEEF,
+		Config: hst.Template(),
+		Time:   testAppTime,
 	}
 	testTime    = time.Unix(3752, 1).UTC()
 	testAppTime = time.Unix(0, 9).UTC()
@@ -53,20 +31,19 @@ func TestPrintShowInstance(t *testing.T) {
 
 	testCases := []struct {
 		name        string
-		instance    *hst.State
+		instance    *state.State
 		config      *hst.Config
 		short, json bool
 		want        string
 		valid       bool
 	}{
-		{"nil", nil, nil, false, false, "Error: invalid configuration!\n\n", false},
 		{"config", nil, hst.Template(), false, false, `App
  Identity:       9 (org.chromium.Chromium)
- Enablements:    wayland, dbus, pipewire
+ Enablements:    wayland, dbus, pulseaudio
  Groups:         video, dialout, plugdev
- Flags:          multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, runtime, tmpdir
  Home:           /data/data/org.chromium.Chromium
  Hostname:       localhost
+ Flags:          userns devel net abstract device tty mapuid
  Path:           /run/current-system/sw/bin/chromium
  Arguments:      chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
 
@@ -110,22 +87,6 @@ App
  Enablements:    (no enablements)
  Flags:          none
 
-`, false},
-		{"config flag none directwl", nil, &hst.Config{DirectWayland: true, Container: new(hst.ContainerConfig)}, false, false, `Error: container configuration missing path to home directory!
-
-App
- Identity:       0
- Enablements:    (no enablements)
- Flags:          directwl
-
-`, false},
-		{"config flag directwl", nil, &hst.Config{DirectWayland: true, Container: &hst.ContainerConfig{Flags: hst.FMultiarch}}, false, false, `Error: container configuration missing path to home directory!
-
-App
- Identity:       0
- Enablements:    (no enablements)
- Flags:          multiarch, directwl
-
 `, false},
 		{"config nil entries", nil, &hst.Config{Container: &hst.ContainerConfig{Filesystem: make([]hst.FilesystemConfigJSON, 1)}, ExtraPerms: make([]hst.ExtraPermConfig, 1)}, false, false, `Error: container configuration missing path to home directory!
 
@@ -153,17 +114,17 @@ Session bus
 
 `, false},
 
-		{"instance", &testState, hst.Template(), false, false, `State
- Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (51966 -> 57005)
+		{"instance", testState, hst.Template(), false, false, `State
+ Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (3735928559)
  Uptime:      1h2m32s
 
 App
  Identity:       9 (org.chromium.Chromium)
- Enablements:    wayland, dbus, pipewire
+ Enablements:    wayland, dbus, pulseaudio
  Groups:         video, dialout, plugdev
- Flags:          multiarch, compat, devel, userns, net, abstract, tty, mapuid, device, runtime, tmpdir
  Home:           /data/data/org.chromium.Chromium
  Hostname:       localhost
+ Flags:          userns devel net abstract device tty mapuid
  Path:           /run/current-system/sw/bin/chromium
  Arguments:      chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
 
@@ -193,10 +154,10 @@ System bus
  Talk:      ["org.bluez" "org.freedesktop.Avahi" "org.freedesktop.UPower"]
 
 `, true},
-		{"instance pd", &testState, new(hst.Config), false, false, `Error: configuration missing container state!
+		{"instance pd", testState, new(hst.Config), false, false, `Error: configuration missing container state!
 
 State
- Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (51966 -> 57005)
+ Instance:    8e2c76b066dabe574cf073bdb46eb5c1 (3735928559)
  Uptime:      1h2m32s
 
 App
@@ -207,156 +168,174 @@ App
 
 		{"json nil", nil, nil, false, true, `null
 `, true},
-		{"json instance", &testState, nil, false, true, `{
-  "instance": "8e2c76b066dabe574cf073bdb46eb5c1",
-  "pid": 51966,
-  "shim_pid": 57005,
-  "id": "org.chromium.Chromium",
-  "enablements": {
-    "wayland": true,
-    "dbus": true,
-    "pipewire": true
-  },
-  "session_bus": {
-    "see": null,
-    "talk": [
-      "org.freedesktop.Notifications",
-      "org.freedesktop.FileManager1",
-      "org.freedesktop.ScreenSaver",
-      "org.freedesktop.secrets",
-      "org.kde.kwalletd5",
-      "org.kde.kwalletd6",
-      "org.gnome.SessionManager"
-    ],
-    "own": [
-      "org.chromium.Chromium.*",
-      "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-      "org.mpris.MediaPlayer2.chromium.*"
-    ],
-    "call": {
-      "org.freedesktop.portal.*": "*"
-    },
-    "broadcast": {
-      "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
-    },
-    "filter": true
-  },
-  "system_bus": {
-    "see": null,
-    "talk": [
-      "org.bluez",
-      "org.freedesktop.Avahi",
-      "org.freedesktop.UPower"
-    ],
-    "own": null,
-    "call": null,
-    "broadcast": null,
-    "filter": true
-  },
-  "extra_perms": [
-    {
-      "ensure": true,
-      "path": "/var/lib/hakurei/u0",
-      "x": true
-    },
-    {
-      "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
-      "r": true,
-      "w": true,
-      "x": true
-    }
+		{"json instance", testState, nil, false, true, `{
+  "instance": [
+    142,
+    44,
+    118,
+    176,
+    102,
+    218,
+    190,
+    87,
+    76,
+    240,
+    115,
+    189,
+    180,
+    110,
+    181,
+    193
   ],
-  "identity": 9,
-  "groups": [
-    "video",
-    "dialout",
-    "plugdev"
-  ],
-  "container": {
-    "hostname": "localhost",
-    "wait_delay": -1,
-    "env": {
-      "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
-      "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
-      "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
+  "pid": 3735928559,
+  "config": {
+    "id": "org.chromium.Chromium",
+    "enablements": {
+      "wayland": true,
+      "dbus": true,
+      "pulse": true
     },
-    "filesystem": [
+    "session_bus": {
+      "see": null,
+      "talk": [
+        "org.freedesktop.Notifications",
+        "org.freedesktop.FileManager1",
+        "org.freedesktop.ScreenSaver",
+        "org.freedesktop.secrets",
+        "org.kde.kwalletd5",
+        "org.kde.kwalletd6",
+        "org.gnome.SessionManager"
+      ],
+      "own": [
+        "org.chromium.Chromium.*",
+        "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+        "org.mpris.MediaPlayer2.chromium.*"
+      ],
+      "call": {
+        "org.freedesktop.portal.*": "*"
+      },
+      "broadcast": {
+        "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
+      },
+      "filter": true
+    },
+    "system_bus": {
+      "see": null,
+      "talk": [
+        "org.bluez",
+        "org.freedesktop.Avahi",
+        "org.freedesktop.UPower"
+      ],
+      "own": null,
+      "call": null,
+      "broadcast": null,
+      "filter": true
+    },
+    "extra_perms": [
       {
-        "type": "bind",
-        "dst": "/",
-        "src": "/var/lib/hakurei/base/org.debian",
-        "write": true,
-        "special": true
+        "ensure": true,
+        "path": "/var/lib/hakurei/u0",
+        "x": true
       },
       {
-        "type": "bind",
-        "dst": "/etc/",
-        "src": "/etc/",
-        "special": true
-      },
-      {
-        "type": "ephemeral",
-        "dst": "/tmp/",
-        "write": true,
-        "perm": 493
-      },
-      {
-        "type": "overlay",
-        "dst": "/nix/store",
-        "lower": [
-          "/var/lib/hakurei/base/org.nixos/ro-store"
-        ],
-        "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
-        "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
-      },
-      {
-        "type": "link",
-        "dst": "/run/current-system",
-        "linkname": "/run/current-system",
-        "dereference": true
-      },
-      {
-        "type": "link",
-        "dst": "/run/opengl-driver",
-        "linkname": "/run/opengl-driver",
-        "dereference": true
-      },
-      {
-        "type": "bind",
-        "dst": "/data/data/org.chromium.Chromium",
-        "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
-        "write": true,
-        "ensure": true
-      },
-      {
-        "type": "bind",
-        "src": "/dev/dri",
-        "dev": true,
-        "optional": true
+        "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
+        "r": true,
+        "w": true,
+        "x": true
       }
     ],
-    "username": "chronos",
-    "shell": "/run/current-system/sw/bin/zsh",
-    "home": "/data/data/org.chromium.Chromium",
-    "path": "/run/current-system/sw/bin/chromium",
-    "args": [
-      "chromium",
-      "--ignore-gpu-blocklist",
-      "--disable-smooth-scrolling",
-      "--enable-features=UseOzonePlatform",
-      "--ozone-platform=wayland"
+    "identity": 9,
+    "groups": [
+      "video",
+      "dialout",
+      "plugdev"
     ],
-    "seccomp_compat": true,
-    "devel": true,
-    "userns": true,
-    "host_net": true,
-    "host_abstract": true,
-    "tty": true,
-    "multiarch": true,
-    "map_real_uid": true,
-    "device": true,
-    "share_runtime": true,
-    "share_tmpdir": true
+    "container": {
+      "hostname": "localhost",
+      "wait_delay": -1,
+      "env": {
+        "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
+        "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
+        "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
+      },
+      "filesystem": [
+        {
+          "type": "bind",
+          "dst": "/",
+          "src": "/var/lib/hakurei/base/org.debian",
+          "write": true,
+          "special": true
+        },
+        {
+          "type": "bind",
+          "dst": "/etc/",
+          "src": "/etc/",
+          "special": true
+        },
+        {
+          "type": "ephemeral",
+          "dst": "/tmp/",
+          "write": true,
+          "perm": 493
+        },
+        {
+          "type": "overlay",
+          "dst": "/nix/store",
+          "lower": [
+            "/var/lib/hakurei/base/org.nixos/ro-store"
+          ],
+          "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
+          "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
+        },
+        {
+          "type": "link",
+          "dst": "/run/current-system",
+          "linkname": "/run/current-system",
+          "dereference": true
+        },
+        {
+          "type": "link",
+          "dst": "/run/opengl-driver",
+          "linkname": "/run/opengl-driver",
+          "dereference": true
+        },
+        {
+          "type": "bind",
+          "dst": "/data/data/org.chromium.Chromium",
+          "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
+          "write": true,
+          "ensure": true
+        },
+        {
+          "type": "bind",
+          "src": "/dev/dri",
+          "dev": true,
+          "optional": true
+        }
+      ],
+      "username": "chronos",
+      "shell": "/run/current-system/sw/bin/zsh",
+      "home": "/data/data/org.chromium.Chromium",
+      "path": "/run/current-system/sw/bin/chromium",
+      "args": [
+        "chromium",
+        "--ignore-gpu-blocklist",
+        "--disable-smooth-scrolling",
+        "--enable-features=UseOzonePlatform",
+        "--ozone-platform=wayland"
+      ],
+      "seccomp_compat": true,
+      "devel": true,
+      "userns": true,
+      "host_net": true,
+      "host_abstract": true,
+      "tty": true,
+      "multiarch": true,
+      "map_real_uid": true,
+      "device": true,
+      "share_runtime": true,
+      "share_tmpdir": true
+    }
   },
   "time": "1970-01-01T00:00:00.000000009Z"
 }
@@ -366,7 +345,7 @@ App
   "enablements": {
     "wayland": true,
     "dbus": true,
-    "pipewire": true
+    "pulse": true
   },
   "session_bus": {
     "see": null,
@@ -535,243 +514,220 @@ func TestPrintPs(t *testing.T) {
 
 	testCases := []struct {
 		name        string
-		data        []hst.State
+		entries     state.Entries
 		short, json bool
-		want, log   string
+		want        string
 	}{
-		{"no entries", []hst.State{}, false, false, "    Instance    PID    Application    Uptime\n", ""},
-		{"no entries short", []hst.State{}, true, false, "", ""},
+		{"no entries", make(state.Entries), false, false, "    Instance    PID    Application    Uptime\n"},
+		{"no entries short", make(state.Entries), true, false, ""},
+		{"nil instance", state.Entries{testID: nil}, false, false, "    Instance    PID    Application    Uptime\n"},
+		{"state corruption", state.Entries{state.ID{}: testState}, false, false, "    Instance    PID    Application    Uptime\n"},
 
-		{"invalid config", []hst.State{{ID: testID, PID: 1 << 8, Config: new(hst.Config), Time: testAppTime}}, false, false, "    Instance    PID    Application    Uptime\n", "check: configuration missing container state\n"},
+		{"valid pd", state.Entries{testID: &state.State{ID: testID, PID: 1 << 8, Config: new(hst.Config), Time: testAppTime}}, false, false, `    Instance    PID    Application                 Uptime
+    8e2c76b0    256    0 (app.hakurei.8e2c76b0)    1h2m32s
+`},
 
-		{"valid", []hst.State{testStateSmall, testState}, false, false, `    Instance    PID      Application                  Uptime
-    4cf073bd    51966    9 (org.chromium.Chromium)    1h2m32s
-    aaaaaaaa    48879    1 (app.hakurei.aaaaaaaa)     1h2m28s
-`, ""},
-		{"valid single", []hst.State{testState}, false, false, `    Instance    PID      Application                  Uptime
-    4cf073bd    51966    9 (org.chromium.Chromium)    1h2m32s
-`, ""},
-
-		{"valid short", []hst.State{testStateSmall, testState}, true, false, "4cf073bd\naaaaaaaa\n", ""},
-		{"valid short single", []hst.State{testState}, true, false, "4cf073bd\n", ""},
-
-		{"valid json", []hst.State{testState, testStateSmall}, false, true, `[
-  {
-    "instance": "8e2c76b066dabe574cf073bdb46eb5c1",
-    "pid": 51966,
-    "shim_pid": 57005,
-    "id": "org.chromium.Chromium",
-    "enablements": {
-      "wayland": true,
-      "dbus": true,
-      "pipewire": true
-    },
-    "session_bus": {
-      "see": null,
-      "talk": [
-        "org.freedesktop.Notifications",
-        "org.freedesktop.FileManager1",
-        "org.freedesktop.ScreenSaver",
-        "org.freedesktop.secrets",
-        "org.kde.kwalletd5",
-        "org.kde.kwalletd6",
-        "org.gnome.SessionManager"
-      ],
-      "own": [
-        "org.chromium.Chromium.*",
-        "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
-        "org.mpris.MediaPlayer2.chromium.*"
-      ],
-      "call": {
-        "org.freedesktop.portal.*": "*"
-      },
-      "broadcast": {
-        "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
-      },
-      "filter": true
-    },
-    "system_bus": {
-      "see": null,
-      "talk": [
-        "org.bluez",
-        "org.freedesktop.Avahi",
-        "org.freedesktop.UPower"
-      ],
-      "own": null,
-      "call": null,
-      "broadcast": null,
-      "filter": true
-    },
-    "extra_perms": [
-      {
-        "ensure": true,
-        "path": "/var/lib/hakurei/u0",
-        "x": true
-      },
-      {
-        "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
-        "r": true,
-        "w": true,
-        "x": true
-      }
+		{"valid", state.Entries{testID: testState}, false, false, `    Instance    PID           Application                  Uptime
+    8e2c76b0    3735928559    9 (org.chromium.Chromium)    1h2m32s
+`},
+		{"valid short", state.Entries{testID: testState}, true, false, "8e2c76b0\n"},
+		{"valid json", state.Entries{testID: testState}, false, true, `{
+  "8e2c76b066dabe574cf073bdb46eb5c1": {
+    "instance": [
+      142,
+      44,
+      118,
+      176,
+      102,
+      218,
+      190,
+      87,
+      76,
+      240,
+      115,
+      189,
+      180,
+      110,
+      181,
+      193
     ],
-    "identity": 9,
-    "groups": [
-      "video",
-      "dialout",
-      "plugdev"
-    ],
-    "container": {
-      "hostname": "localhost",
-      "wait_delay": -1,
-      "env": {
-        "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
-        "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
-        "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
+    "pid": 3735928559,
+    "config": {
+      "id": "org.chromium.Chromium",
+      "enablements": {
+        "wayland": true,
+        "dbus": true,
+        "pulse": true
       },
-      "filesystem": [
+      "session_bus": {
+        "see": null,
+        "talk": [
+          "org.freedesktop.Notifications",
+          "org.freedesktop.FileManager1",
+          "org.freedesktop.ScreenSaver",
+          "org.freedesktop.secrets",
+          "org.kde.kwalletd5",
+          "org.kde.kwalletd6",
+          "org.gnome.SessionManager"
+        ],
+        "own": [
+          "org.chromium.Chromium.*",
+          "org.mpris.MediaPlayer2.org.chromium.Chromium.*",
+          "org.mpris.MediaPlayer2.chromium.*"
+        ],
+        "call": {
+          "org.freedesktop.portal.*": "*"
+        },
+        "broadcast": {
+          "org.freedesktop.portal.*": "@/org/freedesktop/portal/*"
+        },
+        "filter": true
+      },
+      "system_bus": {
+        "see": null,
+        "talk": [
+          "org.bluez",
+          "org.freedesktop.Avahi",
+          "org.freedesktop.UPower"
+        ],
+        "own": null,
+        "call": null,
+        "broadcast": null,
+        "filter": true
+      },
+      "extra_perms": [
         {
-          "type": "bind",
-          "dst": "/",
-          "src": "/var/lib/hakurei/base/org.debian",
-          "write": true,
-          "special": true
+          "ensure": true,
+          "path": "/var/lib/hakurei/u0",
+          "x": true
         },
         {
-          "type": "bind",
-          "dst": "/etc/",
-          "src": "/etc/",
-          "special": true
-        },
-        {
-          "type": "ephemeral",
-          "dst": "/tmp/",
-          "write": true,
-          "perm": 493
-        },
-        {
-          "type": "overlay",
-          "dst": "/nix/store",
-          "lower": [
-            "/var/lib/hakurei/base/org.nixos/ro-store"
-          ],
-          "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
-          "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
-        },
-        {
-          "type": "link",
-          "dst": "/run/current-system",
-          "linkname": "/run/current-system",
-          "dereference": true
-        },
-        {
-          "type": "link",
-          "dst": "/run/opengl-driver",
-          "linkname": "/run/opengl-driver",
-          "dereference": true
-        },
-        {
-          "type": "bind",
-          "dst": "/data/data/org.chromium.Chromium",
-          "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
-          "write": true,
-          "ensure": true
-        },
-        {
-          "type": "bind",
-          "src": "/dev/dri",
-          "dev": true,
-          "optional": true
+          "path": "/var/lib/hakurei/u0/org.chromium.Chromium",
+          "r": true,
+          "w": true,
+          "x": true
         }
       ],
-      "username": "chronos",
-      "shell": "/run/current-system/sw/bin/zsh",
-      "home": "/data/data/org.chromium.Chromium",
-      "path": "/run/current-system/sw/bin/chromium",
-      "args": [
-        "chromium",
-        "--ignore-gpu-blocklist",
-        "--disable-smooth-scrolling",
-        "--enable-features=UseOzonePlatform",
-        "--ozone-platform=wayland"
+      "identity": 9,
+      "groups": [
+        "video",
+        "dialout",
+        "plugdev"
       ],
-      "seccomp_compat": true,
-      "devel": true,
-      "userns": true,
-      "host_net": true,
-      "host_abstract": true,
-      "tty": true,
-      "multiarch": true,
-      "map_real_uid": true,
-      "device": true,
-      "share_runtime": true,
-      "share_tmpdir": true
+      "container": {
+        "hostname": "localhost",
+        "wait_delay": -1,
+        "env": {
+          "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY",
+          "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com",
+          "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
+        },
+        "filesystem": [
+          {
+            "type": "bind",
+            "dst": "/",
+            "src": "/var/lib/hakurei/base/org.debian",
+            "write": true,
+            "special": true
+          },
+          {
+            "type": "bind",
+            "dst": "/etc/",
+            "src": "/etc/",
+            "special": true
+          },
+          {
+            "type": "ephemeral",
+            "dst": "/tmp/",
+            "write": true,
+            "perm": 493
+          },
+          {
+            "type": "overlay",
+            "dst": "/nix/store",
+            "lower": [
+              "/var/lib/hakurei/base/org.nixos/ro-store"
+            ],
+            "upper": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/upper",
+            "work": "/var/lib/hakurei/nix/u0/org.chromium.Chromium/rw-store/work"
+          },
+          {
+            "type": "link",
+            "dst": "/run/current-system",
+            "linkname": "/run/current-system",
+            "dereference": true
+          },
+          {
+            "type": "link",
+            "dst": "/run/opengl-driver",
+            "linkname": "/run/opengl-driver",
+            "dereference": true
+          },
+          {
+            "type": "bind",
+            "dst": "/data/data/org.chromium.Chromium",
+            "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
+            "write": true,
+            "ensure": true
+          },
+          {
+            "type": "bind",
+            "src": "/dev/dri",
+            "dev": true,
+            "optional": true
+          }
+        ],
+        "username": "chronos",
+        "shell": "/run/current-system/sw/bin/zsh",
+        "home": "/data/data/org.chromium.Chromium",
+        "path": "/run/current-system/sw/bin/chromium",
+        "args": [
+          "chromium",
+          "--ignore-gpu-blocklist",
+          "--disable-smooth-scrolling",
+          "--enable-features=UseOzonePlatform",
+          "--ozone-platform=wayland"
+        ],
+        "seccomp_compat": true,
+        "devel": true,
+        "userns": true,
+        "host_net": true,
+        "host_abstract": true,
+        "tty": true,
+        "multiarch": true,
+        "map_real_uid": true,
+        "device": true,
+        "share_runtime": true,
+        "share_tmpdir": true
+      }
     },
     "time": "1970-01-01T00:00:00.000000009Z"
-  },
-  {
-    "instance": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-    "pid": 48879,
-    "shim_pid": 51966,
-    "enablements": {
-      "wayland": true,
-      "pipewire": true
-    },
-    "identity": 1,
-    "groups": null,
-    "container": {
-      "env": null,
-      "filesystem": null,
-      "shell": "/bin/sh",
-      "home": "/data/data/uk.gensokyo.cat",
-      "path": "/usr/bin/cat",
-      "args": [
-        "cat"
-      ],
-      "userns": true,
-      "map_real_uid": false
-    },
-    "time": "1970-01-01T00:00:03.735928559Z"
   }
-]
-`, ""},
-		{"valid short json", []hst.State{testStateSmall, testState}, true, true, `["8e2c76b066dabe574cf073bdb46eb5c1","aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"]
-`, ""},
+}
+`},
+		{"valid short json", state.Entries{testID: testState}, true, true, `["8e2c76b066dabe574cf073bdb46eb5c1"]
+`},
 	}
 
 	for _, tc := range testCases {
-		s := store.New(check.MustAbs(t.TempDir()).Append("store"))
-		for i := range tc.data {
-			if h, err := s.Handle(tc.data[i].Identity); err != nil {
-				t.Fatalf("Handle: error = %v", err)
-			} else {
-				var unlock func()
-				if unlock, err = h.Lock(); err != nil {
-					t.Fatalf("Lock: error = %v", err)
-				}
-				_, err = h.Save(&tc.data[i])
-				unlock()
-				if err != nil {
-					t.Fatalf("Save: error = %v", err)
-				}
-			}
-		}
-
-		// store must not be written to beyond this point
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			var printBuf, logBuf bytes.Buffer
-			msg := message.New(log.New(&logBuf, "check: ", 0))
-			msg.SwapVerbose(true)
-			printPs(msg, &printBuf, testTime, s, tc.short, tc.json)
-			if got := printBuf.String(); got != tc.want {
-				t.Errorf("printPs:\n%s\nwant\n%s", got, tc.want)
+			output := new(strings.Builder)
+			printPs(output, testTime, stubStore(tc.entries), tc.short, tc.json)
+			if got := output.String(); got != tc.want {
+				t.Errorf("printPs: got\n%s\nwant\n%s",
+					got, tc.want)
 				return
 			}
-			if got := logBuf.String(); got != tc.log {
-				t.Errorf("msg:\n%s\nwant\n%s", got, tc.log)
-			}
 		})
 	}
 }
+
+// stubStore implements [state.Store] and returns test samples via [state.Joiner].
+type stubStore state.Entries
+
+func (s stubStore) Join() (state.Entries, error)               { return state.Entries(s), nil }
+func (s stubStore) Do(int, func(c state.Cursor)) (bool, error) { panic("unreachable") }
+func (s stubStore) List() ([]int, error)                       { panic("unreachable") }
+func (s stubStore) Close() error                               { return nil }

cmd/hpkg/app.go

@@ -130,7 +130,6 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *check.Absolute, argv []
 	if app.Multiarch {
 		config.Container.Flags |= hst.FMultiarch
 	}
-	config.Container.Flags |= hst.FShareRuntime | hst.FShareTmpdir
 	return config
 }
 

cmd/hpkg/build.nix

@@ -45,7 +45,7 @@
   allow_wayland ? true,
   allow_x11 ? false,
   allow_dbus ? true,
-  allow_audio ? true,
+  allow_pulse ? true,
   gpu ? allow_wayland || allow_x11,
 }:
 
@@ -175,7 +175,7 @@ let
       wayland = allow_wayland;
       x11 = allow_x11;
       dbus = allow_dbus;
-      pipewire = allow_audio;
+      pulse = allow_pulse;
     };
 
     mesa = if gpu then mesaWrappers else null;

cmd/hpkg/main.go

@@ -24,7 +24,7 @@ var (
 func main() {
 	log.SetPrefix("hpkg: ")
 	log.SetFlags(0)
-	msg := message.New(log.Default())
+	msg := message.NewMsg(log.Default())
 
 	if err := os.Setenv("SHELL", pathShell.String()); err != nil {
 		log.Fatalf("cannot set $SHELL: %v", err)

cmd/hpkg/proc.go

@@ -10,11 +10,11 @@ import (
 	"os/exec"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/info"
+	"hakurei.app/internal"
 	"hakurei.app/message"
 )
 
-var hakureiPathVal = info.MustHakureiPath().String()
+var hakureiPath = internal.MustHakureiPath()
 
 func mustRunApp(ctx context.Context, msg message.Msg, config *hst.Config, beforeFail func()) {
 	var (
@@ -27,9 +27,9 @@ func mustRunApp(ctx context.Context, msg message.Msg, config *hst.Config, before
 		log.Fatalf("cannot pipe: %v", err)
 	} else {
 		if msg.IsVerbose() {
-			cmd = exec.CommandContext(ctx, hakureiPathVal, "-v", "app", "3")
+			cmd = exec.CommandContext(ctx, hakureiPath.String(), "-v", "app", "3")
 		} else {
-			cmd = exec.CommandContext(ctx, hakureiPathVal, "app", "3")
+			cmd = exec.CommandContext(ctx, hakureiPath.String(), "app", "3")
 		}
 		cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 		cmd.ExtraFiles = []*os.File{r}

cmd/hpkg/test/default.nix

@@ -1,5 +1,5 @@
 {
-  testers,
+  nixosTest,
   callPackage,
 
   system,
@@ -8,7 +8,7 @@
 let
   buildPackage = self.buildPackage.${system};
 in
-testers.nixosTest {
+nixosTest {
   name = "hpkg";
   nodes.machine = {
     environment.etc = {

cmd/hpkg/test/test.py

@@ -58,13 +58,15 @@ def check_state(name, enablements):
     instances = json.loads(machine.succeed("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei --json ps"))
     if len(instances) != 1:
         raise Exception(f"unexpected state length {len(instances)}")
-    instance = instances[0]
+    instance = next(iter(instances.values()))
 
-    if len(instance['container']['args']) != 1 or not (instance['container']['args'][0].startswith("/nix/store/")) or f"hakurei-{name}-" not in (instance['container']['args'][0]):
-        raise Exception(f"unexpected args {instance['container']['args']}")
+    config = instance['config']
 
-    if instance['enablements'] != enablements:
-        raise Exception(f"unexpected enablements {instance['enablements']}")
+    if len(config['container']['args']) != 1 or not (config['container']['args'][0].startswith("/nix/store/")) or f"hakurei-{name}-" not in (config['container']['args'][0]):
+        raise Exception(f"unexpected args {config['container']['args']}")
+
+    if config['enablements'] != enablements:
+        raise Exception(f"unexpected enablements {config['enablements']}")
 
 
 start_all()
@@ -90,21 +92,17 @@ wait_for_window("hakurei@machine-foot")
 machine.send_chars("clear; wayland-info && touch /tmp/success-client\n")
 machine.wait_for_file("/tmp/hakurei.0/tmpdir/2/success-client")
 collect_state_ui("app_wayland")
-check_state("foot", {"wayland": True, "dbus": True, "pipewire": True})
+check_state("foot", {"wayland": True, "dbus": True, "pulse": True})
 # Verify acl on XDG_RUNTIME_DIR:
-print(machine.succeed("getfacl --absolute-names --omit-header --numeric /tmp/hakurei.0/runtime | grep 10002"))
+print(machine.succeed("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 1000002"))
 machine.send_chars("exit\n")
 machine.wait_until_fails("pgrep foot")
 # Verify acl cleanup on XDG_RUNTIME_DIR:
-machine.wait_until_fails("getfacl --absolute-names --omit-header --numeric /tmp/hakurei.0/runtime | grep 10002")
+machine.wait_until_fails("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 1000002")
 
 # Exit Sway and verify process exit status 0:
 swaymsg("exit", succeed=False)
 machine.wait_for_file("/tmp/sway-exit-ok")
 
-# Print hakurei share and rundir contents:
-print(machine.succeed("find /tmp/hakurei.0 "
-    + "-path '/tmp/hakurei.0/runtime/*/*' -prune -o "
-    + "-path '/tmp/hakurei.0/tmpdir/*/*' -prune -o "
-    + "-print"))
-print(machine.fail("ls /run/user/1000/hakurei"))
+# Print hakurei runDir contents:
+print(machine.succeed("find /run/user/1000/hakurei"))

cmd/hsu/hst.go

@@ -1,16 +0,0 @@
-package main
-
-/* copied from hst and must never be changed */
-
-const (
-	userOffset = 100000
-	rangeSize  = userOffset / 10
-
-	identityStart = 0
-	identityEnd   = appEnd - appStart
-
-	appStart = rangeSize * 1
-	appEnd   = appStart + rangeSize - 1
-)
-
-func toUser(userid, appid uint32) uint32 { return userid*userOffset + appStart + appid }

cmd/hsu/main.go

@@ -8,7 +8,6 @@ import (
 	"log"
 	"os"
 	"path"
-	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -16,23 +15,18 @@ import (
 )
 
 const (
-	// envIdentity is the name of the environment variable holding a
-	// single byte representing the shim setup pipe file descriptor.
-	envShim = "HAKUREI_SHIM"
-	// envGroups holds a ' ' separated list of string representations of
-	// supplementary group gid. Membership requirements are enforced.
-	envGroups = "HAKUREI_GROUPS"
+	hsuConfFile = "/etc/hsurc"
+	envShim     = "HAKUREI_SHIM"
+	envIdentity = "HAKUREI_IDENTITY"
+	envGroups   = "HAKUREI_GROUPS"
+
+	PR_SET_NO_NEW_PRIVS = 0x26
+
+	identityMin = 0
+	identityMax = 9999
 )
 
-// hakureiPath is the absolute path to Hakurei.
-//
-// This is set by the linker.
-var hakureiPath string
-
 func main() {
-	const PR_SET_NO_NEW_PRIVS = 0x26
-	runtime.LockOSThread()
-
 	log.SetFlags(0)
 	log.SetPrefix("hsu: ")
 	log.SetOutput(os.Stderr)
@@ -49,25 +43,25 @@ func main() {
 		log.Fatal("this program must not be started by root")
 	}
 
-	if !path.IsAbs(hakureiPath) {
-		log.Fatal("this program is compiled incorrectly")
-		return
-	}
-
 	var toolPath string
 	pexe := path.Join("/proc", strconv.Itoa(os.Getppid()), "exe")
 	if p, err := os.Readlink(pexe); err != nil {
 		log.Fatalf("cannot read parent executable path: %v", err)
 	} else if strings.HasSuffix(p, " (deleted)") {
 		log.Fatal("hakurei executable has been deleted")
-	} else if p != hakureiPath {
+	} else if p != mustCheckPath(hmain) {
 		log.Fatal("this program must be started by hakurei")
 	} else {
 		toolPath = p
 	}
 
+	// uid = 1000000 +
+	//    id * 10000 +
+	//      identity
+	uid := 1000000
+
 	// refuse to run if hsurc is not protected correctly
-	if s, err := os.Stat(hsuConfPath); err != nil {
+	if s, err := os.Stat(hsuConfFile); err != nil {
 		log.Fatal(err)
 	} else if s.Mode().Perm() != 0400 {
 		log.Fatal("bad hsurc perm")
@@ -76,13 +70,25 @@ func main() {
 	}
 
 	// authenticate before accepting user input
-	userid := mustParseConfig(puid)
+	var id int
+	if f, err := os.Open(hsuConfFile); err != nil {
+		log.Fatal(err)
+	} else if v, ok := mustParseConfig(f, puid); !ok {
+		log.Fatalf("uid %d is not in the hsurc file", puid)
+	} else {
+		id = v
+		if err = f.Close(); err != nil {
+			log.Fatal(err)
+		}
+
+		uid += id * 10000
+	}
 
 	// pass through setup fd to shim
 	var shimSetupFd string
 	if s, ok := os.LookupEnv(envShim); !ok {
 		// hakurei requests hsurc user id
-		fmt.Print(userid)
+		fmt.Print(id)
 		os.Exit(0)
 	} else if len(s) != 1 || s[0] > '9' || s[0] < '3' {
 		log.Fatal("HAKUREI_SHIM holds an invalid value")
@@ -90,22 +96,13 @@ func main() {
 		shimSetupFd = s
 	}
 
-	// start is going ahead at this point
-	identity := mustReadIdentity()
-
-	const (
-		// first possible uid outcome
-		uidStart = 10000
-		// last possible uid outcome
-		uidEnd = 999919999
-	)
-
-	// cast to int for use with library functions
-	uid := int(toUser(userid, identity))
-
-	// final bounds check to catch any bugs
-	if uid < uidStart || uid >= uidEnd {
-		panic("uid out of bounds")
+	// allowed identity range 0 to 9999
+	if as, ok := os.LookupEnv(envIdentity); !ok {
+		log.Fatal("HAKUREI_IDENTITY not set")
+	} else if identity, err := parseUint32Fast(as); err != nil || identity < identityMin || identity > identityMax {
+		log.Fatal("invalid identity")
+	} else {
+		uid += identity
 	}
 
 	// supplementary groups
@@ -135,6 +132,11 @@ func main() {
 		suppGroups = []int{uid}
 	}
 
+	// final bounds check to catch any bugs
+	if uid < 1000000 || uid >= 2000000 {
+		panic("uid out of bounds")
+	}
+
 	// careful! users in the allowlist is effectively allowed to drop groups via hsu
 
 	if err := syscall.Setresgid(uid, uid, uid); err != nil {

cmd/hsu/package.nix

@@ -19,5 +19,5 @@ buildGoModule {
   ldflags = lib.attrsets.foldlAttrs (
     ldflags: name: value:
     ldflags ++ [ "-X main.${name}=${value}" ]
-  ) [ "-s -w" ] { hakureiPath = "${hakurei}/libexec/hakurei"; };
+  ) [ "-s -w" ] { hmain = "${hakurei}/libexec/hakurei"; };
 }

cmd/hsu/parse.go

@@ -6,128 +6,62 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"math"
-	"os"
 	"strings"
 )
 
-const (
-	// useridStart is the first userid.
-	useridStart = 0
-	// useridEnd is the last userid.
-	useridEnd = useridStart + rangeSize - 1
-)
-
-// parseUint32Fast parses a string representation of an unsigned 32-bit integer value
-// using the fast path only. This limits the range of values it is defined in.
-func parseUint32Fast(s string) (uint32, error) {
+func parseUint32Fast(s string) (int, error) {
 	sLen := len(s)
 	if sLen < 1 {
-		return 0, errors.New("zero length string")
+		return -1, errors.New("zero length string")
 	}
 	if sLen > 10 {
-		return 0, errors.New("string too long")
+		return -1, errors.New("string too long")
 	}
 
-	var n uint32
+	n := 0
 	for i, ch := range []byte(s) {
 		ch -= '0'
 		if ch > 9 {
-			return 0, fmt.Errorf("invalid character '%s' at index %d", string(ch+'0'), i)
+			return -1, fmt.Errorf("invalid character '%s' at index %d", string(ch+'0'), i)
 		}
-		n = n*10 + uint32(ch)
+		n = n*10 + int(ch)
 	}
 	return n, nil
 }
 
-// parseConfig reads a list of allowed users from r until it encounters puid or [io.EOF].
-//
-// Each line of the file specifies a hakurei userid to kernel uid mapping. A line consists
-// of the string representation of the uid of the user wishing to start hakurei containers,
-// followed by a space, followed by the string representation of its userid. Duplicate uid
-// entries are ignored, with the first occurrence taking effect.
-//
-// All string representations are parsed by calling parseUint32Fast.
-func parseConfig(r io.Reader, puid uint32) (userid uint32, ok bool, err error) {
+func parseConfig(r io.Reader, puid int) (fid int, ok bool, err error) {
 	s := bufio.NewScanner(r)
-	var (
-		line  uintptr
-		puid0 uint32
-	)
+	var line, puid0 int
 	for s.Scan() {
 		line++
 
-		// <puid> <userid>
+		// <puid> <fid>
 		lf := strings.SplitN(s.Text(), " ", 2)
 		if len(lf) != 2 {
-			return useridEnd + 1, false, fmt.Errorf("invalid entry on line %d", line)
+			return -1, false, fmt.Errorf("invalid entry on line %d", line)
 		}
 
 		puid0, err = parseUint32Fast(lf[0])
 		if err != nil || puid0 < 1 {
-			return useridEnd + 1, false, fmt.Errorf("invalid parent uid on line %d", line)
+			return -1, false, fmt.Errorf("invalid parent uid on line %d", line)
 		}
 
 		ok = puid0 == puid
 		if ok {
-			// userid bound to a range, uint32 size allows this to be increased if needed
-			if userid, err = parseUint32Fast(lf[1]); err != nil ||
-				userid < useridStart || userid > useridEnd {
-				return useridEnd + 1, false, fmt.Errorf("invalid userid on line %d", line)
+			// allowed fid range 0 to 99
+			if fid, err = parseUint32Fast(lf[1]); err != nil || fid < 0 || fid > 99 {
+				return -1, false, fmt.Errorf("invalid identity on line %d", line)
 			}
 			return
 		}
 	}
-	return useridEnd + 1, false, s.Err()
+	return -1, false, s.Err()
 }
 
-// hsuConfPath is an absolute pathname to the hsu configuration file.
-// Its contents are interpreted by parseConfig.
-const hsuConfPath = "/etc/hsurc"
-
-// mustParseConfig calls parseConfig to interpret the contents of hsuConfPath,
-// terminating the program if an error is encountered, the syntax is incorrect,
-// or the current user is not authorised to use hsu because its uid is missing.
-//
-// Therefore, code after this function call can assume an authenticated state.
-//
-// mustParseConfig returns the userid value of the current user.
-func mustParseConfig(puid int) (userid uint32) {
-	if puid > math.MaxUint32 {
-		log.Fatalf("got impossible uid %d", puid)
-	}
-
-	var ok bool
-	if f, err := os.Open(hsuConfPath); err != nil {
-		log.Fatal(err)
-	} else if userid, ok, err = parseConfig(f, uint32(puid)); err != nil {
-		log.Fatal(err)
-	} else if err = f.Close(); err != nil {
+func mustParseConfig(r io.Reader, puid int) (int, bool) {
+	fid, ok, err := parseConfig(r, puid)
+	if err != nil {
 		log.Fatal(err)
 	}
-	if !ok {
-		log.Fatalf("uid %d is not in the hsurc file", puid)
-	}
-
-	return
-}
-
-// envIdentity is the name of the environment variable holding a
-// string representation of the current application identity.
-var envIdentity = "HAKUREI_IDENTITY"
-
-// mustReadIdentity calls parseUint32Fast to interpret the value stored in envIdentity,
-// terminating the program if the value is not set, malformed, or out of bounds.
-func mustReadIdentity() uint32 {
-	// ranges defined in hst and copied to this package to avoid importing hst
-	if as, ok := os.LookupEnv(envIdentity); !ok {
-		log.Fatal("HAKUREI_IDENTITY not set")
-		panic("unreachable")
-	} else if identity, err := parseUint32Fast(as); err != nil ||
-		identity < identityStart || identity > identityEnd {
-		log.Fatal("invalid identity")
-		panic("unreachable")
-	} else {
-		return identity
-	}
+	return fid, ok
 }

cmd/hsu/parse_test.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"bytes"
-	"math"
 	"strconv"
 	"testing"
 )
@@ -37,32 +36,36 @@ func TestParseUint32Fast(t *testing.T) {
 		}
 	})
 
-	t.Run("range", func(t *testing.T) {
+	t.Run("full range", func(t *testing.T) {
 		t.Parallel()
 
-		testRange := func(i, end uint32) {
+		testRange := func(i, end int) {
 			for ; i < end; i++ {
-				s := strconv.Itoa(int(i))
+				s := strconv.Itoa(i)
 				w := i
 				t.Run("parse "+s, func(t *testing.T) {
 					t.Parallel()
 
 					v, err := parseUint32Fast(s)
 					if err != nil {
-						t.Errorf("parseUint32Fast(%q): error = %v", s, err)
+						t.Errorf("parseUint32Fast(%q): error = %v",
+							s, err)
 						return
 					}
 					if v != w {
-						t.Errorf("parseUint32Fast(%q): got %v", s, v)
+						t.Errorf("parseUint32Fast(%q): got %v",
+							s, v)
 						return
 					}
 				})
 			}
 		}
 
-		testRange(0, 2500)
-		testRange(23002500, 23005000)
-		testRange(math.MaxUint32-2500, math.MaxUint32)
+		testRange(0, 5000)
+		testRange(105000, 110000)
+		testRange(23005000, 23010000)
+		testRange(456005000, 456010000)
+		testRange(7890005000, 7890010000)
 	})
 }
 
@@ -71,14 +74,14 @@ func TestParseConfig(t *testing.T) {
 
 	testCases := []struct {
 		name       string
-		puid, want uint32
+		puid, want int
 		wantErr    string
 		rc         string
 	}{
-		{"empty", 0, useridEnd + 1, "", ``},
-		{"invalid field", 0, useridEnd + 1, "invalid entry on line 1", `9`},
-		{"invalid puid", 0, useridEnd + 1, "invalid parent uid on line 1", `f 9`},
-		{"invalid userid", 1000, useridEnd + 1, "invalid userid on line 1", `1000 f`},
+		{"empty", 0, -1, "", ``},
+		{"invalid field", 0, -1, "invalid entry on line 1", `9`},
+		{"invalid puid", 0, -1, "invalid parent uid on line 1", `f 9`},
+		{"invalid fid", 1000, -1, "invalid identity on line 1", `1000 f`},
 		{"match", 1000, 0, "", `1000 0`},
 	}
 
