release: 0.3.1

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/hakurei/command.go

@@ -52,20 +52,26 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 
 	c.Command("shim", command.UsageInternal, func([]string) error { outcome.Shim(msg); return errSuccess })
 
-	c.Command("app", "Load and start container from configuration file", func(args []string) error {
+	{
-		if len(args) < 1 {
+		var (
-			log.Fatal("app requires at least 1 argument")
+			flagIdentifierFile int
-		}
+		)
+		c.NewCommand("app", "Load and start container from configuration file", func(args []string) error {
+			if len(args) < 1 {
+				log.Fatal("app requires at least 1 argument")
+			}
 
-		// config extraArgs...
+			config := tryPath(msg, args[0])
-		config := tryPath(msg, args[0])
+			if config != nil && config.Container != nil {
-		if config != nil && config.Container != nil {
+				config.Container.Args = append(config.Container.Args, args[1:]...)
-			config.Container.Args = append(config.Container.Args, args[1:]...)
+			}
-		}
 
-		outcome.Main(ctx, msg, config)
+			outcome.Main(ctx, msg, config, flagIdentifierFile)
-		panic("unreachable")
+			panic("unreachable")
-	})
+		}).
+			Flag(&flagIdentifierFile, "identifier-fd", command.IntFlag(-1),
+				"Write identifier of current instance to fd after successful startup")
+	}
 
 	{
 		var (
@@ -257,7 +263,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
 				}
 			}
 
-			outcome.Main(ctx, msg, config)
+			outcome.Main(ctx, msg, config, -1)
 			panic("unreachable")
 		}).
 			Flag(&flagDBusConfigSession, "dbus-config", command.StringFlag("builtin"),

cmd/hakurei/parse.go

@@ -11,6 +11,7 @@ import (
 	"syscall"
 
 	"hakurei.app/hst"
+	"hakurei.app/internal/outcome"
 	"hakurei.app/internal/store"
 	"hakurei.app/message"
 )
@@ -53,14 +54,23 @@ func tryFd(msg message.Msg, name string) io.ReadCloser {
 		}
 		return nil
 	} else {
+		if v < 3 { // reject standard streams
+			return nil
+		}
+
 		msg.Verbosef("trying config stream from %d", v)
 		fd := uintptr(v)
 		if _, _, errno := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_GETFD, 0); errno != 0 {
-			if errors.Is(errno, syscall.EBADF) {
+			if errors.Is(errno, syscall.EBADF) { // reject bad fd
 				return nil
 			}
 			log.Fatalf("cannot get fd %d: %v", fd, errno)
 		}
+
+		if outcome.IsPollDescriptor(fd) { // reject runtime internals
+			log.Fatalf("invalid config stream %d", fd)
+		}
+
 		return os.NewFile(fd, strconv.Itoa(v))
 	}
 }

container/check/absolute_test.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"syscall"
 	"testing"
-	_ "unsafe"
+	_ "unsafe" // for go:linkname
 
 	. "hakurei.app/container/check"
 )

container/container.go

@@ -11,6 +11,7 @@ import (
 	"os/exec"
 	"runtime"
 	"strconv"
+	"sync"
 	. "syscall"
 	"time"
 
@@ -143,11 +144,18 @@ func (e *StartError) Error() string {
 // Message returns a user-facing error message.
 func (e *StartError) Message() string {
 	if e.Passthrough {
+		var (
+			numError *strconv.NumError
+		)
+
 		switch {
 		case errors.As(e.Err, new(*os.PathError)),
 			errors.As(e.Err, new(*os.SyscallError)):
 			return "cannot " + e.Err.Error()
 
+		case errors.As(e.Err, &numError) && numError != nil:
+			return "cannot parse " + strconv.Quote(numError.Num) + ": " + numError.Err.Error()
+
 		default:
 			return e.Err.Error()
 		}
@@ -158,6 +166,39 @@ func (e *StartError) Message() string {
 	return "cannot " + e.Error()
 }
 