@@ -86,21 +89,25 @@ func TestParseConfig(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			userid, ok, err := parseConfig(bytes.NewBufferString(tc.rc), tc.puid)
+			fid, ok, err := parseConfig(bytes.NewBufferString(tc.rc), tc.puid)
 			if err == nil && tc.wantErr != "" {
-				t.Errorf("parseConfig: error = %v; want %q", err, tc.wantErr)
+				t.Errorf("parseConfig: error = %v; wantErr %q",
+					err, tc.wantErr)
 				return
 			}
 			if err != nil && err.Error() != tc.wantErr {
-				t.Errorf("parseConfig: error = %q; want %q", err, tc.wantErr)
+				t.Errorf("parseConfig: error = %q; wantErr %q",
+					err, tc.wantErr)
 				return
 			}
-			if ok == (tc.want == useridEnd+1) {
-				t.Errorf("parseConfig: ok = %v; want %v", ok, tc.want)
+			if ok == (tc.want == -1) {
+				t.Errorf("parseConfig: ok = %v; want %v",
+					ok, tc.want)
 				return
 			}
-			if userid != tc.want {
-				t.Errorf("parseConfig: %v; want %v", userid, tc.want)
+			if fid != tc.want {
+				t.Errorf("parseConfig: fid = %v; want %v",
+					fid, tc.want)
 			}
 		})
 	}

cmd/hsu/path.go

@@ -0,0 +1,20 @@
+package main
+
+import (
+	"log"
+	"path"
+)
+
+const compPoison = "INVALIDINVALIDINVALIDINVALIDINVALID"
+
+var (
+	hmain = compPoison
+)
+
+func mustCheckPath(p string) string {
+	if p != compPoison && p != "" && path.IsAbs(p) {
+		return p
+	}
+	log.Fatal("this program is compiled incorrectly")
+	return compPoison
+}

container/autoetc.go

@@ -59,7 +59,6 @@ func (e *AutoEtcOp) apply(state *setupState, k syscallDispatcher) error {
 
 	return nil
 }
-func (e *AutoEtcOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (e *AutoEtcOp) hostPath() *check.Absolute { return fhs.AbsEtc.Append(e.hostRel()) }
 func (e *AutoEtcOp) hostRel() string           { return ".host/" + e.Prefix }

container/autoroot.go

@@ -69,7 +69,6 @@ func (r *AutoRootOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 	return nil
 }
-func (r *AutoRootOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (r *AutoRootOp) Is(op Op) bool {
 	vr, ok := op.(*AutoRootOp)

container/autoroot_test.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"testing"
 
+	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
-	"hakurei.app/container/std"
 	"hakurei.app/container/stub"
 	"hakurei.app/message"
 )
@@ -23,14 +23,14 @@ func TestAutoRootOp(t *testing.T) {
 	checkOpBehaviour(t, []opBehaviourTestCase{
 		{"readdir", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir(), stub.UniqueError(2)),
 		}, stub.UniqueError(2), nil, nil},
 
 		{"early", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
 				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
@@ -39,7 +39,7 @@ func TestAutoRootOp(t *testing.T) {
 
 		{"apply", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
 				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
@@ -60,7 +60,7 @@ func TestAutoRootOp(t *testing.T) {
 
 		{"success pd", &Params{ParentPerm: 0750}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, []stub.Call{
 			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
 				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
@@ -127,10 +127,10 @@ func TestAutoRootOp(t *testing.T) {
 	})
 
 	checkOpsBuilder(t, []opsBuilderTestCase{
-		{"pd", new(Ops).Root(check.MustAbs("/"), std.BindWritable), Ops{
+		{"pd", new(Ops).Root(check.MustAbs("/"), bits.BindWritable), Ops{
 			&AutoRootOp{
 				Host:  check.MustAbs("/"),
-				Flags: std.BindWritable,
+				Flags: bits.BindWritable,
 			},
 		}},
 	})
@@ -140,42 +140,42 @@ func TestAutoRootOp(t *testing.T) {
 
 		{"internal ne", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, &AutoRootOp{
 			Host:     check.MustAbs("/"),
-			Flags:    std.BindWritable,
+			Flags:    bits.BindWritable,
 			resolved: []*BindMountOp{new(BindMountOp)},
 		}, true},
 
 		{"flags differs", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable | std.BindDevice,
+			Flags: bits.BindWritable | bits.BindDevice,
 		}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, false},
 
 		{"host differs", &AutoRootOp{
 			Host:  check.MustAbs("/tmp/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, false},
 
 		{"equals", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, true},
 	})
 
 	checkOpMeta(t, []opMetaTestCase{
 		{"root", &AutoRootOp{
 			Host:  check.MustAbs("/"),
-			Flags: std.BindWritable,
+			Flags: bits.BindWritable,
 		}, "setting up", `auto root "/" flags 0x2`},
 	})
 }
@@ -202,7 +202,7 @@ func TestIsAutoRootBindable(t *testing.T) {
 			t.Parallel()
 			var msg message.Msg
 			if tc.log {
-				msg = &kstub{nil, nil, stub.New(t, func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { panic("unreachable") }, stub.Expect{Calls: []stub.Call{
+				msg = &kstub{nil, stub.New(t, func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { panic("unreachable") }, stub.Expect{Calls: []stub.Call{
 					call("verbose", stub.ExpectArgs{[]any{"got unexpected root entry"}}, nil, nil),
 				}})}
 			}

container/bits/bits.go

@@ -0,0 +1,13 @@
+// Package bits contains constants for configuring the container.
+package bits
+
+const (
+	// BindOptional skips nonexistent host paths.
+	BindOptional = 1 << iota
+	// BindWritable mounts filesystem read-write.
+	BindWritable
+	// BindDevice allows access to devices (special files) on this filesystem.
+	BindDevice
+	// BindEnsure attempts to create the host path if it does not exist.
+	BindEnsure
+)

container/bits/seccomp.go

@@ -1,16 +1,4 @@
-// Package std contains constants from container packages without depending on cgo.
-package std
-
-const (
-	// BindOptional skips nonexistent host paths.
-	BindOptional = 1 << iota
-	// BindWritable mounts filesystem read-write.
-	BindWritable
-	// BindDevice allows access to devices (special files) on this filesystem.
-	BindDevice
-	// BindEnsure attempts to create the host path if it does not exist.
-	BindEnsure
-)
+package bits
 
 // FilterPreset specifies parts of the syscall filter preset to enable.
 type FilterPreset int

container/capability.go

@@ -49,10 +49,41 @@ func capset(hdrp *capHeader, datap *[2]capData) error {
 }
 
 // capBoundingSetDrop drops a capability from the calling thread's capability bounding set.
-func capBoundingSetDrop(cap uintptr) error { return Prctl(syscall.PR_CAPBSET_DROP, cap, 0) }
+func capBoundingSetDrop(cap uintptr) error {
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_PRCTL,
+		syscall.PR_CAPBSET_DROP,
+		cap, 0,
+	)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}
 
 // capAmbientClearAll clears the ambient capability set of the calling thread.
-func capAmbientClearAll() error { return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0) }
+func capAmbientClearAll() error {
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_PRCTL,
+		PR_CAP_AMBIENT,
+		PR_CAP_AMBIENT_CLEAR_ALL, 0,
+	)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}
 
 // capAmbientRaise adds to the ambient capability set of the calling thread.
-func capAmbientRaise(cap uintptr) error { return Prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap) }
+func capAmbientRaise(cap uintptr) error {
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_PRCTL,
+		PR_CAP_AMBIENT,
+		PR_CAP_AMBIENT_RAISE,
+		cap,
+	)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}

container/check/absolute.go

@@ -56,7 +56,7 @@ func NewAbs(pathname string) (*Absolute, error) {
 // MustAbs calls [NewAbs] and panics on error.
 func MustAbs(pathname string) *Absolute {
 	if a, err := NewAbs(pathname); err != nil {
-		panic(err)
+		panic(err.Error())
 	} else {
 		return a
 	}

container/check/absolute_test.go

@@ -9,15 +9,13 @@ import (
 	"strings"
 	"syscall"
 	"testing"
-	_ "unsafe" // for go:linkname
+	_ "unsafe"
 
 	. "hakurei.app/container/check"
 )
 
-// unsafeAbs returns check.Absolute on any string value.
-//
 //go:linkname unsafeAbs hakurei.app/container/check.unsafeAbs
-func unsafeAbs(pathname string) *Absolute
+func unsafeAbs(_ string) *Absolute
 
 func TestAbsoluteError(t *testing.T) {
 	t.Parallel()
@@ -84,9 +82,9 @@ func TestNewAbs(t *testing.T) {
 		t.Parallel()
 
 		defer func() {
-			wantPanic := &AbsoluteError{Pathname: "etc"}
+			wantPanic := `path "etc" is not absolute`
 
-			if r := recover(); !reflect.DeepEqual(r, wantPanic) {
+			if r := recover(); r != wantPanic {
 				t.Errorf("MustAbs: panic = %v; want %v", r, wantPanic)
 			}
 		}()
@@ -149,7 +147,7 @@ func TestAbsoluteIs(t *testing.T) {
 
 type sCheck struct {
 	Pathname *Absolute `json:"val"`
-	Magic    uint64    `json:"magic"`
+	Magic    int       `json:"magic"`
 }
 
 func TestCodecAbsolute(t *testing.T) {
@@ -171,19 +169,19 @@ func TestCodecAbsolute(t *testing.T) {
 		{"good", MustAbs("/etc"),
 			nil,
 			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\b\xff\x80\x00\x04/etc",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x04/etc\x01\xfc\xc0\xed\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x10\xff\x84\x01\x04/etc\x01\xfb\x01\x81\xda\x00\x00\x00",
 
 			`"/etc"`, `{"val":"/etc","magic":3236757504}`},
 		{"not absolute", nil,
 			&AbsoluteError{Pathname: "etc"},
 			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\a\xff\x80\x00\x03etc",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
 
 			`"etc"`, `{"val":"etc","magic":3236757504}`},
 		{"zero", nil,
 			new(AbsoluteError),
 			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x04\xff\x80\x00\x00",
-			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x06\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
 			`""`, `{"val":"","magic":3236757504}`},
 	}
 

container/container.go

@@ -11,24 +11,20 @@ import (
 	"os/exec"
 	"runtime"
 	"strconv"
-	"sync"
 	. "syscall"
 	"time"
 
+	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
 	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
-	"hakurei.app/container/std"
 	"hakurei.app/message"
 )
 
 const (
 	// CancelSignal is the signal expected by container init on context cancel.
 	// A custom [Container.Cancel] function must eventually deliver this signal.
-	CancelSignal = SIGUSR2
-
-	// Timeout for writing initParams to Container.setup.
-	initSetupTimeout = 5 * time.Second
+	CancelSignal = SIGTERM
 )
 
 type (
@@ -41,8 +37,8 @@ type (
 		// with behaviour identical to its [exec.Cmd] counterpart.
 		ExtraFiles []*os.File
 
-		// param pipe for shim and init
-		setup *os.File
+		// param encoder for shim and init
+		setup *gob.Encoder
 		// cancels cmd
 		cancel context.CancelFunc
 		// closed after Wait returns
@@ -86,11 +82,11 @@ type (
 		*Ops
 
 		// Seccomp system call filter rules.
-		SeccompRules []std.NativeRule
+		SeccompRules []seccomp.NativeRule
 		// Extra seccomp flags.
 		SeccompFlags seccomp.ExportFlag
 		// Seccomp presets. Has no effect unless SeccompRules is zero-length.
-		SeccompPresets std.FilterPreset
+		SeccompPresets bits.FilterPreset
 		// Do not load seccomp program.
 		SeccompDisable bool
 
@@ -144,18 +140,11 @@ func (e *StartError) Error() string {
 // Message returns a user-facing error message.
 func (e *StartError) Message() string {
 	if e.Passthrough {
-		var (
-			numError *strconv.NumError
-		)
-
 		switch {
 		case errors.As(e.Err, new(*os.PathError)),
 			errors.As(e.Err, new(*os.SyscallError)):
 			return "cannot " + e.Err.Error()
 
-		case errors.As(e.Err, &numError) && numError != nil:
-			return "cannot parse " + strconv.Quote(numError.Num) + ": " + numError.Err.Error()
-
 		default:
 			return e.Err.Error()
 		}
@@ -166,39 +155,6 @@ func (e *StartError) Message() string {
 	return "cannot " + e.Error()
 }
 
-// for ensureCloseOnExec
-var (
-	closeOnExecOnce sync.Once
-	closeOnExecErr  error
-)
-
-// ensureCloseOnExec ensures all currently open file descriptors have the syscall.FD_CLOEXEC flag set.
-// This is only ran once as it is intended to handle files left open by the parent, and any file opened
-// on this side should already have syscall.FD_CLOEXEC set.
-func ensureCloseOnExec() error {
-	closeOnExecOnce.Do(func() {
-		const fdPrefixPath = "/proc/self/fd/"
-
-		var entries []os.DirEntry
-		if entries, closeOnExecErr = os.ReadDir(fdPrefixPath); closeOnExecErr != nil {
-			return
-		}
-
-		var fd int
-		for _, ent := range entries {
-			if fd, closeOnExecErr = strconv.Atoi(ent.Name()); closeOnExecErr != nil {
-				break // not reached
-			}
-			CloseOnExec(fd)
-		}
-	})
-
-	if closeOnExecErr == nil {
-		return nil
-	}
-	return &StartError{Fatal: true, Step: "set FD_CLOEXEC on all open files", Err: closeOnExecErr, Passthrough: true}
-}
-
 // Start starts the container init. The init process blocks until Serve is called.
 func (p *Container) Start() error {
 	if p == nil || p.cmd == nil ||
@@ -209,10 +165,6 @@ func (p *Container) Start() error {
 		return errors.New("container: already started")
 	}
 
-	if err := ensureCloseOnExec(); err != nil {
-		return err
-	}
-
 	// map to overflow id to work around ownership checks
 	if p.Uid < 1 {
 		p.Uid = OverflowUid(p.msg)
@@ -222,7 +174,7 @@ func (p *Container) Start() error {
 	}
 
 	if !p.RetainSession {
-		p.SeccompPresets |= std.PresetDenyTTY
+		p.SeccompPresets |= bits.PresetDenyTTY
 	}
 
 	if p.AdoptWaitDelay == 0 {
@@ -276,10 +228,10 @@ func (p *Container) Start() error {
 	}
 
 	// place setup pipe before user supplied extra files, this is later restored by init
-	if fd, f, err := Setup(&p.cmd.ExtraFiles); err != nil {
+	if fd, e, err := Setup(&p.cmd.ExtraFiles); err != nil {
 		return &StartError{true, "set up params stream", err, false, false}
 	} else {
-		p.setup = f
+		p.setup = e
 		p.cmd.Env = []string{setupEnv + "=" + strconv.Itoa(fd)}
 	}
 	p.cmd.ExtraFiles = append(p.cmd.ExtraFiles, p.ExtraFiles...)
@@ -358,9 +310,6 @@ func (p *Container) Serve() error {
 
 	setup := p.setup
 	p.setup = nil
-	if err := setup.SetDeadline(time.Now().Add(initSetupTimeout)); err != nil {
-		return &StartError{true, "set init pipe deadline", err, false, true}
-	}
 
 	if p.Path == nil {
 		p.cancel()
@@ -372,17 +321,18 @@ func (p *Container) Serve() error {
 		p.Dir = fhs.AbsRoot
 	}
 	if p.SeccompRules == nil {
-		p.SeccompRules = make([]std.NativeRule, 0)
+		p.SeccompRules = make([]seccomp.NativeRule, 0)
 	}
 
-	err := gob.NewEncoder(setup).Encode(&initParams{
-		p.Params,
-		Getuid(),
-		Getgid(),
-		len(p.ExtraFiles),
-		p.msg.IsVerbose(),
-	})
-	_ = setup.Close()
+	err := setup.Encode(
+		&initParams{
+			p.Params,
+			Getuid(),
+			Getgid(),
+			len(p.ExtraFiles),
+			p.msg.IsVerbose(),
+		},
+	)
 	if err != nil {
 		p.cancel()
 	}
@@ -449,7 +399,7 @@ func (p *Container) ProcessState() *os.ProcessState {
 // New returns the address to a new instance of [Container] that requires further initialisation before use.
 func New(ctx context.Context, msg message.Msg) *Container {
 	if msg == nil {
-		msg = message.New(nil)
+		msg = message.NewMsg(nil)
 	}
 
 	p := &Container{ctx: ctx, msg: msg, Params: Params{Ops: new(Ops)}}

container/container_test.go

@@ -20,55 +20,15 @@ import (
 
 	"hakurei.app/command"
 	"hakurei.app/container"
+	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
-	"hakurei.app/container/std"
 	"hakurei.app/container/vfs"
 	"hakurei.app/hst"
 	"hakurei.app/ldd"
 	"hakurei.app/message"
 )
 
-// Note: this package requires cgo, which is unavailable in the Go playground.
-func Example() {
-	// Must be called early if the current process starts containers.
-	container.TryArgv0(nil)
-
-	// Configure the container.
-	z := container.New(context.Background(), nil)
-	z.Hostname = "hakurei-example"
-	z.Proc(fhs.AbsProc).Dev(fhs.AbsDev, true)
-	z.Stdin, z.Stdout, z.Stderr = os.Stdin, os.Stdout, os.Stderr
-
-	// Bind / for demonstration.
-	z.Bind(fhs.AbsRoot, fhs.AbsRoot, 0)
-	if name, err := exec.LookPath("hostname"); err != nil {
-		panic(err)
-	} else {
-		z.Path = check.MustAbs(name)
-	}
-
-	// This completes the first stage of container setup and starts the container init process.
-	// The new process blocks until the Serve method is called.
-	if err := z.Start(); err != nil {
-		panic(err)
-	}
-
-	// This serves the setup payload to the container init process,
-	// starting the second stage of container setup.
-	if err := z.Serve(); err != nil {
-		panic(err)
-	}
-
-	// Must be called if the Start method succeeds.
-	if err := z.Wait(); err != nil {
-		panic(err)
-	}
-
-	// Output: hakurei-example
-}
-
 func TestStartError(t *testing.T) {
 	t.Parallel()
 
@@ -84,7 +44,8 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "set up params stream",
 			Err:   container.ErrReceiveEnv,
-		}, "set up params stream: environment variable not set",
+		},
+			"set up params stream: environment variable not set",
 			container.ErrReceiveEnv, syscall.EBADF,
 			"cannot set up params stream: environment variable not set"},
 
@@ -92,7 +53,8 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "set up params stream",
 			Err:   &os.SyscallError{Syscall: "pipe2", Err: syscall.EBADF},
-		}, "set up params stream pipe2: bad file descriptor",
+		},
+			"set up params stream pipe2: bad file descriptor",
 			syscall.EBADF, os.ErrInvalid,
 			"cannot set up params stream pipe2: bad file descriptor"},
 
@@ -100,14 +62,16 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "prctl(PR_SET_NO_NEW_PRIVS)",
 			Err:   syscall.EPERM,
-		}, "prctl(PR_SET_NO_NEW_PRIVS): operation not permitted",
+		},
+			"prctl(PR_SET_NO_NEW_PRIVS): operation not permitted",
 			syscall.EPERM, syscall.EACCES,
 			"cannot prctl(PR_SET_NO_NEW_PRIVS): operation not permitted"},
 
 		{"landlock abi", &container.StartError{
 			Step: "get landlock ABI",
 			Err:  syscall.ENOSYS,
-		}, "get landlock ABI: function not implemented",
+		},
+			"get landlock ABI: function not implemented",
 			syscall.ENOSYS, syscall.ENOEXEC,
 			"cannot get landlock ABI: function not implemented"},
 
@@ -115,7 +79,8 @@ func TestStartError(t *testing.T) {
 			Step:   "kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
 			Err:    syscall.ENOSYS,
 			Origin: true,
-		}, "kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
+		},
+			"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
 			syscall.ENOSYS, syscall.ENOSPC,
 			"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET"},
 
@@ -123,7 +88,8 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "create landlock ruleset",
 			Err:   syscall.EBADFD,
-		}, "create landlock ruleset: file descriptor in bad state",
+		},
+			"create landlock ruleset: file descriptor in bad state",
 			syscall.EBADFD, syscall.EBADF,
 			"cannot create landlock ruleset: file descriptor in bad state"},
 
@@ -131,7 +97,8 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "enforce landlock ruleset",
 			Err:   syscall.ENOTRECOVERABLE,
-		}, "enforce landlock ruleset: state not recoverable",
+		},
+			"enforce landlock ruleset: state not recoverable",
 			syscall.ENOTRECOVERABLE, syscall.ETIMEDOUT,
 			"cannot enforce landlock ruleset: state not recoverable"},
 
@@ -142,7 +109,8 @@ func TestStartError(t *testing.T) {
 				Path: "/proc/nonexistent",
 				Err:  syscall.ENOENT,
 			}, Passthrough: true,
-		}, "fork/exec /proc/nonexistent: no such file or directory",
+		},
+			"fork/exec /proc/nonexistent: no such file or directory",
 			syscall.ENOENT, syscall.ENOSYS,
 			"cannot fork/exec /proc/nonexistent: no such file or directory"},
 
@@ -152,19 +120,11 @@ func TestStartError(t *testing.T) {
 				Syscall: "open",
 				Err:     syscall.ENOSYS,
 			}, Passthrough: true,
-		}, "open: function not implemented",
+		},
+			"open: function not implemented",
 			syscall.ENOSYS, syscall.ENOENT,
 			"cannot open: function not implemented"},
 
-		{"start FD_CLOEXEC", &container.StartError{
-			Fatal:       true,
-			Step:        "set FD_CLOEXEC on all open files",
-			Err:         func() error { _, err := strconv.Atoi("invalid"); return err }(),
-			Passthrough: true,
-		}, `strconv.Atoi: parsing "invalid": invalid syntax`,
-			strconv.ErrSyntax, os.ErrInvalid,
-			`cannot parse "invalid": invalid syntax`},
-
 		{"start other", &container.StartError{
 			Step: "start container init",
 			Err: &net.OpError{
@@ -172,7 +132,8 @@ func TestStartError(t *testing.T) {
 				Net: "unix",
 				Err: syscall.ECONNREFUSED,
 			}, Passthrough: true,
-		}, "dial unix: connection refused",
+		},
+			"dial unix: connection refused",
 			syscall.ECONNREFUSED, syscall.ECONNABORTED,
 			"dial unix: connection refused"},
 	}
@@ -243,22 +204,22 @@ var containerTestCases = []struct {
 	uid int
 	gid int
 
-	rules   []std.NativeRule
+	rules   []seccomp.NativeRule
 	flags   seccomp.ExportFlag
-	presets std.FilterPreset
+	presets bits.FilterPreset
 }{
 	{"minimal", true, false, false, true,
 		emptyOps, emptyMnt,
-		1000, 100, nil, 0, std.PresetStrict},
+		1000, 100, nil, 0, bits.PresetStrict},
 	{"allow", true, true, true, false,
 		emptyOps, emptyMnt,
-		1000, 100, nil, 0, std.PresetExt | std.PresetDenyDevel},
+		1000, 100, nil, 0, bits.PresetExt | bits.PresetDenyDevel},
 	{"no filter", false, true, true, true,
 		emptyOps, emptyMnt,
-		1000, 100, nil, 0, std.PresetExt},
+		1000, 100, nil, 0, bits.PresetExt},
 	{"custom rules", true, true, true, false,
 		emptyOps, emptyMnt,
-		1, 31, []std.NativeRule{{Syscall: std.ScmpSyscall(syscall.SYS_SETUID), Errno: std.ScmpErrno(syscall.EPERM)}}, 0, std.PresetExt},
+		1, 31, []seccomp.NativeRule{{Syscall: seccomp.ScmpSyscall(syscall.SYS_SETUID), Errno: seccomp.ScmpErrno(syscall.EPERM)}}, 0, bits.PresetExt},
 
 	{"tmpfs", true, false, false, true,
 		earlyOps(new(container.Ops).
@@ -267,7 +228,7 @@ var containerTestCases = []struct {
 		earlyMnt(
 			ent("/", hst.PrivateTmp, "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", ignore),
 		),
-		9, 9, nil, 0, std.PresetStrict},
+		9, 9, nil, 0, bits.PresetStrict},
 
 	{"dev", true, true /* go test output is not a tty */, false, false,
 		earlyOps(new(container.Ops).
@@ -285,7 +246,7 @@ var containerTestCases = []struct {
 			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
-		1971, 100, nil, 0, std.PresetStrict},
+		1971, 100, nil, 0, bits.PresetStrict},
 
 	{"dev no mqueue", true, true /* go test output is not a tty */, false, false,
 		earlyOps(new(container.Ops).
@@ -302,7 +263,7 @@ var containerTestCases = []struct {
 			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
 			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
 		),
-		1971, 100, nil, 0, std.PresetStrict},
+		1971, 100, nil, 0, bits.PresetStrict},
 
 	{"overlay", true, false, false, true,
 		func(t *testing.T) (*container.Ops, context.Context) {
@@ -339,7 +300,7 @@ var containerTestCases = []struct {
 						",redirect_dir=nofollow,uuid=on,userxattr"),
 			}
 		},
-		1 << 3, 1 << 14, nil, 0, std.PresetStrict},
+		1 << 3, 1 << 14, nil, 0, bits.PresetStrict},
 
 	{"overlay ephemeral", true, false, false, true,
 		func(t *testing.T) (*container.Ops, context.Context) {
@@ -363,7 +324,7 @@ var containerTestCases = []struct {
 				ent("/", hst.PrivateTmp, "rw", "overlay", "overlay", ignore),
 			}
 		},
-		1 << 3, 1 << 14, nil, 0, std.PresetStrict},
+		1 << 3, 1 << 14, nil, 0, bits.PresetStrict},
 
 	{"overlay readonly", true, false, false, true,
 		func(t *testing.T) (*container.Ops, context.Context) {
@@ -391,7 +352,7 @@ var containerTestCases = []struct {
 						",redirect_dir=nofollow,userxattr"),
 			}
 		},
-		1 << 3, 1 << 14, nil, 0, std.PresetStrict},
+		1 << 3, 1 << 14, nil, 0, bits.PresetStrict},
 }
 
 func TestContainer(t *testing.T) {
@@ -595,13 +556,13 @@ func testContainerCancel(
 
 func TestContainerString(t *testing.T) {
 	t.Parallel()
-	msg := message.New(nil)
+	msg := message.NewMsg(nil)
 	c := container.NewCommand(t.Context(), msg, check.MustAbs("/run/current-system/sw/bin/ldd"), "ldd", "/usr/bin/env")
 	c.SeccompFlags |= seccomp.AllowMultiarch
 	c.SeccompRules = seccomp.Preset(
-		std.PresetExt|std.PresetDenyNS|std.PresetDenyTTY,
+		bits.PresetExt|bits.PresetDenyNS|bits.PresetDenyTTY,
 		c.SeccompFlags)
-	c.SeccompPresets = std.PresetStrict
+	c.SeccompPresets = bits.PresetStrict
 	want := `argv: ["ldd" "/usr/bin/env"], filter: true, rules: 65, flags: 0x1, presets: 0xf`
 	if got := c.String(); got != want {
 		t.Errorf("String: %s, want %s", got, want)
@@ -760,16 +721,13 @@ func TestMain(m *testing.M) {
 }
 
 func helperNewContainerLibPaths(ctx context.Context, libPaths *[]*check.Absolute, args ...string) (c *container.Container) {
-	msg := message.New(nil)
-	msg.SwapVerbose(testing.Verbose())
-	executable := check.MustAbs(container.MustExecutable(msg))
-
+	msg := message.NewMsg(nil)
 	c = container.NewCommand(ctx, msg, absHelperInnerPath, "helper", args...)
 	c.Env = append(c.Env, envDoCheck+"=1")
-	c.Bind(executable, absHelperInnerPath, 0)
+	c.Bind(check.MustAbs(os.Args[0]), absHelperInnerPath, 0)
 
 	// in case test has cgo enabled
-	if entries, err := ldd.Resolve(ctx, msg, executable); err != nil {
+	if entries, err := ldd.Exec(ctx, msg, os.Args[0]); err != nil {
 		log.Fatalf("ldd: %v", err)
 	} else {
 		*libPaths = ldd.Path(entries)

container/dispatcher.go

@@ -11,7 +11,6 @@ import (
 	"syscall"
 
 	"hakurei.app/container/seccomp"
-	"hakurei.app/container/std"
 	"hakurei.app/message"
 )
 
@@ -63,7 +62,7 @@ type syscallDispatcher interface {
 	ensureFile(name string, perm, pperm os.FileMode) error
 
 	// seccompLoad provides [seccomp.Load].
-	seccompLoad(rules []std.NativeRule, flags seccomp.ExportFlag) error
+	seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error
 	// notify provides [signal.Notify].
 	notify(c chan<- os.Signal, sig ...os.Signal)
 	// start starts [os/exec.Cmd].
@@ -165,7 +164,7 @@ func (direct) ensureFile(name string, perm, pperm os.FileMode) error {
 	return ensureFile(name, perm, pperm)
 }
 
-func (direct) seccompLoad(rules []std.NativeRule, flags seccomp.ExportFlag) error {
+func (direct) seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error {
 	return seccomp.Load(rules, flags)
 }
 func (direct) notify(c chan<- os.Signal, sig ...os.Signal) { signal.Notify(c, sig...) }

container/dispatcher_test.go

@@ -17,7 +17,6 @@ import (
 	"time"
 
 	"hakurei.app/container/seccomp"
-	"hakurei.app/container/std"
 	"hakurei.app/container/stub"
 	"hakurei.app/message"
 )
@@ -162,8 +161,7 @@ func checkSimple(t *testing.T, fname string, testCases []simpleTestCase) {
 			t.Parallel()
 
 			wait4signal := make(chan struct{})
-			lockNotify := make(chan struct{})
-			k := &kstub{wait4signal, lockNotify, stub.New(t, func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{wait4signal, lockNotify, s} }, tc.want)}
+			k := &kstub{wait4signal, stub.New(t, func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{wait4signal, s} }, tc.want)}
 			defer stub.HandleExit(t)
 			if err := tc.f(k); !reflect.DeepEqual(err, tc.wantErr) {
 				t.Errorf("%s: error = %v, want %v", fname, err, tc.wantErr)
@@ -201,8 +199,8 @@ func checkOpBehaviour(t *testing.T, testCases []opBehaviourTestCase) {
 				t.Helper()
 				t.Parallel()
 
-				k := &kstub{nil, nil, stub.New(t,
-					func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{nil, nil, s} },
+				k := &kstub{nil, stub.New(t,
+					func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{nil, s} },
 					stub.Expect{Calls: slices.Concat(tc.early, []stub.Call{{Name: stub.CallSeparator}}, tc.apply)},
 				)}
 				state := &setupState{Params: tc.params, Msg: k}
@@ -323,19 +321,12 @@ const (
 
 type kstub struct {
 	wait4signal chan struct{}
-	lockNotify  chan struct{}
 	*stub.Stub[syscallDispatcher]
 }
 
 func (k *kstub) new(f func(k syscallDispatcher)) { k.Helper(); k.New(f) }
 
-func (k *kstub) lockOSThread() {
-	k.Helper()
-	expect := k.Expects("lockOSThread")
-	if k.lockNotify != nil && expect.Ret == magicWait4Signal {
-		<-k.lockNotify
-	}
-}
+func (k *kstub) lockOSThread() { k.Helper(); k.Expects("lockOSThread") }
 
 func (k *kstub) setPtracer(pid uintptr) error {
 	k.Helper()
@@ -465,7 +456,7 @@ func (k *kstub) ensureFile(name string, perm, pperm os.FileMode) error {
 		stub.CheckArg(k.Stub, "pperm", pperm, 2))
 }
 
-func (k *kstub) seccompLoad(rules []std.NativeRule, flags seccomp.ExportFlag) error {
+func (k *kstub) seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error {
 	k.Helper()
 	return k.Expects("seccompLoad").Error(
 		stub.CheckArgReflect(k.Stub, "rules", rules, 0),
@@ -480,10 +471,6 @@ func (k *kstub) notify(c chan<- os.Signal, sig ...os.Signal) {
 		k.FailNow()
 	}
 
-	if k.lockNotify != nil && expect.Ret == magicWait4Signal {
-		defer close(k.lockNotify)
-	}
-
 	// export channel for external instrumentation
 	if chanf, ok := expect.Args[0].(func(c chan<- os.Signal)); ok && chanf != nil {
 		chanf(c)
@@ -771,8 +758,7 @@ func (k *kstub) checkMsg(msg message.Msg) {
 }
 
 func (k *kstub) GetLogger() *log.Logger { panic("unreachable") }
-
-func (k *kstub) IsVerbose() bool { k.Helper(); return k.Expects("isVerbose").Ret.(bool) }
+func (k *kstub) IsVerbose() bool        { panic("unreachable") }
 
 func (k *kstub) SwapVerbose(verbose bool) bool {
 	k.Helper()

container/errors.go

@@ -7,36 +7,31 @@ import (
 
 	"hakurei.app/container/check"
 	"hakurei.app/container/vfs"
-	"hakurei.app/message"
 )
 
 // messageFromError returns a printable error message for a supported concrete type.
-func messageFromError(err error) (m string, ok bool) {
-	if m, ok = messagePrefixP[MountError]("cannot ", err); ok {
-		return
+func messageFromError(err error) (string, bool) {
+	if m, ok := messagePrefixP[MountError]("cannot ", err); ok {
+		return m, ok
 	}
-	if m, ok = messagePrefixP[os.PathError]("cannot ", err); ok {
-		return
+	if m, ok := messagePrefixP[os.PathError]("cannot ", err); ok {
+		return m, ok
 	}
-	if m, ok = messagePrefixP[check.AbsoluteError](zeroString, err); ok {
-		return
+	if m, ok := messagePrefixP[check.AbsoluteError]("", err); ok {
+		return m, ok
 	}
-	if m, ok = messagePrefix[OpRepeatError](zeroString, err); ok {
-		return
+	if m, ok := messagePrefix[OpRepeatError]("", err); ok {
+		return m, ok
 	}
-	if m, ok = messagePrefix[OpStateError](zeroString, err); ok {
-		return
+	if m, ok := messagePrefix[OpStateError]("", err); ok {
+		return m, ok
 	}
 
-	if m, ok = messagePrefixP[vfs.DecoderError]("cannot ", err); ok {
-		return
+	if m, ok := messagePrefixP[vfs.DecoderError]("cannot ", err); ok {
+		return m, ok
 	}
-	if m, ok = messagePrefix[TmpfsSizeError](zeroString, err); ok {
-		return
-	}
-
-	if m, ok = message.GetMessage(err); ok {
-		return
+	if m, ok := messagePrefix[TmpfsSizeError]("", err); ok {
+		return m, ok
 	}
 
 	return zeroString, false

container/errors_test.go

@@ -46,8 +46,8 @@ func TestMessageFromError(t *testing.T) {
 		{"state", OpStateError("overlay"),
 			"impossible overlay state reached", true},
 
-		{"vfs parse", &vfs.DecoderError{Op: "parse", Line: 0xdead, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
-			`cannot parse mountinfo at line 57005: numeric field "meow" invalid syntax`, true},
+		{"vfs parse", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
+			`cannot parse mountinfo at line 3735928559: numeric field "meow" invalid syntax`, true},
 
 		{"tmpfs", TmpfsSizeError(-1),
 			"tmpfs size -1 out of bounds", true},

container/executable.go

@@ -1,8 +1,6 @@
 package container
 
 import (
-	"fmt"
-	"log"
 	"os"
 	"sync"
 
@@ -16,13 +14,8 @@ var (
 
 func copyExecutable(msg message.Msg) {
 	if name, err := os.Executable(); err != nil {
-		m := fmt.Sprintf("cannot read executable path: %v", err)
-		if msg != nil {
-			msg.BeforeExit()
-			msg.GetLogger().Fatal(m)
-		} else {
-			log.Fatal(m)
-		}
+		msg.BeforeExit()
+		msg.GetLogger().Fatalf("cannot read executable path: %v", err)
 	} else {
 		executable = name
 	}

container/executable_test.go

@@ -11,7 +11,7 @@ import (
 func TestExecutable(t *testing.T) {
 	t.Parallel()
 	for i := 0; i < 16; i++ {
-		if got := container.MustExecutable(message.New(nil)); got != os.Args[0] {
+		if got := container.MustExecutable(message.NewMsg(nil)); got != os.Args[0] {
 			t.Errorf("MustExecutable: %q, want %q", got, os.Args[0])
 		}
 	}

container/fhs/abs.go

@@ -1,17 +1,15 @@
 package fhs
 
 import (
-	_ "unsafe" // for go:linkname
+	_ "unsafe"
 
 	"hakurei.app/container/check"
 )
 
 /* constants in this file bypass abs check, be extremely careful when changing them! */
 
-// unsafeAbs returns check.Absolute on any string value.
-//
 //go:linkname unsafeAbs hakurei.app/container/check.unsafeAbs
-func unsafeAbs(pathname string) *check.Absolute
+func unsafeAbs(_ string) *check.Absolute
 
 var (
 	// AbsRoot is [Root] as [check.Absolute].
@@ -36,8 +34,6 @@ var (
 
 	// AbsDev is [Dev] as [check.Absolute].
 	AbsDev = unsafeAbs(Dev)
-	// AbsDevShm is [DevShm] as [check.Absolute].
-	AbsDevShm = unsafeAbs(DevShm)
 	// AbsProc is [Proc] as [check.Absolute].
 	AbsProc = unsafeAbs(Proc)
 	// AbsSys is [Sys] as [check.Absolute].

container/fhs/fhs.go

@@ -29,8 +29,6 @@ const (
 
 	// Dev points to the root directory for device nodes.
 	Dev = "/dev/"
-	// DevShm is the place for POSIX shared memory segments, as created via shm_open(3).
-	DevShm = "/dev/shm/"
 	// Proc points to a virtual kernel file system exposing the process list and other functionality.
 	Proc = "/proc/"
 	// ProcSys points to a hierarchy below /proc/ that exposes a number of kernel tunables.

container/init.go

@@ -1,7 +1,6 @@
 package container
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"log"
@@ -10,8 +9,6 @@ import (
 	"path"
 	"slices"
 	"strconv"
-	"sync"
-	"sync/atomic"
 	. "syscall"
 	"time"
 
@@ -21,28 +18,24 @@ import (
 )
 
 const (
-	/* intermediateHostPath is the pathname of the intermediate tmpfs mount point.
+	/* intermediate tmpfs mount point
 
-	This path might seem like a weird choice, however there are many good reasons to use it:
-	- The contents of this path is never exposed to the container:
-	  The tmpfs root established here effectively becomes anonymous after pivot_root.
-	- It is safe to assume this path exists and is a directory:
-	  This program will not work correctly without a proper /proc and neither will most others.
-	- This path belongs to the container init:
-	  The container init is not any more privileged or trusted than the rest of the container.
-	- This path is only accessible by init and root:
-	  The container init sets SUID_DUMP_DISABLE and terminates if that fails.
+	this path might seem like a weird choice, however there are many good reasons to use it:
+	- the contents of this path is never exposed to the container:
+	  the tmpfs root established here effectively becomes anonymous after pivot_root
+	- it is safe to assume this path exists and is a directory:
+	  this program will not work correctly without a proper /proc and neither will most others
+	- this path belongs to the container init:
+	  the container init is not any more privileged or trusted than the rest of the container
+	- this path is only accessible by init and root:
+	  the container init sets SUID_DUMP_DISABLE and terminates if that fails;
 
-	It should be noted that none of this should become relevant at any point since the resulting
-	intermediate root tmpfs should be effectively anonymous. */
+	it should be noted that none of this should become relevant at any point since the resulting
+	intermediate root tmpfs should be effectively anonymous */
 	intermediateHostPath = fhs.Proc + "self/fd"
 
-	// setupEnv is the name of the environment variable holding the string representation of
-	// the read end file descriptor of the setup params pipe.
+	// setup params file descriptor
 	setupEnv = "HAKUREI_SETUP"
-
-	// exitUnexpectedWait4 is the exit code if wait4 returns an unexpected errno.
-	exitUnexpectedWait4 = 2
 )
 
 type (
@@ -56,8 +49,6 @@ type (
 		early(state *setupState, k syscallDispatcher) error
 		// apply is called in intermediate root.
 		apply(state *setupState, k syscallDispatcher) error
-		// late is called right before starting the initial process.
-		late(state *setupState, k syscallDispatcher) error
 
 		// prefix returns a log message prefix, and whether this Op prints no identifying message on its own.
 		prefix() (string, bool)
@@ -70,29 +61,11 @@ type (
 	// setupState persists context between Ops.
 	setupState struct {
 		nonrepeatable uintptr
-
-		// Whether early reaping has concluded. Must only be accessed in the wait4 loop.
-		processConcluded bool
-		// Process to syscall.WaitStatus populated in the wait4 loop. Freed after early reaping concludes.
-		process map[int]WaitStatus
-		// Synchronises access to process.
-		processMu sync.RWMutex
-
 		*Params
-		context.Context
 		message.Msg
 	}
 )
 
-// terminated returns whether the specified pid has been reaped, and its
-// syscall.WaitStatus if it had. This is only usable by [Op].
-func (state *setupState) terminated(pid int) (wstatus WaitStatus, ok bool) {
-	state.processMu.RLock()
-	wstatus, ok = state.process[pid]
-	state.processMu.RUnlock()
-	return
-}
-
 // Grow grows the slice Ops points to using [slices.Grow].
 func (f *Ops) Grow(n int) { *f = slices.Grow(*f, n) }
 
@@ -123,14 +96,15 @@ type initParams struct {
 }
 
 // Init is called by [TryArgv0] if the current process is the container init.
-func Init(msg message.Msg) { initEntrypoint(direct{}, msg) }
-
-func initEntrypoint(k syscallDispatcher, msg message.Msg) {
-	k.lockOSThread()
-
+func Init(msg message.Msg) {
 	if msg == nil {
 		panic("attempting to call initEntrypoint with nil msg")
 	}
+	initEntrypoint(direct{}, msg)
+}
+
+func initEntrypoint(k syscallDispatcher, msg message.Msg) {
+	k.lockOSThread()
 
 	if k.getpid() != 1 {
 		k.fatal(msg, "this process must run as pid 1")
@@ -207,9 +181,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "cannot make / rslave: %v", optionalErrorUnwrap(err))
 	}
 
-	ctx, cancel := context.WithCancel(context.Background())
-	state := &setupState{process: make(map[int]WaitStatus), Params: &params.Params, Msg: msg, Context: ctx}
-	defer cancel()
+	state := &setupState{Params: &params.Params, Msg: msg}
 
 	/* early is called right before pivot_root into intermediate root;
 	this step is mostly for gathering information that would otherwise be difficult to obtain
@@ -359,7 +331,24 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 	k.umask(oldmask)
 
-	// winfo represents an exited process from wait4.
+	cmd := exec.Command(params.Path.String())
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+	cmd.Args = params.Args
+	cmd.Env = params.Env
+	cmd.ExtraFiles = extraFiles
+	cmd.Dir = params.Dir.String()
+
+	msg.Verbosef("starting initial program %s", params.Path)
+	if err := k.start(cmd); err != nil {
+		k.fatalf(msg, "%v", err)
+	}
+	msg.Suspend()
+
+	if err := closeSetup(); err != nil {
+		k.printf(msg, "cannot close setup pipe: %v", err)
+		// not fatal
+	}
+
 	type winfo struct {
 		wpid    int
 		wstatus WaitStatus
@@ -369,20 +358,13 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	// when there are no longer any processes left to reap
 	info := make(chan winfo, 1)
 
-	// whether initial process has started
-	var initialProcessStarted atomic.Bool
-
 	k.new(func(k syscallDispatcher) {
 		k.lockOSThread()
 
-	wait4:
 		var (
 			err     error
 			wpid    = -2
 			wstatus WaitStatus
-
-			// whether initial process has started
-			started bool
 		)
 