+// for ensureCloseOnExec
+var (
+	closeOnExecOnce sync.Once
+	closeOnExecErr  error
+)
+
+// ensureCloseOnExec ensures all currently open file descriptors have the syscall.FD_CLOEXEC flag set.
+// This is only ran once as it is intended to handle files left open by the parent, and any file opened
+// on this side should already have syscall.FD_CLOEXEC set.
+func ensureCloseOnExec() error {
+	closeOnExecOnce.Do(func() {
+		const fdPrefixPath = "/proc/self/fd/"
+
+		var entries []os.DirEntry
+		if entries, closeOnExecErr = os.ReadDir(fdPrefixPath); closeOnExecErr != nil {
+			return
+		}
+
+		var fd int
+		for _, ent := range entries {
+			if fd, closeOnExecErr = strconv.Atoi(ent.Name()); closeOnExecErr != nil {
+				break // not reached
+			}
+			CloseOnExec(fd)
+		}
+	})
+
+	if closeOnExecErr == nil {
+		return nil
+	}
+	return &StartError{Fatal: true, Step: "set FD_CLOEXEC on all open files", Err: closeOnExecErr, Passthrough: true}
+}
+
 // Start starts the container init. The init process blocks until Serve is called.
 func (p *Container) Start() error {
 	if p == nil || p.cmd == nil ||
@@ -168,6 +209,10 @@ func (p *Container) Start() error {
 		return errors.New("container: already started")
 	}
 
+	if err := ensureCloseOnExec(); err != nil {
+		return err
+	}
+
 	// map to overflow id to work around ownership checks
 	if p.Uid < 1 {
 		p.Uid = OverflowUid(p.msg)

container/container_test.go

@@ -44,8 +44,7 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "set up params stream",
 			Err:   container.ErrReceiveEnv,
-		},
+		}, "set up params stream: environment variable not set",
-			"set up params stream: environment variable not set",
 			container.ErrReceiveEnv, syscall.EBADF,
 			"cannot set up params stream: environment variable not set"},
 
@@ -53,8 +52,7 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "set up params stream",
 			Err:   &os.SyscallError{Syscall: "pipe2", Err: syscall.EBADF},
-		},
+		}, "set up params stream pipe2: bad file descriptor",
-			"set up params stream pipe2: bad file descriptor",
 			syscall.EBADF, os.ErrInvalid,
 			"cannot set up params stream pipe2: bad file descriptor"},
 
@@ -62,16 +60,14 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "prctl(PR_SET_NO_NEW_PRIVS)",
 			Err:   syscall.EPERM,
-		},
+		}, "prctl(PR_SET_NO_NEW_PRIVS): operation not permitted",
-			"prctl(PR_SET_NO_NEW_PRIVS): operation not permitted",
 			syscall.EPERM, syscall.EACCES,
 			"cannot prctl(PR_SET_NO_NEW_PRIVS): operation not permitted"},
 
 		{"landlock abi", &container.StartError{
 			Step: "get landlock ABI",
 			Err:  syscall.ENOSYS,
-		},
+		}, "get landlock ABI: function not implemented",
-			"get landlock ABI: function not implemented",
 			syscall.ENOSYS, syscall.ENOEXEC,
 			"cannot get landlock ABI: function not implemented"},
 
@@ -79,8 +75,7 @@ func TestStartError(t *testing.T) {
 			Step:   "kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
 			Err:    syscall.ENOSYS,
 			Origin: true,
-		},
+		}, "kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
-			"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
 			syscall.ENOSYS, syscall.ENOSPC,
 			"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET"},
 
@@ -88,8 +83,7 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "create landlock ruleset",
 			Err:   syscall.EBADFD,
-		},
+		}, "create landlock ruleset: file descriptor in bad state",
-			"create landlock ruleset: file descriptor in bad state",
 			syscall.EBADFD, syscall.EBADF,
 			"cannot create landlock ruleset: file descriptor in bad state"},
 