 		// keep going until no child process is left
@@ -392,25 +374,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 			}
 
 			if wpid != -2 {
-				if !state.processConcluded {
-					state.processMu.Lock()
-					if state.process == nil {
-						// early reaping has already concluded at this point
-						state.processConcluded = true
-						info <- winfo{wpid, wstatus}
-					} else {
-						// initial process has not yet been created, and the
-						// info channel is not yet being received from
-						state.process[wpid] = wstatus
-					}
-					state.processMu.Unlock()
-				} else {
-					info <- winfo{wpid, wstatus}
-				}
-			}
-
-			if !started {
-				started = initialProcessStarted.Load()
+				info <- winfo{wpid, wstatus}
 			}
 
 			err = EINTR
@@ -418,67 +382,29 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 				wpid, err = k.wait4(-1, &wstatus, 0, nil)
 			}
 		}
-
 		if !errors.Is(err, ECHILD) {
 			k.printf(msg, "unexpected wait4 response: %v", err)
-		} else if !started {
-			// initial process has not yet been reached and all daemons
-			// terminated or none were started in the first place
-			time.Sleep(500 * time.Microsecond)
-			goto wait4
 		}
 
 		close(info)
 	})
 
-	// called right before startup of initial process, all state changes to the
-	// current process is prohibited during late
-	for i, op := range *params.Ops {
-		// ops already checked during early setup
-		if err := op.late(state, k); err != nil {
-			if m, ok := messageFromError(err); ok {
-				k.fatal(msg, m)
-			} else if errors.Is(err, context.DeadlineExceeded) {
-				k.fatalf(msg, "%s deadline exceeded", op.String())
-			} else {
-				k.fatalf(msg, "cannot complete op at index %d: %v", i, err)
-			}
-		}
-	}
-	// early reaping has concluded, this must happen before initial process is created
-	state.processMu.Lock()
-	state.process = nil
-	state.processMu.Unlock()
-
-	if err := closeSetup(); err != nil {
-		k.fatalf(msg, "cannot close setup pipe: %v", err)
-	}
-
-	cmd := exec.Command(params.Path.String())
-	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
-	cmd.Args = params.Args
-	cmd.Env = params.Env
-	cmd.ExtraFiles = extraFiles
-	cmd.Dir = params.Dir.String()
-
-	msg.Verbosef("starting initial process %s", params.Path)
-	if err := k.start(cmd); err != nil {
-		k.fatalf(msg, "%v", err)
-	}
-	initialProcessStarted.Store(true)
-
 	// handle signals to dump withheld messages
 	sig := make(chan os.Signal, 2)
-	k.notify(sig, CancelSignal,
-		os.Interrupt, SIGTERM, SIGQUIT)
+	k.notify(sig, os.Interrupt, CancelSignal)
 
 	// closed after residualProcessTimeout has elapsed after initial process death
 	timeout := make(chan struct{})
 
-	r := exitUnexpectedWait4
+	r := 2
 	for {
 		select {
 		case s := <-sig:
+			if msg.Resume() {
+				msg.Verbosef("%s after process start", s.String())
+			} else {
+				msg.Verbosef("got %s", s.String())
+			}
 			if s == CancelSignal && params.ForwardCancel && cmd.Process != nil {
 				msg.Verbose("forwarding context cancellation")
 				if err := k.signal(cmd, os.Interrupt); err != nil {
@@ -486,16 +412,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 				}
 				continue
 			}
-
-			if s == SIGTERM || s == SIGQUIT {
-				msg.Verbosef("got %s, forwarding to initial process", s.String())
-				if err := k.signal(cmd, s); err != nil {
-					k.printf(msg, "cannot forward signal: %v", err)
-				}
-				continue
-			}
-
-			msg.Verbosef("got %s", s.String())
 			msg.BeforeExit()
 			k.exit(0)
 
@@ -507,18 +423,8 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 			}
 
 			if w.wpid == cmd.Process.Pid {
-				// cancel Op context early
-				cancel()
-
-				// start timeout early
-				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
-
-				// close initial process files; this also keeps them alive
-				for _, f := range extraFiles {
-					if err := f.Close(); err != nil {
-						msg.Verbose(err.Error())
-					}
-				}
+				// initial process exited, output is most likely available again
+				msg.Resume()
 
 				switch {
 				case w.wstatus.Exited():
@@ -533,6 +439,8 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 					r = 255
 					msg.Verbosef("initial process exited with status %#x", w.wstatus)
 				}
+
+				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
 			}
 
 		case <-timeout:
@@ -543,7 +451,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 }
 
-// initName is the prefix used by log.std in the init process.
 const initName = "init"
 
 // TryArgv0 calls [Init] if the last element of argv0 is "init".
@@ -552,7 +459,7 @@ func TryArgv0(msg message.Msg) {
 	if msg == nil {
 		log.SetPrefix(initName + ": ")
 		log.SetFlags(0)
-		msg = message.New(log.Default())
+		msg = message.NewMsg(log.Default())
 	}
 
 	if len(os.Args) > 0 && path.Base(os.Args[0]) == initName {

container/initbind.go

@@ -6,8 +6,8 @@ import (
 	"os"
 	"syscall"
 
+	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
-	"hakurei.app/container/std"
 )
 
 func init() { gob.Register(new(BindMountOp)) }
@@ -29,18 +29,18 @@ type BindMountOp struct {
 func (b *BindMountOp) Valid() bool {
 	return b != nil &&
 		b.Source != nil && b.Target != nil &&
-		b.Flags&(std.BindOptional|std.BindEnsure) != (std.BindOptional|std.BindEnsure)
+		b.Flags&(bits.BindOptional|bits.BindEnsure) != (bits.BindOptional|bits.BindEnsure)
 }
 
 func (b *BindMountOp) early(_ *setupState, k syscallDispatcher) error {
-	if b.Flags&std.BindEnsure != 0 {
+	if b.Flags&bits.BindEnsure != 0 {
 		if err := k.mkdirAll(b.Source.String(), 0700); err != nil {
 			return err
 		}
 	}
 
 	if pathname, err := k.evalSymlinks(b.Source.String()); err != nil {
-		if os.IsNotExist(err) && b.Flags&std.BindOptional != 0 {
+		if os.IsNotExist(err) && b.Flags&bits.BindOptional != 0 {
 			// leave sourceFinal as nil
 			return nil
 		}
@@ -53,7 +53,7 @@ func (b *BindMountOp) early(_ *setupState, k syscallDispatcher) error {
 
 func (b *BindMountOp) apply(state *setupState, k syscallDispatcher) error {
 	if b.sourceFinal == nil {
-		if b.Flags&std.BindOptional == 0 {
+		if b.Flags&bits.BindOptional == 0 {
 			// unreachable
 			return OpStateError("bind")
 		}
@@ -76,10 +76,10 @@ func (b *BindMountOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 
 	var flags uintptr = syscall.MS_REC
-	if b.Flags&std.BindWritable == 0 {
+	if b.Flags&bits.BindWritable == 0 {
 		flags |= syscall.MS_RDONLY
 	}
-	if b.Flags&std.BindDevice == 0 {
+	if b.Flags&bits.BindDevice == 0 {
 		flags |= syscall.MS_NODEV
 	}
 
@@ -90,7 +90,6 @@ func (b *BindMountOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 	return k.bindMount(state, source, target, flags)
 }
-func (b *BindMountOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (b *BindMountOp) Is(op Op) bool {
 	vb, ok := op.(*BindMountOp)

container/initbind_test.go

@@ -6,8 +6,8 @@ import (
 	"syscall"
 	"testing"
 
+	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
-	"hakurei.app/container/std"
 	"hakurei.app/container/stub"
 )
 
@@ -25,7 +25,7 @@ func TestBindMountOp(t *testing.T) {
 		{"skip optional", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/bin/"),
-			Flags:  std.BindOptional,
+			Flags:  bits.BindOptional,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "", syscall.ENOENT),
 		}, nil, nil, nil},
@@ -33,7 +33,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success optional", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/bin/"),
-			Flags:  std.BindOptional,
+			Flags:  bits.BindOptional,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
 		}, nil, []stub.Call{
@@ -46,7 +46,7 @@ func TestBindMountOp(t *testing.T) {
 		{"ensureFile device", new(Params), &BindMountOp{
 			Source: check.MustAbs("/dev/null"),
 			Target: check.MustAbs("/dev/null"),
-			Flags:  std.BindWritable | std.BindDevice,
+			Flags:  bits.BindWritable | bits.BindDevice,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
 		}, nil, []stub.Call{
@@ -57,7 +57,7 @@ func TestBindMountOp(t *testing.T) {
 		{"mkdirAll ensure", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/bin/"),
-			Flags:  std.BindEnsure,
+			Flags:  bits.BindEnsure,
 		}, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/bin/", os.FileMode(0700)}, nil, stub.UniqueError(4)),
 		}, stub.UniqueError(4), nil, nil},
@@ -65,7 +65,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success ensure", new(Params), &BindMountOp{
 			Source: check.MustAbs("/bin/"),
 			Target: check.MustAbs("/usr/bin/"),
-			Flags:  std.BindEnsure,
+			Flags:  bits.BindEnsure,
 		}, []stub.Call{
 			call("mkdirAll", stub.ExpectArgs{"/bin/", os.FileMode(0700)}, nil, nil),
 			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
@@ -79,7 +79,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success device ro", new(Params), &BindMountOp{
 			Source: check.MustAbs("/dev/null"),
 			Target: check.MustAbs("/dev/null"),
-			Flags:  std.BindDevice,
+			Flags:  bits.BindDevice,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
 		}, nil, []stub.Call{
@@ -92,7 +92,7 @@ func TestBindMountOp(t *testing.T) {
 		{"success device", new(Params), &BindMountOp{
 			Source: check.MustAbs("/dev/null"),
 			Target: check.MustAbs("/dev/null"),
-			Flags:  std.BindWritable | std.BindDevice,
+			Flags:  bits.BindWritable | bits.BindDevice,
 		}, []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
 		}, nil, []stub.Call{
@@ -182,7 +182,7 @@ func TestBindMountOp(t *testing.T) {
 		{"zero", new(BindMountOp), false},
 		{"nil source", &BindMountOp{Target: check.MustAbs("/")}, false},
 		{"nil target", &BindMountOp{Source: check.MustAbs("/")}, false},
-		{"flag optional ensure", &BindMountOp{Source: check.MustAbs("/"), Target: check.MustAbs("/"), Flags: std.BindOptional | std.BindEnsure}, false},
+		{"flag optional ensure", &BindMountOp{Source: check.MustAbs("/"), Target: check.MustAbs("/"), Flags: bits.BindOptional | bits.BindEnsure}, false},
 		{"valid", &BindMountOp{Source: check.MustAbs("/"), Target: check.MustAbs("/")}, true},
 	})
 
@@ -217,7 +217,7 @@ func TestBindMountOp(t *testing.T) {
 		}, &BindMountOp{
 			Source: check.MustAbs("/etc/"),
 			Target: check.MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
-			Flags:  std.BindOptional,
+			Flags:  bits.BindOptional,
 		}, false},
 
 		{"source differs", &BindMountOp{
@@ -256,7 +256,7 @@ func TestBindMountOp(t *testing.T) {
 		{"hostdev", &BindMountOp{
 			Source: check.MustAbs("/dev/"),
 			Target: check.MustAbs("/dev/"),
-			Flags:  std.BindWritable | std.BindDevice,
+			Flags:  bits.BindWritable | bits.BindDevice,
 		}, "mounting", `"/dev/" flags 0x6`},
 	})
 }

container/initdaemon.go

@@ -1,134 +0,0 @@
-package container
-
-import (
-	"context"
-	"encoding/gob"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"slices"
-	"strconv"
-	"syscall"
-	"time"
-
-	"hakurei.app/container/check"
-	"hakurei.app/container/fhs"
-)
-
-func init() { gob.Register(new(DaemonOp)) }
-
-const (
-	// daemonTimeout is the duration a [DaemonOp] is allowed to block before the
-	// [DaemonOp.Target] marker becomes available.
-	daemonTimeout = 5 * time.Second
-)
-
-// Daemon appends an [Op] that starts a daemon in the container and blocks until
-// [DaemonOp.Target] appears.
-func (f *Ops) Daemon(target, path *check.Absolute, args ...string) *Ops {
-	*f = append(*f, &DaemonOp{target, path, args})
-	return f
-}
-
-// DaemonOp starts a daemon in the container and blocks until Target appears.
-type DaemonOp struct {
-	// Pathname indicating readiness of daemon.
-	Target *check.Absolute
-	// Absolute pathname passed to [exec.Cmd].
-	Path *check.Absolute
-	// Arguments (excl. first) passed to [exec.Cmd].
-	Args []string
-}
-
-// earlyTerminationError is returned by [DaemonOp] when a daemon terminates
-// before [DaemonOp.Target] appears.
-type earlyTerminationError struct {
-	// Returned by [DaemonOp.String].
-	op string
-	// Copied from wait4 loop.
-	wstatus syscall.WaitStatus
-}
-
-func (e *earlyTerminationError) Error() string {
-	res := ""
-	switch {
-	case e.wstatus.Exited():
-		res = "exit status " + strconv.Itoa(e.wstatus.ExitStatus())
-	case e.wstatus.Signaled():
-		res = "signal: " + e.wstatus.Signal().String()
-	case e.wstatus.Stopped():
-		res = "stop signal: " + e.wstatus.StopSignal().String()
-		if e.wstatus.StopSignal() == syscall.SIGTRAP && e.wstatus.TrapCause() != 0 {
-			res += " (trap " + strconv.Itoa(e.wstatus.TrapCause()) + ")"
-		}
-	case e.wstatus.Continued():
-		res = "continued"
-	}
-	if e.wstatus.CoreDump() {
-		res += " (core dumped)"
-	}
-	return res
-}
-
-func (e *earlyTerminationError) Message() string { return e.op + " " + e.Error() }
-
-func (d *DaemonOp) Valid() bool                                { return d != nil && d.Target != nil && d.Path != nil }
-func (d *DaemonOp) early(*setupState, syscallDispatcher) error { return nil }
-func (d *DaemonOp) apply(*setupState, syscallDispatcher) error { return nil }
-func (d *DaemonOp) late(state *setupState, k syscallDispatcher) error {
-	cmd := exec.CommandContext(state.Context, d.Path.String(), d.Args...)
-	cmd.Env = state.Env
-	cmd.Dir = fhs.Root
-	if state.IsVerbose() {
-		cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
-	}
-	// WaitDelay: left unset because lifetime is bound by AdoptWaitDelay on cancellation
-	cmd.Cancel = func() error { return cmd.Process.Signal(syscall.SIGTERM) }
-
-	state.Verbosef("starting %s", d.String())
-	if err := k.start(cmd); err != nil {
-		return err
-	}
-
-	deadline := time.Now().Add(daemonTimeout)
-	var wstatusErr error
-
-	for {
-		if _, err := k.stat(d.Target.String()); err != nil {
-			if !errors.Is(err, os.ErrNotExist) {
-				_ = k.signal(cmd, os.Kill)
-				return err
-			}
-
-			if time.Now().After(deadline) {
-				_ = k.signal(cmd, os.Kill)
-				return context.DeadlineExceeded
-			}
-
-			if wstatusErr != nil {
-				return wstatusErr
-			}
-			if wstatus, ok := state.terminated(cmd.Process.Pid); ok {
-				// check once again: process could have satisfied Target between stat and the lookup
-				wstatusErr = &earlyTerminationError{d.String(), wstatus}
-				continue
-			}
-
-			time.Sleep(500 * time.Microsecond)
-			continue
-		}
-
-		state.Verbosef("daemon process %d ready", cmd.Process.Pid)
-		return nil
-	}
-}
-
-func (d *DaemonOp) Is(op Op) bool {
-	vd, ok := op.(*DaemonOp)
-	return ok && d.Valid() && vd.Valid() &&
-		d.Target.Is(vd.Target) && d.Path.Is(vd.Path) &&
-		slices.Equal(d.Args, vd.Args)
-}
-func (*DaemonOp) prefix() (string, bool) { return zeroString, false }
-func (d *DaemonOp) String() string       { return fmt.Sprintf("daemon providing %q", d.Target) }

container/initdaemon_test.go

@@ -1,127 +0,0 @@
-package container
-
-import (
-	"os"
-	"testing"
-
-	"hakurei.app/container/check"
-	"hakurei.app/container/stub"
-	"hakurei.app/message"
-)
-
-func TestEarlyTerminationError(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name string
-		err  error
-		want string
-		msg  string
-	}{
-		{"exited", &earlyTerminationError{
-			`daemon providing "/run/user/1971/pulse/native"`, 127 << 8,
-		}, "exit status 127", `daemon providing "/run/user/1971/pulse/native" exit status 127`},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			if got := tc.err.Error(); got != tc.want {
-				t.Errorf("Error: %q, want %q", got, tc.want)
-			}
-			if got := tc.err.(message.Error).Message(); got != tc.msg {
-				t.Errorf("Message: %s, want %s", got, tc.msg)
-			}
-		})
-	}
-}
-
-func TestDaemonOp(t *testing.T) {
-	t.Parallel()
-
-	checkSimple(t, "DaemonOp.late", []simpleTestCase{
-		{"success", func(k *kstub) error {
-			state := setupState{Params: &Params{Env: []string{"\x00"}}, Context: t.Context(), Msg: k}
-			return (&DaemonOp{
-				Target: check.MustAbs("/run/user/1971/pulse/native"),
-				Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-				Args:   []string{"-v"},
-			}).late(&state, k)
-		}, stub.Expect{Calls: []stub.Call{
-			call("isVerbose", stub.ExpectArgs{}, true, nil),
-			call("verbosef", stub.ExpectArgs{"starting %s", []any{`daemon providing "/run/user/1971/pulse/native"`}}, nil, nil),
-			call("start", stub.ExpectArgs{"/run/current-system/sw/bin/pipewire-pulse", []string{"/run/current-system/sw/bin/pipewire-pulse", "-v"}, []string{"\x00"}, "/"}, &os.Process{Pid: 0xcafe}, nil),
-			call("stat", stub.ExpectArgs{"/run/user/1971/pulse/native"}, isDirFi(false), os.ErrNotExist),
-			call("stat", stub.ExpectArgs{"/run/user/1971/pulse/native"}, isDirFi(false), os.ErrNotExist),
-			call("stat", stub.ExpectArgs{"/run/user/1971/pulse/native"}, isDirFi(false), os.ErrNotExist),
-			call("stat", stub.ExpectArgs{"/run/user/1971/pulse/native"}, isDirFi(false), nil),
-			call("verbosef", stub.ExpectArgs{"daemon process %d ready", []any{0xcafe}}, nil, nil),
-		}}, nil},
-	})
-
-	checkOpsValid(t, []opValidTestCase{
-		{"nil", (*DaemonOp)(nil), false},
-		{"zero", new(DaemonOp), false},
-		{"valid", &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-			Args:   []string{"-v"},
-		}, true},
-	})
-
-	checkOpsBuilder(t, []opsBuilderTestCase{
-		{"pipewire-pulse", new(Ops).Daemon(
-			check.MustAbs("/run/user/1971/pulse/native"),
-			check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"), "-v",
-		), Ops{
-			&DaemonOp{
-				Target: check.MustAbs("/run/user/1971/pulse/native"),
-				Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-				Args:   []string{"-v"},
-			},
-		}},
-	})
-
-	checkOpIs(t, []opIsTestCase{
-		{"zero", new(DaemonOp), new(DaemonOp), false},
-
-		{"args differs", &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-			Args:   []string{"-v"},
-		}, &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-		}, false},
-
-		{"path differs", &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire"),
-		}, &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-		}, false},
-
-		{"target differs", &DaemonOp{
-			Target: check.MustAbs("/run/user/65534/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-		}, &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-		}, false},
-
-		{"equals", &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-		}, &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-			Path:   check.MustAbs("/run/current-system/sw/bin/pipewire-pulse"),
-		}, true},
-	})
-
-	checkOpMeta(t, []opMetaTestCase{
-		{"pipewire-pulse", &DaemonOp{
-			Target: check.MustAbs("/run/user/1971/pulse/native"),
-		}, zeroString, `daemon providing "/run/user/1971/pulse/native"`},
-	})
-}

container/initdev.go

@@ -126,7 +126,6 @@ func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 	return k.mountTmpfs(SourceTmpfs, devShmPath, MS_NOSUID|MS_NODEV, 0, 01777)
 }
-func (d *MountDevOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (d *MountDevOp) Is(op Op) bool {
 	vd, ok := op.(*MountDevOp)

container/initmkdir.go

@@ -27,7 +27,6 @@ func (m *MkdirOp) early(*setupState, syscallDispatcher) error { return nil }
 func (m *MkdirOp) apply(_ *setupState, k syscallDispatcher) error {
 	return k.mkdirAll(toSysroot(m.Path.String()), m.Perm)
 }
-func (m *MkdirOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (m *MkdirOp) Is(op Op) bool {
 	vm, ok := op.(*MkdirOp)

container/initoverlay.go

@@ -205,8 +205,6 @@ func (o *MountOverlayOp) apply(state *setupState, k syscallDispatcher) error {
 	return k.mount(SourceOverlay, target, FstypeOverlay, 0, strings.Join(options, check.SpecialOverlayOption))
 }
 
-func (o *MountOverlayOp) late(*setupState, syscallDispatcher) error { return nil }
-
 func (o *MountOverlayOp) Is(op Op) bool {
 	vo, ok := op.(*MountOverlayOp)
 	return ok && o.Valid() && vo.Valid() &&

container/initplace.go

@@ -57,7 +57,6 @@ func (t *TmpfileOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 	return nil
 }
-func (t *TmpfileOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (t *TmpfileOp) Is(op Op) bool {
 	vt, ok := op.(*TmpfileOp)

container/initproc.go

@@ -28,7 +28,6 @@ func (p *MountProcOp) apply(state *setupState, k syscallDispatcher) error {
 	}
 	return k.mount(SourceProc, target, FstypeProc, MS_NOSUID|MS_NOEXEC|MS_NODEV, zeroString)
 }
-func (p *MountProcOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (p *MountProcOp) Is(op Op) bool {
 	vp, ok := op.(*MountProcOp)

container/initremount.go

@@ -26,7 +26,6 @@ func (*RemountOp) early(*setupState, syscallDispatcher) error { return nil }
 func (r *RemountOp) apply(state *setupState, k syscallDispatcher) error {
 	return k.remount(state, toSysroot(r.Target.String()), r.Flags)
 }
-func (r *RemountOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (r *RemountOp) Is(op Op) bool {
 	vr, ok := op.(*RemountOp)

container/initsymlink.go

@@ -50,8 +50,6 @@ func (l *SymlinkOp) apply(state *setupState, k syscallDispatcher) error {
 	return k.symlink(l.LinkName, target)
 }
 
-func (l *SymlinkOp) late(*setupState, syscallDispatcher) error { return nil }
-
 func (l *SymlinkOp) Is(op Op) bool {
 	vl, ok := op.(*SymlinkOp)
 	return ok && l.Valid() && vl.Valid() &&

container/inittmpfs.go

@@ -48,7 +48,6 @@ func (t *MountTmpfsOp) apply(_ *setupState, k syscallDispatcher) error {
 	}
 	return k.mountTmpfs(t.FSName, toSysroot(t.Path.String()), t.Flags, t.Size, t.Perm)
 }
-func (t *MountTmpfsOp) late(*setupState, syscallDispatcher) error { return nil }
 
 func (t *MountTmpfsOp) Is(op Op) bool {
 	vt, ok := op.(*MountTmpfsOp)

container/landlock.go

@@ -5,7 +5,7 @@ import (
 	"syscall"
 	"unsafe"
 
-	"hakurei.app/container/std"
+	"hakurei.app/container/seccomp"
 )
 
 // include/uapi/linux/landlock.h
@@ -14,8 +14,7 @@ const (
 	LANDLOCK_CREATE_RULESET_VERSION = 1 << iota
 )
 
-// LandlockAccessFS is bitmask of handled filesystem actions.
-type LandlockAccessFS uint64
+type LandlockAccessFS uintptr
 
 const (
 	LANDLOCK_ACCESS_FS_EXECUTE LandlockAccessFS = 1 << iota
@@ -106,8 +105,7 @@ func (f LandlockAccessFS) String() string {
 	}
 }
 
-// LandlockAccessNet is bitmask of handled network actions.
-type LandlockAccessNet uint64
+type LandlockAccessNet uintptr
 
 const (
 	LANDLOCK_ACCESS_NET_BIND_TCP LandlockAccessNet = 1 << iota
@@ -142,8 +140,7 @@ func (f LandlockAccessNet) String() string {
 	}
 }
 
-// LandlockScope is bitmask of scopes restricting a Landlock domain from accessing outside resources.
-type LandlockScope uint64
+type LandlockScope uintptr
 
 const (
 	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET LandlockScope = 1 << iota
@@ -178,7 +175,6 @@ func (f LandlockScope) String() string {
 	}
 }
 
-// RulesetAttr is equivalent to struct landlock_ruleset_attr.
 type RulesetAttr struct {
 	// Bitmask of handled filesystem actions.
 	HandledAccessFS LandlockAccessFS
@@ -216,7 +212,7 @@ func (rulesetAttr *RulesetAttr) Create(flags uintptr) (fd int, err error) {
 		size = unsafe.Sizeof(*rulesetAttr)
 	}
 
-	rulesetFd, _, errno := syscall.Syscall(std.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags)
+	rulesetFd, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags)
 	fd = int(rulesetFd)
 	err = errno
 
@@ -235,7 +231,7 @@ func LandlockGetABI() (int, error) {
 }
 
 func LandlockRestrictSelf(rulesetFd int, flags uintptr) error {
-	r, _, errno := syscall.Syscall(std.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0)
+	r, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0)
 	if r != 0 {
 		return errno
 	}

container/mount_test.go

@@ -69,8 +69,8 @@ func TestRemount(t *testing.T) {
 403 397 0:63 / /host/run/user/1000 rw,nosuid,nodev,relatime master:295 - tmpfs tmpfs rw,size=401060k,nr_inodes=100265,mode=700,uid=1000,gid=100
 404 254 0:46 / /host/mnt/cwd rw,relatime master:96 - overlay overlay rw,lowerdir=/mnt/.ro-cwd,upperdir=/tmp/.cwd/upper,workdir=/tmp/.cwd/work
 405 254 0:47 / /host/mnt/src rw,relatime master:99 - overlay overlay rw,lowerdir=/nix/store/ihcrl3zwvp2002xyylri2wz0drwajx4z-ns0pa7q2b1jpx9pbf1l9352x6rniwxjn-source,upperdir=/tmp/.src/upper,workdir=/tmp/.src/work
-407 253 0:65 / / rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=10000,gid=10000
-408 407 0:65 /sysroot /sysroot rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=10000,gid=10000
+407 253 0:65 / / rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=1000000,gid=1000000
+408 407 0:65 /sysroot /sysroot rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=1000000,gid=1000000
 409 408 253:0 /bin /sysroot/bin rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
 410 408 253:0 /home /sysroot/home rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
 411 408 253:0 /lib64 /sysroot/lib64 rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
@@ -91,24 +91,24 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, stub.UniqueError(5)),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, stub.UniqueError(5)),
 		}}, &os.PathError{Op: "open", Path: "/sysroot/nix", Err: stub.UniqueError(5)}},
 
 		{"readlink", func(k *kstub) error {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", stub.UniqueError(4)),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", stub.UniqueError(4)),
 		}}, stub.UniqueError(4)},
 
 		{"close", func(k *kstub) error {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, stub.UniqueError(3)),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, stub.UniqueError(3)),
 		}}, &os.PathError{Op: "close", Path: "/sysroot/nix", Err: stub.UniqueError(3)}},
 
 		{"mountinfo no match", func(k *kstub) error {
@@ -116,9 +116,9 @@ func TestRemount(t *testing.T) {
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/.hakurei", nil),
 			call("verbosef", stub.ExpectArgs{"target resolves to %q", []any{"/sysroot/.hakurei"}}, nil, nil),
-			call("open", stub.ExpectArgs{"/sysroot/.hakurei", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/.hakurei", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/.hakurei", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/.hakurei", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 		}}, &vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/sysroot/.hakurei")}},
 
@@ -126,9 +126,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile("\x00"), nil),
 		}}, &vfs.DecoderError{Op: "parse", Line: 0, Err: vfs.ErrMountInfoFields}},
 
@@ -136,9 +136,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, stub.UniqueError(2)),
 		}}, stub.UniqueError(2)},
@@ -147,9 +147,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, stub.UniqueError(1)),
@@ -170,9 +170,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, syscall.EACCES),
@@ -183,9 +183,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 		}}, nil},
@@ -194,9 +194,9 @@ func TestRemount(t *testing.T) {
 			return newProcPaths(k, hostPath).remount(nil, "/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
-			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, nil),
@@ -208,9 +208,9 @@ func TestRemount(t *testing.T) {
 		}, stub.Expect{Calls: []stub.Call{
 			call("evalSymlinks", stub.ExpectArgs{"/sysroot/.nix"}, "/sysroot/NIX", nil),
 			call("verbosef", stub.ExpectArgs{"target resolves to %q", []any{"/sysroot/NIX"}}, nil, nil),
-			call("open", stub.ExpectArgs{"/sysroot/NIX", 0x280000, uint32(0)}, 0xdead, nil),
-			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/57005"}, "/sysroot/nix", nil),
-			call("close", stub.ExpectArgs{0xdead}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/NIX", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
 			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
 			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, nil),

container/params.go

@@ -9,13 +9,13 @@ import (
 )
 
 // Setup appends the read end of a pipe for setup params transmission and returns its fd.
-func Setup(extraFiles *[]*os.File) (int, *os.File, error) {
+func Setup(extraFiles *[]*os.File) (int, *gob.Encoder, error) {
 	if r, w, err := os.Pipe(); err != nil {
 		return -1, nil, err
 	} else {
 		fd := 3 + len(*extraFiles)
 		*extraFiles = append(*extraFiles, r)
-		return fd, w, nil
+		return fd, gob.NewEncoder(w), nil
 	}
 }
 

container/params_test.go

@@ -1,7 +1,6 @@
 package container_test
 
 import (
-	"encoding/gob"
 	"errors"
 	"os"
 	"slices"
@@ -56,20 +55,16 @@ func TestSetupReceive(t *testing.T) {
 	t.Run("setup receive", func(t *testing.T) {
 		check := func(t *testing.T, useNilFdp bool) {
 			const key = "TEST_SETUP_RECEIVE"
-			payload := []uint64{syscall.MS_MGC_VAL, syscall.MS_MGC_MSK, syscall.MS_ASYNC, syscall.MS_ACTIVE}
+			payload := []int{syscall.MS_MGC_VAL, syscall.MS_MGC_MSK, syscall.MS_ASYNC, syscall.MS_ACTIVE}
 
 			encoderDone := make(chan error, 1)
 			extraFiles := make([]*os.File, 0, 1)
-			deadline, _ := t.Deadline()
-			if fd, f, err := container.Setup(&extraFiles); err != nil {
+			if fd, encoder, err := container.Setup(&extraFiles); err != nil {
 				t.Fatalf("Setup: error = %v", err)
 			} else if fd != 3 {
 				t.Fatalf("Setup: fd = %d, want 3", fd)
 			} else {
-				if err = f.SetDeadline(deadline); err != nil {
-					t.Fatal(err.Error())
-				}
-				go func() { encoderDone <- gob.NewEncoder(f).Encode(payload) }()
+				go func() { encoderDone <- encoder.Encode(payload) }()
 			}
 
 			if len(extraFiles) != 1 {
@@ -86,7 +81,7 @@ func TestSetupReceive(t *testing.T) {
 			}
 
 			var (
-				gotPayload []uint64
+				gotPayload []int
 				fdp        *uintptr
 			)
 			if !useNilFdp {

container/path_test.go

@@ -173,8 +173,8 @@ func TestProcPaths(t *testing.T) {
 			}
 		})
 		t.Run("fd", func(t *testing.T) {
-			want := "/host/proc/self/fd/2147483647"
-			if got := hostProc.fd(math.MaxInt32); got != want {
+			want := "/host/proc/self/fd/9223372036854775807"
+			if got := hostProc.fd(math.MaxInt64); got != want {
 				t.Errorf("stdout: %q, want %q", got, want)
 			}
 		})

container/seccomp/hash_amd64_test.go

@@ -1,8 +1,8 @@
 package seccomp_test
 
 import (
+	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
-	. "hakurei.app/container/std"
 )
 
 var bpfExpected = bpfLookup{

container/seccomp/hash_arm64_test.go

@@ -1,8 +1,8 @@
 package seccomp_test
 
 import (
+	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
-	. "hakurei.app/container/std"
 )
 
 var bpfExpected = bpfLookup{

container/seccomp/hash_test.go

@@ -4,14 +4,14 @@ import (
 	"crypto/sha512"
 	"encoding/hex"
 
+	"hakurei.app/container/bits"
 	"hakurei.app/container/seccomp"
-	"hakurei.app/container/std"
 )
 
 type (
 	bpfPreset = struct {
 		seccomp.ExportFlag
-		std.FilterPreset
+		bits.FilterPreset
 	}
 	bpfLookup map[bpfPreset][sha512.Size]byte
 )

container/seccomp/libseccomp-helper.c

@@ -9,130 +9,136 @@
 
 #define LEN(arr) (sizeof(arr) / sizeof((arr)[0]))
 
-int32_t hakurei_scmp_make_filter(
-    int *ret_p, uintptr_t allocate_p,
-    uint32_t arch, uint32_t multiarch,
-    struct hakurei_syscall_rule *rules,
-    size_t rules_sz, hakurei_export_flag flags) {
-    int i;
-    int last_allowed_family;
-    int disallowed;
-    struct hakurei_syscall_rule *rule;
-    void *buf;
-    size_t len = 0;
+int32_t hakurei_scmp_make_filter(int *ret_p, uintptr_t allocate_p,
+                                 uint32_t arch, uint32_t multiarch,
+                                 struct hakurei_syscall_rule *rules,
+                                 size_t rules_sz, hakurei_export_flag flags) {
+  int i;
+  int last_allowed_family;
+  int disallowed;
+  struct hakurei_syscall_rule *rule;
+  void *buf;
+  size_t len = 0;
 
-    int32_t res = 0; /* refer to resPrefix for message */
+  int32_t res = 0; /* refer to resPrefix for message */
 
-    /* Blocklist all but unix, inet, inet6 and netlink */
-    struct {
-        int family;
-        hakurei_export_flag flags_mask;
-    } socket_family_allowlist[] = {
-        /* NOTE: Keep in numerical order */
-        {AF_UNSPEC, 0},
-        {AF_LOCAL, 0},
-        {AF_INET, 0},
-        {AF_INET6, 0},
-        {AF_NETLINK, 0},
-        {AF_CAN, HAKUREI_EXPORT_CAN},
-        {AF_BLUETOOTH, HAKUREI_EXPORT_BLUETOOTH},
-    };
+  /* Blocklist all but unix, inet, inet6 and netlink */
+  struct {
+    int family;
+    hakurei_export_flag flags_mask;
+  } socket_family_allowlist[] = {
+      /* NOTE: Keep in numerical order */
+      {AF_UNSPEC, 0},
+      {AF_LOCAL, 0},
+      {AF_INET, 0},
+      {AF_INET6, 0},
+      {AF_NETLINK, 0},
+      {AF_CAN, HAKUREI_EXPORT_CAN},
+      {AF_BLUETOOTH, HAKUREI_EXPORT_BLUETOOTH},
+  };
 
-    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
-    if (ctx == NULL) {
-        res = 1;
+  scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
+  if (ctx == NULL) {
+    res = 1;
+    goto out;
+  } else
+    errno = 0;
+
+  /* We only really need to handle arches on multiarch systems.
+   * If only one arch is supported the default is fine */
+  if (arch != 0) {
+    /* This *adds* the target arch, instead of replacing the
+     * native one. This is not ideal, because we'd like to only
+     * allow the target arch, but we can't really disallow the
+     * native arch at this point, because then bubblewrap
+     * couldn't continue running. */
+    *ret_p = seccomp_arch_add(ctx, arch);
+    if (*ret_p < 0 && *ret_p != -EEXIST) {
+      res = 2;
+      goto out;
+    }
+
+    if (flags & HAKUREI_EXPORT_MULTIARCH && multiarch != 0) {
+      *ret_p = seccomp_arch_add(ctx, multiarch);
+      if (*ret_p < 0 && *ret_p != -EEXIST) {
+        res = 3;
         goto out;
-    } else
-        errno = 0;
+      }
+    }
+  }
 
-    /* We only really need to handle arches on multiarch systems.
-     * If only one arch is supported the default is fine */
-    if (arch != 0) {
-        /* This *adds* the target arch, instead of replacing the
-         * native one. This is not ideal, because we'd like to only
-         * allow the target arch, but we can't really disallow the
-         * native arch at this point, because then bubblewrap
-         * couldn't continue running. */
-        *ret_p = seccomp_arch_add(ctx, arch);
-        if (*ret_p < 0 && *ret_p != -EEXIST) {
-            res = 2;
-            goto out;
-        }
+  for (i = 0; i < rules_sz; i++) {
+    rule = &rules[i];
+    assert(rule->m_errno == EPERM || rule->m_errno == ENOSYS);
 
-        if (flags & HAKUREI_EXPORT_MULTIARCH && multiarch != 0) {
-            *ret_p = seccomp_arch_add(ctx, multiarch);
-            if (*ret_p < 0 && *ret_p != -EEXIST) {
-                res = 3;
-                goto out;
-            }
-        }
+    if (rule->arg)
+      *ret_p = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(rule->m_errno),
+                                rule->syscall, 1, *rule->arg);
+    else
+      *ret_p = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(rule->m_errno),
+                                rule->syscall, 0);
+
+    if (*ret_p == -EFAULT) {
+      res = 4;
+      goto out;
+    } else if (*ret_p < 0) {
+      res = 5;
+      goto out;
+    }
+  }
+
+  /* Socket filtering doesn't work on e.g. i386, so ignore failures here
+   * However, we need to user seccomp_rule_add_exact to avoid libseccomp doing
+   * something else: https://github.com/seccomp/libseccomp/issues/8 */
+  last_allowed_family = -1;
+  for (i = 0; i < LEN(socket_family_allowlist); i++) {
+    if (socket_family_allowlist[i].flags_mask != 0 &&
+        (socket_family_allowlist[i].flags_mask & flags) !=
+            socket_family_allowlist[i].flags_mask)
+      continue;
+
+    for (disallowed = last_allowed_family + 1;
+         disallowed < socket_family_allowlist[i].family; disallowed++) {
+      /* Blocklist the in-between valid families */
+      seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EAFNOSUPPORT),
+                             SCMP_SYS(socket), 1,
+                             SCMP_A0(SCMP_CMP_EQ, disallowed));
+    }
+    last_allowed_family = socket_family_allowlist[i].family;
+  }
+  /* Blocklist the rest */
+  seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EAFNOSUPPORT), SCMP_SYS(socket), 1,
+                         SCMP_A0(SCMP_CMP_GE, last_allowed_family + 1));
+
+  if (allocate_p == 0) {
+    *ret_p = seccomp_load(ctx);
+    if (*ret_p != 0) {
+      res = 7;
+      goto out;
+    }
+  } else {
+    *ret_p = seccomp_export_bpf_mem(ctx, NULL, &len);
+    if (*ret_p != 0) {
+      res = 6;
+      goto out;
     }
 
-    for (i = 0; i < rules_sz; i++) {
-        rule = &rules[i];
-        assert(rule->m_errno == EPERM || rule->m_errno == ENOSYS);
-
-        if (rule->arg)
-            *ret_p = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(rule->m_errno), rule->syscall, 1, *rule->arg);
-        else
-            *ret_p = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(rule->m_errno), rule->syscall, 0);
-
-        if (*ret_p == -EFAULT) {
-            res = 4;
-            goto out;
-        } else if (*ret_p < 0) {
-            res = 5;
-            goto out;
-        }
+    buf = hakurei_scmp_allocate(allocate_p, len);
+    if (buf == NULL) {
+      res = 4;
+      goto out;
     }
 
-    /* Socket filtering doesn't work on e.g. i386, so ignore failures here
-     * However, we need to user seccomp_rule_add_exact to avoid libseccomp doing
-     * something else: https://github.com/seccomp/libseccomp/issues/8 */
-    last_allowed_family = -1;
-    for (i = 0; i < LEN(socket_family_allowlist); i++) {
-        if (socket_family_allowlist[i].flags_mask != 0 &&
-            (socket_family_allowlist[i].flags_mask & flags) != socket_family_allowlist[i].flags_mask)
-            continue;
-
-        for (disallowed = last_allowed_family + 1; disallowed < socket_family_allowlist[i].family; disallowed++) {
-            /* Blocklist the in-between valid families */
-            seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EAFNOSUPPORT), SCMP_SYS(socket), 1, SCMP_A0(SCMP_CMP_EQ, disallowed));
-        }
-        last_allowed_family = socket_family_allowlist[i].family;
-    }
-    /* Blocklist the rest */
-    seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EAFNOSUPPORT), SCMP_SYS(socket), 1, SCMP_A0(SCMP_CMP_GE, last_allowed_family + 1));
-
-    if (allocate_p == 0) {
-        *ret_p = seccomp_load(ctx);
-        if (*ret_p != 0) {
-            res = 7;
-            goto out;
-        }
-    } else {
-        *ret_p = seccomp_export_bpf_mem(ctx, NULL, &len);
-        if (*ret_p != 0) {
-            res = 6;
-            goto out;
-        }
-
-        buf = hakurei_scmp_allocate(allocate_p, len);
-        if (buf == NULL) {
-            res = 4;
-            goto out;
-        }
-
-        *ret_p = seccomp_export_bpf_mem(ctx, buf, &len);
-        if (*ret_p != 0) {
-            res = 6;
-            goto out;
-        }
+    *ret_p = seccomp_export_bpf_mem(ctx, buf, &len);
+    if (*ret_p != 0) {
+      res = 6;
+      goto out;
     }
+  }
 
 out:
-    if (ctx)
-        seccomp_release(ctx);
+  if (ctx)
+    seccomp_release(ctx);
 
-    return res;
+  return res;
 }

container/seccomp/libseccomp-helper.h

@@ -1,26 +1,25 @@
 #include <seccomp.h>
 #include <stdint.h>
 
-#if (SCMP_VER_MAJOR < 2) || (SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 5) || \
+#if (SCMP_VER_MAJOR < 2) || (SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 5) ||     \
     (SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR == 5 && SCMP_VER_MICRO < 1)
 #error This package requires libseccomp >= v2.5.1
 #endif
 
 typedef enum {
-    HAKUREI_EXPORT_MULTIARCH = 1 << 0,
-    HAKUREI_EXPORT_CAN = 1 << 1,
-    HAKUREI_EXPORT_BLUETOOTH = 1 << 2,
+  HAKUREI_EXPORT_MULTIARCH = 1 << 0,
+  HAKUREI_EXPORT_CAN = 1 << 1,
+  HAKUREI_EXPORT_BLUETOOTH = 1 << 2,
 } hakurei_export_flag;
 
 struct hakurei_syscall_rule {
-    int syscall;
-    int m_errno;
-    struct scmp_arg_cmp *arg;
+  int syscall;
+  int m_errno;
+  struct scmp_arg_cmp *arg;
 };
 
 extern void *hakurei_scmp_allocate(uintptr_t f, size_t len);
-int32_t hakurei_scmp_make_filter(
-    int *ret_p, uintptr_t allocate_p,
-    uint32_t arch, uint32_t multiarch,
-    struct hakurei_syscall_rule *rules,
-    size_t rules_sz, hakurei_export_flag flags);
+int32_t hakurei_scmp_make_filter(int *ret_p, uintptr_t allocate_p,
+                                 uint32_t arch, uint32_t multiarch,
+                                 struct hakurei_syscall_rule *rules,
+                                 size_t rules_sz, hakurei_export_flag flags);

container/seccomp/libseccomp.go

@@ -14,8 +14,6 @@ import (
 	"runtime/cgo"
 	"syscall"
 	"unsafe"
-
-	"hakurei.app/container/std"
 )
 