@@ -97,8 +91,7 @@ func TestStartError(t *testing.T) {
 			Fatal: true,
 			Step:  "enforce landlock ruleset",
 			Err:   syscall.ENOTRECOVERABLE,
-		},
+		}, "enforce landlock ruleset: state not recoverable",
-			"enforce landlock ruleset: state not recoverable",
 			syscall.ENOTRECOVERABLE, syscall.ETIMEDOUT,
 			"cannot enforce landlock ruleset: state not recoverable"},
 
@@ -109,8 +102,7 @@ func TestStartError(t *testing.T) {
 				Path: "/proc/nonexistent",
 				Err:  syscall.ENOENT,
 			}, Passthrough: true,
-		},
+		}, "fork/exec /proc/nonexistent: no such file or directory",
-			"fork/exec /proc/nonexistent: no such file or directory",
 			syscall.ENOENT, syscall.ENOSYS,
 			"cannot fork/exec /proc/nonexistent: no such file or directory"},
 
@@ -120,11 +112,19 @@ func TestStartError(t *testing.T) {
 				Syscall: "open",
 				Err:     syscall.ENOSYS,
 			}, Passthrough: true,
-		},
+		}, "open: function not implemented",
-			"open: function not implemented",
 			syscall.ENOSYS, syscall.ENOENT,
 			"cannot open: function not implemented"},
 
+		{"start FD_CLOEXEC", &container.StartError{
+			Fatal:       true,
+			Step:        "set FD_CLOEXEC on all open files",
+			Err:         func() error { _, err := strconv.Atoi("invalid"); return err }(),
+			Passthrough: true,
+		}, `strconv.Atoi: parsing "invalid": invalid syntax`,
+			strconv.ErrSyntax, os.ErrInvalid,
+			`cannot parse "invalid": invalid syntax`},
+
 		{"start other", &container.StartError{
 			Step: "start container init",
 			Err: &net.OpError{
@@ -132,8 +132,7 @@ func TestStartError(t *testing.T) {
 				Net: "unix",
 				Err: syscall.ECONNREFUSED,
 			}, Passthrough: true,
-		},
+		}, "dial unix: connection refused",
-			"dial unix: connection refused",
 			syscall.ECONNREFUSED, syscall.ECONNABORTED,
 			"dial unix: connection refused"},
 	}
@@ -722,6 +721,7 @@ func TestMain(m *testing.M) {
 
 func helperNewContainerLibPaths(ctx context.Context, libPaths *[]*check.Absolute, args ...string) (c *container.Container) {
 	msg := message.New(nil)
+	msg.SwapVerbose(testing.Verbose())
 	c = container.NewCommand(ctx, msg, absHelperInnerPath, "helper", args...)
 	c.Env = append(c.Env, envDoCheck+"=1")
 	c.Bind(check.MustAbs(os.Args[0]), absHelperInnerPath, 0)

container/fhs/abs.go

@@ -1,7 +1,7 @@
 package fhs
 
 import (
-	_ "unsafe"
+	_ "unsafe" // for go:linkname
 
 	"hakurei.app/container/check"
 )

container/init.go

@@ -330,6 +330,10 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 	}
 	k.umask(oldmask)
 
+	if err := closeSetup(); err != nil {
+		k.fatalf(msg, "cannot close setup pipe: %v", err)
+	}
+
 	cmd := exec.Command(params.Path.String())
 	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 	cmd.Args = params.Args
@@ -342,11 +346,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 		k.fatalf(msg, "%v", err)
 	}
 