 // ErrInvalidRules is returned for a zero-length rules slice.
@@ -56,16 +54,22 @@ func (e *LibraryError) Is(err error) bool {
 }
 
 type (
-	// scmpUint is equivalent to [std.ScmpUint].
-	scmpUint = C.uint
-	// scmpInt is equivalent to [std.ScmpInt].
-	scmpInt = C.int
-
-	// syscallRule is equivalent to [std.NativeRule].
-	syscallRule = C.struct_hakurei_syscall_rule
+	// ScmpSyscall represents a syscall number passed to libseccomp via [NativeRule.Syscall].
+	ScmpSyscall = C.int
+	// ScmpErrno represents an errno value passed to libseccomp via [NativeRule.Errno].
+	ScmpErrno = C.int
 )
 
-// ExportFlag configures filter behaviour that are not implemented as rules.
+// A NativeRule specifies an arch-specific action taken by seccomp under certain conditions.
+type NativeRule struct {
+	// Syscall is the arch-dependent syscall number to act against.
+	Syscall ScmpSyscall
+	// Errno is the errno value to return when the condition is satisfied.
+	Errno ScmpErrno
+	// Arg is the optional struct scmp_arg_cmp passed to libseccomp.
+	Arg *ScmpArgCmp
+}
+
 type ExportFlag = C.hakurei_export_flag
 
 const (
@@ -98,9 +102,9 @@ func hakurei_scmp_allocate(f C.uintptr_t, len C.size_t) (buf unsafe.Pointer) {
 	return cgo.Handle(f).Value().(cbAllocateBuffer)(len)
 }
 
-// makeFilter generates a bpf program from a slice of [std.NativeRule] and writes the resulting byte slice to p.
+// makeFilter generates a bpf program from a slice of [NativeRule] and writes the resulting byte slice to p.
 // The filter is installed to the current process if p is nil.
-func makeFilter(rules []std.NativeRule, flags ExportFlag, p *[]byte) error {
+func makeFilter(rules []NativeRule, flags ExportFlag, p *[]byte) error {
 	if len(rules) == 0 {
 		return ErrInvalidRules
 	}
@@ -148,7 +152,7 @@ func makeFilter(rules []std.NativeRule, flags ExportFlag, p *[]byte) error {
 	res, err := C.hakurei_scmp_make_filter(
 		&ret, C.uintptr_t(allocateP),
 		arch, multiarch,
-		(*syscallRule)(unsafe.Pointer(&rules[0])),
+		(*C.struct_hakurei_syscall_rule)(unsafe.Pointer(&rules[0])),
 		C.size_t(len(rules)),
 		flags,
 	)
@@ -163,27 +167,20 @@ func makeFilter(rules []std.NativeRule, flags ExportFlag, p *[]byte) error {
 	return err
 }
 
-// Export generates a bpf program from a slice of [std.NativeRule].
+// Export generates a bpf program from a slice of [NativeRule].
 // Errors returned by libseccomp is wrapped in [LibraryError].
-func Export(rules []std.NativeRule, flags ExportFlag) (data []byte, err error) {
+func Export(rules []NativeRule, flags ExportFlag) (data []byte, err error) {
 	err = makeFilter(rules, flags, &data)
 	return
 }
 
-// Load generates a bpf program from a slice of [std.NativeRule] and enforces it on the current process.
+// Load generates a bpf program from a slice of [NativeRule] and enforces it on the current process.
 // Errors returned by libseccomp is wrapped in [LibraryError].
-func Load(rules []std.NativeRule, flags ExportFlag) error { return makeFilter(rules, flags, nil) }
+func Load(rules []NativeRule, flags ExportFlag) error { return makeFilter(rules, flags, nil) }
 
-type (
-	// Comparison operators.
-	scmpCompare = C.enum_scmp_compare
-
-	// Argument datum.
-	scmpDatum = C.scmp_datum_t
-
-	// Argument / Value comparison definition.
-	scmpArgCmp = C.struct_scmp_arg_cmp
-)
+// ScmpCompare is the equivalent of scmp_compare;
+// Comparison operators
+type ScmpCompare = C.enum_scmp_compare
 
 const (
 	_SCMP_CMP_MIN = C._SCMP_CMP_MIN
@@ -206,19 +203,33 @@ const (
 	_SCMP_CMP_MAX = C._SCMP_CMP_MAX
 )
 
+// ScmpDatum is the equivalent of scmp_datum_t;
+// Argument datum
+type ScmpDatum uint64
+
+// ScmpArgCmp is the equivalent of struct scmp_arg_cmp;
+// Argument / Value comparison definition
+type ScmpArgCmp struct {
+	// argument number, starting at 0
+	Arg C.uint
+	// the comparison op, e.g. SCMP_CMP_*
+	Op ScmpCompare
+
+	DatumA, DatumB ScmpDatum
+}
+
 const (
-	// PersonaLinux is passed in a [std.ScmpDatum] for filtering calls to syscall.SYS_PERSONALITY.
+	// PersonaLinux is passed in a [ScmpDatum] for filtering calls to syscall.SYS_PERSONALITY.
 	PersonaLinux = C.PER_LINUX
-	// PersonaLinux32 is passed in a [std.ScmpDatum] for filtering calls to syscall.SYS_PERSONALITY.
+	// PersonaLinux32 is passed in a [ScmpDatum] for filtering calls to syscall.SYS_PERSONALITY.
 	PersonaLinux32 = C.PER_LINUX32
 )
 
 // syscallResolveName resolves a syscall number by name via seccomp_syscall_resolve_name.
 // This function is only for testing the lookup tables and included here for convenience.
-func syscallResolveName(s string) (num std.ScmpSyscall, ok bool) {
+func syscallResolveName(s string) (trap int) {
 	v := C.CString(s)
-	num = std.ScmpSyscall(C.seccomp_syscall_resolve_name(v))
+	trap = int(C.seccomp_syscall_resolve_name(v))
 	C.free(unsafe.Pointer(v))
-	ok = num != C.__NR_SCMP_ERROR
 	return
 }

container/seccomp/libseccomp_test.go

@@ -6,8 +6,8 @@ import (
 	"syscall"
 	"testing"
 
+	. "hakurei.app/container/bits"
 	. "hakurei.app/container/seccomp"
-	. "hakurei.app/container/std"
 )
 
 func TestLibraryError(t *testing.T) {

container/seccomp/mksysnum_linux.pl

@@ -9,7 +9,6 @@ use POSIX ();
 my $command = "mksysnum_linux.pl ". join(' ', @ARGV);
 my $uname_arch = (POSIX::uname)[4];
 my %syscall_cutoff_arch = (
-	"x86" => 340,
 	"x86_64" => 302,
 	"aarch64" => 281,
 );
@@ -18,11 +17,11 @@ print <<EOF;
 // $command
 // Code generated by the command above; DO NOT EDIT.
 
-package std
+package seccomp
 
 import . "syscall"
 
-var syscallNum = map[string]ScmpSyscall{
+var syscallNum = map[string]int{
 EOF
 
 my $offset = 0;
@@ -37,14 +36,16 @@ sub fmt {
 	}
 	(my $name_upper = $name) =~ y/a-z/A-Z/;
 	$num = $num + $offset;
-	if($num > $syscall_cutoff_arch{$uname_arch} && $state == 0){ # not wired in Go standard library
-		print " SYS_$name_upper = $num\n";
+	if($num > $syscall_cutoff_arch{$uname_arch}){ # not wired in Go standard library
+		if($state < 0){
+			print "	\"$name\": SYS_$name_upper,\n";
+		}
+		else{
+			print " SYS_$name_upper = $num;\n";
+		}
 	}
-	elsif($state == -1){
-		print "	\"$name\": SNR_$name_upper,\n";
-	}
-	elsif($state == 1){
-		print " SNR_$name_upper ScmpSyscall = SYS_$name_upper\n";
+	elsif($state < 0){
+		print "	\"$name\": SYS_$name_upper,\n";
 	}
 	else{
 		return;
@@ -79,16 +80,10 @@ while(<GCC>){
 	}
 }
 
-if($state == -1){
+if($state < 0){
+	$state = $state + 1;
 	print "}\n\nconst (\n";
+	goto GENERATE;
 }
-elsif($state == 0){
-	print ")\n\nconst (\n";
-}
-elsif($state == 1){
-	print ")";
-	exit;
-}
-++$state;
-goto GENERATE;
 
+print ")";

container/seccomp/presets.go

@@ -5,32 +5,32 @@ package seccomp
 import (
 	. "syscall"
 
-	. "hakurei.app/container/std"
+	"hakurei.app/container/bits"
 )
 
-func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
+func Preset(presets bits.FilterPreset, flags ExportFlag) (rules []NativeRule) {
 	allowedPersonality := PersonaLinux
-	if presets&PresetLinux32 != 0 {
+	if presets&bits.PresetLinux32 != 0 {
 		allowedPersonality = PersonaLinux32
 	}
 	presetDevelFinal := presetDevel(ScmpDatum(allowedPersonality))
 
 	l := len(presetCommon)
-	if presets&PresetDenyNS != 0 {
+	if presets&bits.PresetDenyNS != 0 {
 		l += len(presetNamespace)
 	}
-	if presets&PresetDenyTTY != 0 {
+	if presets&bits.PresetDenyTTY != 0 {
 		l += len(presetTTY)
 	}
-	if presets&PresetDenyDevel != 0 {
+	if presets&bits.PresetDenyDevel != 0 {
 		l += len(presetDevelFinal)
 	}
 	if flags&AllowMultiarch == 0 {
 		l += len(presetEmu)
 	}
-	if presets&PresetExt != 0 {
+	if presets&bits.PresetExt != 0 {
 		l += len(presetCommonExt)
-		if presets&PresetDenyNS != 0 {
+		if presets&bits.PresetDenyNS != 0 {
 			l += len(presetNamespaceExt)
 		}
 		if flags&AllowMultiarch == 0 {
@@ -40,21 +40,21 @@ func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
 
 	rules = make([]NativeRule, 0, l)
 	rules = append(rules, presetCommon...)
-	if presets&PresetDenyNS != 0 {
+	if presets&bits.PresetDenyNS != 0 {
 		rules = append(rules, presetNamespace...)
 	}
-	if presets&PresetDenyTTY != 0 {
+	if presets&bits.PresetDenyTTY != 0 {
 		rules = append(rules, presetTTY...)
 	}
-	if presets&PresetDenyDevel != 0 {
+	if presets&bits.PresetDenyDevel != 0 {
 		rules = append(rules, presetDevelFinal...)
 	}
 	if flags&AllowMultiarch == 0 {
 		rules = append(rules, presetEmu...)
 	}
-	if presets&PresetExt != 0 {
+	if presets&bits.PresetExt != 0 {
 		rules = append(rules, presetCommonExt...)
-		if presets&PresetDenyNS != 0 {
+		if presets&bits.PresetDenyNS != 0 {
 			rules = append(rules, presetNamespaceExt...)
 		}
 		if flags&AllowMultiarch == 0 {
@@ -68,121 +68,121 @@ func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
 var (
 	presetCommon = []NativeRule{
 		/* Block dmesg */
-		{Syscall: SNR_SYSLOG, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_SYSLOG), ScmpErrno(EPERM), nil},
 		/* Useless old syscall */
-		{Syscall: SNR_USELIB, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_USELIB), ScmpErrno(EPERM), nil},
 		/* Don't allow disabling accounting */
-		{Syscall: SNR_ACCT, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_ACCT), ScmpErrno(EPERM), nil},
 		/* Don't allow reading current quota use */
-		{Syscall: SNR_QUOTACTL, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_QUOTACTL), ScmpErrno(EPERM), nil},
 
 		/* Don't allow access to the kernel keyring */
-		{Syscall: SNR_ADD_KEY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_KEYCTL, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_REQUEST_KEY, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_ADD_KEY), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_KEYCTL), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_REQUEST_KEY), ScmpErrno(EPERM), nil},
 
 		/* Scary VM/NUMA ops */
-		{Syscall: SNR_MOVE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_MBIND, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_GET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_MIGRATE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_MOVE_PAGES), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_MBIND), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_GET_MEMPOLICY), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SET_MEMPOLICY), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_MIGRATE_PAGES), ScmpErrno(EPERM), nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetCommonExt = []NativeRule{
 		/* system calls for changing the system clock */
-		{Syscall: SNR_ADJTIMEX, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_ADJTIME, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_ADJTIME64, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_SETTIME, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLOCK_SETTIME64, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETTIMEOFDAY, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_ADJTIMEX), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CLOCK_ADJTIME), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CLOCK_ADJTIME64), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CLOCK_SETTIME), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CLOCK_SETTIME64), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETTIMEOFDAY), ScmpErrno(EPERM), nil},
 
 		/* loading and unloading of kernel modules */
-		{Syscall: SNR_DELETE_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FINIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_INIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_DELETE_MODULE), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_FINIT_MODULE), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_INIT_MODULE), ScmpErrno(EPERM), nil},
 
 		/* system calls for rebooting and reboot preparation */
-		{Syscall: SNR_KEXEC_FILE_LOAD, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_KEXEC_LOAD, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_REBOOT, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_KEXEC_FILE_LOAD), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_KEXEC_LOAD), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_REBOOT), ScmpErrno(EPERM), nil},
 
 		/* system calls for enabling/disabling swap devices */
-		{Syscall: SNR_SWAPOFF, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SWAPON, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_SWAPOFF), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SWAPON), ScmpErrno(EPERM), nil},
 	}
 
 	presetNamespace = []NativeRule{
 		/* Don't allow subnamespace setups: */
-		{Syscall: SNR_UNSHARE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETNS, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_MOUNT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_UMOUNT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_UMOUNT2, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_PIVOT_ROOT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CHROOT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CLONE, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: cloneArg, Op: SCMP_CMP_MASKED_EQ, DatumA: CLONE_NEWUSER, DatumB: CLONE_NEWUSER}},
+		{ScmpSyscall(SYS_UNSHARE), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETNS), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_MOUNT), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_UMOUNT), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_UMOUNT2), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_PIVOT_ROOT), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CHROOT), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CLONE), ScmpErrno(EPERM),
+			&ScmpArgCmp{cloneArg, SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER}},
 
 		/* seccomp can't look into clone3()'s struct clone_args to check whether
 		 * the flags are OK, so we have no choice but to block clone3().
 		 * Return ENOSYS so user-space will fall back to clone().
 		 * (CVE-2021-41133; see also https://github.com/moby/moby/commit/9f6b562d)
 		 */
-		{Syscall: SNR_CLONE3, Errno: ScmpErrno(ENOSYS), Arg: nil},
+		{ScmpSyscall(SYS_CLONE3), ScmpErrno(ENOSYS), nil},
 
 		/* New mount manipulation APIs can also change our VFS. There's no
 		 * legitimate reason to do these in the sandbox, so block all of them
 		 * rather than thinking about which ones might be dangerous.
 		 * (CVE-2021-41133) */
-		{Syscall: SNR_OPEN_TREE, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_MOVE_MOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSOPEN, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSCONFIG, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSMOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_FSPICK, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_MOUNT_SETATTR, Errno: ScmpErrno(ENOSYS), Arg: nil},
+		{ScmpSyscall(SYS_OPEN_TREE), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_MOVE_MOUNT), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_FSOPEN), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_FSCONFIG), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_FSMOUNT), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_FSPICK), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_MOUNT_SETATTR), ScmpErrno(ENOSYS), nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetNamespaceExt = []NativeRule{
 		/* changing file ownership */
-		{Syscall: SNR_CHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_CHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FCHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_FCHOWNAT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_LCHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_LCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_CHOWN), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_CHOWN32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_FCHOWN), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_FCHOWN32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_FCHOWNAT), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_LCHOWN), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_LCHOWN32), ScmpErrno(EPERM), nil},
 
 		/* system calls for changing user ID and group ID credentials */
-		{Syscall: SNR_SETGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETGROUPS, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETGROUPS32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETRESUID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETREUID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{Syscall: SNR_SETUID32, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_SETGID), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETGID32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETGROUPS), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETGROUPS32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETREGID), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETREGID32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETRESGID), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETRESGID32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETRESUID), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETRESUID32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETREUID), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETREUID32), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETUID), ScmpErrno(EPERM), nil},
+		{ScmpSyscall(SYS_SETUID32), ScmpErrno(EPERM), nil},
 	}
 
 	presetTTY = []NativeRule{
 		/* Don't allow faking input to the controlling tty (CVE-2017-5226) */
-		{Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCSTI}},
+		{ScmpSyscall(SYS_IOCTL), ScmpErrno(EPERM),
+			&ScmpArgCmp{1, SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, TIOCSTI}},
 		/* In the unlikely event that the controlling tty is a Linux virtual
 		 * console (/dev/tty2 or similar), copy/paste operations have an effect
 		 * similar to TIOCSTI (CVE-2023-28100) */
-		{Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCLINUX}},
+		{ScmpSyscall(SYS_IOCTL), ScmpErrno(EPERM),
+			&ScmpArgCmp{1, SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, TIOCLINUX}},
 	}
 
 	presetEmu = []NativeRule{
@@ -190,15 +190,15 @@ var (
 		 * so it's disabled as a hardening measure.
 		 * However, it is required to run old 16-bit applications
 		 * as well as some Wine patches, so it's allowed in multiarch. */
-		{Syscall: SNR_MODIFY_LDT, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_MODIFY_LDT), ScmpErrno(EPERM), nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetEmuExt = []NativeRule{
-		{Syscall: SNR_SUBPAGE_PROT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_SWITCH_ENDIAN, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_VM86, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{Syscall: SNR_VM86OLD, Errno: ScmpErrno(ENOSYS), Arg: nil},
+		{ScmpSyscall(SYS_SUBPAGE_PROT), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_SWITCH_ENDIAN), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_VM86), ScmpErrno(ENOSYS), nil},
+		{ScmpSyscall(SYS_VM86OLD), ScmpErrno(ENOSYS), nil},
 	}
 )
 
@@ -206,11 +206,11 @@ func presetDevel(allowedPersonality ScmpDatum) []NativeRule {
 	return []NativeRule{
 		/* Profiling operations; we expect these to be done by tools from outside
 		 * the sandbox.  In particular perf has been the source of many CVEs. */
-		{Syscall: SNR_PERF_EVENT_OPEN, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_PERF_EVENT_OPEN), ScmpErrno(EPERM), nil},
 		/* Don't allow you to switch to bsd emulation or whatnot */
-		{Syscall: SNR_PERSONALITY, Errno: ScmpErrno(EPERM),
-			Arg: &ScmpArgCmp{Arg: 0, Op: SCMP_CMP_NE, DatumA: allowedPersonality}},
+		{ScmpSyscall(SYS_PERSONALITY), ScmpErrno(EPERM),
+			&ScmpArgCmp{0, SCMP_CMP_NE, allowedPersonality, 0}},
 
-		{Syscall: SNR_PTRACE, Errno: ScmpErrno(EPERM), Arg: nil},
+		{ScmpSyscall(SYS_PTRACE), ScmpErrno(EPERM), nil},
 	}
 }

container/seccomp/presets_386_test.go

@@ -1,27 +0,0 @@
-package seccomp_test
-
-import (
-	. "hakurei.app/container/seccomp"
-	. "hakurei.app/container/std"
-)
-
-var bpfExpected = bpfLookup{
-	{AllowMultiarch | AllowCAN |
-		AllowBluetooth, PresetExt |
-		PresetDenyNS | PresetDenyTTY | PresetDenyDevel |
-		PresetLinux32}: toHash(
-		"e67735d24caba42b6801e829ea4393727a36c5e37b8a51e5648e7886047e8454484ff06872aaef810799c29cbd0c1b361f423ad0ef518e33f68436372cc90eb1"),
-
-	{0, 0}: toHash(
-		"5dbcc08a4a1ccd8c12dd0cf6d9817ea6d4f40246e1db7a60e71a50111c4897d69f6fb6d710382d70c18910c2e4fa2d2aeb2daed835dd2fabe3f71def628ade59"),
-	{0, PresetExt}: toHash(
-		"d6c0f130dbb5c793d1c10f730455701875778138bd2d03ca009d674842fd97a10815a8c539b76b7801a73de19463938701216b756c053ec91cfe304cba04a0ed"),
-	{0, PresetStrict}: toHash(
-		"af7d7b66f2e83f9a850472170c1b83d1371426faa9d0dee4e85b179d3ec75ca92828cb8529eb3012b559497494b2eab4d4b140605e3a26c70dfdbe5efe33c105"),
-	{0, PresetDenyNS | PresetDenyTTY | PresetDenyDevel}: toHash(
-		"adfb4397e6eeae8c477d315d58204aae854d60071687b8df4c758e297780e02deee1af48328cef80e16e4d6ab1a66ef13e42247c3475cf447923f15cbc17a6a6"),
-	{0, PresetExt | PresetDenyDevel}: toHash(
-		"5d641321460cf54a7036a40a08e845082e1f6d65b9dee75db85ef179f2732f321b16aee2258b74273b04e0d24562e8b1e727930a7e787f41eb5c8aaa0bc22793"),
-	{0, PresetExt | PresetDenyNS | PresetDenyDevel}: toHash(
-		"b1f802d39de5897b1e4cb0e82a199f53df0a803ea88e2fd19491fb8c90387c9e2eaa7e323f565fecaa0202a579eb050531f22e6748e04cfd935b8faac35983ec"),
-}

container/seccomp/std_test.go

@@ -1,63 +0,0 @@
-package seccomp
-
-import (
-	"reflect"
-	"testing"
-	"unsafe"
-
-	"hakurei.app/container/std"
-)
-
-func TestSyscallResolveName(t *testing.T) {
-	t.Parallel()
-
-	for name, want := range std.Syscalls() {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			// this checks the std implementation against libseccomp.
-			if got, ok := syscallResolveName(name); !ok || got != want {
-				t.Errorf("syscallResolveName(%q) = %d, want %d", name, got, want)
-			}
-		})
-	}
-}
-
-func TestRuleType(t *testing.T) {
-	assertKind[std.ScmpUint, scmpUint](t)
-	assertKind[std.ScmpInt, scmpInt](t)
-
-	assertSize[std.NativeRule, syscallRule](t)
-	assertKind[std.ScmpDatum, scmpDatum](t)
-	assertKind[std.ScmpCompare, scmpCompare](t)
-	assertSize[std.ScmpArgCmp, scmpArgCmp](t)
-}
-
-// assertSize asserts that native and equivalent are of the same size.
-func assertSize[native, equivalent any](t *testing.T) {
-	t.Helper()
-
-	got, want := unsafe.Sizeof(*new(native)), unsafe.Sizeof(*new(equivalent))
-	if got != want {
-		t.Fatalf("%s: %d, want %d", reflect.TypeFor[native]().Name(), got, want)
-	}
-}
-
-// assertKind asserts that native and equivalent are of the same kind.
-func assertKind[native, equivalent any](t *testing.T) {
-	t.Helper()
-
-	assertSize[native, equivalent](t)
-	nativeType, equivalentType := reflect.TypeFor[native](), reflect.TypeFor[equivalent]()
-	got, want := nativeType.Kind(), equivalentType.Kind()
-
-	if got == reflect.Invalid || want == reflect.Invalid {
-		t.Fatalf("%s: invalid call to assertKind", nativeType.Name())
-	}
-	if got == reflect.Struct {
-		t.Fatalf("%s: struct is unsupported by assertKind", nativeType.Name())
-	}
-	if got != want {
-		t.Fatalf("%s: %s, want %s", nativeType.Name(), nativeType.Kind(), equivalentType.Kind())
-	}
-}

container/seccomp/syscall.go

@@ -1,10 +1,10 @@
-package std
+package seccomp
 
 import "iter"
 
 // Syscalls returns an iterator over all wired syscalls.
-func Syscalls() iter.Seq2[string, ScmpSyscall] {
-	return func(yield func(string, ScmpSyscall) bool) {
+func Syscalls() iter.Seq2[string, int] {
+	return func(yield func(string, int) bool) {
 		for name, num := range syscallNum {
 			if !yield(name, num) {
 				return
@@ -19,7 +19,7 @@ func Syscalls() iter.Seq2[string, ScmpSyscall] {
 }
 
 // SyscallResolveName resolves a syscall number from its string representation.
-func SyscallResolveName(name string) (num ScmpSyscall, ok bool) {
+func SyscallResolveName(name string) (num int, ok bool) {
 	if num, ok = syscallNum[name]; ok {
 		return
 	}

container/seccomp/syscall_extra_linux_amd64.go

@@ -0,0 +1,48 @@
+package seccomp
+
+/*
+#cgo linux pkg-config: --static libseccomp
+
+#include <seccomp.h>
+*/
+import "C"
+
+var syscallNumExtra = map[string]int{
+	"umount":          SYS_UMOUNT,
+	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"vm86":            SYS_VM86,
+	"vm86old":         SYS_VM86OLD,
+	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
+	"clock_settime64": SYS_CLOCK_SETTIME64,
+	"chown32":         SYS_CHOWN32,
+	"fchown32":        SYS_FCHOWN32,
+	"lchown32":        SYS_LCHOWN32,
+	"setgid32":        SYS_SETGID32,
+	"setgroups32":     SYS_SETGROUPS32,
+	"setregid32":      SYS_SETREGID32,
+	"setresgid32":     SYS_SETRESGID32,
+	"setresuid32":     SYS_SETRESUID32,
+	"setreuid32":      SYS_SETREUID32,
+	"setuid32":        SYS_SETUID32,
+}
+
+const (
+	SYS_UMOUNT          = C.__SNR_umount
+	SYS_SUBPAGE_PROT    = C.__SNR_subpage_prot
+	SYS_SWITCH_ENDIAN   = C.__SNR_switch_endian
+	SYS_VM86            = C.__SNR_vm86
+	SYS_VM86OLD         = C.__SNR_vm86old
+	SYS_CLOCK_ADJTIME64 = C.__SNR_clock_adjtime64
+	SYS_CLOCK_SETTIME64 = C.__SNR_clock_settime64
+	SYS_CHOWN32         = C.__SNR_chown32
+	SYS_FCHOWN32        = C.__SNR_fchown32
+	SYS_LCHOWN32        = C.__SNR_lchown32
+	SYS_SETGID32        = C.__SNR_setgid32
+	SYS_SETGROUPS32     = C.__SNR_setgroups32
+	SYS_SETREGID32      = C.__SNR_setregid32
+	SYS_SETRESGID32     = C.__SNR_setresgid32
+	SYS_SETRESUID32     = C.__SNR_setresuid32
+	SYS_SETREUID32      = C.__SNR_setreuid32
+	SYS_SETUID32        = C.__SNR_setuid32
+)

container/seccomp/syscall_extra_linux_arm64.go

@@ -0,0 +1,61 @@
+package seccomp
+
+/*
+#cgo linux pkg-config: --static libseccomp
+
+#include <seccomp.h>
+*/
+import "C"
+import "syscall"
+
+const (
+	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
+)
+
+var syscallNumExtra = map[string]int{
+	"uselib":          SYS_USELIB,
+	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
+	"clock_settime64": SYS_CLOCK_SETTIME64,
+	"umount":          SYS_UMOUNT,
+	"chown":           SYS_CHOWN,
+	"chown32":         SYS_CHOWN32,
+	"fchown32":        SYS_FCHOWN32,
+	"lchown":          SYS_LCHOWN,
+	"lchown32":        SYS_LCHOWN32,
+	"setgid32":        SYS_SETGID32,
+	"setgroups32":     SYS_SETGROUPS32,
+	"setregid32":      SYS_SETREGID32,
+	"setresgid32":     SYS_SETRESGID32,
+	"setresuid32":     SYS_SETRESUID32,
+	"setreuid32":      SYS_SETREUID32,
+	"setuid32":        SYS_SETUID32,
+	"modify_ldt":      SYS_MODIFY_LDT,
+	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"vm86":            SYS_VM86,
+	"vm86old":         SYS_VM86OLD,
+}
+
+const (
+	SYS_USELIB          = C.__SNR_uselib
+	SYS_CLOCK_ADJTIME64 = C.__SNR_clock_adjtime64
+	SYS_CLOCK_SETTIME64 = C.__SNR_clock_settime64
+	SYS_UMOUNT          = C.__SNR_umount
+	SYS_CHOWN           = C.__SNR_chown
+	SYS_CHOWN32         = C.__SNR_chown32
+	SYS_FCHOWN32        = C.__SNR_fchown32
+	SYS_LCHOWN          = C.__SNR_lchown
+	SYS_LCHOWN32        = C.__SNR_lchown32
+	SYS_SETGID32        = C.__SNR_setgid32
+	SYS_SETGROUPS32     = C.__SNR_setgroups32
+	SYS_SETREGID32      = C.__SNR_setregid32
+	SYS_SETRESGID32     = C.__SNR_setresgid32
+	SYS_SETRESUID32     = C.__SNR_setresuid32
+	SYS_SETREUID32      = C.__SNR_setreuid32
+	SYS_SETUID32        = C.__SNR_setuid32
+	SYS_MODIFY_LDT      = C.__SNR_modify_ldt
+	SYS_SUBPAGE_PROT    = C.__SNR_subpage_prot
+	SYS_SWITCH_ENDIAN   = C.__SNR_switch_endian
+	SYS_VM86            = C.__SNR_vm86
+	SYS_VM86OLD         = C.__SNR_vm86old
+)

container/seccomp/syscall_linux_amd64.go

@@ -0,0 +1,459 @@
+// mksysnum_linux.pl /usr/include/asm/unistd_64.h
+// Code generated by the command above; DO NOT EDIT.
+
+package seccomp
+
+import . "syscall"
+
+var syscallNum = map[string]int{
+	"read":                    SYS_READ,
+	"write":                   SYS_WRITE,
+	"open":                    SYS_OPEN,
+	"close":                   SYS_CLOSE,
+	"stat":                    SYS_STAT,
+	"fstat":                   SYS_FSTAT,
+	"lstat":                   SYS_LSTAT,
+	"poll":                    SYS_POLL,
+	"lseek":                   SYS_LSEEK,
+	"mmap":                    SYS_MMAP,
+	"mprotect":                SYS_MPROTECT,
+	"munmap":                  SYS_MUNMAP,
+	"brk":                     SYS_BRK,
+	"rt_sigaction":            SYS_RT_SIGACTION,
+	"rt_sigprocmask":          SYS_RT_SIGPROCMASK,
+	"rt_sigreturn":            SYS_RT_SIGRETURN,
+	"ioctl":                   SYS_IOCTL,
+	"pread64":                 SYS_PREAD64,
+	"pwrite64":                SYS_PWRITE64,
+	"readv":                   SYS_READV,
+	"writev":                  SYS_WRITEV,
+	"access":                  SYS_ACCESS,
+	"pipe":                    SYS_PIPE,
+	"select":                  SYS_SELECT,
+	"sched_yield":             SYS_SCHED_YIELD,
+	"mremap":                  SYS_MREMAP,
+	"msync":                   SYS_MSYNC,
+	"mincore":                 SYS_MINCORE,
+	"madvise":                 SYS_MADVISE,
+	"shmget":                  SYS_SHMGET,
+	"shmat":                   SYS_SHMAT,
+	"shmctl":                  SYS_SHMCTL,
+	"dup":                     SYS_DUP,
+	"dup2":                    SYS_DUP2,
+	"pause":                   SYS_PAUSE,
+	"nanosleep":               SYS_NANOSLEEP,
+	"getitimer":               SYS_GETITIMER,
+	"alarm":                   SYS_ALARM,
+	"setitimer":               SYS_SETITIMER,
+	"getpid":                  SYS_GETPID,
+	"sendfile":                SYS_SENDFILE,
+	"socket":                  SYS_SOCKET,
+	"connect":                 SYS_CONNECT,
+	"accept":                  SYS_ACCEPT,
+	"sendto":                  SYS_SENDTO,
+	"recvfrom":                SYS_RECVFROM,
+	"sendmsg":                 SYS_SENDMSG,
+	"recvmsg":                 SYS_RECVMSG,
+	"shutdown":                SYS_SHUTDOWN,
+	"bind":                    SYS_BIND,
+	"listen":                  SYS_LISTEN,
+	"getsockname":             SYS_GETSOCKNAME,
+	"getpeername":             SYS_GETPEERNAME,
+	"socketpair":              SYS_SOCKETPAIR,
+	"setsockopt":              SYS_SETSOCKOPT,
+	"getsockopt":              SYS_GETSOCKOPT,
+	"clone":                   SYS_CLONE,
+	"fork":                    SYS_FORK,
+	"vfork":                   SYS_VFORK,
+	"execve":                  SYS_EXECVE,
+	"exit":                    SYS_EXIT,
+	"wait4":                   SYS_WAIT4,
+	"kill":                    SYS_KILL,
+	"uname":                   SYS_UNAME,
+	"semget":                  SYS_SEMGET,
+	"semop":                   SYS_SEMOP,
+	"semctl":                  SYS_SEMCTL,
+	"shmdt":                   SYS_SHMDT,
+	"msgget":                  SYS_MSGGET,
+	"msgsnd":                  SYS_MSGSND,
+	"msgrcv":                  SYS_MSGRCV,
+	"msgctl":                  SYS_MSGCTL,
+	"fcntl":                   SYS_FCNTL,
+	"flock":                   SYS_FLOCK,
+	"fsync":                   SYS_FSYNC,
+	"fdatasync":               SYS_FDATASYNC,
+	"truncate":                SYS_TRUNCATE,
+	"ftruncate":               SYS_FTRUNCATE,
+	"getdents":                SYS_GETDENTS,
+	"getcwd":                  SYS_GETCWD,
+	"chdir":                   SYS_CHDIR,
+	"fchdir":                  SYS_FCHDIR,
+	"rename":                  SYS_RENAME,
+	"mkdir":                   SYS_MKDIR,
+	"rmdir":                   SYS_RMDIR,
+	"creat":                   SYS_CREAT,
+	"link":                    SYS_LINK,
+	"unlink":                  SYS_UNLINK,
+	"symlink":                 SYS_SYMLINK,
+	"readlink":                SYS_READLINK,
+	"chmod":                   SYS_CHMOD,
+	"fchmod":                  SYS_FCHMOD,
+	"chown":                   SYS_CHOWN,
+	"fchown":                  SYS_FCHOWN,
+	"lchown":                  SYS_LCHOWN,
+	"umask":                   SYS_UMASK,
+	"gettimeofday":            SYS_GETTIMEOFDAY,
+	"getrlimit":               SYS_GETRLIMIT,
+	"getrusage":               SYS_GETRUSAGE,
+	"sysinfo":                 SYS_SYSINFO,
+	"times":                   SYS_TIMES,
+	"ptrace":                  SYS_PTRACE,
+	"getuid":                  SYS_GETUID,
+	"syslog":                  SYS_SYSLOG,
+	"getgid":                  SYS_GETGID,
+	"setuid":                  SYS_SETUID,
+	"setgid":                  SYS_SETGID,
+	"geteuid":                 SYS_GETEUID,
+	"getegid":                 SYS_GETEGID,
+	"setpgid":                 SYS_SETPGID,
+	"getppid":                 SYS_GETPPID,
+	"getpgrp":                 SYS_GETPGRP,
+	"setsid":                  SYS_SETSID,
+	"setreuid":                SYS_SETREUID,
+	"setregid":                SYS_SETREGID,
+	"getgroups":               SYS_GETGROUPS,
+	"setgroups":               SYS_SETGROUPS,
+	"setresuid":               SYS_SETRESUID,
+	"getresuid":               SYS_GETRESUID,
+	"setresgid":               SYS_SETRESGID,
+	"getresgid":               SYS_GETRESGID,
+	"getpgid":                 SYS_GETPGID,
+	"setfsuid":                SYS_SETFSUID,
+	"setfsgid":                SYS_SETFSGID,
+	"getsid":                  SYS_GETSID,
+	"capget":                  SYS_CAPGET,
+	"capset":                  SYS_CAPSET,
+	"rt_sigpending":           SYS_RT_SIGPENDING,
+	"rt_sigtimedwait":         SYS_RT_SIGTIMEDWAIT,
+	"rt_sigqueueinfo":         SYS_RT_SIGQUEUEINFO,
+	"rt_sigsuspend":           SYS_RT_SIGSUSPEND,
+	"sigaltstack":             SYS_SIGALTSTACK,
+	"utime":                   SYS_UTIME,
+	"mknod":                   SYS_MKNOD,
+	"uselib":                  SYS_USELIB,
+	"personality":             SYS_PERSONALITY,
+	"ustat":                   SYS_USTAT,
+	"statfs":                  SYS_STATFS,
+	"fstatfs":                 SYS_FSTATFS,
+	"sysfs":                   SYS_SYSFS,
+	"getpriority":             SYS_GETPRIORITY,
+	"setpriority":             SYS_SETPRIORITY,
+	"sched_setparam":          SYS_SCHED_SETPARAM,
+	"sched_getparam":          SYS_SCHED_GETPARAM,
+	"sched_setscheduler":      SYS_SCHED_SETSCHEDULER,
+	"sched_getscheduler":      SYS_SCHED_GETSCHEDULER,
+	"sched_get_priority_max":  SYS_SCHED_GET_PRIORITY_MAX,
+	"sched_get_priority_min":  SYS_SCHED_GET_PRIORITY_MIN,
+	"sched_rr_get_interval":   SYS_SCHED_RR_GET_INTERVAL,
+	"mlock":                   SYS_MLOCK,
+	"munlock":                 SYS_MUNLOCK,
+	"mlockall":                SYS_MLOCKALL,
+	"munlockall":              SYS_MUNLOCKALL,
+	"vhangup":                 SYS_VHANGUP,
+	"modify_ldt":              SYS_MODIFY_LDT,
+	"pivot_root":              SYS_PIVOT_ROOT,
+	"_sysctl":                 SYS__SYSCTL,
+	"prctl":                   SYS_PRCTL,
+	"arch_prctl":              SYS_ARCH_PRCTL,
+	"adjtimex":                SYS_ADJTIMEX,
+	"setrlimit":               SYS_SETRLIMIT,
+	"chroot":                  SYS_CHROOT,
+	"sync":                    SYS_SYNC,
+	"acct":                    SYS_ACCT,
+	"settimeofday":            SYS_SETTIMEOFDAY,
+	"mount":                   SYS_MOUNT,
+	"umount2":                 SYS_UMOUNT2,
+	"swapon":                  SYS_SWAPON,
+	"swapoff":                 SYS_SWAPOFF,
+	"reboot":                  SYS_REBOOT,
+	"sethostname":             SYS_SETHOSTNAME,
+	"setdomainname":           SYS_SETDOMAINNAME,
+	"iopl":                    SYS_IOPL,
+	"ioperm":                  SYS_IOPERM,
+	"create_module":           SYS_CREATE_MODULE,
+	"init_module":             SYS_INIT_MODULE,
+	"delete_module":           SYS_DELETE_MODULE,
+	"get_kernel_syms":         SYS_GET_KERNEL_SYMS,
+	"query_module":            SYS_QUERY_MODULE,
+	"quotactl":                SYS_QUOTACTL,
+	"nfsservctl":              SYS_NFSSERVCTL,
+	"getpmsg":                 SYS_GETPMSG,
+	"putpmsg":                 SYS_PUTPMSG,
+	"afs_syscall":             SYS_AFS_SYSCALL,
+	"tuxcall":                 SYS_TUXCALL,
+	"security":                SYS_SECURITY,
+	"gettid":                  SYS_GETTID,
+	"readahead":               SYS_READAHEAD,
+	"setxattr":                SYS_SETXATTR,
+	"lsetxattr":               SYS_LSETXATTR,
+	"fsetxattr":               SYS_FSETXATTR,
+	"getxattr":                SYS_GETXATTR,
+	"lgetxattr":               SYS_LGETXATTR,
+	"fgetxattr":               SYS_FGETXATTR,
+	"listxattr":               SYS_LISTXATTR,
+	"llistxattr":              SYS_LLISTXATTR,
+	"flistxattr":              SYS_FLISTXATTR,
+	"removexattr":             SYS_REMOVEXATTR,
+	"lremovexattr":            SYS_LREMOVEXATTR,
+	"fremovexattr":            SYS_FREMOVEXATTR,
+	"tkill":                   SYS_TKILL,
+	"time":                    SYS_TIME,
+	"futex":                   SYS_FUTEX,
+	"sched_setaffinity":       SYS_SCHED_SETAFFINITY,
+	"sched_getaffinity":       SYS_SCHED_GETAFFINITY,
+	"set_thread_area":         SYS_SET_THREAD_AREA,
+	"io_setup":                SYS_IO_SETUP,
+	"io_destroy":              SYS_IO_DESTROY,
+	"io_getevents":            SYS_IO_GETEVENTS,
+	"io_submit":               SYS_IO_SUBMIT,
+	"io_cancel":               SYS_IO_CANCEL,
+	"get_thread_area":         SYS_GET_THREAD_AREA,
+	"lookup_dcookie":          SYS_LOOKUP_DCOOKIE,
+	"epoll_create":            SYS_EPOLL_CREATE,
+	"epoll_ctl_old":           SYS_EPOLL_CTL_OLD,
+	"epoll_wait_old":          SYS_EPOLL_WAIT_OLD,
+	"remap_file_pages":        SYS_REMAP_FILE_PAGES,
+	"getdents64":              SYS_GETDENTS64,
+	"set_tid_address":         SYS_SET_TID_ADDRESS,
+	"restart_syscall":         SYS_RESTART_SYSCALL,
+	"semtimedop":              SYS_SEMTIMEDOP,
+	"fadvise64":               SYS_FADVISE64,
+	"timer_create":            SYS_TIMER_CREATE,
+	"timer_settime":           SYS_TIMER_SETTIME,
+	"timer_gettime":           SYS_TIMER_GETTIME,
+	"timer_getoverrun":        SYS_TIMER_GETOVERRUN,
+	"timer_delete":            SYS_TIMER_DELETE,
+	"clock_settime":           SYS_CLOCK_SETTIME,
+	"clock_gettime":           SYS_CLOCK_GETTIME,
+	"clock_getres":            SYS_CLOCK_GETRES,
+	"clock_nanosleep":         SYS_CLOCK_NANOSLEEP,
+	"exit_group":              SYS_EXIT_GROUP,
+	"epoll_wait":              SYS_EPOLL_WAIT,
+	"epoll_ctl":               SYS_EPOLL_CTL,
+	"tgkill":                  SYS_TGKILL,
+	"utimes":                  SYS_UTIMES,
+	"vserver":                 SYS_VSERVER,
+	"mbind":                   SYS_MBIND,
+	"set_mempolicy":           SYS_SET_MEMPOLICY,
+	"get_mempolicy":           SYS_GET_MEMPOLICY,
+	"mq_open":                 SYS_MQ_OPEN,
+	"mq_unlink":               SYS_MQ_UNLINK,
+	"mq_timedsend":            SYS_MQ_TIMEDSEND,
+	"mq_timedreceive":         SYS_MQ_TIMEDRECEIVE,
+	"mq_notify":               SYS_MQ_NOTIFY,
+	"mq_getsetattr":           SYS_MQ_GETSETATTR,
+	"kexec_load":              SYS_KEXEC_LOAD,
+	"waitid":                  SYS_WAITID,
+	"add_key":                 SYS_ADD_KEY,
+	"request_key":             SYS_REQUEST_KEY,
+	"keyctl":                  SYS_KEYCTL,
+	"ioprio_set":              SYS_IOPRIO_SET,
+	"ioprio_get":              SYS_IOPRIO_GET,
+	"inotify_init":            SYS_INOTIFY_INIT,
+	"inotify_add_watch":       SYS_INOTIFY_ADD_WATCH,
+	"inotify_rm_watch":        SYS_INOTIFY_RM_WATCH,
+	"migrate_pages":           SYS_MIGRATE_PAGES,
+	"openat":                  SYS_OPENAT,
+	"mkdirat":                 SYS_MKDIRAT,
+	"mknodat":                 SYS_MKNODAT,
+	"fchownat":                SYS_FCHOWNAT,
+	"futimesat":               SYS_FUTIMESAT,
+	"newfstatat":              SYS_NEWFSTATAT,
+	"unlinkat":                SYS_UNLINKAT,
+	"renameat":                SYS_RENAMEAT,
+	"linkat":                  SYS_LINKAT,
+	"symlinkat":               SYS_SYMLINKAT,
+	"readlinkat":              SYS_READLINKAT,
+	"fchmodat":                SYS_FCHMODAT,
+	"faccessat":               SYS_FACCESSAT,
+	"pselect6":                SYS_PSELECT6,
+	"ppoll":                   SYS_PPOLL,
+	"unshare":                 SYS_UNSHARE,
+	"set_robust_list":         SYS_SET_ROBUST_LIST,
+	"get_robust_list":         SYS_GET_ROBUST_LIST,
+	"splice":                  SYS_SPLICE,
+	"tee":                     SYS_TEE,
+	"sync_file_range":         SYS_SYNC_FILE_RANGE,
+	"vmsplice":                SYS_VMSPLICE,
+	"move_pages":              SYS_MOVE_PAGES,
+	"utimensat":               SYS_UTIMENSAT,
+	"epoll_pwait":             SYS_EPOLL_PWAIT,
+	"signalfd":                SYS_SIGNALFD,
+	"timerfd_create":          SYS_TIMERFD_CREATE,
+	"eventfd":                 SYS_EVENTFD,
+	"fallocate":               SYS_FALLOCATE,
+	"timerfd_settime":         SYS_TIMERFD_SETTIME,
+	"timerfd_gettime":         SYS_TIMERFD_GETTIME,
+	"accept4":                 SYS_ACCEPT4,
+	"signalfd4":               SYS_SIGNALFD4,
+	"eventfd2":                SYS_EVENTFD2,
+	"epoll_create1":           SYS_EPOLL_CREATE1,
+	"dup3":                    SYS_DUP3,
+	"pipe2":                   SYS_PIPE2,
+	"inotify_init1":           SYS_INOTIFY_INIT1,
+	"preadv":                  SYS_PREADV,
+	"pwritev":                 SYS_PWRITEV,
+	"rt_tgsigqueueinfo":       SYS_RT_TGSIGQUEUEINFO,
+	"perf_event_open":         SYS_PERF_EVENT_OPEN,
+	"recvmmsg":                SYS_RECVMMSG,
+	"fanotify_init":           SYS_FANOTIFY_INIT,
+	"fanotify_mark":           SYS_FANOTIFY_MARK,
+	"prlimit64":               SYS_PRLIMIT64,
+	"name_to_handle_at":       SYS_NAME_TO_HANDLE_AT,
+	"open_by_handle_at":       SYS_OPEN_BY_HANDLE_AT,
+	"clock_adjtime":           SYS_CLOCK_ADJTIME,
+	"syncfs":                  SYS_SYNCFS,
+	"sendmmsg":                SYS_SENDMMSG,
+	"setns":                   SYS_SETNS,
+	"getcpu":                  SYS_GETCPU,
+	"process_vm_readv":        SYS_PROCESS_VM_READV,
+	"process_vm_writev":       SYS_PROCESS_VM_WRITEV,
+	"kcmp":                    SYS_KCMP,
+	"finit_module":            SYS_FINIT_MODULE,
+	"sched_setattr":           SYS_SCHED_SETATTR,
+	"sched_getattr":           SYS_SCHED_GETATTR,
+	"renameat2":               SYS_RENAMEAT2,
+	"seccomp":                 SYS_SECCOMP,
+	"getrandom":               SYS_GETRANDOM,
+	"memfd_create":            SYS_MEMFD_CREATE,
+	"kexec_file_load":         SYS_KEXEC_FILE_LOAD,
+	"bpf":                     SYS_BPF,
+	"execveat":                SYS_EXECVEAT,
+	"userfaultfd":             SYS_USERFAULTFD,
+	"membarrier":              SYS_MEMBARRIER,
+	"mlock2":                  SYS_MLOCK2,
+	"copy_file_range":         SYS_COPY_FILE_RANGE,
+	"preadv2":                 SYS_PREADV2,
+	"pwritev2":                SYS_PWRITEV2,
+	"pkey_mprotect":           SYS_PKEY_MPROTECT,
+	"pkey_alloc":              SYS_PKEY_ALLOC,
+	"pkey_free":               SYS_PKEY_FREE,
+	"statx":                   SYS_STATX,
+	"io_pgetevents":           SYS_IO_PGETEVENTS,
+	"rseq":                    SYS_RSEQ,
+	"uretprobe":               SYS_URETPROBE,
+	"pidfd_send_signal":       SYS_PIDFD_SEND_SIGNAL,
+	"io_uring_setup":          SYS_IO_URING_SETUP,
+	"io_uring_enter":          SYS_IO_URING_ENTER,
+	"io_uring_register":       SYS_IO_URING_REGISTER,
+	"open_tree":               SYS_OPEN_TREE,
+	"move_mount":              SYS_MOVE_MOUNT,
+	"fsopen":                  SYS_FSOPEN,
+	"fsconfig":                SYS_FSCONFIG,
+	"fsmount":                 SYS_FSMOUNT,
+	"fspick":                  SYS_FSPICK,
+	"pidfd_open":              SYS_PIDFD_OPEN,
+	"clone3":                  SYS_CLONE3,
+	"close_range":             SYS_CLOSE_RANGE,
+	"openat2":                 SYS_OPENAT2,
+	"pidfd_getfd":             SYS_PIDFD_GETFD,
+	"faccessat2":              SYS_FACCESSAT2,
+	"process_madvise":         SYS_PROCESS_MADVISE,
+	"epoll_pwait2":            SYS_EPOLL_PWAIT2,
+	"mount_setattr":           SYS_MOUNT_SETATTR,
+	"quotactl_fd":             SYS_QUOTACTL_FD,
+	"landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET,
+	"landlock_add_rule":       SYS_LANDLOCK_ADD_RULE,
+	"landlock_restrict_self":  SYS_LANDLOCK_RESTRICT_SELF,
+	"memfd_secret":            SYS_MEMFD_SECRET,
+	"process_mrelease":        SYS_PROCESS_MRELEASE,
+	"futex_waitv":             SYS_FUTEX_WAITV,
+	"set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE,
+	"cachestat":               SYS_CACHESTAT,
+	"fchmodat2":               SYS_FCHMODAT2,
+	"map_shadow_stack":        SYS_MAP_SHADOW_STACK,
+	"futex_wake":              SYS_FUTEX_WAKE,
+	"futex_wait":              SYS_FUTEX_WAIT,
+	"futex_requeue":           SYS_FUTEX_REQUEUE,
+	"statmount":               SYS_STATMOUNT,
+	"listmount":               SYS_LISTMOUNT,
+	"lsm_get_self_attr":       SYS_LSM_GET_SELF_ATTR,
+	"lsm_set_self_attr":       SYS_LSM_SET_SELF_ATTR,
+	"lsm_list_modules":        SYS_LSM_LIST_MODULES,
+	"mseal":                   SYS_MSEAL,
+}
+
+const (
+	SYS_NAME_TO_HANDLE_AT       = 303
+	SYS_OPEN_BY_HANDLE_AT       = 304
+	SYS_CLOCK_ADJTIME           = 305
+	SYS_SYNCFS                  = 306
+	SYS_SENDMMSG                = 307
+	SYS_SETNS                   = 308
+	SYS_GETCPU                  = 309
+	SYS_PROCESS_VM_READV        = 310
+	SYS_PROCESS_VM_WRITEV       = 311
+	SYS_KCMP                    = 312
+	SYS_FINIT_MODULE            = 313
+	SYS_SCHED_SETATTR           = 314
+	SYS_SCHED_GETATTR           = 315
+	SYS_RENAMEAT2               = 316
+	SYS_SECCOMP                 = 317
+	SYS_GETRANDOM               = 318
+	SYS_MEMFD_CREATE            = 319
+	SYS_KEXEC_FILE_LOAD         = 320
+	SYS_BPF                     = 321
+	SYS_EXECVEAT                = 322
+	SYS_USERFAULTFD             = 323
+	SYS_MEMBARRIER              = 324
+	SYS_MLOCK2                  = 325
+	SYS_COPY_FILE_RANGE         = 326
+	SYS_PREADV2                 = 327
+	SYS_PWRITEV2                = 328
+	SYS_PKEY_MPROTECT           = 329
+	SYS_PKEY_ALLOC              = 330
+	SYS_PKEY_FREE               = 331
+	SYS_STATX                   = 332
+	SYS_IO_PGETEVENTS           = 333
+	SYS_RSEQ                    = 334
+	SYS_URETPROBE               = 335
+	SYS_PIDFD_SEND_SIGNAL       = 424
+	SYS_IO_URING_SETUP          = 425
+	SYS_IO_URING_ENTER          = 426
+	SYS_IO_URING_REGISTER       = 427
+	SYS_OPEN_TREE               = 428
+	SYS_MOVE_MOUNT              = 429
+	SYS_FSOPEN                  = 430
+	SYS_FSCONFIG                = 431
+	SYS_FSMOUNT                 = 432
+	SYS_FSPICK                  = 433
+	SYS_PIDFD_OPEN              = 434
+	SYS_CLONE3                  = 435
+	SYS_CLOSE_RANGE             = 436
+	SYS_OPENAT2                 = 437
+	SYS_PIDFD_GETFD             = 438
+	SYS_FACCESSAT2              = 439
+	SYS_PROCESS_MADVISE         = 440
+	SYS_EPOLL_PWAIT2            = 441
+	SYS_MOUNT_SETATTR           = 442
+	SYS_QUOTACTL_FD             = 443
+	SYS_LANDLOCK_CREATE_RULESET = 444
+	SYS_LANDLOCK_ADD_RULE       = 445
+	SYS_LANDLOCK_RESTRICT_SELF  = 446
+	SYS_MEMFD_SECRET            = 447
+	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
+	SYS_FCHMODAT2               = 452
+	SYS_MAP_SHADOW_STACK        = 453
+	SYS_FUTEX_WAKE              = 454
+	SYS_FUTEX_WAIT              = 455
+	SYS_FUTEX_REQUEUE           = 456
+	SYS_STATMOUNT               = 457
+	SYS_LISTMOUNT               = 458
+	SYS_LSM_GET_SELF_ATTR       = 459
+	SYS_LSM_SET_SELF_ATTR       = 460
+	SYS_LSM_LIST_MODULES        = 461
+	SYS_MSEAL                   = 462
+)