-	if err := closeSetup(); err != nil {
-		k.printf(msg, "cannot close setup pipe: %v", err)
-		// not fatal
-	}
-
 	type winfo struct {
 		wpid    int
 		wstatus WaitStatus
@@ -427,6 +426,16 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 			}
 
 			if w.wpid == cmd.Process.Pid {
+				// start timeout early
+				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
+
+				// close initial process files; this also keeps them alive
+				for _, f := range extraFiles {
+					if err := f.Close(); err != nil {
+						msg.Verbose(err.Error())
+					}
+				}
+
 				switch {
 				case w.wstatus.Exited():
 					r = w.wstatus.ExitStatus()
@@ -440,8 +449,6 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) {
 					r = 255
 					msg.Verbosef("initial process exited with status %#x", w.wstatus)
 				}
-
-				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
 			}
 
 		case <-timeout:

container/init_test.go

@@ -1983,6 +1983,7 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(13)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, nil, stub.UniqueError(12)),
 				call("fatalf", stub.ExpectArgs{"%v", []any{stub.UniqueError(12)}}, nil, nil),
@@ -2061,15 +2062,17 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(10)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, &os.Process{Pid: 0xbad}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(10)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{func(c chan<- os.Signal) { c <- CancelSignal }, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
 				call("verbose", stub.ExpectArgs{[]any{"forwarding context cancellation"}}, nil, nil),
 				// magicWait4Signal as ret causes wait4 stub to unblock
 				call("signal", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent", os.Interrupt}, magicWait4Signal, stub.UniqueError(9)),
 				call("printf", stub.ExpectArgs{"cannot forward cancellation: %v", []any{stub.UniqueError(9)}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"initial process exited with signal %s", []any{syscall.Signal(0x4e)}}, nil, nil),
 				call("printf", stub.ExpectArgs{"timeout exceeded waiting for lingering processes", ([]any)(nil)}, nil, nil),
 				call("beforeExit", stub.ExpectArgs{}, nil, nil),
@@ -2159,15 +2162,17 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(7)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, &os.Process{Pid: 0xbad}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(7)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{func(c chan<- os.Signal) { c <- syscall.SIGQUIT }, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"got %s, forwarding to initial process", []any{"quit"}}, nil, nil),
 				// magicWait4Signal as ret causes wait4 stub to unblock
 				call("signal", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent", syscall.SIGQUIT}, magicWait4Signal, stub.UniqueError(0xfe)),
 				call("printf", stub.ExpectArgs{"cannot forward signal: %v", []any{stub.UniqueError(0xfe)}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"initial process exited with signal %s", []any{syscall.Signal(0x4e)}}, nil, nil),
 				call("printf", stub.ExpectArgs{"timeout exceeded waiting for lingering processes", []any(nil)}, nil, nil),
 				call("beforeExit", stub.ExpectArgs{}, nil, nil),
@@ -2257,9 +2262,9 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(7)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, &os.Process{Pid: 0xbad}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(7)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{func(c chan<- os.Signal) { c <- os.Interrupt }, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"got %s", []any{"interrupt"}}, nil, nil),
@@ -2348,11 +2353,13 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(5)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, &os.Process{Pid: 0xbad}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(5)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{nil, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"initial process exited with signal %s", []any{syscall.Signal(0x4e)}}, nil, nil),
 				call("printf", stub.ExpectArgs{"timeout exceeded waiting for lingering processes", ([]any)(nil)}, nil, nil),
 				call("beforeExit", stub.ExpectArgs{}, nil, nil),
@@ -2441,11 +2448,13 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(3)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, &os.Process{Pid: 0xbad}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(3)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{nil, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"initial process exited with signal %s", []any{syscall.Signal(0x4e)}}, nil, nil),
 				call("beforeExit", stub.ExpectArgs{}, nil, nil),
 				call("exit", stub.ExpectArgs{0xce}, nil, nil),
@@ -2577,11 +2586,13 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(0x3a), "extra file 0"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(0x3b), "extra file 1"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(1)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/run/current-system/sw/bin/bash")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/run/current-system/sw/bin/bash", []string{"bash", "-c", "false"}, ([]string)(nil), "/.hakurei/nonexistent"}, &os.Process{Pid: 0xbad}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(1)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{nil, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"initial process exited with code %d", []any{1}}, nil, nil),
 				call("beforeExit", stub.ExpectArgs{}, nil, nil),
 				call("exit", stub.ExpectArgs{1}, nil, nil),
@@ -2717,11 +2728,14 @@ func TestInitEntrypoint(t *testing.T) {
 				call("newFile", stub.ExpectArgs{uintptr(11), "extra file 1"}, (*os.File)(nil), nil),
 				call("newFile", stub.ExpectArgs{uintptr(12), "extra file 2"}, (*os.File)(nil), nil),
 				call("umask", stub.ExpectArgs{022}, 0, nil),
+				call("fatalf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(0)}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"starting initial program %s", []any{check.MustAbs("/bin/zsh")}}, nil, nil),
 				call("start", stub.ExpectArgs{"/bin/zsh", []string{"zsh", "-c", "exec vim"}, []string{"DISPLAY=:0"}, "/.hakurei"}, &os.Process{Pid: 0xcafe}, nil),
-				call("printf", stub.ExpectArgs{"cannot close setup pipe: %v", []any{stub.UniqueError(0)}}, nil, nil),
 				call("New", stub.ExpectArgs{}, nil, nil),
 				call("notify", stub.ExpectArgs{nil, []os.Signal{CancelSignal, os.Interrupt, syscall.SIGTERM, syscall.SIGQUIT}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{os.ErrInvalid.Error()}}, nil, nil),
 				call("verbosef", stub.ExpectArgs{"initial process exited with status %#x", []any{syscall.WaitStatus(0xfade007f)}}, nil, nil),
 				call("beforeExit", stub.ExpectArgs{}, nil, nil),
 				call("exit", stub.ExpectArgs{0xff}, nil, nil),