container/seccomp/syscall_linux_arm64.go

@@ -0,0 +1,382 @@
+// mksysnum_linux.pl /usr/include/asm/unistd_64.h
+// Code generated by the command above; DO NOT EDIT.
+
+package seccomp
+
+import . "syscall"
+
+var syscallNum = map[string]int{
+	"io_setup":                SYS_IO_SETUP,
+	"io_destroy":              SYS_IO_DESTROY,
+	"io_submit":               SYS_IO_SUBMIT,
+	"io_cancel":               SYS_IO_CANCEL,
+	"io_getevents":            SYS_IO_GETEVENTS,
+	"setxattr":                SYS_SETXATTR,
+	"lsetxattr":               SYS_LSETXATTR,
+	"fsetxattr":               SYS_FSETXATTR,
+	"getxattr":                SYS_GETXATTR,
+	"lgetxattr":               SYS_LGETXATTR,
+	"fgetxattr":               SYS_FGETXATTR,
+	"listxattr":               SYS_LISTXATTR,
+	"llistxattr":              SYS_LLISTXATTR,
+	"flistxattr":              SYS_FLISTXATTR,
+	"removexattr":             SYS_REMOVEXATTR,
+	"lremovexattr":            SYS_LREMOVEXATTR,
+	"fremovexattr":            SYS_FREMOVEXATTR,
+	"getcwd":                  SYS_GETCWD,
+	"lookup_dcookie":          SYS_LOOKUP_DCOOKIE,
+	"eventfd2":                SYS_EVENTFD2,
+	"epoll_create1":           SYS_EPOLL_CREATE1,
+	"epoll_ctl":               SYS_EPOLL_CTL,
+	"epoll_pwait":             SYS_EPOLL_PWAIT,
+	"dup":                     SYS_DUP,
+	"dup3":                    SYS_DUP3,
+	"fcntl":                   SYS_FCNTL,
+	"inotify_init1":           SYS_INOTIFY_INIT1,
+	"inotify_add_watch":       SYS_INOTIFY_ADD_WATCH,
+	"inotify_rm_watch":        SYS_INOTIFY_RM_WATCH,
+	"ioctl":                   SYS_IOCTL,
+	"ioprio_set":              SYS_IOPRIO_SET,
+	"ioprio_get":              SYS_IOPRIO_GET,
+	"flock":                   SYS_FLOCK,
+	"mknodat":                 SYS_MKNODAT,
+	"mkdirat":                 SYS_MKDIRAT,
+	"unlinkat":                SYS_UNLINKAT,
+	"symlinkat":               SYS_SYMLINKAT,
+	"linkat":                  SYS_LINKAT,
+	"renameat":                SYS_RENAMEAT,
+	"umount2":                 SYS_UMOUNT2,
+	"mount":                   SYS_MOUNT,
+	"pivot_root":              SYS_PIVOT_ROOT,
+	"nfsservctl":              SYS_NFSSERVCTL,
+	"statfs":                  SYS_STATFS,
+	"fstatfs":                 SYS_FSTATFS,
+	"truncate":                SYS_TRUNCATE,
+	"ftruncate":               SYS_FTRUNCATE,
+	"fallocate":               SYS_FALLOCATE,
+	"faccessat":               SYS_FACCESSAT,
+	"chdir":                   SYS_CHDIR,
+	"fchdir":                  SYS_FCHDIR,
+	"chroot":                  SYS_CHROOT,
+	"fchmod":                  SYS_FCHMOD,
+	"fchmodat":                SYS_FCHMODAT,
+	"fchownat":                SYS_FCHOWNAT,
+	"fchown":                  SYS_FCHOWN,
+	"openat":                  SYS_OPENAT,
+	"close":                   SYS_CLOSE,
+	"vhangup":                 SYS_VHANGUP,
+	"pipe2":                   SYS_PIPE2,
+	"quotactl":                SYS_QUOTACTL,
+	"getdents64":              SYS_GETDENTS64,
+	"lseek":                   SYS_LSEEK,
+	"read":                    SYS_READ,
+	"write":                   SYS_WRITE,
+	"readv":                   SYS_READV,
+	"writev":                  SYS_WRITEV,
+	"pread64":                 SYS_PREAD64,
+	"pwrite64":                SYS_PWRITE64,
+	"preadv":                  SYS_PREADV,
+	"pwritev":                 SYS_PWRITEV,
+	"sendfile":                SYS_SENDFILE,
+	"pselect6":                SYS_PSELECT6,
+	"ppoll":                   SYS_PPOLL,
+	"signalfd4":               SYS_SIGNALFD4,
+	"vmsplice":                SYS_VMSPLICE,
+	"splice":                  SYS_SPLICE,
+	"tee":                     SYS_TEE,
+	"readlinkat":              SYS_READLINKAT,
+	"newfstatat":              SYS_NEWFSTATAT,
+	"fstat":                   SYS_FSTAT,
+	"sync":                    SYS_SYNC,
+	"fsync":                   SYS_FSYNC,
+	"fdatasync":               SYS_FDATASYNC,
+	"sync_file_range":         SYS_SYNC_FILE_RANGE,
+	"timerfd_create":          SYS_TIMERFD_CREATE,
+	"timerfd_settime":         SYS_TIMERFD_SETTIME,
+	"timerfd_gettime":         SYS_TIMERFD_GETTIME,
+	"utimensat":               SYS_UTIMENSAT,
+	"acct":                    SYS_ACCT,
+	"capget":                  SYS_CAPGET,
+	"capset":                  SYS_CAPSET,
+	"personality":             SYS_PERSONALITY,
+	"exit":                    SYS_EXIT,
+	"exit_group":              SYS_EXIT_GROUP,
+	"waitid":                  SYS_WAITID,
+	"set_tid_address":         SYS_SET_TID_ADDRESS,
+	"unshare":                 SYS_UNSHARE,
+	"futex":                   SYS_FUTEX,
+	"set_robust_list":         SYS_SET_ROBUST_LIST,
+	"get_robust_list":         SYS_GET_ROBUST_LIST,
+	"nanosleep":               SYS_NANOSLEEP,
+	"getitimer":               SYS_GETITIMER,
+	"setitimer":               SYS_SETITIMER,
+	"kexec_load":              SYS_KEXEC_LOAD,
+	"init_module":             SYS_INIT_MODULE,
+	"delete_module":           SYS_DELETE_MODULE,
+	"timer_create":            SYS_TIMER_CREATE,
+	"timer_gettime":           SYS_TIMER_GETTIME,
+	"timer_getoverrun":        SYS_TIMER_GETOVERRUN,
+	"timer_settime":           SYS_TIMER_SETTIME,
+	"timer_delete":            SYS_TIMER_DELETE,
+	"clock_settime":           SYS_CLOCK_SETTIME,
+	"clock_gettime":           SYS_CLOCK_GETTIME,
+	"clock_getres":            SYS_CLOCK_GETRES,
+	"clock_nanosleep":         SYS_CLOCK_NANOSLEEP,
+	"syslog":                  SYS_SYSLOG,
+	"ptrace":                  SYS_PTRACE,
+	"sched_setparam":          SYS_SCHED_SETPARAM,
+	"sched_setscheduler":      SYS_SCHED_SETSCHEDULER,
+	"sched_getscheduler":      SYS_SCHED_GETSCHEDULER,
+	"sched_getparam":          SYS_SCHED_GETPARAM,
+	"sched_setaffinity":       SYS_SCHED_SETAFFINITY,
+	"sched_getaffinity":       SYS_SCHED_GETAFFINITY,
+	"sched_yield":             SYS_SCHED_YIELD,
+	"sched_get_priority_max":  SYS_SCHED_GET_PRIORITY_MAX,
+	"sched_get_priority_min":  SYS_SCHED_GET_PRIORITY_MIN,
+	"sched_rr_get_interval":   SYS_SCHED_RR_GET_INTERVAL,
+	"restart_syscall":         SYS_RESTART_SYSCALL,
+	"kill":                    SYS_KILL,
+	"tkill":                   SYS_TKILL,
+	"tgkill":                  SYS_TGKILL,
+	"sigaltstack":             SYS_SIGALTSTACK,
+	"rt_sigsuspend":           SYS_RT_SIGSUSPEND,
+	"rt_sigaction":            SYS_RT_SIGACTION,
+	"rt_sigprocmask":          SYS_RT_SIGPROCMASK,
+	"rt_sigpending":           SYS_RT_SIGPENDING,
+	"rt_sigtimedwait":         SYS_RT_SIGTIMEDWAIT,
+	"rt_sigqueueinfo":         SYS_RT_SIGQUEUEINFO,
+	"rt_sigreturn":            SYS_RT_SIGRETURN,
+	"setpriority":             SYS_SETPRIORITY,
+	"getpriority":             SYS_GETPRIORITY,
+	"reboot":                  SYS_REBOOT,
+	"setregid":                SYS_SETREGID,
+	"setgid":                  SYS_SETGID,
+	"setreuid":                SYS_SETREUID,
+	"setuid":                  SYS_SETUID,
+	"setresuid":               SYS_SETRESUID,
+	"getresuid":               SYS_GETRESUID,
+	"setresgid":               SYS_SETRESGID,
+	"getresgid":               SYS_GETRESGID,
+	"setfsuid":                SYS_SETFSUID,
+	"setfsgid":                SYS_SETFSGID,
+	"times":                   SYS_TIMES,
+	"setpgid":                 SYS_SETPGID,
+	"getpgid":                 SYS_GETPGID,
+	"getsid":                  SYS_GETSID,
+	"setsid":                  SYS_SETSID,
+	"getgroups":               SYS_GETGROUPS,
+	"setgroups":               SYS_SETGROUPS,
+	"uname":                   SYS_UNAME,
+	"sethostname":             SYS_SETHOSTNAME,
+	"setdomainname":           SYS_SETDOMAINNAME,
+	"getrlimit":               SYS_GETRLIMIT,
+	"setrlimit":               SYS_SETRLIMIT,
+	"getrusage":               SYS_GETRUSAGE,
+	"umask":                   SYS_UMASK,
+	"prctl":                   SYS_PRCTL,
+	"getcpu":                  SYS_GETCPU,
+	"gettimeofday":            SYS_GETTIMEOFDAY,
+	"settimeofday":            SYS_SETTIMEOFDAY,
+	"adjtimex":                SYS_ADJTIMEX,
+	"getpid":                  SYS_GETPID,
+	"getppid":                 SYS_GETPPID,
+	"getuid":                  SYS_GETUID,
+	"geteuid":                 SYS_GETEUID,
+	"getgid":                  SYS_GETGID,
+	"getegid":                 SYS_GETEGID,
+	"gettid":                  SYS_GETTID,
+	"sysinfo":                 SYS_SYSINFO,
+	"mq_open":                 SYS_MQ_OPEN,
+	"mq_unlink":               SYS_MQ_UNLINK,
+	"mq_timedsend":            SYS_MQ_TIMEDSEND,
+	"mq_timedreceive":         SYS_MQ_TIMEDRECEIVE,
+	"mq_notify":               SYS_MQ_NOTIFY,
+	"mq_getsetattr":           SYS_MQ_GETSETATTR,
+	"msgget":                  SYS_MSGGET,
+	"msgctl":                  SYS_MSGCTL,
+	"msgrcv":                  SYS_MSGRCV,
+	"msgsnd":                  SYS_MSGSND,
+	"semget":                  SYS_SEMGET,
+	"semctl":                  SYS_SEMCTL,
+	"semtimedop":              SYS_SEMTIMEDOP,
+	"semop":                   SYS_SEMOP,
+	"shmget":                  SYS_SHMGET,
+	"shmctl":                  SYS_SHMCTL,
+	"shmat":                   SYS_SHMAT,
+	"shmdt":                   SYS_SHMDT,
+	"socket":                  SYS_SOCKET,
+	"socketpair":              SYS_SOCKETPAIR,
+	"bind":                    SYS_BIND,
+	"listen":                  SYS_LISTEN,
+	"accept":                  SYS_ACCEPT,
+	"connect":                 SYS_CONNECT,
+	"getsockname":             SYS_GETSOCKNAME,
+	"getpeername":             SYS_GETPEERNAME,
+	"sendto":                  SYS_SENDTO,
+	"recvfrom":                SYS_RECVFROM,
+	"setsockopt":              SYS_SETSOCKOPT,
+	"getsockopt":              SYS_GETSOCKOPT,
+	"shutdown":                SYS_SHUTDOWN,
+	"sendmsg":                 SYS_SENDMSG,
+	"recvmsg":                 SYS_RECVMSG,
+	"readahead":               SYS_READAHEAD,
+	"brk":                     SYS_BRK,
+	"munmap":                  SYS_MUNMAP,
+	"mremap":                  SYS_MREMAP,
+	"add_key":                 SYS_ADD_KEY,
+	"request_key":             SYS_REQUEST_KEY,
+	"keyctl":                  SYS_KEYCTL,
+	"clone":                   SYS_CLONE,
+	"execve":                  SYS_EXECVE,
+	"mmap":                    SYS_MMAP,
+	"fadvise64":               SYS_FADVISE64,
+	"swapon":                  SYS_SWAPON,
+	"swapoff":                 SYS_SWAPOFF,
+	"mprotect":                SYS_MPROTECT,
+	"msync":                   SYS_MSYNC,
+	"mlock":                   SYS_MLOCK,
+	"munlock":                 SYS_MUNLOCK,
+	"mlockall":                SYS_MLOCKALL,
+	"munlockall":              SYS_MUNLOCKALL,
+	"mincore":                 SYS_MINCORE,
+	"madvise":                 SYS_MADVISE,
+	"remap_file_pages":        SYS_REMAP_FILE_PAGES,
+	"mbind":                   SYS_MBIND,
+	"get_mempolicy":           SYS_GET_MEMPOLICY,
+	"set_mempolicy":           SYS_SET_MEMPOLICY,
+	"migrate_pages":           SYS_MIGRATE_PAGES,
+	"move_pages":              SYS_MOVE_PAGES,
+	"rt_tgsigqueueinfo":       SYS_RT_TGSIGQUEUEINFO,
+	"perf_event_open":         SYS_PERF_EVENT_OPEN,
+	"accept4":                 SYS_ACCEPT4,
+	"recvmmsg":                SYS_RECVMMSG,
+	"wait4":                   SYS_WAIT4,
+	"prlimit64":               SYS_PRLIMIT64,
+	"fanotify_init":           SYS_FANOTIFY_INIT,
+	"fanotify_mark":           SYS_FANOTIFY_MARK,
+	"name_to_handle_at":       SYS_NAME_TO_HANDLE_AT,
+	"open_by_handle_at":       SYS_OPEN_BY_HANDLE_AT,
+	"clock_adjtime":           SYS_CLOCK_ADJTIME,
+	"syncfs":                  SYS_SYNCFS,
+	"setns":                   SYS_SETNS,
+	"sendmmsg":                SYS_SENDMMSG,
+	"process_vm_readv":        SYS_PROCESS_VM_READV,
+	"process_vm_writev":       SYS_PROCESS_VM_WRITEV,
+	"kcmp":                    SYS_KCMP,
+	"finit_module":            SYS_FINIT_MODULE,
+	"sched_setattr":           SYS_SCHED_SETATTR,
+	"sched_getattr":           SYS_SCHED_GETATTR,
+	"renameat2":               SYS_RENAMEAT2,
+	"seccomp":                 SYS_SECCOMP,
+	"getrandom":               SYS_GETRANDOM,
+	"memfd_create":            SYS_MEMFD_CREATE,
+	"bpf":                     SYS_BPF,
+	"execveat":                SYS_EXECVEAT,
+	"userfaultfd":             SYS_USERFAULTFD,
+	"membarrier":              SYS_MEMBARRIER,
+	"mlock2":                  SYS_MLOCK2,
+	"copy_file_range":         SYS_COPY_FILE_RANGE,
+	"preadv2":                 SYS_PREADV2,
+	"pwritev2":                SYS_PWRITEV2,
+	"pkey_mprotect":           SYS_PKEY_MPROTECT,
+	"pkey_alloc":              SYS_PKEY_ALLOC,
+	"pkey_free":               SYS_PKEY_FREE,
+	"statx":                   SYS_STATX,
+	"io_pgetevents":           SYS_IO_PGETEVENTS,
+	"rseq":                    SYS_RSEQ,
+	"kexec_file_load":         SYS_KEXEC_FILE_LOAD,
+	"pidfd_send_signal":       SYS_PIDFD_SEND_SIGNAL,
+	"io_uring_setup":          SYS_IO_URING_SETUP,
+	"io_uring_enter":          SYS_IO_URING_ENTER,
+	"io_uring_register":       SYS_IO_URING_REGISTER,
+	"open_tree":               SYS_OPEN_TREE,
+	"move_mount":              SYS_MOVE_MOUNT,
+	"fsopen":                  SYS_FSOPEN,
+	"fsconfig":                SYS_FSCONFIG,
+	"fsmount":                 SYS_FSMOUNT,
+	"fspick":                  SYS_FSPICK,
+	"pidfd_open":              SYS_PIDFD_OPEN,
+	"clone3":                  SYS_CLONE3,
+	"close_range":             SYS_CLOSE_RANGE,
+	"openat2":                 SYS_OPENAT2,
+	"pidfd_getfd":             SYS_PIDFD_GETFD,
+	"faccessat2":              SYS_FACCESSAT2,
+	"process_madvise":         SYS_PROCESS_MADVISE,
+	"epoll_pwait2":            SYS_EPOLL_PWAIT2,
+	"mount_setattr":           SYS_MOUNT_SETATTR,
+	"quotactl_fd":             SYS_QUOTACTL_FD,
+	"landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET,
+	"landlock_add_rule":       SYS_LANDLOCK_ADD_RULE,
+	"landlock_restrict_self":  SYS_LANDLOCK_RESTRICT_SELF,
+	"memfd_secret":            SYS_MEMFD_SECRET,
+	"process_mrelease":        SYS_PROCESS_MRELEASE,
+	"futex_waitv":             SYS_FUTEX_WAITV,
+	"set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE,
+	"cachestat":               SYS_CACHESTAT,
+	"fchmodat2":               SYS_FCHMODAT2,
+	"map_shadow_stack":        SYS_MAP_SHADOW_STACK,
+	"futex_wake":              SYS_FUTEX_WAKE,
+	"futex_wait":              SYS_FUTEX_WAIT,
+	"futex_requeue":           SYS_FUTEX_REQUEUE,
+	"statmount":               SYS_STATMOUNT,
+	"listmount":               SYS_LISTMOUNT,
+	"lsm_get_self_attr":       SYS_LSM_GET_SELF_ATTR,
+	"lsm_set_self_attr":       SYS_LSM_SET_SELF_ATTR,
+	"lsm_list_modules":        SYS_LSM_LIST_MODULES,
+	"mseal":                   SYS_MSEAL,
+}
+
+const (
+	SYS_USERFAULTFD             = 282
+	SYS_MEMBARRIER              = 283
+	SYS_MLOCK2                  = 284
+	SYS_COPY_FILE_RANGE         = 285
+	SYS_PREADV2                 = 286
+	SYS_PWRITEV2                = 287
+	SYS_PKEY_MPROTECT           = 288
+	SYS_PKEY_ALLOC              = 289
+	SYS_PKEY_FREE               = 290
+	SYS_STATX                   = 291
+	SYS_IO_PGETEVENTS           = 292
+	SYS_RSEQ                    = 293
+	SYS_KEXEC_FILE_LOAD         = 294
+	SYS_PIDFD_SEND_SIGNAL       = 424
+	SYS_IO_URING_SETUP          = 425
+	SYS_IO_URING_ENTER          = 426
+	SYS_IO_URING_REGISTER       = 427
+	SYS_OPEN_TREE               = 428
+	SYS_MOVE_MOUNT              = 429
+	SYS_FSOPEN                  = 430
+	SYS_FSCONFIG                = 431
+	SYS_FSMOUNT                 = 432
+	SYS_FSPICK                  = 433
+	SYS_PIDFD_OPEN              = 434
+	SYS_CLONE3                  = 435
+	SYS_CLOSE_RANGE             = 436
+	SYS_OPENAT2                 = 437
+	SYS_PIDFD_GETFD             = 438
+	SYS_FACCESSAT2              = 439
+	SYS_PROCESS_MADVISE         = 440
+	SYS_EPOLL_PWAIT2            = 441
+	SYS_MOUNT_SETATTR           = 442
+	SYS_QUOTACTL_FD             = 443
+	SYS_LANDLOCK_CREATE_RULESET = 444
+	SYS_LANDLOCK_ADD_RULE       = 445
+	SYS_LANDLOCK_RESTRICT_SELF  = 446
+	SYS_MEMFD_SECRET            = 447
+	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
+	SYS_FCHMODAT2               = 452
+	SYS_MAP_SHADOW_STACK        = 453
+	SYS_FUTEX_WAKE              = 454
+	SYS_FUTEX_WAIT              = 455
+	SYS_FUTEX_REQUEUE           = 456
+	SYS_STATMOUNT               = 457
+	SYS_LISTMOUNT               = 458
+	SYS_LSM_GET_SELF_ATTR       = 459
+	SYS_LSM_SET_SELF_ATTR       = 460
+	SYS_LSM_LIST_MODULES        = 461
+	SYS_MSEAL                   = 462
+)

container/seccomp/syscall_test.go

@@ -0,0 +1,22 @@
+package seccomp
+
+import (
+	"testing"
+)
+
+func TestSyscallResolveName(t *testing.T) {
+	t.Parallel()
+
+	for name, want := range Syscalls() {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := syscallResolveName(name); got != want {
+				t.Errorf("syscallResolveName(%q) = %d, want %d", name, got, want)
+			}
+			if got, ok := SyscallResolveName(name); !ok || got != want {
+				t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want)
+			}
+		})
+	}
+}

container/std/pnr.go

@@ -1,267 +0,0 @@
-// Code generated from include/seccomp-syscalls.h; DO NOT EDIT.
-
-package std
-
-/*
- * pseudo syscall definitions
- */
-
-const (
-
-	/* socket syscalls */
-
-	__PNR_socket      = -101
-	__PNR_bind        = -102
-	__PNR_connect     = -103
-	__PNR_listen      = -104
-	__PNR_accept      = -105
-	__PNR_getsockname = -106
-	__PNR_getpeername = -107
-	__PNR_socketpair  = -108
-	__PNR_send        = -109
-	__PNR_recv        = -110
-	__PNR_sendto      = -111
-	__PNR_recvfrom    = -112
-	__PNR_shutdown    = -113
-	__PNR_setsockopt  = -114
-	__PNR_getsockopt  = -115
-	__PNR_sendmsg     = -116
-	__PNR_recvmsg     = -117
-	__PNR_accept4     = -118
-	__PNR_recvmmsg    = -119
-	__PNR_sendmmsg    = -120
-
-	/* ipc syscalls */
-
-	__PNR_semop      = -201
-	__PNR_semget     = -202
-	__PNR_semctl     = -203
-	__PNR_semtimedop = -204
-	__PNR_msgsnd     = -211
-	__PNR_msgrcv     = -212
-	__PNR_msgget     = -213
-	__PNR_msgctl     = -214
-	__PNR_shmat      = -221
-	__PNR_shmdt      = -222
-	__PNR_shmget     = -223
-	__PNR_shmctl     = -224
-
-	/* single syscalls */
-
-	__PNR_arch_prctl                   = -10001
-	__PNR_bdflush                      = -10002
-	__PNR_break                        = -10003
-	__PNR_chown32                      = -10004
-	__PNR_epoll_ctl_old                = -10005
-	__PNR_epoll_wait_old               = -10006
-	__PNR_fadvise64_64                 = -10007
-	__PNR_fchown32                     = -10008
-	__PNR_fcntl64                      = -10009
-	__PNR_fstat64                      = -10010
-	__PNR_fstatat64                    = -10011
-	__PNR_fstatfs64                    = -10012
-	__PNR_ftime                        = -10013
-	__PNR_ftruncate64                  = -10014
-	__PNR_getegid32                    = -10015
-	__PNR_geteuid32                    = -10016
-	__PNR_getgid32                     = -10017
-	__PNR_getgroups32                  = -10018
-	__PNR_getresgid32                  = -10019
-	__PNR_getresuid32                  = -10020
-	__PNR_getuid32                     = -10021
-	__PNR_gtty                         = -10022
-	__PNR_idle                         = -10023
-	__PNR_ipc                          = -10024
-	__PNR_lchown32                     = -10025
-	__PNR__llseek                      = -10026
-	__PNR_lock                         = -10027
-	__PNR_lstat64                      = -10028
-	__PNR_mmap2                        = -10029
-	__PNR_mpx                          = -10030
-	__PNR_newfstatat                   = -10031
-	__PNR__newselect                   = -10032
-	__PNR_nice                         = -10033
-	__PNR_oldfstat                     = -10034
-	__PNR_oldlstat                     = -10035
-	__PNR_oldolduname                  = -10036
-	__PNR_oldstat                      = -10037
-	__PNR_olduname                     = -10038
-	__PNR_prof                         = -10039
-	__PNR_profil                       = -10040
-	__PNR_readdir                      = -10041
-	__PNR_security                     = -10042
-	__PNR_sendfile64                   = -10043
-	__PNR_setfsgid32                   = -10044
-	__PNR_setfsuid32                   = -10045
-	__PNR_setgid32                     = -10046
-	__PNR_setgroups32                  = -10047
-	__PNR_setregid32                   = -10048
-	__PNR_setresgid32                  = -10049
-	__PNR_setresuid32                  = -10050
-	__PNR_setreuid32                   = -10051
-	__PNR_setuid32                     = -10052
-	__PNR_sgetmask                     = -10053
-	__PNR_sigaction                    = -10054
-	__PNR_signal                       = -10055
-	__PNR_sigpending                   = -10056
-	__PNR_sigprocmask                  = -10057
-	__PNR_sigreturn                    = -10058
-	__PNR_sigsuspend                   = -10059
-	__PNR_socketcall                   = -10060
-	__PNR_ssetmask                     = -10061
-	__PNR_stat64                       = -10062
-	__PNR_statfs64                     = -10063
-	__PNR_stime                        = -10064
-	__PNR_stty                         = -10065
-	__PNR_truncate64                   = -10066
-	__PNR_tuxcall                      = -10067
-	__PNR_ugetrlimit                   = -10068
-	__PNR_ulimit                       = -10069
-	__PNR_umount                       = -10070
-	__PNR_vm86                         = -10071
-	__PNR_vm86old                      = -10072
-	__PNR_waitpid                      = -10073
-	__PNR_create_module                = -10074
-	__PNR_get_kernel_syms              = -10075
-	__PNR_get_thread_area              = -10076
-	__PNR_nfsservctl                   = -10077
-	__PNR_query_module                 = -10078
-	__PNR_set_thread_area              = -10079
-	__PNR__sysctl                      = -10080
-	__PNR_uselib                       = -10081
-	__PNR_vserver                      = -10082
-	__PNR_arm_fadvise64_64             = -10083
-	__PNR_arm_sync_file_range          = -10084
-	__PNR_pciconfig_iobase             = -10086
-	__PNR_pciconfig_read               = -10087
-	__PNR_pciconfig_write              = -10088
-	__PNR_sync_file_range2             = -10089
-	__PNR_syscall                      = -10090
-	__PNR_afs_syscall                  = -10091
-	__PNR_fadvise64                    = -10092
-	__PNR_getpmsg                      = -10093
-	__PNR_ioperm                       = -10094
-	__PNR_iopl                         = -10095
-	__PNR_migrate_pages                = -10097
-	__PNR_modify_ldt                   = -10098
-	__PNR_putpmsg                      = -10099
-	__PNR_sync_file_range              = -10100
-	__PNR_select                       = -10101
-	__PNR_vfork                        = -10102
-	__PNR_cachectl                     = -10103
-	__PNR_cacheflush                   = -10104
-	__PNR_sysmips                      = -10106
-	__PNR_timerfd                      = -10107
-	__PNR_time                         = -10108
-	__PNR_getrandom                    = -10109
-	__PNR_memfd_create                 = -10110
-	__PNR_kexec_file_load              = -10111
-	__PNR_sysfs                        = -10145
-	__PNR_oldwait4                     = -10146
-	__PNR_access                       = -10147
-	__PNR_alarm                        = -10148
-	__PNR_chmod                        = -10149
-	__PNR_chown                        = -10150
-	__PNR_creat                        = -10151
-	__PNR_dup2                         = -10152
-	__PNR_epoll_create                 = -10153
-	__PNR_epoll_wait                   = -10154
-	__PNR_eventfd                      = -10155
-	__PNR_fork                         = -10156
-	__PNR_futimesat                    = -10157
-	__PNR_getdents                     = -10158
-	__PNR_getpgrp                      = -10159
-	__PNR_inotify_init                 = -10160
-	__PNR_lchown                       = -10161
-	__PNR_link                         = -10162
-	__PNR_lstat                        = -10163
-	__PNR_mkdir                        = -10164
-	__PNR_mknod                        = -10165
-	__PNR_open                         = -10166
-	__PNR_pause                        = -10167
-	__PNR_pipe                         = -10168
-	__PNR_poll                         = -10169
-	__PNR_readlink                     = -10170
-	__PNR_rename                       = -10171
-	__PNR_rmdir                        = -10172
-	__PNR_signalfd                     = -10173
-	__PNR_stat                         = -10174
-	__PNR_symlink                      = -10175
-	__PNR_unlink                       = -10176
-	__PNR_ustat                        = -10177
-	__PNR_utime                        = -10178
-	__PNR_utimes                       = -10179
-	__PNR_getrlimit                    = -10180
-	__PNR_mmap                         = -10181
-	__PNR_breakpoint                   = -10182
-	__PNR_set_tls                      = -10183
-	__PNR_usr26                        = -10184
-	__PNR_usr32                        = -10185
-	__PNR_multiplexer                  = -10186
-	__PNR_rtas                         = -10187
-	__PNR_spu_create                   = -10188
-	__PNR_spu_run                      = -10189
-	__PNR_swapcontext                  = -10190
-	__PNR_sys_debug_setcontext         = -10191
-	__PNR_switch_endian                = -10191
-	__PNR_get_mempolicy                = -10192
-	__PNR_move_pages                   = -10193
-	__PNR_mbind                        = -10194
-	__PNR_set_mempolicy                = -10195
-	__PNR_s390_runtime_instr           = -10196
-	__PNR_s390_pci_mmio_read           = -10197
-	__PNR_s390_pci_mmio_write          = -10198
-	__PNR_membarrier                   = -10199
-	__PNR_userfaultfd                  = -10200
-	__PNR_pkey_mprotect                = -10201
-	__PNR_pkey_alloc                   = -10202
-	__PNR_pkey_free                    = -10203
-	__PNR_get_tls                      = -10204
-	__PNR_s390_guarded_storage         = -10205
-	__PNR_s390_sthyi                   = -10206
-	__PNR_subpage_prot                 = -10207
-	__PNR_statx                        = -10208
-	__PNR_io_pgetevents                = -10209
-	__PNR_rseq                         = -10210
-	__PNR_setrlimit                    = -10211
-	__PNR_clock_adjtime64              = -10212
-	__PNR_clock_getres_time64          = -10213
-	__PNR_clock_gettime64              = -10214
-	__PNR_clock_nanosleep_time64       = -10215
-	__PNR_clock_settime64              = -10216
-	__PNR_clone3                       = -10217
-	__PNR_fsconfig                     = -10218
-	__PNR_fsmount                      = -10219
-	__PNR_fsopen                       = -10220
-	__PNR_fspick                       = -10221
-	__PNR_futex_time64                 = -10222
-	__PNR_io_pgetevents_time64         = -10223
-	__PNR_move_mount                   = -10224
-	__PNR_mq_timedreceive_time64       = -10225
-	__PNR_mq_timedsend_time64          = -10226
-	__PNR_open_tree                    = -10227
-	__PNR_pidfd_open                   = -10228
-	__PNR_pidfd_send_signal            = -10229
-	__PNR_ppoll_time64                 = -10230
-	__PNR_pselect6_time64              = -10231
-	__PNR_recvmmsg_time64              = -10232
-	__PNR_rt_sigtimedwait_time64       = -10233
-	__PNR_sched_rr_get_interval_time64 = -10234
-	__PNR_semtimedop_time64            = -10235
-	__PNR_timer_gettime64              = -10236
-	__PNR_timer_settime64              = -10237
-	__PNR_timerfd_gettime64            = -10238
-	__PNR_timerfd_settime64            = -10239
-	__PNR_utimensat_time64             = -10240
-	__PNR_ppoll                        = -10241
-	__PNR_renameat                     = -10242
-	__PNR_riscv_flush_icache           = -10243
-	__PNR_memfd_secret                 = -10244
-	__PNR_map_shadow_stack             = -10245
-	__PNR_fstat                        = -10246
-	__PNR_atomic_barrier               = -10247
-	__PNR_atomic_cmpxchg_32            = -10248
-	__PNR_getpagesize                  = -10249
-	__PNR_riscv_hwprobe                = -10250
-	__PNR_uretprobe                    = -10251
-)