container/seccomp/libseccomp.go

@@ -215,10 +215,10 @@ const (
 
 // syscallResolveName resolves a syscall number by name via seccomp_syscall_resolve_name.
 // This function is only for testing the lookup tables and included here for convenience.
-func syscallResolveName(s string) (trap int, ok bool) {
+func syscallResolveName(s string) (num std.ScmpSyscall, ok bool) {
 	v := C.CString(s)
-	trap = int(C.seccomp_syscall_resolve_name(v))
+	num = std.ScmpSyscall(C.seccomp_syscall_resolve_name(v))
 	C.free(unsafe.Pointer(v))
-	ok = trap != C.__NR_SCMP_ERROR
+	ok = num != C.__NR_SCMP_ERROR
 	return
 }

container/seccomp/presets.go

@@ -68,121 +68,121 @@ func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) {
 var (
 	presetCommon = []NativeRule{
 		/* Block dmesg */
-		{ScmpSyscall(SYS_SYSLOG), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SYSLOG, Errno: ScmpErrno(EPERM), Arg: nil},
 		/* Useless old syscall */
-		{ScmpSyscall(SYS_USELIB), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_USELIB, Errno: ScmpErrno(EPERM), Arg: nil},
 		/* Don't allow disabling accounting */
-		{ScmpSyscall(SYS_ACCT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_ACCT, Errno: ScmpErrno(EPERM), Arg: nil},
 		/* Don't allow reading current quota use */
-		{ScmpSyscall(SYS_QUOTACTL), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_QUOTACTL, Errno: ScmpErrno(EPERM), Arg: nil},
 
 		/* Don't allow access to the kernel keyring */
-		{ScmpSyscall(SYS_ADD_KEY), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_ADD_KEY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_KEYCTL), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_KEYCTL, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_REQUEST_KEY), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_REQUEST_KEY, Errno: ScmpErrno(EPERM), Arg: nil},
 
 		/* Scary VM/NUMA ops */
-		{ScmpSyscall(SYS_MOVE_PAGES), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_MOVE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_MBIND), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_MBIND, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_GET_MEMPOLICY), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_GET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SET_MEMPOLICY), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_MIGRATE_PAGES), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_MIGRATE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetCommonExt = []NativeRule{
 		/* system calls for changing the system clock */
-		{ScmpSyscall(SYS_ADJTIMEX), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_ADJTIMEX, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CLOCK_ADJTIME), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CLOCK_ADJTIME, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CLOCK_ADJTIME64), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CLOCK_ADJTIME64, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CLOCK_SETTIME), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CLOCK_SETTIME, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CLOCK_SETTIME64), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CLOCK_SETTIME64, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETTIMEOFDAY), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETTIMEOFDAY, Errno: ScmpErrno(EPERM), Arg: nil},
 