container/std/seccomp.go

@@ -1,76 +0,0 @@
-package std
-
-import (
-	"encoding/json"
-	"strconv"
-)
-
-type (
-	// ScmpUint is equivalent to C.uint.
-	ScmpUint uint32
-	// ScmpInt is equivalent to C.int.
-	ScmpInt int32
-
-	// ScmpSyscall represents a syscall number passed to libseccomp via [NativeRule.Syscall].
-	ScmpSyscall ScmpInt
-	// ScmpErrno represents an errno value passed to libseccomp via [NativeRule.Errno].
-	ScmpErrno ScmpInt
-
-	// ScmpCompare is equivalent to enum scmp_compare;
-	ScmpCompare ScmpUint
-	// ScmpDatum is equivalent to scmp_datum_t.
-	ScmpDatum uint64
-
-	// ScmpArgCmp is equivalent to struct scmp_arg_cmp.
-	ScmpArgCmp struct {
-		// argument number, starting at 0
-		Arg ScmpUint `json:"arg"`
-		// the comparison op, e.g. SCMP_CMP_*
-		Op ScmpCompare `json:"op"`
-
-		DatumA ScmpDatum `json:"a,omitempty"`
-		DatumB ScmpDatum `json:"b,omitempty"`
-	}
-
-	// A NativeRule specifies an arch-specific action taken by seccomp under certain conditions.
-	NativeRule struct {
-		// Syscall is the arch-dependent syscall number to act against.
-		Syscall ScmpSyscall `json:"syscall"`
-		// Errno is the errno value to return when the condition is satisfied.
-		Errno ScmpErrno `json:"errno"`
-		// Arg is the optional struct scmp_arg_cmp passed to libseccomp.
-		Arg *ScmpArgCmp `json:"arg,omitempty"`
-	}
-)
-
-// MarshalJSON resolves the name of [ScmpSyscall] and encodes it as a [json] string.
-// If such a name does not exist, the syscall number is encoded instead.
-func (num *ScmpSyscall) MarshalJSON() ([]byte, error) {
-	n := *num
-	for name, cur := range Syscalls() {
-		if cur == n {
-			return json.Marshal(name)
-		}
-	}
-	return json.Marshal(n)
-}
-
-// SyscallNameError is returned when trying to unmarshal an invalid syscall name into [ScmpSyscall].
-type SyscallNameError string
-
-func (e SyscallNameError) Error() string { return "invalid syscall name " + strconv.Quote(string(e)) }
-
-// UnmarshalJSON looks up the syscall number corresponding to name encoded in data
-// by calling [SyscallResolveName].
-func (num *ScmpSyscall) UnmarshalJSON(data []byte) error {
-	var name string
-	if err := json.Unmarshal(data, &name); err != nil {
-		return err
-	}
-	if n, ok := SyscallResolveName(name); !ok {
-		return SyscallNameError(name)
-	} else {
-		*num = n
-		return nil
-	}
-}

container/std/seccomp_test.go

@@ -1,62 +0,0 @@
-package std_test
-
-import (
-	"encoding/json"
-	"errors"
-	"math"
-	"reflect"
-	"testing"
-
-	"hakurei.app/container/std"
-)
-
-func TestScmpSyscall(t *testing.T) {
-	t.Parallel()
-
-	testCases := []struct {
-		name string
-		data string
-		want std.ScmpSyscall
-		err  error
-	}{
-		{"epoll_create1", `"epoll_create1"`, std.SNR_EPOLL_CREATE1, nil},
-		{"clone3", `"clone3"`, std.SNR_CLONE3, nil},
-
-		{"oob", `-2147483647`, -math.MaxInt32,
-			&json.UnmarshalTypeError{Value: "number", Type: reflect.TypeFor[string](), Offset: 11}},
-		{"name", `"nonexistent_syscall"`, -math.MaxInt32,
-			std.SyscallNameError("nonexistent_syscall")},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			t.Run("decode", func(t *testing.T) {
-				var got std.ScmpSyscall
-				if err := json.Unmarshal([]byte(tc.data), &got); !reflect.DeepEqual(err, tc.err) {
-					t.Fatalf("Unmarshal: error = %#v, want %#v", err, tc.err)
-				} else if err == nil && got != tc.want {
-					t.Errorf("Unmarshal: %v, want %v", got, tc.want)
-				}
-			})
-			if errors.As(tc.err, new(std.SyscallNameError)) {
-				return
-			}
-
-			t.Run("encode", func(t *testing.T) {
-				if got, err := json.Marshal(&tc.want); err != nil {
-					t.Fatalf("Marshal: error = %v", err)
-				} else if string(got) != tc.data {
-					t.Errorf("Marshal: %s, want %s", string(got), tc.data)
-				}
-			})
-		})
-	}
-
-	t.Run("error", func(t *testing.T) {
-		const want = `invalid syscall name "\x00"`
-		if got := std.SyscallNameError("\x00").Error(); got != want {
-			t.Fatalf("Error: %q, want %q", got, want)
-		}
-	})
-}

container/std/syscall_extra_linux_386.go

@@ -1,13 +0,0 @@
-package std
-
-var syscallNumExtra = map[string]ScmpSyscall{
-	"kexec_file_load": SNR_KEXEC_FILE_LOAD,
-	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SNR_SWITCH_ENDIAN,
-}
-
-const (
-	SNR_KEXEC_FILE_LOAD ScmpSyscall = __PNR_kexec_file_load
-	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
-)

container/std/syscall_extra_linux_amd64.go

@@ -1,41 +0,0 @@
-package std
-
-var syscallNumExtra = map[string]ScmpSyscall{
-	"umount":          SNR_UMOUNT,
-	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SNR_SWITCH_ENDIAN,
-	"vm86":            SNR_VM86,
-	"vm86old":         SNR_VM86OLD,
-	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
-	"clock_settime64": SNR_CLOCK_SETTIME64,
-	"chown32":         SNR_CHOWN32,
-	"fchown32":        SNR_FCHOWN32,
-	"lchown32":        SNR_LCHOWN32,
-	"setgid32":        SNR_SETGID32,
-	"setgroups32":     SNR_SETGROUPS32,
-	"setregid32":      SNR_SETREGID32,
-	"setresgid32":     SNR_SETRESGID32,
-	"setresuid32":     SNR_SETRESUID32,
-	"setreuid32":      SNR_SETREUID32,
-	"setuid32":        SNR_SETUID32,
-}
-
-const (
-	SNR_UMOUNT          ScmpSyscall = __PNR_umount
-	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
-	SNR_VM86            ScmpSyscall = __PNR_vm86
-	SNR_VM86OLD         ScmpSyscall = __PNR_vm86old
-	SNR_CLOCK_ADJTIME64 ScmpSyscall = __PNR_clock_adjtime64
-	SNR_CLOCK_SETTIME64 ScmpSyscall = __PNR_clock_settime64
-	SNR_CHOWN32         ScmpSyscall = __PNR_chown32
-	SNR_FCHOWN32        ScmpSyscall = __PNR_fchown32
-	SNR_LCHOWN32        ScmpSyscall = __PNR_lchown32
-	SNR_SETGID32        ScmpSyscall = __PNR_setgid32
-	SNR_SETGROUPS32     ScmpSyscall = __PNR_setgroups32
-	SNR_SETREGID32      ScmpSyscall = __PNR_setregid32
-	SNR_SETRESGID32     ScmpSyscall = __PNR_setresgid32
-	SNR_SETRESUID32     ScmpSyscall = __PNR_setresuid32
-	SNR_SETREUID32      ScmpSyscall = __PNR_setreuid32
-	SNR_SETUID32        ScmpSyscall = __PNR_setuid32
-)

container/std/syscall_extra_linux_arm64.go

@@ -1,55 +0,0 @@
-package std
-
-import "syscall"
-
-const (
-	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
-)
-
-var syscallNumExtra = map[string]ScmpSyscall{
-	"uselib":          SNR_USELIB,
-	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
-	"clock_settime64": SNR_CLOCK_SETTIME64,
-	"umount":          SNR_UMOUNT,
-	"chown":           SNR_CHOWN,
-	"chown32":         SNR_CHOWN32,
-	"fchown32":        SNR_FCHOWN32,
-	"lchown":          SNR_LCHOWN,
-	"lchown32":        SNR_LCHOWN32,
-	"setgid32":        SNR_SETGID32,
-	"setgroups32":     SNR_SETGROUPS32,
-	"setregid32":      SNR_SETREGID32,
-	"setresgid32":     SNR_SETRESGID32,
-	"setresuid32":     SNR_SETRESUID32,
-	"setreuid32":      SNR_SETREUID32,
-	"setuid32":        SNR_SETUID32,
-	"modify_ldt":      SNR_MODIFY_LDT,
-	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SNR_SWITCH_ENDIAN,
-	"vm86":            SNR_VM86,
-	"vm86old":         SNR_VM86OLD,
-}
-
-const (
-	SNR_USELIB          ScmpSyscall = __PNR_uselib
-	SNR_CLOCK_ADJTIME64 ScmpSyscall = __PNR_clock_adjtime64
-	SNR_CLOCK_SETTIME64 ScmpSyscall = __PNR_clock_settime64
-	SNR_UMOUNT          ScmpSyscall = __PNR_umount
-	SNR_CHOWN           ScmpSyscall = __PNR_chown
-	SNR_CHOWN32         ScmpSyscall = __PNR_chown32
-	SNR_FCHOWN32        ScmpSyscall = __PNR_fchown32
-	SNR_LCHOWN          ScmpSyscall = __PNR_lchown
-	SNR_LCHOWN32        ScmpSyscall = __PNR_lchown32
-	SNR_SETGID32        ScmpSyscall = __PNR_setgid32
-	SNR_SETGROUPS32     ScmpSyscall = __PNR_setgroups32
-	SNR_SETREGID32      ScmpSyscall = __PNR_setregid32
-	SNR_SETRESGID32     ScmpSyscall = __PNR_setresgid32
-	SNR_SETRESUID32     ScmpSyscall = __PNR_setresuid32
-	SNR_SETREUID32      ScmpSyscall = __PNR_setreuid32
-	SNR_SETUID32        ScmpSyscall = __PNR_setuid32
-	SNR_MODIFY_LDT      ScmpSyscall = __PNR_modify_ldt
-	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
-	SNR_VM86            ScmpSyscall = __PNR_vm86
-	SNR_VM86OLD         ScmpSyscall = __PNR_vm86old
-)

container/std/syscall_linux_amd64.go

@@ -1,837 +0,0 @@
-// mksysnum_linux.pl /usr/include/asm/unistd_64.h
-// Code generated by the command above; DO NOT EDIT.
-
-package std
-
-import . "syscall"
-
-var syscallNum = map[string]ScmpSyscall{
-	"read":                    SNR_READ,
-	"write":                   SNR_WRITE,
-	"open":                    SNR_OPEN,
-	"close":                   SNR_CLOSE,
-	"stat":                    SNR_STAT,
-	"fstat":                   SNR_FSTAT,
-	"lstat":                   SNR_LSTAT,
-	"poll":                    SNR_POLL,
-	"lseek":                   SNR_LSEEK,
-	"mmap":                    SNR_MMAP,
-	"mprotect":                SNR_MPROTECT,
-	"munmap":                  SNR_MUNMAP,
-	"brk":                     SNR_BRK,
-	"rt_sigaction":            SNR_RT_SIGACTION,
-	"rt_sigprocmask":          SNR_RT_SIGPROCMASK,
-	"rt_sigreturn":            SNR_RT_SIGRETURN,
-	"ioctl":                   SNR_IOCTL,
-	"pread64":                 SNR_PREAD64,
-	"pwrite64":                SNR_PWRITE64,
-	"readv":                   SNR_READV,
-	"writev":                  SNR_WRITEV,
-	"access":                  SNR_ACCESS,
-	"pipe":                    SNR_PIPE,
-	"select":                  SNR_SELECT,
-	"sched_yield":             SNR_SCHED_YIELD,
-	"mremap":                  SNR_MREMAP,
-	"msync":                   SNR_MSYNC,
-	"mincore":                 SNR_MINCORE,
-	"madvise":                 SNR_MADVISE,
-	"shmget":                  SNR_SHMGET,
-	"shmat":                   SNR_SHMAT,
-	"shmctl":                  SNR_SHMCTL,
-	"dup":                     SNR_DUP,
-	"dup2":                    SNR_DUP2,
-	"pause":                   SNR_PAUSE,
-	"nanosleep":               SNR_NANOSLEEP,
-	"getitimer":               SNR_GETITIMER,
-	"alarm":                   SNR_ALARM,
-	"setitimer":               SNR_SETITIMER,
-	"getpid":                  SNR_GETPID,
-	"sendfile":                SNR_SENDFILE,
-	"socket":                  SNR_SOCKET,
-	"connect":                 SNR_CONNECT,
-	"accept":                  SNR_ACCEPT,
-	"sendto":                  SNR_SENDTO,
-	"recvfrom":                SNR_RECVFROM,
-	"sendmsg":                 SNR_SENDMSG,
-	"recvmsg":                 SNR_RECVMSG,
-	"shutdown":                SNR_SHUTDOWN,
-	"bind":                    SNR_BIND,
-	"listen":                  SNR_LISTEN,
-	"getsockname":             SNR_GETSOCKNAME,
-	"getpeername":             SNR_GETPEERNAME,
-	"socketpair":              SNR_SOCKETPAIR,
-	"setsockopt":              SNR_SETSOCKOPT,
-	"getsockopt":              SNR_GETSOCKOPT,
-	"clone":                   SNR_CLONE,
-	"fork":                    SNR_FORK,
-	"vfork":                   SNR_VFORK,
-	"execve":                  SNR_EXECVE,
-	"exit":                    SNR_EXIT,
-	"wait4":                   SNR_WAIT4,
-	"kill":                    SNR_KILL,
-	"uname":                   SNR_UNAME,
-	"semget":                  SNR_SEMGET,
-	"semop":                   SNR_SEMOP,
-	"semctl":                  SNR_SEMCTL,
-	"shmdt":                   SNR_SHMDT,
-	"msgget":                  SNR_MSGGET,
-	"msgsnd":                  SNR_MSGSND,
-	"msgrcv":                  SNR_MSGRCV,
-	"msgctl":                  SNR_MSGCTL,
-	"fcntl":                   SNR_FCNTL,
-	"flock":                   SNR_FLOCK,
-	"fsync":                   SNR_FSYNC,
-	"fdatasync":               SNR_FDATASYNC,
-	"truncate":                SNR_TRUNCATE,
-	"ftruncate":               SNR_FTRUNCATE,
-	"getdents":                SNR_GETDENTS,
-	"getcwd":                  SNR_GETCWD,
-	"chdir":                   SNR_CHDIR,
-	"fchdir":                  SNR_FCHDIR,
-	"rename":                  SNR_RENAME,
-	"mkdir":                   SNR_MKDIR,
-	"rmdir":                   SNR_RMDIR,
-	"creat":                   SNR_CREAT,
-	"link":                    SNR_LINK,
-	"unlink":                  SNR_UNLINK,
-	"symlink":                 SNR_SYMLINK,
-	"readlink":                SNR_READLINK,
-	"chmod":                   SNR_CHMOD,
-	"fchmod":                  SNR_FCHMOD,
-	"chown":                   SNR_CHOWN,
-	"fchown":                  SNR_FCHOWN,
-	"lchown":                  SNR_LCHOWN,
-	"umask":                   SNR_UMASK,
-	"gettimeofday":            SNR_GETTIMEOFDAY,
-	"getrlimit":               SNR_GETRLIMIT,
-	"getrusage":               SNR_GETRUSAGE,
-	"sysinfo":                 SNR_SYSINFO,
-	"times":                   SNR_TIMES,
-	"ptrace":                  SNR_PTRACE,
-	"getuid":                  SNR_GETUID,
-	"syslog":                  SNR_SYSLOG,
-	"getgid":                  SNR_GETGID,
-	"setuid":                  SNR_SETUID,
-	"setgid":                  SNR_SETGID,
-	"geteuid":                 SNR_GETEUID,
-	"getegid":                 SNR_GETEGID,
-	"setpgid":                 SNR_SETPGID,
-	"getppid":                 SNR_GETPPID,
-	"getpgrp":                 SNR_GETPGRP,
-	"setsid":                  SNR_SETSID,
-	"setreuid":                SNR_SETREUID,
-	"setregid":                SNR_SETREGID,
-	"getgroups":               SNR_GETGROUPS,
-	"setgroups":               SNR_SETGROUPS,
-	"setresuid":               SNR_SETRESUID,
-	"getresuid":               SNR_GETRESUID,
-	"setresgid":               SNR_SETRESGID,
-	"getresgid":               SNR_GETRESGID,
-	"getpgid":                 SNR_GETPGID,
-	"setfsuid":                SNR_SETFSUID,
-	"setfsgid":                SNR_SETFSGID,
-	"getsid":                  SNR_GETSID,
-	"capget":                  SNR_CAPGET,
-	"capset":                  SNR_CAPSET,
-	"rt_sigpending":           SNR_RT_SIGPENDING,
-	"rt_sigtimedwait":         SNR_RT_SIGTIMEDWAIT,
-	"rt_sigqueueinfo":         SNR_RT_SIGQUEUEINFO,
-	"rt_sigsuspend":           SNR_RT_SIGSUSPEND,
-	"sigaltstack":             SNR_SIGALTSTACK,
-	"utime":                   SNR_UTIME,
-	"mknod":                   SNR_MKNOD,
-	"uselib":                  SNR_USELIB,
-	"personality":             SNR_PERSONALITY,
-	"ustat":                   SNR_USTAT,
-	"statfs":                  SNR_STATFS,
-	"fstatfs":                 SNR_FSTATFS,
-	"sysfs":                   SNR_SYSFS,
-	"getpriority":             SNR_GETPRIORITY,
-	"setpriority":             SNR_SETPRIORITY,
-	"sched_setparam":          SNR_SCHED_SETPARAM,
-	"sched_getparam":          SNR_SCHED_GETPARAM,
-	"sched_setscheduler":      SNR_SCHED_SETSCHEDULER,
-	"sched_getscheduler":      SNR_SCHED_GETSCHEDULER,
-	"sched_get_priority_max":  SNR_SCHED_GET_PRIORITY_MAX,
-	"sched_get_priority_min":  SNR_SCHED_GET_PRIORITY_MIN,
-	"sched_rr_get_interval":   SNR_SCHED_RR_GET_INTERVAL,
-	"mlock":                   SNR_MLOCK,
-	"munlock":                 SNR_MUNLOCK,
-	"mlockall":                SNR_MLOCKALL,
-	"munlockall":              SNR_MUNLOCKALL,
-	"vhangup":                 SNR_VHANGUP,
-	"modify_ldt":              SNR_MODIFY_LDT,
-	"pivot_root":              SNR_PIVOT_ROOT,
-	"_sysctl":                 SNR__SYSCTL,
-	"prctl":                   SNR_PRCTL,
-	"arch_prctl":              SNR_ARCH_PRCTL,
-	"adjtimex":                SNR_ADJTIMEX,
-	"setrlimit":               SNR_SETRLIMIT,
-	"chroot":                  SNR_CHROOT,
-	"sync":                    SNR_SYNC,
-	"acct":                    SNR_ACCT,
-	"settimeofday":            SNR_SETTIMEOFDAY,
-	"mount":                   SNR_MOUNT,
-	"umount2":                 SNR_UMOUNT2,
-	"swapon":                  SNR_SWAPON,
-	"swapoff":                 SNR_SWAPOFF,
-	"reboot":                  SNR_REBOOT,
-	"sethostname":             SNR_SETHOSTNAME,
-	"setdomainname":           SNR_SETDOMAINNAME,
-	"iopl":                    SNR_IOPL,
-	"ioperm":                  SNR_IOPERM,
-	"create_module":           SNR_CREATE_MODULE,
-	"init_module":             SNR_INIT_MODULE,
-	"delete_module":           SNR_DELETE_MODULE,
-	"get_kernel_syms":         SNR_GET_KERNEL_SYMS,
-	"query_module":            SNR_QUERY_MODULE,
-	"quotactl":                SNR_QUOTACTL,
-	"nfsservctl":              SNR_NFSSERVCTL,
-	"getpmsg":                 SNR_GETPMSG,
-	"putpmsg":                 SNR_PUTPMSG,
-	"afs_syscall":             SNR_AFS_SYSCALL,
-	"tuxcall":                 SNR_TUXCALL,
-	"security":                SNR_SECURITY,
-	"gettid":                  SNR_GETTID,
-	"readahead":               SNR_READAHEAD,
-	"setxattr":                SNR_SETXATTR,
-	"lsetxattr":               SNR_LSETXATTR,
-	"fsetxattr":               SNR_FSETXATTR,
-	"getxattr":                SNR_GETXATTR,
-	"lgetxattr":               SNR_LGETXATTR,
-	"fgetxattr":               SNR_FGETXATTR,
-	"listxattr":               SNR_LISTXATTR,
-	"llistxattr":              SNR_LLISTXATTR,
-	"flistxattr":              SNR_FLISTXATTR,
-	"removexattr":             SNR_REMOVEXATTR,
-	"lremovexattr":            SNR_LREMOVEXATTR,
-	"fremovexattr":            SNR_FREMOVEXATTR,
-	"tkill":                   SNR_TKILL,
-	"time":                    SNR_TIME,
-	"futex":                   SNR_FUTEX,
-	"sched_setaffinity":       SNR_SCHED_SETAFFINITY,
-	"sched_getaffinity":       SNR_SCHED_GETAFFINITY,
-	"set_thread_area":         SNR_SET_THREAD_AREA,
-	"io_setup":                SNR_IO_SETUP,
-	"io_destroy":              SNR_IO_DESTROY,
-	"io_getevents":            SNR_IO_GETEVENTS,
-	"io_submit":               SNR_IO_SUBMIT,
-	"io_cancel":               SNR_IO_CANCEL,
-	"get_thread_area":         SNR_GET_THREAD_AREA,
-	"lookup_dcookie":          SNR_LOOKUP_DCOOKIE,
-	"epoll_create":            SNR_EPOLL_CREATE,
-	"epoll_ctl_old":           SNR_EPOLL_CTL_OLD,
-	"epoll_wait_old":          SNR_EPOLL_WAIT_OLD,
-	"remap_file_pages":        SNR_REMAP_FILE_PAGES,
-	"getdents64":              SNR_GETDENTS64,
-	"set_tid_address":         SNR_SET_TID_ADDRESS,
-	"restart_syscall":         SNR_RESTART_SYSCALL,
-	"semtimedop":              SNR_SEMTIMEDOP,
-	"fadvise64":               SNR_FADVISE64,
-	"timer_create":            SNR_TIMER_CREATE,
-	"timer_settime":           SNR_TIMER_SETTIME,
-	"timer_gettime":           SNR_TIMER_GETTIME,
-	"timer_getoverrun":        SNR_TIMER_GETOVERRUN,
-	"timer_delete":            SNR_TIMER_DELETE,
-	"clock_settime":           SNR_CLOCK_SETTIME,
-	"clock_gettime":           SNR_CLOCK_GETTIME,
-	"clock_getres":            SNR_CLOCK_GETRES,
-	"clock_nanosleep":         SNR_CLOCK_NANOSLEEP,
-	"exit_group":              SNR_EXIT_GROUP,
-	"epoll_wait":              SNR_EPOLL_WAIT,
-	"epoll_ctl":               SNR_EPOLL_CTL,
-	"tgkill":                  SNR_TGKILL,
-	"utimes":                  SNR_UTIMES,
-	"vserver":                 SNR_VSERVER,
-	"mbind":                   SNR_MBIND,
-	"set_mempolicy":           SNR_SET_MEMPOLICY,
-	"get_mempolicy":           SNR_GET_MEMPOLICY,
-	"mq_open":                 SNR_MQ_OPEN,
-	"mq_unlink":               SNR_MQ_UNLINK,
-	"mq_timedsend":            SNR_MQ_TIMEDSEND,
-	"mq_timedreceive":         SNR_MQ_TIMEDRECEIVE,
-	"mq_notify":               SNR_MQ_NOTIFY,
-	"mq_getsetattr":           SNR_MQ_GETSETATTR,
-	"kexec_load":              SNR_KEXEC_LOAD,
-	"waitid":                  SNR_WAITID,
-	"add_key":                 SNR_ADD_KEY,
-	"request_key":             SNR_REQUEST_KEY,
-	"keyctl":                  SNR_KEYCTL,
-	"ioprio_set":              SNR_IOPRIO_SET,
-	"ioprio_get":              SNR_IOPRIO_GET,
-	"inotify_init":            SNR_INOTIFY_INIT,
-	"inotify_add_watch":       SNR_INOTIFY_ADD_WATCH,
-	"inotify_rm_watch":        SNR_INOTIFY_RM_WATCH,
-	"migrate_pages":           SNR_MIGRATE_PAGES,
-	"openat":                  SNR_OPENAT,
-	"mkdirat":                 SNR_MKDIRAT,
-	"mknodat":                 SNR_MKNODAT,
-	"fchownat":                SNR_FCHOWNAT,
-	"futimesat":               SNR_FUTIMESAT,
-	"newfstatat":              SNR_NEWFSTATAT,
-	"unlinkat":                SNR_UNLINKAT,
-	"renameat":                SNR_RENAMEAT,
-	"linkat":                  SNR_LINKAT,
-	"symlinkat":               SNR_SYMLINKAT,
-	"readlinkat":              SNR_READLINKAT,
-	"fchmodat":                SNR_FCHMODAT,
-	"faccessat":               SNR_FACCESSAT,
-	"pselect6":                SNR_PSELECT6,
-	"ppoll":                   SNR_PPOLL,
-	"unshare":                 SNR_UNSHARE,
-	"set_robust_list":         SNR_SET_ROBUST_LIST,
-	"get_robust_list":         SNR_GET_ROBUST_LIST,
-	"splice":                  SNR_SPLICE,
-	"tee":                     SNR_TEE,
-	"sync_file_range":         SNR_SYNC_FILE_RANGE,
-	"vmsplice":                SNR_VMSPLICE,
-	"move_pages":              SNR_MOVE_PAGES,
-	"utimensat":               SNR_UTIMENSAT,
-	"epoll_pwait":             SNR_EPOLL_PWAIT,
-	"signalfd":                SNR_SIGNALFD,
-	"timerfd_create":          SNR_TIMERFD_CREATE,
-	"eventfd":                 SNR_EVENTFD,
-	"fallocate":               SNR_FALLOCATE,
-	"timerfd_settime":         SNR_TIMERFD_SETTIME,
-	"timerfd_gettime":         SNR_TIMERFD_GETTIME,
-	"accept4":                 SNR_ACCEPT4,
-	"signalfd4":               SNR_SIGNALFD4,
-	"eventfd2":                SNR_EVENTFD2,
-	"epoll_create1":           SNR_EPOLL_CREATE1,
-	"dup3":                    SNR_DUP3,
-	"pipe2":                   SNR_PIPE2,
-	"inotify_init1":           SNR_INOTIFY_INIT1,
-	"preadv":                  SNR_PREADV,
-	"pwritev":                 SNR_PWRITEV,
-	"rt_tgsigqueueinfo":       SNR_RT_TGSIGQUEUEINFO,
-	"perf_event_open":         SNR_PERF_EVENT_OPEN,
-	"recvmmsg":                SNR_RECVMMSG,
-	"fanotify_init":           SNR_FANOTIFY_INIT,
-	"fanotify_mark":           SNR_FANOTIFY_MARK,
-	"prlimit64":               SNR_PRLIMIT64,
-	"name_to_handle_at":       SNR_NAME_TO_HANDLE_AT,
-	"open_by_handle_at":       SNR_OPEN_BY_HANDLE_AT,
-	"clock_adjtime":           SNR_CLOCK_ADJTIME,
-	"syncfs":                  SNR_SYNCFS,
-	"sendmmsg":                SNR_SENDMMSG,
-	"setns":                   SNR_SETNS,
-	"getcpu":                  SNR_GETCPU,
-	"process_vm_readv":        SNR_PROCESS_VM_READV,
-	"process_vm_writev":       SNR_PROCESS_VM_WRITEV,
-	"kcmp":                    SNR_KCMP,
-	"finit_module":            SNR_FINIT_MODULE,
-	"sched_setattr":           SNR_SCHED_SETATTR,
-	"sched_getattr":           SNR_SCHED_GETATTR,
-	"renameat2":               SNR_RENAMEAT2,
-	"seccomp":                 SNR_SECCOMP,
-	"getrandom":               SNR_GETRANDOM,
-	"memfd_create":            SNR_MEMFD_CREATE,
-	"kexec_file_load":         SNR_KEXEC_FILE_LOAD,
-	"bpf":                     SNR_BPF,
-	"execveat":                SNR_EXECVEAT,
-	"userfaultfd":             SNR_USERFAULTFD,
-	"membarrier":              SNR_MEMBARRIER,
-	"mlock2":                  SNR_MLOCK2,
-	"copy_file_range":         SNR_COPY_FILE_RANGE,
-	"preadv2":                 SNR_PREADV2,
-	"pwritev2":                SNR_PWRITEV2,
-	"pkey_mprotect":           SNR_PKEY_MPROTECT,
-	"pkey_alloc":              SNR_PKEY_ALLOC,
-	"pkey_free":               SNR_PKEY_FREE,
-	"statx":                   SNR_STATX,
-	"io_pgetevents":           SNR_IO_PGETEVENTS,
-	"rseq":                    SNR_RSEQ,
-	"uretprobe":               SNR_URETPROBE,
-	"pidfd_send_signal":       SNR_PIDFD_SEND_SIGNAL,
-	"io_uring_setup":          SNR_IO_URING_SETUP,
-	"io_uring_enter":          SNR_IO_URING_ENTER,
-	"io_uring_register":       SNR_IO_URING_REGISTER,
-	"open_tree":               SNR_OPEN_TREE,
-	"move_mount":              SNR_MOVE_MOUNT,
-	"fsopen":                  SNR_FSOPEN,
-	"fsconfig":                SNR_FSCONFIG,
-	"fsmount":                 SNR_FSMOUNT,
-	"fspick":                  SNR_FSPICK,
-	"pidfd_open":              SNR_PIDFD_OPEN,
-	"clone3":                  SNR_CLONE3,
-	"close_range":             SNR_CLOSE_RANGE,
-	"openat2":                 SNR_OPENAT2,
-	"pidfd_getfd":             SNR_PIDFD_GETFD,
-	"faccessat2":              SNR_FACCESSAT2,
-	"process_madvise":         SNR_PROCESS_MADVISE,
-	"epoll_pwait2":            SNR_EPOLL_PWAIT2,
-	"mount_setattr":           SNR_MOUNT_SETATTR,
-	"quotactl_fd":             SNR_QUOTACTL_FD,
-	"landlock_create_ruleset": SNR_LANDLOCK_CREATE_RULESET,
-	"landlock_add_rule":       SNR_LANDLOCK_ADD_RULE,
-	"landlock_restrict_self":  SNR_LANDLOCK_RESTRICT_SELF,
-	"memfd_secret":            SNR_MEMFD_SECRET,
-	"process_mrelease":        SNR_PROCESS_MRELEASE,
-	"futex_waitv":             SNR_FUTEX_WAITV,
-	"set_mempolicy_home_node": SNR_SET_MEMPOLICY_HOME_NODE,
-	"cachestat":               SNR_CACHESTAT,
-	"fchmodat2":               SNR_FCHMODAT2,
-	"map_shadow_stack":        SNR_MAP_SHADOW_STACK,
-	"futex_wake":              SNR_FUTEX_WAKE,
-	"futex_wait":              SNR_FUTEX_WAIT,
-	"futex_requeue":           SNR_FUTEX_REQUEUE,
-	"statmount":               SNR_STATMOUNT,
-	"listmount":               SNR_LISTMOUNT,
-	"lsm_get_self_attr":       SNR_LSM_GET_SELF_ATTR,
-	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
-	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
-	"mseal":                   SNR_MSEAL,
-}
-
-const (
-	SYS_NAME_TO_HANDLE_AT       = 303
-	SYS_OPEN_BY_HANDLE_AT       = 304
-	SYS_CLOCK_ADJTIME           = 305
-	SYS_SYNCFS                  = 306
-	SYS_SENDMMSG                = 307
-	SYS_SETNS                   = 308
-	SYS_GETCPU                  = 309
-	SYS_PROCESS_VM_READV        = 310
-	SYS_PROCESS_VM_WRITEV       = 311
-	SYS_KCMP                    = 312
-	SYS_FINIT_MODULE            = 313
-	SYS_SCHED_SETATTR           = 314
-	SYS_SCHED_GETATTR           = 315
-	SYS_RENAMEAT2               = 316
-	SYS_SECCOMP                 = 317
-	SYS_GETRANDOM               = 318
-	SYS_MEMFD_CREATE            = 319
-	SYS_KEXEC_FILE_LOAD         = 320
-	SYS_BPF                     = 321
-	SYS_EXECVEAT                = 322
-	SYS_USERFAULTFD             = 323
-	SYS_MEMBARRIER              = 324
-	SYS_MLOCK2                  = 325
-	SYS_COPY_FILE_RANGE         = 326
-	SYS_PREADV2                 = 327
-	SYS_PWRITEV2                = 328
-	SYS_PKEY_MPROTECT           = 329
-	SYS_PKEY_ALLOC              = 330
-	SYS_PKEY_FREE               = 331
-	SYS_STATX                   = 332
-	SYS_IO_PGETEVENTS           = 333
-	SYS_RSEQ                    = 334
-	SYS_URETPROBE               = 335
-	SYS_PIDFD_SEND_SIGNAL       = 424
-	SYS_IO_URING_SETUP          = 425
-	SYS_IO_URING_ENTER          = 426
-	SYS_IO_URING_REGISTER       = 427
-	SYS_OPEN_TREE               = 428
-	SYS_MOVE_MOUNT              = 429
-	SYS_FSOPEN                  = 430
-	SYS_FSCONFIG                = 431
-	SYS_FSMOUNT                 = 432
-	SYS_FSPICK                  = 433
-	SYS_PIDFD_OPEN              = 434
-	SYS_CLONE3                  = 435
-	SYS_CLOSE_RANGE             = 436
-	SYS_OPENAT2                 = 437
-	SYS_PIDFD_GETFD             = 438
-	SYS_FACCESSAT2              = 439
-	SYS_PROCESS_MADVISE         = 440
-	SYS_EPOLL_PWAIT2            = 441
-	SYS_MOUNT_SETATTR           = 442
-	SYS_QUOTACTL_FD             = 443
-	SYS_LANDLOCK_CREATE_RULESET = 444
-	SYS_LANDLOCK_ADD_RULE       = 445
-	SYS_LANDLOCK_RESTRICT_SELF  = 446
-	SYS_MEMFD_SECRET            = 447
-	SYS_PROCESS_MRELEASE        = 448
-	SYS_FUTEX_WAITV             = 449
-	SYS_SET_MEMPOLICY_HOME_NODE = 450
-	SYS_CACHESTAT               = 451
-	SYS_FCHMODAT2               = 452
-	SYS_MAP_SHADOW_STACK        = 453
-	SYS_FUTEX_WAKE              = 454
-	SYS_FUTEX_WAIT              = 455
-	SYS_FUTEX_REQUEUE           = 456
-	SYS_STATMOUNT               = 457
-	SYS_LISTMOUNT               = 458
-	SYS_LSM_GET_SELF_ATTR       = 459
-	SYS_LSM_SET_SELF_ATTR       = 460
-	SYS_LSM_LIST_MODULES        = 461
-	SYS_MSEAL                   = 462
-)
-
-const (
-	SNR_READ                    ScmpSyscall = SYS_READ
-	SNR_WRITE                   ScmpSyscall = SYS_WRITE
-	SNR_OPEN                    ScmpSyscall = SYS_OPEN
-	SNR_CLOSE                   ScmpSyscall = SYS_CLOSE
-	SNR_STAT                    ScmpSyscall = SYS_STAT
-	SNR_FSTAT                   ScmpSyscall = SYS_FSTAT
-	SNR_LSTAT                   ScmpSyscall = SYS_LSTAT
-	SNR_POLL                    ScmpSyscall = SYS_POLL
-	SNR_LSEEK                   ScmpSyscall = SYS_LSEEK
-	SNR_MMAP                    ScmpSyscall = SYS_MMAP
-	SNR_MPROTECT                ScmpSyscall = SYS_MPROTECT
-	SNR_MUNMAP                  ScmpSyscall = SYS_MUNMAP
-	SNR_BRK                     ScmpSyscall = SYS_BRK
-	SNR_RT_SIGACTION            ScmpSyscall = SYS_RT_SIGACTION
-	SNR_RT_SIGPROCMASK          ScmpSyscall = SYS_RT_SIGPROCMASK
-	SNR_RT_SIGRETURN            ScmpSyscall = SYS_RT_SIGRETURN
-	SNR_IOCTL                   ScmpSyscall = SYS_IOCTL
-	SNR_PREAD64                 ScmpSyscall = SYS_PREAD64
-	SNR_PWRITE64                ScmpSyscall = SYS_PWRITE64
-	SNR_READV                   ScmpSyscall = SYS_READV
-	SNR_WRITEV                  ScmpSyscall = SYS_WRITEV
-	SNR_ACCESS                  ScmpSyscall = SYS_ACCESS
-	SNR_PIPE                    ScmpSyscall = SYS_PIPE
-	SNR_SELECT                  ScmpSyscall = SYS_SELECT
-	SNR_SCHED_YIELD             ScmpSyscall = SYS_SCHED_YIELD
-	SNR_MREMAP                  ScmpSyscall = SYS_MREMAP
-	SNR_MSYNC                   ScmpSyscall = SYS_MSYNC
-	SNR_MINCORE                 ScmpSyscall = SYS_MINCORE
-	SNR_MADVISE                 ScmpSyscall = SYS_MADVISE
-	SNR_SHMGET                  ScmpSyscall = SYS_SHMGET
-	SNR_SHMAT                   ScmpSyscall = SYS_SHMAT
-	SNR_SHMCTL                  ScmpSyscall = SYS_SHMCTL
-	SNR_DUP                     ScmpSyscall = SYS_DUP
-	SNR_DUP2                    ScmpSyscall = SYS_DUP2
-	SNR_PAUSE                   ScmpSyscall = SYS_PAUSE
-	SNR_NANOSLEEP               ScmpSyscall = SYS_NANOSLEEP
-	SNR_GETITIMER               ScmpSyscall = SYS_GETITIMER
-	SNR_ALARM                   ScmpSyscall = SYS_ALARM
-	SNR_SETITIMER               ScmpSyscall = SYS_SETITIMER
-	SNR_GETPID                  ScmpSyscall = SYS_GETPID
-	SNR_SENDFILE                ScmpSyscall = SYS_SENDFILE
-	SNR_SOCKET                  ScmpSyscall = SYS_SOCKET
-	SNR_CONNECT                 ScmpSyscall = SYS_CONNECT
-	SNR_ACCEPT                  ScmpSyscall = SYS_ACCEPT
-	SNR_SENDTO                  ScmpSyscall = SYS_SENDTO
-	SNR_RECVFROM                ScmpSyscall = SYS_RECVFROM
-	SNR_SENDMSG                 ScmpSyscall = SYS_SENDMSG
-	SNR_RECVMSG                 ScmpSyscall = SYS_RECVMSG
-	SNR_SHUTDOWN                ScmpSyscall = SYS_SHUTDOWN
-	SNR_BIND                    ScmpSyscall = SYS_BIND
-	SNR_LISTEN                  ScmpSyscall = SYS_LISTEN
-	SNR_GETSOCKNAME             ScmpSyscall = SYS_GETSOCKNAME
-	SNR_GETPEERNAME             ScmpSyscall = SYS_GETPEERNAME
-	SNR_SOCKETPAIR              ScmpSyscall = SYS_SOCKETPAIR
-	SNR_SETSOCKOPT              ScmpSyscall = SYS_SETSOCKOPT
-	SNR_GETSOCKOPT              ScmpSyscall = SYS_GETSOCKOPT
-	SNR_CLONE                   ScmpSyscall = SYS_CLONE
-	SNR_FORK                    ScmpSyscall = SYS_FORK
-	SNR_VFORK                   ScmpSyscall = SYS_VFORK
-	SNR_EXECVE                  ScmpSyscall = SYS_EXECVE
-	SNR_EXIT                    ScmpSyscall = SYS_EXIT
-	SNR_WAIT4                   ScmpSyscall = SYS_WAIT4
-	SNR_KILL                    ScmpSyscall = SYS_KILL
-	SNR_UNAME                   ScmpSyscall = SYS_UNAME
-	SNR_SEMGET                  ScmpSyscall = SYS_SEMGET
-	SNR_SEMOP                   ScmpSyscall = SYS_SEMOP
-	SNR_SEMCTL                  ScmpSyscall = SYS_SEMCTL
-	SNR_SHMDT                   ScmpSyscall = SYS_SHMDT
-	SNR_MSGGET                  ScmpSyscall = SYS_MSGGET
-	SNR_MSGSND                  ScmpSyscall = SYS_MSGSND
-	SNR_MSGRCV                  ScmpSyscall = SYS_MSGRCV
-	SNR_MSGCTL                  ScmpSyscall = SYS_MSGCTL
-	SNR_FCNTL                   ScmpSyscall = SYS_FCNTL
-	SNR_FLOCK                   ScmpSyscall = SYS_FLOCK
-	SNR_FSYNC                   ScmpSyscall = SYS_FSYNC
-	SNR_FDATASYNC               ScmpSyscall = SYS_FDATASYNC
-	SNR_TRUNCATE                ScmpSyscall = SYS_TRUNCATE
-	SNR_FTRUNCATE               ScmpSyscall = SYS_FTRUNCATE
-	SNR_GETDENTS                ScmpSyscall = SYS_GETDENTS
-	SNR_GETCWD                  ScmpSyscall = SYS_GETCWD
-	SNR_CHDIR                   ScmpSyscall = SYS_CHDIR
-	SNR_FCHDIR                  ScmpSyscall = SYS_FCHDIR
-	SNR_RENAME                  ScmpSyscall = SYS_RENAME
-	SNR_MKDIR                   ScmpSyscall = SYS_MKDIR
-	SNR_RMDIR                   ScmpSyscall = SYS_RMDIR
-	SNR_CREAT                   ScmpSyscall = SYS_CREAT
-	SNR_LINK                    ScmpSyscall = SYS_LINK
-	SNR_UNLINK                  ScmpSyscall = SYS_UNLINK
-	SNR_SYMLINK                 ScmpSyscall = SYS_SYMLINK
-	SNR_READLINK                ScmpSyscall = SYS_READLINK
-	SNR_CHMOD                   ScmpSyscall = SYS_CHMOD
-	SNR_FCHMOD                  ScmpSyscall = SYS_FCHMOD
-	SNR_CHOWN                   ScmpSyscall = SYS_CHOWN
-	SNR_FCHOWN                  ScmpSyscall = SYS_FCHOWN
-	SNR_LCHOWN                  ScmpSyscall = SYS_LCHOWN
-	SNR_UMASK                   ScmpSyscall = SYS_UMASK
-	SNR_GETTIMEOFDAY            ScmpSyscall = SYS_GETTIMEOFDAY
-	SNR_GETRLIMIT               ScmpSyscall = SYS_GETRLIMIT
-	SNR_GETRUSAGE               ScmpSyscall = SYS_GETRUSAGE
-	SNR_SYSINFO                 ScmpSyscall = SYS_SYSINFO
-	SNR_TIMES                   ScmpSyscall = SYS_TIMES
-	SNR_PTRACE                  ScmpSyscall = SYS_PTRACE
-	SNR_GETUID                  ScmpSyscall = SYS_GETUID
-	SNR_SYSLOG                  ScmpSyscall = SYS_SYSLOG
-	SNR_GETGID                  ScmpSyscall = SYS_GETGID
-	SNR_SETUID                  ScmpSyscall = SYS_SETUID
-	SNR_SETGID                  ScmpSyscall = SYS_SETGID
-	SNR_GETEUID                 ScmpSyscall = SYS_GETEUID
-	SNR_GETEGID                 ScmpSyscall = SYS_GETEGID
-	SNR_SETPGID                 ScmpSyscall = SYS_SETPGID
-	SNR_GETPPID                 ScmpSyscall = SYS_GETPPID
-	SNR_GETPGRP                 ScmpSyscall = SYS_GETPGRP
-	SNR_SETSID                  ScmpSyscall = SYS_SETSID
-	SNR_SETREUID                ScmpSyscall = SYS_SETREUID
-	SNR_SETREGID                ScmpSyscall = SYS_SETREGID
-	SNR_GETGROUPS               ScmpSyscall = SYS_GETGROUPS
-	SNR_SETGROUPS               ScmpSyscall = SYS_SETGROUPS
-	SNR_SETRESUID               ScmpSyscall = SYS_SETRESUID
-	SNR_GETRESUID               ScmpSyscall = SYS_GETRESUID
-	SNR_SETRESGID               ScmpSyscall = SYS_SETRESGID
-	SNR_GETRESGID               ScmpSyscall = SYS_GETRESGID
-	SNR_GETPGID                 ScmpSyscall = SYS_GETPGID
-	SNR_SETFSUID                ScmpSyscall = SYS_SETFSUID
-	SNR_SETFSGID                ScmpSyscall = SYS_SETFSGID
-	SNR_GETSID                  ScmpSyscall = SYS_GETSID
-	SNR_CAPGET                  ScmpSyscall = SYS_CAPGET
-	SNR_CAPSET                  ScmpSyscall = SYS_CAPSET
-	SNR_RT_SIGPENDING           ScmpSyscall = SYS_RT_SIGPENDING
-	SNR_RT_SIGTIMEDWAIT         ScmpSyscall = SYS_RT_SIGTIMEDWAIT
-	SNR_RT_SIGQUEUEINFO         ScmpSyscall = SYS_RT_SIGQUEUEINFO
-	SNR_RT_SIGSUSPEND           ScmpSyscall = SYS_RT_SIGSUSPEND
-	SNR_SIGALTSTACK             ScmpSyscall = SYS_SIGALTSTACK
-	SNR_UTIME                   ScmpSyscall = SYS_UTIME
-	SNR_MKNOD                   ScmpSyscall = SYS_MKNOD
-	SNR_USELIB                  ScmpSyscall = SYS_USELIB
-	SNR_PERSONALITY             ScmpSyscall = SYS_PERSONALITY
-	SNR_USTAT                   ScmpSyscall = SYS_USTAT
-	SNR_STATFS                  ScmpSyscall = SYS_STATFS
-	SNR_FSTATFS                 ScmpSyscall = SYS_FSTATFS
-	SNR_SYSFS                   ScmpSyscall = SYS_SYSFS
-	SNR_GETPRIORITY             ScmpSyscall = SYS_GETPRIORITY
-	SNR_SETPRIORITY             ScmpSyscall = SYS_SETPRIORITY
-	SNR_SCHED_SETPARAM          ScmpSyscall = SYS_SCHED_SETPARAM
-	SNR_SCHED_GETPARAM          ScmpSyscall = SYS_SCHED_GETPARAM
-	SNR_SCHED_SETSCHEDULER      ScmpSyscall = SYS_SCHED_SETSCHEDULER
-	SNR_SCHED_GETSCHEDULER      ScmpSyscall = SYS_SCHED_GETSCHEDULER
-	SNR_SCHED_GET_PRIORITY_MAX  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MAX
-	SNR_SCHED_GET_PRIORITY_MIN  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MIN
-	SNR_SCHED_RR_GET_INTERVAL   ScmpSyscall = SYS_SCHED_RR_GET_INTERVAL
-	SNR_MLOCK                   ScmpSyscall = SYS_MLOCK
-	SNR_MUNLOCK                 ScmpSyscall = SYS_MUNLOCK
-	SNR_MLOCKALL                ScmpSyscall = SYS_MLOCKALL
-	SNR_MUNLOCKALL              ScmpSyscall = SYS_MUNLOCKALL
-	SNR_VHANGUP                 ScmpSyscall = SYS_VHANGUP
-	SNR_MODIFY_LDT              ScmpSyscall = SYS_MODIFY_LDT
-	SNR_PIVOT_ROOT              ScmpSyscall = SYS_PIVOT_ROOT
-	SNR__SYSCTL                 ScmpSyscall = SYS__SYSCTL
-	SNR_PRCTL                   ScmpSyscall = SYS_PRCTL
-	SNR_ARCH_PRCTL              ScmpSyscall = SYS_ARCH_PRCTL
-	SNR_ADJTIMEX                ScmpSyscall = SYS_ADJTIMEX
-	SNR_SETRLIMIT               ScmpSyscall = SYS_SETRLIMIT
-	SNR_CHROOT                  ScmpSyscall = SYS_CHROOT
-	SNR_SYNC                    ScmpSyscall = SYS_SYNC
-	SNR_ACCT                    ScmpSyscall = SYS_ACCT
-	SNR_SETTIMEOFDAY            ScmpSyscall = SYS_SETTIMEOFDAY
-	SNR_MOUNT                   ScmpSyscall = SYS_MOUNT
-	SNR_UMOUNT2                 ScmpSyscall = SYS_UMOUNT2
-	SNR_SWAPON                  ScmpSyscall = SYS_SWAPON
-	SNR_SWAPOFF                 ScmpSyscall = SYS_SWAPOFF
-	SNR_REBOOT                  ScmpSyscall = SYS_REBOOT
-	SNR_SETHOSTNAME             ScmpSyscall = SYS_SETHOSTNAME
-	SNR_SETDOMAINNAME           ScmpSyscall = SYS_SETDOMAINNAME
-	SNR_IOPL                    ScmpSyscall = SYS_IOPL
-	SNR_IOPERM                  ScmpSyscall = SYS_IOPERM
-	SNR_CREATE_MODULE           ScmpSyscall = SYS_CREATE_MODULE
-	SNR_INIT_MODULE             ScmpSyscall = SYS_INIT_MODULE
-	SNR_DELETE_MODULE           ScmpSyscall = SYS_DELETE_MODULE
-	SNR_GET_KERNEL_SYMS         ScmpSyscall = SYS_GET_KERNEL_SYMS
-	SNR_QUERY_MODULE            ScmpSyscall = SYS_QUERY_MODULE
-	SNR_QUOTACTL                ScmpSyscall = SYS_QUOTACTL
-	SNR_NFSSERVCTL              ScmpSyscall = SYS_NFSSERVCTL
-	SNR_GETPMSG                 ScmpSyscall = SYS_GETPMSG
-	SNR_PUTPMSG                 ScmpSyscall = SYS_PUTPMSG
-	SNR_AFS_SYSCALL             ScmpSyscall = SYS_AFS_SYSCALL
-	SNR_TUXCALL                 ScmpSyscall = SYS_TUXCALL
-	SNR_SECURITY                ScmpSyscall = SYS_SECURITY
-	SNR_GETTID                  ScmpSyscall = SYS_GETTID
-	SNR_READAHEAD               ScmpSyscall = SYS_READAHEAD
-	SNR_SETXATTR                ScmpSyscall = SYS_SETXATTR
-	SNR_LSETXATTR               ScmpSyscall = SYS_LSETXATTR
-	SNR_FSETXATTR               ScmpSyscall = SYS_FSETXATTR
-	SNR_GETXATTR                ScmpSyscall = SYS_GETXATTR
-	SNR_LGETXATTR               ScmpSyscall = SYS_LGETXATTR
-	SNR_FGETXATTR               ScmpSyscall = SYS_FGETXATTR
-	SNR_LISTXATTR               ScmpSyscall = SYS_LISTXATTR
-	SNR_LLISTXATTR              ScmpSyscall = SYS_LLISTXATTR
-	SNR_FLISTXATTR              ScmpSyscall = SYS_FLISTXATTR
-	SNR_REMOVEXATTR             ScmpSyscall = SYS_REMOVEXATTR
-	SNR_LREMOVEXATTR            ScmpSyscall = SYS_LREMOVEXATTR
-	SNR_FREMOVEXATTR            ScmpSyscall = SYS_FREMOVEXATTR
-	SNR_TKILL                   ScmpSyscall = SYS_TKILL
-	SNR_TIME                    ScmpSyscall = SYS_TIME
-	SNR_FUTEX                   ScmpSyscall = SYS_FUTEX
-	SNR_SCHED_SETAFFINITY       ScmpSyscall = SYS_SCHED_SETAFFINITY
-	SNR_SCHED_GETAFFINITY       ScmpSyscall = SYS_SCHED_GETAFFINITY
-	SNR_SET_THREAD_AREA         ScmpSyscall = SYS_SET_THREAD_AREA
-	SNR_IO_SETUP                ScmpSyscall = SYS_IO_SETUP
-	SNR_IO_DESTROY              ScmpSyscall = SYS_IO_DESTROY
-	SNR_IO_GETEVENTS            ScmpSyscall = SYS_IO_GETEVENTS
-	SNR_IO_SUBMIT               ScmpSyscall = SYS_IO_SUBMIT
-	SNR_IO_CANCEL               ScmpSyscall = SYS_IO_CANCEL
-	SNR_GET_THREAD_AREA         ScmpSyscall = SYS_GET_THREAD_AREA
-	SNR_LOOKUP_DCOOKIE          ScmpSyscall = SYS_LOOKUP_DCOOKIE
-	SNR_EPOLL_CREATE            ScmpSyscall = SYS_EPOLL_CREATE
-	SNR_EPOLL_CTL_OLD           ScmpSyscall = SYS_EPOLL_CTL_OLD
-	SNR_EPOLL_WAIT_OLD          ScmpSyscall = SYS_EPOLL_WAIT_OLD
-	SNR_REMAP_FILE_PAGES        ScmpSyscall = SYS_REMAP_FILE_PAGES
-	SNR_GETDENTS64              ScmpSyscall = SYS_GETDENTS64
-	SNR_SET_TID_ADDRESS         ScmpSyscall = SYS_SET_TID_ADDRESS
-	SNR_RESTART_SYSCALL         ScmpSyscall = SYS_RESTART_SYSCALL
-	SNR_SEMTIMEDOP              ScmpSyscall = SYS_SEMTIMEDOP
-	SNR_FADVISE64               ScmpSyscall = SYS_FADVISE64
-	SNR_TIMER_CREATE            ScmpSyscall = SYS_TIMER_CREATE
-	SNR_TIMER_SETTIME           ScmpSyscall = SYS_TIMER_SETTIME
-	SNR_TIMER_GETTIME           ScmpSyscall = SYS_TIMER_GETTIME
-	SNR_TIMER_GETOVERRUN        ScmpSyscall = SYS_TIMER_GETOVERRUN
-	SNR_TIMER_DELETE            ScmpSyscall = SYS_TIMER_DELETE
-	SNR_CLOCK_SETTIME           ScmpSyscall = SYS_CLOCK_SETTIME
-	SNR_CLOCK_GETTIME           ScmpSyscall = SYS_CLOCK_GETTIME
-	SNR_CLOCK_GETRES            ScmpSyscall = SYS_CLOCK_GETRES
-	SNR_CLOCK_NANOSLEEP         ScmpSyscall = SYS_CLOCK_NANOSLEEP
-	SNR_EXIT_GROUP              ScmpSyscall = SYS_EXIT_GROUP
-	SNR_EPOLL_WAIT              ScmpSyscall = SYS_EPOLL_WAIT
-	SNR_EPOLL_CTL               ScmpSyscall = SYS_EPOLL_CTL
-	SNR_TGKILL                  ScmpSyscall = SYS_TGKILL
-	SNR_UTIMES                  ScmpSyscall = SYS_UTIMES
-	SNR_VSERVER                 ScmpSyscall = SYS_VSERVER
-	SNR_MBIND                   ScmpSyscall = SYS_MBIND
-	SNR_SET_MEMPOLICY           ScmpSyscall = SYS_SET_MEMPOLICY
-	SNR_GET_MEMPOLICY           ScmpSyscall = SYS_GET_MEMPOLICY
-	SNR_MQ_OPEN                 ScmpSyscall = SYS_MQ_OPEN
-	SNR_MQ_UNLINK               ScmpSyscall = SYS_MQ_UNLINK
-	SNR_MQ_TIMEDSEND            ScmpSyscall = SYS_MQ_TIMEDSEND
-	SNR_MQ_TIMEDRECEIVE         ScmpSyscall = SYS_MQ_TIMEDRECEIVE
-	SNR_MQ_NOTIFY               ScmpSyscall = SYS_MQ_NOTIFY
-	SNR_MQ_GETSETATTR           ScmpSyscall = SYS_MQ_GETSETATTR
-	SNR_KEXEC_LOAD              ScmpSyscall = SYS_KEXEC_LOAD
-	SNR_WAITID                  ScmpSyscall = SYS_WAITID
-	SNR_ADD_KEY                 ScmpSyscall = SYS_ADD_KEY
-	SNR_REQUEST_KEY             ScmpSyscall = SYS_REQUEST_KEY
-	SNR_KEYCTL                  ScmpSyscall = SYS_KEYCTL
-	SNR_IOPRIO_SET              ScmpSyscall = SYS_IOPRIO_SET
-	SNR_IOPRIO_GET              ScmpSyscall = SYS_IOPRIO_GET
-	SNR_INOTIFY_INIT            ScmpSyscall = SYS_INOTIFY_INIT
-	SNR_INOTIFY_ADD_WATCH       ScmpSyscall = SYS_INOTIFY_ADD_WATCH
-	SNR_INOTIFY_RM_WATCH        ScmpSyscall = SYS_INOTIFY_RM_WATCH
-	SNR_MIGRATE_PAGES           ScmpSyscall = SYS_MIGRATE_PAGES
-	SNR_OPENAT                  ScmpSyscall = SYS_OPENAT
-	SNR_MKDIRAT                 ScmpSyscall = SYS_MKDIRAT
-	SNR_MKNODAT                 ScmpSyscall = SYS_MKNODAT
-	SNR_FCHOWNAT                ScmpSyscall = SYS_FCHOWNAT
-	SNR_FUTIMESAT               ScmpSyscall = SYS_FUTIMESAT
-	SNR_NEWFSTATAT              ScmpSyscall = SYS_NEWFSTATAT
-	SNR_UNLINKAT                ScmpSyscall = SYS_UNLINKAT
-	SNR_RENAMEAT                ScmpSyscall = SYS_RENAMEAT
-	SNR_LINKAT                  ScmpSyscall = SYS_LINKAT
-	SNR_SYMLINKAT               ScmpSyscall = SYS_SYMLINKAT
-	SNR_READLINKAT              ScmpSyscall = SYS_READLINKAT
-	SNR_FCHMODAT                ScmpSyscall = SYS_FCHMODAT
-	SNR_FACCESSAT               ScmpSyscall = SYS_FACCESSAT
-	SNR_PSELECT6                ScmpSyscall = SYS_PSELECT6
-	SNR_PPOLL                   ScmpSyscall = SYS_PPOLL
-	SNR_UNSHARE                 ScmpSyscall = SYS_UNSHARE
-	SNR_SET_ROBUST_LIST         ScmpSyscall = SYS_SET_ROBUST_LIST
-	SNR_GET_ROBUST_LIST         ScmpSyscall = SYS_GET_ROBUST_LIST
-	SNR_SPLICE                  ScmpSyscall = SYS_SPLICE
-	SNR_TEE                     ScmpSyscall = SYS_TEE
-	SNR_SYNC_FILE_RANGE         ScmpSyscall = SYS_SYNC_FILE_RANGE
-	SNR_VMSPLICE                ScmpSyscall = SYS_VMSPLICE
-	SNR_MOVE_PAGES              ScmpSyscall = SYS_MOVE_PAGES
-	SNR_UTIMENSAT               ScmpSyscall = SYS_UTIMENSAT
-	SNR_EPOLL_PWAIT             ScmpSyscall = SYS_EPOLL_PWAIT
-	SNR_SIGNALFD                ScmpSyscall = SYS_SIGNALFD
-	SNR_TIMERFD_CREATE          ScmpSyscall = SYS_TIMERFD_CREATE
-	SNR_EVENTFD                 ScmpSyscall = SYS_EVENTFD
-	SNR_FALLOCATE               ScmpSyscall = SYS_FALLOCATE
-	SNR_TIMERFD_SETTIME         ScmpSyscall = SYS_TIMERFD_SETTIME
-	SNR_TIMERFD_GETTIME         ScmpSyscall = SYS_TIMERFD_GETTIME
-	SNR_ACCEPT4                 ScmpSyscall = SYS_ACCEPT4
-	SNR_SIGNALFD4               ScmpSyscall = SYS_SIGNALFD4
-	SNR_EVENTFD2                ScmpSyscall = SYS_EVENTFD2
-	SNR_EPOLL_CREATE1           ScmpSyscall = SYS_EPOLL_CREATE1
-	SNR_DUP3                    ScmpSyscall = SYS_DUP3
-	SNR_PIPE2                   ScmpSyscall = SYS_PIPE2
-	SNR_INOTIFY_INIT1           ScmpSyscall = SYS_INOTIFY_INIT1
-	SNR_PREADV                  ScmpSyscall = SYS_PREADV
-	SNR_PWRITEV                 ScmpSyscall = SYS_PWRITEV
-	SNR_RT_TGSIGQUEUEINFO       ScmpSyscall = SYS_RT_TGSIGQUEUEINFO
-	SNR_PERF_EVENT_OPEN         ScmpSyscall = SYS_PERF_EVENT_OPEN
-	SNR_RECVMMSG                ScmpSyscall = SYS_RECVMMSG
-	SNR_FANOTIFY_INIT           ScmpSyscall = SYS_FANOTIFY_INIT
-	SNR_FANOTIFY_MARK           ScmpSyscall = SYS_FANOTIFY_MARK
-	SNR_PRLIMIT64               ScmpSyscall = SYS_PRLIMIT64
-	SNR_NAME_TO_HANDLE_AT       ScmpSyscall = SYS_NAME_TO_HANDLE_AT
-	SNR_OPEN_BY_HANDLE_AT       ScmpSyscall = SYS_OPEN_BY_HANDLE_AT
-	SNR_CLOCK_ADJTIME           ScmpSyscall = SYS_CLOCK_ADJTIME
-	SNR_SYNCFS                  ScmpSyscall = SYS_SYNCFS
-	SNR_SENDMMSG                ScmpSyscall = SYS_SENDMMSG
-	SNR_SETNS                   ScmpSyscall = SYS_SETNS
-	SNR_GETCPU                  ScmpSyscall = SYS_GETCPU
-	SNR_PROCESS_VM_READV        ScmpSyscall = SYS_PROCESS_VM_READV
-	SNR_PROCESS_VM_WRITEV       ScmpSyscall = SYS_PROCESS_VM_WRITEV
-	SNR_KCMP                    ScmpSyscall = SYS_KCMP
-	SNR_FINIT_MODULE            ScmpSyscall = SYS_FINIT_MODULE
-	SNR_SCHED_SETATTR           ScmpSyscall = SYS_SCHED_SETATTR
-	SNR_SCHED_GETATTR           ScmpSyscall = SYS_SCHED_GETATTR
-	SNR_RENAMEAT2               ScmpSyscall = SYS_RENAMEAT2
-	SNR_SECCOMP                 ScmpSyscall = SYS_SECCOMP
-	SNR_GETRANDOM               ScmpSyscall = SYS_GETRANDOM
-	SNR_MEMFD_CREATE            ScmpSyscall = SYS_MEMFD_CREATE
-	SNR_KEXEC_FILE_LOAD         ScmpSyscall = SYS_KEXEC_FILE_LOAD
-	SNR_BPF                     ScmpSyscall = SYS_BPF
-	SNR_EXECVEAT                ScmpSyscall = SYS_EXECVEAT
-	SNR_USERFAULTFD             ScmpSyscall = SYS_USERFAULTFD
-	SNR_MEMBARRIER              ScmpSyscall = SYS_MEMBARRIER
-	SNR_MLOCK2                  ScmpSyscall = SYS_MLOCK2
-	SNR_COPY_FILE_RANGE         ScmpSyscall = SYS_COPY_FILE_RANGE
-	SNR_PREADV2                 ScmpSyscall = SYS_PREADV2
-	SNR_PWRITEV2                ScmpSyscall = SYS_PWRITEV2
-	SNR_PKEY_MPROTECT           ScmpSyscall = SYS_PKEY_MPROTECT
-	SNR_PKEY_ALLOC              ScmpSyscall = SYS_PKEY_ALLOC
-	SNR_PKEY_FREE               ScmpSyscall = SYS_PKEY_FREE
-	SNR_STATX                   ScmpSyscall = SYS_STATX
-	SNR_IO_PGETEVENTS           ScmpSyscall = SYS_IO_PGETEVENTS
-	SNR_RSEQ                    ScmpSyscall = SYS_RSEQ
-	SNR_URETPROBE               ScmpSyscall = SYS_URETPROBE
-	SNR_PIDFD_SEND_SIGNAL       ScmpSyscall = SYS_PIDFD_SEND_SIGNAL
-	SNR_IO_URING_SETUP          ScmpSyscall = SYS_IO_URING_SETUP
-	SNR_IO_URING_ENTER          ScmpSyscall = SYS_IO_URING_ENTER
-	SNR_IO_URING_REGISTER       ScmpSyscall = SYS_IO_URING_REGISTER
-	SNR_OPEN_TREE               ScmpSyscall = SYS_OPEN_TREE
-	SNR_MOVE_MOUNT              ScmpSyscall = SYS_MOVE_MOUNT
-	SNR_FSOPEN                  ScmpSyscall = SYS_FSOPEN
-	SNR_FSCONFIG                ScmpSyscall = SYS_FSCONFIG
-	SNR_FSMOUNT                 ScmpSyscall = SYS_FSMOUNT
-	SNR_FSPICK                  ScmpSyscall = SYS_FSPICK
-	SNR_PIDFD_OPEN              ScmpSyscall = SYS_PIDFD_OPEN
-	SNR_CLONE3                  ScmpSyscall = SYS_CLONE3
-	SNR_CLOSE_RANGE             ScmpSyscall = SYS_CLOSE_RANGE
-	SNR_OPENAT2                 ScmpSyscall = SYS_OPENAT2
-	SNR_PIDFD_GETFD             ScmpSyscall = SYS_PIDFD_GETFD
-	SNR_FACCESSAT2              ScmpSyscall = SYS_FACCESSAT2
-	SNR_PROCESS_MADVISE         ScmpSyscall = SYS_PROCESS_MADVISE
-	SNR_EPOLL_PWAIT2            ScmpSyscall = SYS_EPOLL_PWAIT2
-	SNR_MOUNT_SETATTR           ScmpSyscall = SYS_MOUNT_SETATTR
-	SNR_QUOTACTL_FD             ScmpSyscall = SYS_QUOTACTL_FD
-	SNR_LANDLOCK_CREATE_RULESET ScmpSyscall = SYS_LANDLOCK_CREATE_RULESET
-	SNR_LANDLOCK_ADD_RULE       ScmpSyscall = SYS_LANDLOCK_ADD_RULE
-	SNR_LANDLOCK_RESTRICT_SELF  ScmpSyscall = SYS_LANDLOCK_RESTRICT_SELF
-	SNR_MEMFD_SECRET            ScmpSyscall = SYS_MEMFD_SECRET
-	SNR_PROCESS_MRELEASE        ScmpSyscall = SYS_PROCESS_MRELEASE
-	SNR_FUTEX_WAITV             ScmpSyscall = SYS_FUTEX_WAITV
-	SNR_SET_MEMPOLICY_HOME_NODE ScmpSyscall = SYS_SET_MEMPOLICY_HOME_NODE
-	SNR_CACHESTAT               ScmpSyscall = SYS_CACHESTAT
-	SNR_FCHMODAT2               ScmpSyscall = SYS_FCHMODAT2
-	SNR_MAP_SHADOW_STACK        ScmpSyscall = SYS_MAP_SHADOW_STACK
-	SNR_FUTEX_WAKE              ScmpSyscall = SYS_FUTEX_WAKE
-	SNR_FUTEX_WAIT              ScmpSyscall = SYS_FUTEX_WAIT
-	SNR_FUTEX_REQUEUE           ScmpSyscall = SYS_FUTEX_REQUEUE
-	SNR_STATMOUNT               ScmpSyscall = SYS_STATMOUNT
-	SNR_LISTMOUNT               ScmpSyscall = SYS_LISTMOUNT
-	SNR_LSM_GET_SELF_ATTR       ScmpSyscall = SYS_LSM_GET_SELF_ATTR
-	SNR_LSM_SET_SELF_ATTR       ScmpSyscall = SYS_LSM_SET_SELF_ATTR
-	SNR_LSM_LIST_MODULES        ScmpSyscall = SYS_LSM_LIST_MODULES
-	SNR_MSEAL                   ScmpSyscall = SYS_MSEAL
-)