 		/* loading and unloading of kernel modules */
-		{ScmpSyscall(SYS_DELETE_MODULE), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_DELETE_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_FINIT_MODULE), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_FINIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_INIT_MODULE), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_INIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil},
 
 		/* system calls for rebooting and reboot preparation */
-		{ScmpSyscall(SYS_KEXEC_FILE_LOAD), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_KEXEC_FILE_LOAD, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_KEXEC_LOAD), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_KEXEC_LOAD, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_REBOOT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_REBOOT, Errno: ScmpErrno(EPERM), Arg: nil},
 
 		/* system calls for enabling/disabling swap devices */
-		{ScmpSyscall(SYS_SWAPOFF), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SWAPOFF, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SWAPON), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SWAPON, Errno: ScmpErrno(EPERM), Arg: nil},
 	}
 
 	presetNamespace = []NativeRule{
 		/* Don't allow subnamespace setups: */
-		{ScmpSyscall(SYS_UNSHARE), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_UNSHARE, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETNS), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETNS, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_MOUNT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_MOUNT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_UMOUNT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_UMOUNT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_UMOUNT2), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_UMOUNT2, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_PIVOT_ROOT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_PIVOT_ROOT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CHROOT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CHROOT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CLONE), ScmpErrno(EPERM),
+		{Syscall: SNR_CLONE, Errno: ScmpErrno(EPERM),
-			&ScmpArgCmp{cloneArg, SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER}},
+			Arg: &ScmpArgCmp{Arg: cloneArg, Op: SCMP_CMP_MASKED_EQ, DatumA: CLONE_NEWUSER, DatumB: CLONE_NEWUSER}},
 
 		/* seccomp can't look into clone3()'s struct clone_args to check whether
 		 * the flags are OK, so we have no choice but to block clone3().
 		 * Return ENOSYS so user-space will fall back to clone().
 		 * (CVE-2021-41133; see also https://github.com/moby/moby/commit/9f6b562d)
 		 */
-		{ScmpSyscall(SYS_CLONE3), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_CLONE3, Errno: ScmpErrno(ENOSYS), Arg: nil},
 
 		/* New mount manipulation APIs can also change our VFS. There's no
 		 * legitimate reason to do these in the sandbox, so block all of them
 		 * rather than thinking about which ones might be dangerous.
 		 * (CVE-2021-41133) */
-		{ScmpSyscall(SYS_OPEN_TREE), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_OPEN_TREE, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_MOVE_MOUNT), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_MOVE_MOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_FSOPEN), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_FSOPEN, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_FSCONFIG), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_FSCONFIG, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_FSMOUNT), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_FSMOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_FSPICK), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_FSPICK, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_MOUNT_SETATTR), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_MOUNT_SETATTR, Errno: ScmpErrno(ENOSYS), Arg: nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetNamespaceExt = []NativeRule{
 		/* changing file ownership */
-		{ScmpSyscall(SYS_CHOWN), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_CHOWN32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_CHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_FCHOWN), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_FCHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_FCHOWN32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_FCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_FCHOWNAT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_FCHOWNAT, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_LCHOWN), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_LCHOWN, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_LCHOWN32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_LCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil},
 