container/std/syscall_linux_arm64.go

@@ -1,703 +0,0 @@
-// mksysnum_linux.pl /usr/include/asm/unistd_64.h
-// Code generated by the command above; DO NOT EDIT.
-
-package std
-
-import . "syscall"
-
-var syscallNum = map[string]ScmpSyscall{
-	"io_setup":                SNR_IO_SETUP,
-	"io_destroy":              SNR_IO_DESTROY,
-	"io_submit":               SNR_IO_SUBMIT,
-	"io_cancel":               SNR_IO_CANCEL,
-	"io_getevents":            SNR_IO_GETEVENTS,
-	"setxattr":                SNR_SETXATTR,
-	"lsetxattr":               SNR_LSETXATTR,
-	"fsetxattr":               SNR_FSETXATTR,
-	"getxattr":                SNR_GETXATTR,
-	"lgetxattr":               SNR_LGETXATTR,
-	"fgetxattr":               SNR_FGETXATTR,
-	"listxattr":               SNR_LISTXATTR,
-	"llistxattr":              SNR_LLISTXATTR,
-	"flistxattr":              SNR_FLISTXATTR,
-	"removexattr":             SNR_REMOVEXATTR,
-	"lremovexattr":            SNR_LREMOVEXATTR,
-	"fremovexattr":            SNR_FREMOVEXATTR,
-	"getcwd":                  SNR_GETCWD,
-	"lookup_dcookie":          SNR_LOOKUP_DCOOKIE,
-	"eventfd2":                SNR_EVENTFD2,
-	"epoll_create1":           SNR_EPOLL_CREATE1,
-	"epoll_ctl":               SNR_EPOLL_CTL,
-	"epoll_pwait":             SNR_EPOLL_PWAIT,
-	"dup":                     SNR_DUP,
-	"dup3":                    SNR_DUP3,
-	"fcntl":                   SNR_FCNTL,
-	"inotify_init1":           SNR_INOTIFY_INIT1,
-	"inotify_add_watch":       SNR_INOTIFY_ADD_WATCH,
-	"inotify_rm_watch":        SNR_INOTIFY_RM_WATCH,
-	"ioctl":                   SNR_IOCTL,
-	"ioprio_set":              SNR_IOPRIO_SET,
-	"ioprio_get":              SNR_IOPRIO_GET,
-	"flock":                   SNR_FLOCK,
-	"mknodat":                 SNR_MKNODAT,
-	"mkdirat":                 SNR_MKDIRAT,
-	"unlinkat":                SNR_UNLINKAT,
-	"symlinkat":               SNR_SYMLINKAT,
-	"linkat":                  SNR_LINKAT,
-	"renameat":                SNR_RENAMEAT,
-	"umount2":                 SNR_UMOUNT2,
-	"mount":                   SNR_MOUNT,
-	"pivot_root":              SNR_PIVOT_ROOT,
-	"nfsservctl":              SNR_NFSSERVCTL,
-	"statfs":                  SNR_STATFS,
-	"fstatfs":                 SNR_FSTATFS,
-	"truncate":                SNR_TRUNCATE,
-	"ftruncate":               SNR_FTRUNCATE,
-	"fallocate":               SNR_FALLOCATE,
-	"faccessat":               SNR_FACCESSAT,
-	"chdir":                   SNR_CHDIR,
-	"fchdir":                  SNR_FCHDIR,
-	"chroot":                  SNR_CHROOT,
-	"fchmod":                  SNR_FCHMOD,
-	"fchmodat":                SNR_FCHMODAT,
-	"fchownat":                SNR_FCHOWNAT,
-	"fchown":                  SNR_FCHOWN,
-	"openat":                  SNR_OPENAT,
-	"close":                   SNR_CLOSE,
-	"vhangup":                 SNR_VHANGUP,
-	"pipe2":                   SNR_PIPE2,
-	"quotactl":                SNR_QUOTACTL,
-	"getdents64":              SNR_GETDENTS64,
-	"lseek":                   SNR_LSEEK,
-	"read":                    SNR_READ,
-	"write":                   SNR_WRITE,
-	"readv":                   SNR_READV,
-	"writev":                  SNR_WRITEV,
-	"pread64":                 SNR_PREAD64,
-	"pwrite64":                SNR_PWRITE64,
-	"preadv":                  SNR_PREADV,
-	"pwritev":                 SNR_PWRITEV,
-	"sendfile":                SNR_SENDFILE,
-	"pselect6":                SNR_PSELECT6,
-	"ppoll":                   SNR_PPOLL,
-	"signalfd4":               SNR_SIGNALFD4,
-	"vmsplice":                SNR_VMSPLICE,
-	"splice":                  SNR_SPLICE,
-	"tee":                     SNR_TEE,
-	"readlinkat":              SNR_READLINKAT,
-	"newfstatat":              SNR_NEWFSTATAT,
-	"fstat":                   SNR_FSTAT,
-	"sync":                    SNR_SYNC,
-	"fsync":                   SNR_FSYNC,
-	"fdatasync":               SNR_FDATASYNC,
-	"sync_file_range":         SNR_SYNC_FILE_RANGE,
-	"timerfd_create":          SNR_TIMERFD_CREATE,
-	"timerfd_settime":         SNR_TIMERFD_SETTIME,
-	"timerfd_gettime":         SNR_TIMERFD_GETTIME,
-	"utimensat":               SNR_UTIMENSAT,
-	"acct":                    SNR_ACCT,
-	"capget":                  SNR_CAPGET,
-	"capset":                  SNR_CAPSET,
-	"personality":             SNR_PERSONALITY,
-	"exit":                    SNR_EXIT,
-	"exit_group":              SNR_EXIT_GROUP,
-	"waitid":                  SNR_WAITID,
-	"set_tid_address":         SNR_SET_TID_ADDRESS,
-	"unshare":                 SNR_UNSHARE,
-	"futex":                   SNR_FUTEX,
-	"set_robust_list":         SNR_SET_ROBUST_LIST,
-	"get_robust_list":         SNR_GET_ROBUST_LIST,
-	"nanosleep":               SNR_NANOSLEEP,
-	"getitimer":               SNR_GETITIMER,
-	"setitimer":               SNR_SETITIMER,
-	"kexec_load":              SNR_KEXEC_LOAD,
-	"init_module":             SNR_INIT_MODULE,
-	"delete_module":           SNR_DELETE_MODULE,
-	"timer_create":            SNR_TIMER_CREATE,
-	"timer_gettime":           SNR_TIMER_GETTIME,
-	"timer_getoverrun":        SNR_TIMER_GETOVERRUN,
-	"timer_settime":           SNR_TIMER_SETTIME,
-	"timer_delete":            SNR_TIMER_DELETE,
-	"clock_settime":           SNR_CLOCK_SETTIME,
-	"clock_gettime":           SNR_CLOCK_GETTIME,
-	"clock_getres":            SNR_CLOCK_GETRES,
-	"clock_nanosleep":         SNR_CLOCK_NANOSLEEP,
-	"syslog":                  SNR_SYSLOG,
-	"ptrace":                  SNR_PTRACE,
-	"sched_setparam":          SNR_SCHED_SETPARAM,
-	"sched_setscheduler":      SNR_SCHED_SETSCHEDULER,
-	"sched_getscheduler":      SNR_SCHED_GETSCHEDULER,
-	"sched_getparam":          SNR_SCHED_GETPARAM,
-	"sched_setaffinity":       SNR_SCHED_SETAFFINITY,
-	"sched_getaffinity":       SNR_SCHED_GETAFFINITY,
-	"sched_yield":             SNR_SCHED_YIELD,
-	"sched_get_priority_max":  SNR_SCHED_GET_PRIORITY_MAX,
-	"sched_get_priority_min":  SNR_SCHED_GET_PRIORITY_MIN,
-	"sched_rr_get_interval":   SNR_SCHED_RR_GET_INTERVAL,
-	"restart_syscall":         SNR_RESTART_SYSCALL,
-	"kill":                    SNR_KILL,
-	"tkill":                   SNR_TKILL,
-	"tgkill":                  SNR_TGKILL,
-	"sigaltstack":             SNR_SIGALTSTACK,
-	"rt_sigsuspend":           SNR_RT_SIGSUSPEND,
-	"rt_sigaction":            SNR_RT_SIGACTION,
-	"rt_sigprocmask":          SNR_RT_SIGPROCMASK,
-	"rt_sigpending":           SNR_RT_SIGPENDING,
-	"rt_sigtimedwait":         SNR_RT_SIGTIMEDWAIT,
-	"rt_sigqueueinfo":         SNR_RT_SIGQUEUEINFO,
-	"rt_sigreturn":            SNR_RT_SIGRETURN,
-	"setpriority":             SNR_SETPRIORITY,
-	"getpriority":             SNR_GETPRIORITY,
-	"reboot":                  SNR_REBOOT,
-	"setregid":                SNR_SETREGID,
-	"setgid":                  SNR_SETGID,
-	"setreuid":                SNR_SETREUID,
-	"setuid":                  SNR_SETUID,
-	"setresuid":               SNR_SETRESUID,
-	"getresuid":               SNR_GETRESUID,
-	"setresgid":               SNR_SETRESGID,
-	"getresgid":               SNR_GETRESGID,
-	"setfsuid":                SNR_SETFSUID,
-	"setfsgid":                SNR_SETFSGID,
-	"times":                   SNR_TIMES,
-	"setpgid":                 SNR_SETPGID,
-	"getpgid":                 SNR_GETPGID,
-	"getsid":                  SNR_GETSID,
-	"setsid":                  SNR_SETSID,
-	"getgroups":               SNR_GETGROUPS,
-	"setgroups":               SNR_SETGROUPS,
-	"uname":                   SNR_UNAME,
-	"sethostname":             SNR_SETHOSTNAME,
-	"setdomainname":           SNR_SETDOMAINNAME,
-	"getrlimit":               SNR_GETRLIMIT,
-	"setrlimit":               SNR_SETRLIMIT,
-	"getrusage":               SNR_GETRUSAGE,
-	"umask":                   SNR_UMASK,
-	"prctl":                   SNR_PRCTL,
-	"getcpu":                  SNR_GETCPU,
-	"gettimeofday":            SNR_GETTIMEOFDAY,
-	"settimeofday":            SNR_SETTIMEOFDAY,
-	"adjtimex":                SNR_ADJTIMEX,
-	"getpid":                  SNR_GETPID,
-	"getppid":                 SNR_GETPPID,
-	"getuid":                  SNR_GETUID,
-	"geteuid":                 SNR_GETEUID,
-	"getgid":                  SNR_GETGID,
-	"getegid":                 SNR_GETEGID,
-	"gettid":                  SNR_GETTID,
-	"sysinfo":                 SNR_SYSINFO,
-	"mq_open":                 SNR_MQ_OPEN,
-	"mq_unlink":               SNR_MQ_UNLINK,
-	"mq_timedsend":            SNR_MQ_TIMEDSEND,
-	"mq_timedreceive":         SNR_MQ_TIMEDRECEIVE,
-	"mq_notify":               SNR_MQ_NOTIFY,
-	"mq_getsetattr":           SNR_MQ_GETSETATTR,
-	"msgget":                  SNR_MSGGET,
-	"msgctl":                  SNR_MSGCTL,
-	"msgrcv":                  SNR_MSGRCV,
-	"msgsnd":                  SNR_MSGSND,
-	"semget":                  SNR_SEMGET,
-	"semctl":                  SNR_SEMCTL,
-	"semtimedop":              SNR_SEMTIMEDOP,
-	"semop":                   SNR_SEMOP,
-	"shmget":                  SNR_SHMGET,
-	"shmctl":                  SNR_SHMCTL,
-	"shmat":                   SNR_SHMAT,
-	"shmdt":                   SNR_SHMDT,
-	"socket":                  SNR_SOCKET,
-	"socketpair":              SNR_SOCKETPAIR,
-	"bind":                    SNR_BIND,
-	"listen":                  SNR_LISTEN,
-	"accept":                  SNR_ACCEPT,
-	"connect":                 SNR_CONNECT,
-	"getsockname":             SNR_GETSOCKNAME,
-	"getpeername":             SNR_GETPEERNAME,
-	"sendto":                  SNR_SENDTO,
-	"recvfrom":                SNR_RECVFROM,
-	"setsockopt":              SNR_SETSOCKOPT,
-	"getsockopt":              SNR_GETSOCKOPT,
-	"shutdown":                SNR_SHUTDOWN,
-	"sendmsg":                 SNR_SENDMSG,
-	"recvmsg":                 SNR_RECVMSG,
-	"readahead":               SNR_READAHEAD,
-	"brk":                     SNR_BRK,
-	"munmap":                  SNR_MUNMAP,
-	"mremap":                  SNR_MREMAP,
-	"add_key":                 SNR_ADD_KEY,
-	"request_key":             SNR_REQUEST_KEY,
-	"keyctl":                  SNR_KEYCTL,
-	"clone":                   SNR_CLONE,
-	"execve":                  SNR_EXECVE,
-	"mmap":                    SNR_MMAP,
-	"fadvise64":               SNR_FADVISE64,
-	"swapon":                  SNR_SWAPON,
-	"swapoff":                 SNR_SWAPOFF,
-	"mprotect":                SNR_MPROTECT,
-	"msync":                   SNR_MSYNC,
-	"mlock":                   SNR_MLOCK,
-	"munlock":                 SNR_MUNLOCK,
-	"mlockall":                SNR_MLOCKALL,
-	"munlockall":              SNR_MUNLOCKALL,
-	"mincore":                 SNR_MINCORE,
-	"madvise":                 SNR_MADVISE,
-	"remap_file_pages":        SNR_REMAP_FILE_PAGES,
-	"mbind":                   SNR_MBIND,
-	"get_mempolicy":           SNR_GET_MEMPOLICY,
-	"set_mempolicy":           SNR_SET_MEMPOLICY,
-	"migrate_pages":           SNR_MIGRATE_PAGES,
-	"move_pages":              SNR_MOVE_PAGES,
-	"rt_tgsigqueueinfo":       SNR_RT_TGSIGQUEUEINFO,
-	"perf_event_open":         SNR_PERF_EVENT_OPEN,
-	"accept4":                 SNR_ACCEPT4,
-	"recvmmsg":                SNR_RECVMMSG,
-	"wait4":                   SNR_WAIT4,
-	"prlimit64":               SNR_PRLIMIT64,
-	"fanotify_init":           SNR_FANOTIFY_INIT,
-	"fanotify_mark":           SNR_FANOTIFY_MARK,
-	"name_to_handle_at":       SNR_NAME_TO_HANDLE_AT,
-	"open_by_handle_at":       SNR_OPEN_BY_HANDLE_AT,
-	"clock_adjtime":           SNR_CLOCK_ADJTIME,
-	"syncfs":                  SNR_SYNCFS,
-	"setns":                   SNR_SETNS,
-	"sendmmsg":                SNR_SENDMMSG,
-	"process_vm_readv":        SNR_PROCESS_VM_READV,
-	"process_vm_writev":       SNR_PROCESS_VM_WRITEV,
-	"kcmp":                    SNR_KCMP,
-	"finit_module":            SNR_FINIT_MODULE,
-	"sched_setattr":           SNR_SCHED_SETATTR,
-	"sched_getattr":           SNR_SCHED_GETATTR,
-	"renameat2":               SNR_RENAMEAT2,
-	"seccomp":                 SNR_SECCOMP,
-	"getrandom":               SNR_GETRANDOM,
-	"memfd_create":            SNR_MEMFD_CREATE,
-	"bpf":                     SNR_BPF,
-	"execveat":                SNR_EXECVEAT,
-	"userfaultfd":             SNR_USERFAULTFD,
-	"membarrier":              SNR_MEMBARRIER,
-	"mlock2":                  SNR_MLOCK2,
-	"copy_file_range":         SNR_COPY_FILE_RANGE,
-	"preadv2":                 SNR_PREADV2,
-	"pwritev2":                SNR_PWRITEV2,
-	"pkey_mprotect":           SNR_PKEY_MPROTECT,
-	"pkey_alloc":              SNR_PKEY_ALLOC,
-	"pkey_free":               SNR_PKEY_FREE,
-	"statx":                   SNR_STATX,
-	"io_pgetevents":           SNR_IO_PGETEVENTS,
-	"rseq":                    SNR_RSEQ,
-	"kexec_file_load":         SNR_KEXEC_FILE_LOAD,
-	"pidfd_send_signal":       SNR_PIDFD_SEND_SIGNAL,
-	"io_uring_setup":          SNR_IO_URING_SETUP,
-	"io_uring_enter":          SNR_IO_URING_ENTER,
-	"io_uring_register":       SNR_IO_URING_REGISTER,
-	"open_tree":               SNR_OPEN_TREE,
-	"move_mount":              SNR_MOVE_MOUNT,
-	"fsopen":                  SNR_FSOPEN,
-	"fsconfig":                SNR_FSCONFIG,
-	"fsmount":                 SNR_FSMOUNT,
-	"fspick":                  SNR_FSPICK,
-	"pidfd_open":              SNR_PIDFD_OPEN,
-	"clone3":                  SNR_CLONE3,
-	"close_range":             SNR_CLOSE_RANGE,
-	"openat2":                 SNR_OPENAT2,
-	"pidfd_getfd":             SNR_PIDFD_GETFD,
-	"faccessat2":              SNR_FACCESSAT2,
-	"process_madvise":         SNR_PROCESS_MADVISE,
-	"epoll_pwait2":            SNR_EPOLL_PWAIT2,
-	"mount_setattr":           SNR_MOUNT_SETATTR,
-	"quotactl_fd":             SNR_QUOTACTL_FD,
-	"landlock_create_ruleset": SNR_LANDLOCK_CREATE_RULESET,
-	"landlock_add_rule":       SNR_LANDLOCK_ADD_RULE,
-	"landlock_restrict_self":  SNR_LANDLOCK_RESTRICT_SELF,
-	"memfd_secret":            SNR_MEMFD_SECRET,
-	"process_mrelease":        SNR_PROCESS_MRELEASE,
-	"futex_waitv":             SNR_FUTEX_WAITV,
-	"set_mempolicy_home_node": SNR_SET_MEMPOLICY_HOME_NODE,
-	"cachestat":               SNR_CACHESTAT,
-	"fchmodat2":               SNR_FCHMODAT2,
-	"map_shadow_stack":        SNR_MAP_SHADOW_STACK,
-	"futex_wake":              SNR_FUTEX_WAKE,
-	"futex_wait":              SNR_FUTEX_WAIT,
-	"futex_requeue":           SNR_FUTEX_REQUEUE,
-	"statmount":               SNR_STATMOUNT,
-	"listmount":               SNR_LISTMOUNT,
-	"lsm_get_self_attr":       SNR_LSM_GET_SELF_ATTR,
-	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
-	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
-	"mseal":                   SNR_MSEAL,
-}
-
-const (
-	SYS_USERFAULTFD             = 282
-	SYS_MEMBARRIER              = 283
-	SYS_MLOCK2                  = 284
-	SYS_COPY_FILE_RANGE         = 285
-	SYS_PREADV2                 = 286
-	SYS_PWRITEV2                = 287
-	SYS_PKEY_MPROTECT           = 288
-	SYS_PKEY_ALLOC              = 289
-	SYS_PKEY_FREE               = 290
-	SYS_STATX                   = 291
-	SYS_IO_PGETEVENTS           = 292
-	SYS_RSEQ                    = 293
-	SYS_KEXEC_FILE_LOAD         = 294
-	SYS_PIDFD_SEND_SIGNAL       = 424
-	SYS_IO_URING_SETUP          = 425
-	SYS_IO_URING_ENTER          = 426
-	SYS_IO_URING_REGISTER       = 427
-	SYS_OPEN_TREE               = 428
-	SYS_MOVE_MOUNT              = 429
-	SYS_FSOPEN                  = 430
-	SYS_FSCONFIG                = 431
-	SYS_FSMOUNT                 = 432
-	SYS_FSPICK                  = 433
-	SYS_PIDFD_OPEN              = 434
-	SYS_CLONE3                  = 435
-	SYS_CLOSE_RANGE             = 436
-	SYS_OPENAT2                 = 437
-	SYS_PIDFD_GETFD             = 438
-	SYS_FACCESSAT2              = 439
-	SYS_PROCESS_MADVISE         = 440
-	SYS_EPOLL_PWAIT2            = 441
-	SYS_MOUNT_SETATTR           = 442
-	SYS_QUOTACTL_FD             = 443
-	SYS_LANDLOCK_CREATE_RULESET = 444
-	SYS_LANDLOCK_ADD_RULE       = 445
-	SYS_LANDLOCK_RESTRICT_SELF  = 446
-	SYS_MEMFD_SECRET            = 447
-	SYS_PROCESS_MRELEASE        = 448
-	SYS_FUTEX_WAITV             = 449
-	SYS_SET_MEMPOLICY_HOME_NODE = 450
-	SYS_CACHESTAT               = 451
-	SYS_FCHMODAT2               = 452
-	SYS_MAP_SHADOW_STACK        = 453
-	SYS_FUTEX_WAKE              = 454
-	SYS_FUTEX_WAIT              = 455
-	SYS_FUTEX_REQUEUE           = 456
-	SYS_STATMOUNT               = 457
-	SYS_LISTMOUNT               = 458
-	SYS_LSM_GET_SELF_ATTR       = 459
-	SYS_LSM_SET_SELF_ATTR       = 460
-	SYS_LSM_LIST_MODULES        = 461
-	SYS_MSEAL                   = 462
-)
-
-const (
-	SNR_IO_SETUP                ScmpSyscall = SYS_IO_SETUP
-	SNR_IO_DESTROY              ScmpSyscall = SYS_IO_DESTROY
-	SNR_IO_SUBMIT               ScmpSyscall = SYS_IO_SUBMIT
-	SNR_IO_CANCEL               ScmpSyscall = SYS_IO_CANCEL
-	SNR_IO_GETEVENTS            ScmpSyscall = SYS_IO_GETEVENTS
-	SNR_SETXATTR                ScmpSyscall = SYS_SETXATTR
-	SNR_LSETXATTR               ScmpSyscall = SYS_LSETXATTR
-	SNR_FSETXATTR               ScmpSyscall = SYS_FSETXATTR
-	SNR_GETXATTR                ScmpSyscall = SYS_GETXATTR
-	SNR_LGETXATTR               ScmpSyscall = SYS_LGETXATTR
-	SNR_FGETXATTR               ScmpSyscall = SYS_FGETXATTR
-	SNR_LISTXATTR               ScmpSyscall = SYS_LISTXATTR
-	SNR_LLISTXATTR              ScmpSyscall = SYS_LLISTXATTR
-	SNR_FLISTXATTR              ScmpSyscall = SYS_FLISTXATTR
-	SNR_REMOVEXATTR             ScmpSyscall = SYS_REMOVEXATTR
-	SNR_LREMOVEXATTR            ScmpSyscall = SYS_LREMOVEXATTR
-	SNR_FREMOVEXATTR            ScmpSyscall = SYS_FREMOVEXATTR
-	SNR_GETCWD                  ScmpSyscall = SYS_GETCWD
-	SNR_LOOKUP_DCOOKIE          ScmpSyscall = SYS_LOOKUP_DCOOKIE
-	SNR_EVENTFD2                ScmpSyscall = SYS_EVENTFD2
-	SNR_EPOLL_CREATE1           ScmpSyscall = SYS_EPOLL_CREATE1
-	SNR_EPOLL_CTL               ScmpSyscall = SYS_EPOLL_CTL
-	SNR_EPOLL_PWAIT             ScmpSyscall = SYS_EPOLL_PWAIT
-	SNR_DUP                     ScmpSyscall = SYS_DUP
-	SNR_DUP3                    ScmpSyscall = SYS_DUP3
-	SNR_FCNTL                   ScmpSyscall = SYS_FCNTL
-	SNR_INOTIFY_INIT1           ScmpSyscall = SYS_INOTIFY_INIT1
-	SNR_INOTIFY_ADD_WATCH       ScmpSyscall = SYS_INOTIFY_ADD_WATCH
-	SNR_INOTIFY_RM_WATCH        ScmpSyscall = SYS_INOTIFY_RM_WATCH
-	SNR_IOCTL                   ScmpSyscall = SYS_IOCTL
-	SNR_IOPRIO_SET              ScmpSyscall = SYS_IOPRIO_SET
-	SNR_IOPRIO_GET              ScmpSyscall = SYS_IOPRIO_GET
-	SNR_FLOCK                   ScmpSyscall = SYS_FLOCK
-	SNR_MKNODAT                 ScmpSyscall = SYS_MKNODAT
-	SNR_MKDIRAT                 ScmpSyscall = SYS_MKDIRAT
-	SNR_UNLINKAT                ScmpSyscall = SYS_UNLINKAT
-	SNR_SYMLINKAT               ScmpSyscall = SYS_SYMLINKAT
-	SNR_LINKAT                  ScmpSyscall = SYS_LINKAT
-	SNR_RENAMEAT                ScmpSyscall = SYS_RENAMEAT
-	SNR_UMOUNT2                 ScmpSyscall = SYS_UMOUNT2
-	SNR_MOUNT                   ScmpSyscall = SYS_MOUNT
-	SNR_PIVOT_ROOT              ScmpSyscall = SYS_PIVOT_ROOT
-	SNR_NFSSERVCTL              ScmpSyscall = SYS_NFSSERVCTL
-	SNR_STATFS                  ScmpSyscall = SYS_STATFS
-	SNR_FSTATFS                 ScmpSyscall = SYS_FSTATFS
-	SNR_TRUNCATE                ScmpSyscall = SYS_TRUNCATE
-	SNR_FTRUNCATE               ScmpSyscall = SYS_FTRUNCATE
-	SNR_FALLOCATE               ScmpSyscall = SYS_FALLOCATE
-	SNR_FACCESSAT               ScmpSyscall = SYS_FACCESSAT
-	SNR_CHDIR                   ScmpSyscall = SYS_CHDIR
-	SNR_FCHDIR                  ScmpSyscall = SYS_FCHDIR
-	SNR_CHROOT                  ScmpSyscall = SYS_CHROOT
-	SNR_FCHMOD                  ScmpSyscall = SYS_FCHMOD
-	SNR_FCHMODAT                ScmpSyscall = SYS_FCHMODAT
-	SNR_FCHOWNAT                ScmpSyscall = SYS_FCHOWNAT
-	SNR_FCHOWN                  ScmpSyscall = SYS_FCHOWN
-	SNR_OPENAT                  ScmpSyscall = SYS_OPENAT
-	SNR_CLOSE                   ScmpSyscall = SYS_CLOSE
-	SNR_VHANGUP                 ScmpSyscall = SYS_VHANGUP
-	SNR_PIPE2                   ScmpSyscall = SYS_PIPE2
-	SNR_QUOTACTL                ScmpSyscall = SYS_QUOTACTL
-	SNR_GETDENTS64              ScmpSyscall = SYS_GETDENTS64
-	SNR_LSEEK                   ScmpSyscall = SYS_LSEEK
-	SNR_READ                    ScmpSyscall = SYS_READ
-	SNR_WRITE                   ScmpSyscall = SYS_WRITE
-	SNR_READV                   ScmpSyscall = SYS_READV
-	SNR_WRITEV                  ScmpSyscall = SYS_WRITEV
-	SNR_PREAD64                 ScmpSyscall = SYS_PREAD64
-	SNR_PWRITE64                ScmpSyscall = SYS_PWRITE64
-	SNR_PREADV                  ScmpSyscall = SYS_PREADV
-	SNR_PWRITEV                 ScmpSyscall = SYS_PWRITEV
-	SNR_SENDFILE                ScmpSyscall = SYS_SENDFILE
-	SNR_PSELECT6                ScmpSyscall = SYS_PSELECT6
-	SNR_PPOLL                   ScmpSyscall = SYS_PPOLL
-	SNR_SIGNALFD4               ScmpSyscall = SYS_SIGNALFD4
-	SNR_VMSPLICE                ScmpSyscall = SYS_VMSPLICE
-	SNR_SPLICE                  ScmpSyscall = SYS_SPLICE
-	SNR_TEE                     ScmpSyscall = SYS_TEE
-	SNR_READLINKAT              ScmpSyscall = SYS_READLINKAT
-	SNR_NEWFSTATAT              ScmpSyscall = SYS_NEWFSTATAT
-	SNR_FSTAT                   ScmpSyscall = SYS_FSTAT
-	SNR_SYNC                    ScmpSyscall = SYS_SYNC
-	SNR_FSYNC                   ScmpSyscall = SYS_FSYNC
-	SNR_FDATASYNC               ScmpSyscall = SYS_FDATASYNC
-	SNR_SYNC_FILE_RANGE         ScmpSyscall = SYS_SYNC_FILE_RANGE
-	SNR_TIMERFD_CREATE          ScmpSyscall = SYS_TIMERFD_CREATE
-	SNR_TIMERFD_SETTIME         ScmpSyscall = SYS_TIMERFD_SETTIME
-	SNR_TIMERFD_GETTIME         ScmpSyscall = SYS_TIMERFD_GETTIME
-	SNR_UTIMENSAT               ScmpSyscall = SYS_UTIMENSAT
-	SNR_ACCT                    ScmpSyscall = SYS_ACCT
-	SNR_CAPGET                  ScmpSyscall = SYS_CAPGET
-	SNR_CAPSET                  ScmpSyscall = SYS_CAPSET
-	SNR_PERSONALITY             ScmpSyscall = SYS_PERSONALITY
-	SNR_EXIT                    ScmpSyscall = SYS_EXIT
-	SNR_EXIT_GROUP              ScmpSyscall = SYS_EXIT_GROUP
-	SNR_WAITID                  ScmpSyscall = SYS_WAITID
-	SNR_SET_TID_ADDRESS         ScmpSyscall = SYS_SET_TID_ADDRESS
-	SNR_UNSHARE                 ScmpSyscall = SYS_UNSHARE
-	SNR_FUTEX                   ScmpSyscall = SYS_FUTEX
-	SNR_SET_ROBUST_LIST         ScmpSyscall = SYS_SET_ROBUST_LIST
-	SNR_GET_ROBUST_LIST         ScmpSyscall = SYS_GET_ROBUST_LIST
-	SNR_NANOSLEEP               ScmpSyscall = SYS_NANOSLEEP
-	SNR_GETITIMER               ScmpSyscall = SYS_GETITIMER
-	SNR_SETITIMER               ScmpSyscall = SYS_SETITIMER
-	SNR_KEXEC_LOAD              ScmpSyscall = SYS_KEXEC_LOAD
-	SNR_INIT_MODULE             ScmpSyscall = SYS_INIT_MODULE
-	SNR_DELETE_MODULE           ScmpSyscall = SYS_DELETE_MODULE
-	SNR_TIMER_CREATE            ScmpSyscall = SYS_TIMER_CREATE
-	SNR_TIMER_GETTIME           ScmpSyscall = SYS_TIMER_GETTIME
-	SNR_TIMER_GETOVERRUN        ScmpSyscall = SYS_TIMER_GETOVERRUN
-	SNR_TIMER_SETTIME           ScmpSyscall = SYS_TIMER_SETTIME
-	SNR_TIMER_DELETE            ScmpSyscall = SYS_TIMER_DELETE
-	SNR_CLOCK_SETTIME           ScmpSyscall = SYS_CLOCK_SETTIME
-	SNR_CLOCK_GETTIME           ScmpSyscall = SYS_CLOCK_GETTIME
-	SNR_CLOCK_GETRES            ScmpSyscall = SYS_CLOCK_GETRES
-	SNR_CLOCK_NANOSLEEP         ScmpSyscall = SYS_CLOCK_NANOSLEEP
-	SNR_SYSLOG                  ScmpSyscall = SYS_SYSLOG
-	SNR_PTRACE                  ScmpSyscall = SYS_PTRACE
-	SNR_SCHED_SETPARAM          ScmpSyscall = SYS_SCHED_SETPARAM
-	SNR_SCHED_SETSCHEDULER      ScmpSyscall = SYS_SCHED_SETSCHEDULER
-	SNR_SCHED_GETSCHEDULER      ScmpSyscall = SYS_SCHED_GETSCHEDULER
-	SNR_SCHED_GETPARAM          ScmpSyscall = SYS_SCHED_GETPARAM
-	SNR_SCHED_SETAFFINITY       ScmpSyscall = SYS_SCHED_SETAFFINITY
-	SNR_SCHED_GETAFFINITY       ScmpSyscall = SYS_SCHED_GETAFFINITY
-	SNR_SCHED_YIELD             ScmpSyscall = SYS_SCHED_YIELD
-	SNR_SCHED_GET_PRIORITY_MAX  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MAX
-	SNR_SCHED_GET_PRIORITY_MIN  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MIN
-	SNR_SCHED_RR_GET_INTERVAL   ScmpSyscall = SYS_SCHED_RR_GET_INTERVAL
-	SNR_RESTART_SYSCALL         ScmpSyscall = SYS_RESTART_SYSCALL
-	SNR_KILL                    ScmpSyscall = SYS_KILL
-	SNR_TKILL                   ScmpSyscall = SYS_TKILL
-	SNR_TGKILL                  ScmpSyscall = SYS_TGKILL
-	SNR_SIGALTSTACK             ScmpSyscall = SYS_SIGALTSTACK
-	SNR_RT_SIGSUSPEND           ScmpSyscall = SYS_RT_SIGSUSPEND
-	SNR_RT_SIGACTION            ScmpSyscall = SYS_RT_SIGACTION
-	SNR_RT_SIGPROCMASK          ScmpSyscall = SYS_RT_SIGPROCMASK
-	SNR_RT_SIGPENDING           ScmpSyscall = SYS_RT_SIGPENDING
-	SNR_RT_SIGTIMEDWAIT         ScmpSyscall = SYS_RT_SIGTIMEDWAIT
-	SNR_RT_SIGQUEUEINFO         ScmpSyscall = SYS_RT_SIGQUEUEINFO
-	SNR_RT_SIGRETURN            ScmpSyscall = SYS_RT_SIGRETURN
-	SNR_SETPRIORITY             ScmpSyscall = SYS_SETPRIORITY
-	SNR_GETPRIORITY             ScmpSyscall = SYS_GETPRIORITY
-	SNR_REBOOT                  ScmpSyscall = SYS_REBOOT
-	SNR_SETREGID                ScmpSyscall = SYS_SETREGID
-	SNR_SETGID                  ScmpSyscall = SYS_SETGID
-	SNR_SETREUID                ScmpSyscall = SYS_SETREUID
-	SNR_SETUID                  ScmpSyscall = SYS_SETUID
-	SNR_SETRESUID               ScmpSyscall = SYS_SETRESUID
-	SNR_GETRESUID               ScmpSyscall = SYS_GETRESUID
-	SNR_SETRESGID               ScmpSyscall = SYS_SETRESGID
-	SNR_GETRESGID               ScmpSyscall = SYS_GETRESGID
-	SNR_SETFSUID                ScmpSyscall = SYS_SETFSUID
-	SNR_SETFSGID                ScmpSyscall = SYS_SETFSGID
-	SNR_TIMES                   ScmpSyscall = SYS_TIMES
-	SNR_SETPGID                 ScmpSyscall = SYS_SETPGID
-	SNR_GETPGID                 ScmpSyscall = SYS_GETPGID
-	SNR_GETSID                  ScmpSyscall = SYS_GETSID
-	SNR_SETSID                  ScmpSyscall = SYS_SETSID
-	SNR_GETGROUPS               ScmpSyscall = SYS_GETGROUPS
-	SNR_SETGROUPS               ScmpSyscall = SYS_SETGROUPS
-	SNR_UNAME                   ScmpSyscall = SYS_UNAME
-	SNR_SETHOSTNAME             ScmpSyscall = SYS_SETHOSTNAME
-	SNR_SETDOMAINNAME           ScmpSyscall = SYS_SETDOMAINNAME
-	SNR_GETRLIMIT               ScmpSyscall = SYS_GETRLIMIT
-	SNR_SETRLIMIT               ScmpSyscall = SYS_SETRLIMIT
-	SNR_GETRUSAGE               ScmpSyscall = SYS_GETRUSAGE
-	SNR_UMASK                   ScmpSyscall = SYS_UMASK
-	SNR_PRCTL                   ScmpSyscall = SYS_PRCTL
-	SNR_GETCPU                  ScmpSyscall = SYS_GETCPU
-	SNR_GETTIMEOFDAY            ScmpSyscall = SYS_GETTIMEOFDAY
-	SNR_SETTIMEOFDAY            ScmpSyscall = SYS_SETTIMEOFDAY
-	SNR_ADJTIMEX                ScmpSyscall = SYS_ADJTIMEX
-	SNR_GETPID                  ScmpSyscall = SYS_GETPID
-	SNR_GETPPID                 ScmpSyscall = SYS_GETPPID
-	SNR_GETUID                  ScmpSyscall = SYS_GETUID
-	SNR_GETEUID                 ScmpSyscall = SYS_GETEUID
-	SNR_GETGID                  ScmpSyscall = SYS_GETGID
-	SNR_GETEGID                 ScmpSyscall = SYS_GETEGID
-	SNR_GETTID                  ScmpSyscall = SYS_GETTID
-	SNR_SYSINFO                 ScmpSyscall = SYS_SYSINFO
-	SNR_MQ_OPEN                 ScmpSyscall = SYS_MQ_OPEN
-	SNR_MQ_UNLINK               ScmpSyscall = SYS_MQ_UNLINK
-	SNR_MQ_TIMEDSEND            ScmpSyscall = SYS_MQ_TIMEDSEND
-	SNR_MQ_TIMEDRECEIVE         ScmpSyscall = SYS_MQ_TIMEDRECEIVE
-	SNR_MQ_NOTIFY               ScmpSyscall = SYS_MQ_NOTIFY
-	SNR_MQ_GETSETATTR           ScmpSyscall = SYS_MQ_GETSETATTR
-	SNR_MSGGET                  ScmpSyscall = SYS_MSGGET
-	SNR_MSGCTL                  ScmpSyscall = SYS_MSGCTL
-	SNR_MSGRCV                  ScmpSyscall = SYS_MSGRCV
-	SNR_MSGSND                  ScmpSyscall = SYS_MSGSND
-	SNR_SEMGET                  ScmpSyscall = SYS_SEMGET
-	SNR_SEMCTL                  ScmpSyscall = SYS_SEMCTL
-	SNR_SEMTIMEDOP              ScmpSyscall = SYS_SEMTIMEDOP
-	SNR_SEMOP                   ScmpSyscall = SYS_SEMOP
-	SNR_SHMGET                  ScmpSyscall = SYS_SHMGET
-	SNR_SHMCTL                  ScmpSyscall = SYS_SHMCTL
-	SNR_SHMAT                   ScmpSyscall = SYS_SHMAT
-	SNR_SHMDT                   ScmpSyscall = SYS_SHMDT
-	SNR_SOCKET                  ScmpSyscall = SYS_SOCKET
-	SNR_SOCKETPAIR              ScmpSyscall = SYS_SOCKETPAIR
-	SNR_BIND                    ScmpSyscall = SYS_BIND
-	SNR_LISTEN                  ScmpSyscall = SYS_LISTEN
-	SNR_ACCEPT                  ScmpSyscall = SYS_ACCEPT
-	SNR_CONNECT                 ScmpSyscall = SYS_CONNECT
-	SNR_GETSOCKNAME             ScmpSyscall = SYS_GETSOCKNAME
-	SNR_GETPEERNAME             ScmpSyscall = SYS_GETPEERNAME
-	SNR_SENDTO                  ScmpSyscall = SYS_SENDTO
-	SNR_RECVFROM                ScmpSyscall = SYS_RECVFROM
-	SNR_SETSOCKOPT              ScmpSyscall = SYS_SETSOCKOPT
-	SNR_GETSOCKOPT              ScmpSyscall = SYS_GETSOCKOPT
-	SNR_SHUTDOWN                ScmpSyscall = SYS_SHUTDOWN
-	SNR_SENDMSG                 ScmpSyscall = SYS_SENDMSG
-	SNR_RECVMSG                 ScmpSyscall = SYS_RECVMSG
-	SNR_READAHEAD               ScmpSyscall = SYS_READAHEAD
-	SNR_BRK                     ScmpSyscall = SYS_BRK
-	SNR_MUNMAP                  ScmpSyscall = SYS_MUNMAP
-	SNR_MREMAP                  ScmpSyscall = SYS_MREMAP
-	SNR_ADD_KEY                 ScmpSyscall = SYS_ADD_KEY
-	SNR_REQUEST_KEY             ScmpSyscall = SYS_REQUEST_KEY
-	SNR_KEYCTL                  ScmpSyscall = SYS_KEYCTL
-	SNR_CLONE                   ScmpSyscall = SYS_CLONE
-	SNR_EXECVE                  ScmpSyscall = SYS_EXECVE
-	SNR_MMAP                    ScmpSyscall = SYS_MMAP
-	SNR_FADVISE64               ScmpSyscall = SYS_FADVISE64
-	SNR_SWAPON                  ScmpSyscall = SYS_SWAPON
-	SNR_SWAPOFF                 ScmpSyscall = SYS_SWAPOFF
-	SNR_MPROTECT                ScmpSyscall = SYS_MPROTECT
-	SNR_MSYNC                   ScmpSyscall = SYS_MSYNC
-	SNR_MLOCK                   ScmpSyscall = SYS_MLOCK
-	SNR_MUNLOCK                 ScmpSyscall = SYS_MUNLOCK
-	SNR_MLOCKALL                ScmpSyscall = SYS_MLOCKALL
-	SNR_MUNLOCKALL              ScmpSyscall = SYS_MUNLOCKALL
-	SNR_MINCORE                 ScmpSyscall = SYS_MINCORE
-	SNR_MADVISE                 ScmpSyscall = SYS_MADVISE
-	SNR_REMAP_FILE_PAGES        ScmpSyscall = SYS_REMAP_FILE_PAGES
-	SNR_MBIND                   ScmpSyscall = SYS_MBIND
-	SNR_GET_MEMPOLICY           ScmpSyscall = SYS_GET_MEMPOLICY
-	SNR_SET_MEMPOLICY           ScmpSyscall = SYS_SET_MEMPOLICY
-	SNR_MIGRATE_PAGES           ScmpSyscall = SYS_MIGRATE_PAGES
-	SNR_MOVE_PAGES              ScmpSyscall = SYS_MOVE_PAGES
-	SNR_RT_TGSIGQUEUEINFO       ScmpSyscall = SYS_RT_TGSIGQUEUEINFO
-	SNR_PERF_EVENT_OPEN         ScmpSyscall = SYS_PERF_EVENT_OPEN
-	SNR_ACCEPT4                 ScmpSyscall = SYS_ACCEPT4
-	SNR_RECVMMSG                ScmpSyscall = SYS_RECVMMSG
-	SNR_WAIT4                   ScmpSyscall = SYS_WAIT4
-	SNR_PRLIMIT64               ScmpSyscall = SYS_PRLIMIT64
-	SNR_FANOTIFY_INIT           ScmpSyscall = SYS_FANOTIFY_INIT
-	SNR_FANOTIFY_MARK           ScmpSyscall = SYS_FANOTIFY_MARK
-	SNR_NAME_TO_HANDLE_AT       ScmpSyscall = SYS_NAME_TO_HANDLE_AT
-	SNR_OPEN_BY_HANDLE_AT       ScmpSyscall = SYS_OPEN_BY_HANDLE_AT
-	SNR_CLOCK_ADJTIME           ScmpSyscall = SYS_CLOCK_ADJTIME
-	SNR_SYNCFS                  ScmpSyscall = SYS_SYNCFS
-	SNR_SETNS                   ScmpSyscall = SYS_SETNS
-	SNR_SENDMMSG                ScmpSyscall = SYS_SENDMMSG
-	SNR_PROCESS_VM_READV        ScmpSyscall = SYS_PROCESS_VM_READV
-	SNR_PROCESS_VM_WRITEV       ScmpSyscall = SYS_PROCESS_VM_WRITEV
-	SNR_KCMP                    ScmpSyscall = SYS_KCMP
-	SNR_FINIT_MODULE            ScmpSyscall = SYS_FINIT_MODULE
-	SNR_SCHED_SETATTR           ScmpSyscall = SYS_SCHED_SETATTR
-	SNR_SCHED_GETATTR           ScmpSyscall = SYS_SCHED_GETATTR
-	SNR_RENAMEAT2               ScmpSyscall = SYS_RENAMEAT2
-	SNR_SECCOMP                 ScmpSyscall = SYS_SECCOMP
-	SNR_GETRANDOM               ScmpSyscall = SYS_GETRANDOM
-	SNR_MEMFD_CREATE            ScmpSyscall = SYS_MEMFD_CREATE
-	SNR_BPF                     ScmpSyscall = SYS_BPF
-	SNR_EXECVEAT                ScmpSyscall = SYS_EXECVEAT
-	SNR_USERFAULTFD             ScmpSyscall = SYS_USERFAULTFD
-	SNR_MEMBARRIER              ScmpSyscall = SYS_MEMBARRIER
-	SNR_MLOCK2                  ScmpSyscall = SYS_MLOCK2
-	SNR_COPY_FILE_RANGE         ScmpSyscall = SYS_COPY_FILE_RANGE
-	SNR_PREADV2                 ScmpSyscall = SYS_PREADV2
-	SNR_PWRITEV2                ScmpSyscall = SYS_PWRITEV2
-	SNR_PKEY_MPROTECT           ScmpSyscall = SYS_PKEY_MPROTECT
-	SNR_PKEY_ALLOC              ScmpSyscall = SYS_PKEY_ALLOC
-	SNR_PKEY_FREE               ScmpSyscall = SYS_PKEY_FREE
-	SNR_STATX                   ScmpSyscall = SYS_STATX
-	SNR_IO_PGETEVENTS           ScmpSyscall = SYS_IO_PGETEVENTS
-	SNR_RSEQ                    ScmpSyscall = SYS_RSEQ
-	SNR_KEXEC_FILE_LOAD         ScmpSyscall = SYS_KEXEC_FILE_LOAD
-	SNR_PIDFD_SEND_SIGNAL       ScmpSyscall = SYS_PIDFD_SEND_SIGNAL
-	SNR_IO_URING_SETUP          ScmpSyscall = SYS_IO_URING_SETUP
-	SNR_IO_URING_ENTER          ScmpSyscall = SYS_IO_URING_ENTER
-	SNR_IO_URING_REGISTER       ScmpSyscall = SYS_IO_URING_REGISTER
-	SNR_OPEN_TREE               ScmpSyscall = SYS_OPEN_TREE
-	SNR_MOVE_MOUNT              ScmpSyscall = SYS_MOVE_MOUNT
-	SNR_FSOPEN                  ScmpSyscall = SYS_FSOPEN
-	SNR_FSCONFIG                ScmpSyscall = SYS_FSCONFIG
-	SNR_FSMOUNT                 ScmpSyscall = SYS_FSMOUNT
-	SNR_FSPICK                  ScmpSyscall = SYS_FSPICK
-	SNR_PIDFD_OPEN              ScmpSyscall = SYS_PIDFD_OPEN
-	SNR_CLONE3                  ScmpSyscall = SYS_CLONE3
-	SNR_CLOSE_RANGE             ScmpSyscall = SYS_CLOSE_RANGE
-	SNR_OPENAT2                 ScmpSyscall = SYS_OPENAT2
-	SNR_PIDFD_GETFD             ScmpSyscall = SYS_PIDFD_GETFD
-	SNR_FACCESSAT2              ScmpSyscall = SYS_FACCESSAT2
-	SNR_PROCESS_MADVISE         ScmpSyscall = SYS_PROCESS_MADVISE
-	SNR_EPOLL_PWAIT2            ScmpSyscall = SYS_EPOLL_PWAIT2
-	SNR_MOUNT_SETATTR           ScmpSyscall = SYS_MOUNT_SETATTR
-	SNR_QUOTACTL_FD             ScmpSyscall = SYS_QUOTACTL_FD
-	SNR_LANDLOCK_CREATE_RULESET ScmpSyscall = SYS_LANDLOCK_CREATE_RULESET
-	SNR_LANDLOCK_ADD_RULE       ScmpSyscall = SYS_LANDLOCK_ADD_RULE
-	SNR_LANDLOCK_RESTRICT_SELF  ScmpSyscall = SYS_LANDLOCK_RESTRICT_SELF
-	SNR_MEMFD_SECRET            ScmpSyscall = SYS_MEMFD_SECRET
-	SNR_PROCESS_MRELEASE        ScmpSyscall = SYS_PROCESS_MRELEASE
-	SNR_FUTEX_WAITV             ScmpSyscall = SYS_FUTEX_WAITV
-	SNR_SET_MEMPOLICY_HOME_NODE ScmpSyscall = SYS_SET_MEMPOLICY_HOME_NODE
-	SNR_CACHESTAT               ScmpSyscall = SYS_CACHESTAT
-	SNR_FCHMODAT2               ScmpSyscall = SYS_FCHMODAT2
-	SNR_MAP_SHADOW_STACK        ScmpSyscall = SYS_MAP_SHADOW_STACK
-	SNR_FUTEX_WAKE              ScmpSyscall = SYS_FUTEX_WAKE
-	SNR_FUTEX_WAIT              ScmpSyscall = SYS_FUTEX_WAIT
-	SNR_FUTEX_REQUEUE           ScmpSyscall = SYS_FUTEX_REQUEUE
-	SNR_STATMOUNT               ScmpSyscall = SYS_STATMOUNT
-	SNR_LISTMOUNT               ScmpSyscall = SYS_LISTMOUNT
-	SNR_LSM_GET_SELF_ATTR       ScmpSyscall = SYS_LSM_GET_SELF_ATTR
-	SNR_LSM_SET_SELF_ATTR       ScmpSyscall = SYS_LSM_SET_SELF_ATTR
-	SNR_LSM_LIST_MODULES        ScmpSyscall = SYS_LSM_LIST_MODULES
-	SNR_MSEAL                   ScmpSyscall = SYS_MSEAL
-)

container/std/syscall_test.go

@@ -1,21 +0,0 @@
-package std_test
-
-import (
-	"testing"
-
-	"hakurei.app/container/std"
-)
-
-func TestSyscallResolveName(t *testing.T) {
-	t.Parallel()
-
-	for name, want := range std.Syscalls() {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			if got, ok := std.SyscallResolveName(name); !ok || got != want {
-				t.Errorf("SyscallResolveName(%q) = %d, want %d", name, got, want)
-			}
-		})
-	}
-}

container/stub/errors.go

@@ -13,7 +13,7 @@ var (
 type UniqueError uintptr
 
 func (e UniqueError) Error() string {
-	return "unique error " + strconv.FormatUint(uint64(e), 10) + " injected by the test suite"
+	return "unique error " + strconv.Itoa(int(e)) + " injected by the test suite"
 }
 
 func (e UniqueError) Is(target error) bool {

container/stub/exit.go

@@ -3,10 +3,10 @@ package stub
 import "testing"
 
 // PanicExit is a magic panic value treated as a simulated exit.
-const PanicExit = 0xdead
+const PanicExit = 0xdeadbeef
 
 const (
-	panicFailNow = 0xcafe0 + iota
+	panicFailNow = 0xcafe0000 + iota
 	panicFatal
 	panicFatalf
 )

container/stub/exit_test.go

@@ -2,15 +2,13 @@ package stub_test
 
 import (
 	"testing"
-	_ "unsafe" // for go:linkname
+	_ "unsafe"
 
 	"hakurei.app/container/stub"
 )
 
-// Made available here to check panic recovery behaviour.
-//
 //go:linkname handleExitNew hakurei.app/container/stub.handleExitNew
-func handleExitNew(t testing.TB)
+func handleExitNew(_ testing.TB)
 
 // overrideTFailNow overrides the Fail and FailNow method.
 type overrideTFailNow struct {
@@ -55,7 +53,7 @@ func TestHandleExit(t *testing.T) {
 				}
 			}()
 			defer stub.HandleExit(ot)
-			panic(0xcafe0)
+			panic(0xcafe0000)
 		})
 
 		t.Run("Fail", func(t *testing.T) {
@@ -68,7 +66,7 @@ func TestHandleExit(t *testing.T) {
 				}
 			}()
 			defer handleExitNew(ot)
-			panic(0xcafe0)
+			panic(0xcafe0000)
 		})
 	})
 
@@ -84,14 +82,14 @@ func TestHandleExit(t *testing.T) {
 			t.Parallel()
 
 			defer func() {
-				want := 0xcafe
+				want := 0xcafebabe
 				if r := recover(); r != want {
 					t.Errorf("recover: %v, want %v", r, want)
 				}
 
 			}()
 			defer stub.HandleExit(t)
-			panic(0xcafe)
+			panic(0xcafebabe)
 		})
 
 		t.Run("new", func(t *testing.T) {

container/syscall.go

@@ -1,41 +1,50 @@
 package container
 
 import (
-	. "syscall"
+	"syscall"
 	"unsafe"
 )
 
-// Prctl manipulates various aspects of the behavior of the calling thread or process.
-func Prctl(op, arg2, arg3 uintptr) error {
-	r, _, errno := Syscall(SYS_PRCTL, op, arg2, arg3)
-	if r < 0 {
-		return errno
+// SetPtracer allows processes to ptrace(2) the calling process.
+func SetPtracer(pid uintptr) error {
+	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_PTRACER, pid, 0)
+	if errno == 0 {
+		return nil
 	}
-	return nil
+	return errno
 }
 
-// SetPtracer allows processes to ptrace(2) the calling process.
-func SetPtracer(pid uintptr) error { return Prctl(PR_SET_PTRACER, pid, 0) }
-
-// linux/sched/coredump.h
 const (
 	SUID_DUMP_DISABLE = iota
 	SUID_DUMP_USER
 )
 
 // SetDumpable sets the "dumpable" attribute of the calling process.
-func SetDumpable(dumpable uintptr) error { return Prctl(PR_SET_DUMPABLE, dumpable, 0) }
+func SetDumpable(dumpable uintptr) error {
+	// linux/sched/coredump.h
+	if _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 {
+		return errno
+	}
+
+	return nil
+}
 
 // SetNoNewPrivs sets the calling thread's no_new_privs attribute.
-func SetNoNewPrivs() error { return Prctl(PR_SET_NO_NEW_PRIVS, 1, 0) }
+func SetNoNewPrivs() error {
+	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0)
+	if errno == 0 {
+		return nil
+	}
+	return errno
+}
 
 // Isatty tests whether a file descriptor refers to a terminal.
 func Isatty(fd int) bool {
 	var buf [8]byte
-	r, _, _ := Syscall(
-		SYS_IOCTL,
+	r, _, _ := syscall.Syscall(
+		syscall.SYS_IOCTL,
 		uintptr(fd),
-		TIOCGWINSZ,
+		syscall.TIOCGWINSZ,
 		uintptr(unsafe.Pointer(&buf[0])),
 	)
 	return r == 0
@@ -51,7 +60,7 @@ func Isatty(fd int) bool {
 func IgnoringEINTR(fn func() error) error {
 	for {
 		err := fn()
-		if err != EINTR {
+		if err != syscall.EINTR {
 			return err
 		}
 	}

container/syscall_386.go

@@ -1,7 +0,0 @@
-package container
-
-const (
-	O_PATH = 0x200000
-
-	PR_SET_NO_NEW_PRIVS = 0x26
-)

container/vfs/mountinfo_test.go

@@ -26,11 +26,11 @@ func TestDecoderError(t *testing.T) {
 		target  error
 		targetF error
 	}{
-		{"errno", &vfs.DecoderError{Op: "parse", Line: 0xdead, Err: syscall.ENOTRECOVERABLE},
-			"parse mountinfo at line 57005: state not recoverable", syscall.ENOTRECOVERABLE, syscall.EROFS},
+		{"errno", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: syscall.ENOTRECOVERABLE},
+			"parse mountinfo at line 3735928559: state not recoverable", syscall.ENOTRECOVERABLE, syscall.EROFS},
 
-		{"strconv", &vfs.DecoderError{Op: "parse", Line: 0xdead, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
-			`parse mountinfo at line 57005: numeric field "meow" invalid syntax`, strconv.ErrSyntax, os.ErrInvalid},
+		{"strconv", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
+			`parse mountinfo at line 3735928559: numeric field "meow" invalid syntax`, strconv.ErrSyntax, os.ErrInvalid},
 
 		{"unfold", &vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/proc/nonexistent")},
 			"unfold mountinfo: mount point /proc/nonexistent never appeared in mountinfo", vfs.UnfoldTargetError("/proc/nonexistent"), os.ErrNotExist},

dist/comp/_hakurei

@@ -17,8 +17,7 @@ _hakurei_run() {
     '--wayland[Enable connection to Wayland via security-context-v1]' \
     '-X[Enable direct connection to X11]' \
     '--dbus[Enable proxied connection to D-Bus]' \
-    '--pipewire[Enable connection to PipeWire via SecurityContext]' \
-    '--pulse[Enable PulseAudio compatibility daemon]' \
+    '--pulse[Enable direct connection to PulseAudio]' \
     '--dbus-config[Path to session bus proxy config file]: :_files -g "*.json"' \
     '--dbus-system[Path to system bus proxy config file]: :_files -g "*.json"' \
     '--mpris[Allow owning MPRIS D-Bus path]' \

dist/release.sh

@@ -10,10 +10,10 @@ cp -rv "dist/comp" "${out}"
 
 go generate ./...
 go build -trimpath -v -o "${out}/bin/" -ldflags "-s -w -buildid= -extldflags '-static'
-  -X hakurei.app/internal/info.buildVersion=${VERSION}
-  -X hakurei.app/internal/info.hakureiPath=/usr/bin/hakurei
-  -X hakurei.app/internal/info.hsuPath=/usr/bin/hsu
-  -X main.hakureiPath=/usr/bin/hakurei" ./...
+  -X hakurei.app/internal.version=${VERSION}
+  -X hakurei.app/internal.hmain=/usr/bin/hakurei
+  -X hakurei.app/internal.hsu=/usr/bin/hsu
+  -X main.hmain=/usr/bin/hakurei" ./...
 
 rm -f "./${out}.tar.gz" && tar -C dist -czf "${out}.tar.gz" "${pname}"
 rm -rf "./${out}"

flake.lock

@@ -7,32 +7,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1765384171,
-        "narHash": "sha256-FuFtkJrW1Z7u+3lhzPRau69E0CNjADku1mLQQflUORo=",
+        "lastModified": 1756679287,
+        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "44777152652bc9eacf8876976fa72cc77ca8b9d8",
+        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
+        "ref": "release-25.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765311797,
-        "narHash": "sha256-mSD5Ob7a+T2RNjvPvOA1dkJHGVrNVl8ZOrAwBjKBDQo=",
+        "lastModified": 1757020766,
+        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "09eb77e94fa25202af8f3e81ddc7353d9970ac1b",
+        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,10 +2,10 @@
   description = "hakurei container tool and nixos module";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
@@ -114,7 +114,7 @@
             inherit (pkgs)
               # passthru.buildInputs
               go
-              clang
+              gcc
 
               # nativeBuildInputs
               pkg-config
@@ -129,10 +129,6 @@
               zstd
               gnutar
               coreutils
-
-              # for check
-              util-linux
-              nettools
               ;
           };
           hsu = pkgs.callPackage ./cmd/hsu/package.nix { inherit (self.packages.${system}) hakurei; };
@@ -148,7 +144,7 @@
                 && chmod -R +w .
 
             export HAKUREI_VERSION="v${hakurei.version}"
-            CC="clang -O3 -Werror" ./dist/release.sh && mkdir $out && cp -v "dist/hakurei-$HAKUREI_VERSION.tar.gz"* $out
+            ./dist/release.sh && mkdir $out && cp -v "dist/hakurei-$HAKUREI_VERSION.tar.gz"* $out
           '';
         }
       );
@@ -185,13 +181,13 @@
                       hakurei =
                         let
                           # this is used for interactive vm testing during development, where tests might be broken
-                          package = self.packages.${pkgs.stdenv.hostPlatform.system}.hakurei.override {
+                          package = self.packages.${pkgs.system}.hakurei.override {
                             buildGoModule = previousArgs: pkgs.pkgsStatic.buildGoModule (previousArgs // { doCheck = false; });
                           };
                         in
                         {
                           inherit package;
-                          hsuPackage = self.packages.${pkgs.stdenv.hostPlatform.system}.hsu.override { hakurei = package; };
+                          hsuPackage = self.packages.${pkgs.system}.hsu.override { hakurei = package; };
                         };
                     };
                   }
@@ -248,10 +244,10 @@
               shellHook = "exec ${pkgs.writeShellScript "generate-syscall-table" ''
                 set -e
                 ${pkgs.perl}/bin/perl \
-                  container/std/mksysnum_linux.pl \
+                  container/seccomp/mksysnum_linux.pl \
                   ${pkgs.linuxHeaders}/include/asm/unistd_64.h | \
                   ${pkgs.go}/bin/gofmt > \
-                  container/std/syscall_linux_${GOARCH.${system}}.go
+                  container/seccomp/syscall_linux_${GOARCH.${system}}.go
               ''}";
             };
         }

helper/args_test.go

@@ -7,7 +7,7 @@ import (
 	"syscall"
 	"testing"
 
-	"hakurei.app/internal/helper"
+	"hakurei.app/helper"
 )
 
 func TestArgsString(t *testing.T) {

helper/cmd.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 	"syscall"
 
-	"hakurei.app/internal/helper/proc"
+	"hakurei.app/helper/proc"
 )
 
 // NewDirect initialises a new direct Helper instance with wt as the null-terminated argument writer.