 		/* system calls for changing user ID and group ID credentials */
-		{ScmpSyscall(SYS_SETGID), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETGID32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETGROUPS), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETGROUPS, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETGROUPS32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETGROUPS32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETREGID), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETREGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETREGID32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETREGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETRESGID), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETRESGID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETRESGID32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETRESGID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETRESUID), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETRESUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETRESUID32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETRESUID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETREUID), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETREUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETREUID32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETREUID32, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETUID), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETUID, Errno: ScmpErrno(EPERM), Arg: nil},
-		{ScmpSyscall(SYS_SETUID32), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_SETUID32, Errno: ScmpErrno(EPERM), Arg: nil},
 	}
 
 	presetTTY = []NativeRule{
 		/* Don't allow faking input to the controlling tty (CVE-2017-5226) */
-		{ScmpSyscall(SYS_IOCTL), ScmpErrno(EPERM),
+		{Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM),
-			&ScmpArgCmp{1, SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, TIOCSTI}},
+			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCSTI}},
 		/* In the unlikely event that the controlling tty is a Linux virtual
 		 * console (/dev/tty2 or similar), copy/paste operations have an effect
 		 * similar to TIOCSTI (CVE-2023-28100) */
-		{ScmpSyscall(SYS_IOCTL), ScmpErrno(EPERM),
+		{Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM),
-			&ScmpArgCmp{1, SCMP_CMP_MASKED_EQ, 0xFFFFFFFF, TIOCLINUX}},
+			Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCLINUX}},
 	}
 
 	presetEmu = []NativeRule{
@@ -190,15 +190,15 @@ var (
 		 * so it's disabled as a hardening measure.
 		 * However, it is required to run old 16-bit applications
 		 * as well as some Wine patches, so it's allowed in multiarch. */
-		{ScmpSyscall(SYS_MODIFY_LDT), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_MODIFY_LDT, Errno: ScmpErrno(EPERM), Arg: nil},
 	}
 
 	/* hakurei: project-specific extensions */
 	presetEmuExt = []NativeRule{
-		{ScmpSyscall(SYS_SUBPAGE_PROT), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_SUBPAGE_PROT, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_SWITCH_ENDIAN), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_SWITCH_ENDIAN, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_VM86), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_VM86, Errno: ScmpErrno(ENOSYS), Arg: nil},
-		{ScmpSyscall(SYS_VM86OLD), ScmpErrno(ENOSYS), nil},
+		{Syscall: SNR_VM86OLD, Errno: ScmpErrno(ENOSYS), Arg: nil},
 	}
 )
 
@@ -206,11 +206,11 @@ func presetDevel(allowedPersonality ScmpDatum) []NativeRule {
 	return []NativeRule{
 		/* Profiling operations; we expect these to be done by tools from outside
 		 * the sandbox.  In particular perf has been the source of many CVEs. */
-		{ScmpSyscall(SYS_PERF_EVENT_OPEN), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_PERF_EVENT_OPEN, Errno: ScmpErrno(EPERM), Arg: nil},
 		/* Don't allow you to switch to bsd emulation or whatnot */
-		{ScmpSyscall(SYS_PERSONALITY), ScmpErrno(EPERM),
+		{Syscall: SNR_PERSONALITY, Errno: ScmpErrno(EPERM),
-			&ScmpArgCmp{0, SCMP_CMP_NE, allowedPersonality, 0}},
+			Arg: &ScmpArgCmp{Arg: 0, Op: SCMP_CMP_NE, DatumA: allowedPersonality}},
 
-		{ScmpSyscall(SYS_PTRACE), ScmpErrno(EPERM), nil},
+		{Syscall: SNR_PTRACE, Errno: ScmpErrno(EPERM), Arg: nil},
 	}
 }

container/std/mksysnum_linux.pl

@@ -22,7 +22,7 @@ package std
 
 import . "syscall"
 
-var syscallNum = map[string]int{
+var syscallNum = map[string]ScmpSyscall{
 EOF
 
 my $offset = 0;
@@ -37,16 +37,14 @@ sub fmt {
 	}
 	(my $name_upper = $name) =~ y/a-z/A-Z/;
 	$num = $num + $offset;
-	if($num > $syscall_cutoff_arch{$uname_arch}){ # not wired in Go standard library
+	if($num > $syscall_cutoff_arch{$uname_arch} && $state == 0){ # not wired in Go standard library
-		if($state < 0){
+		print " SYS_$name_upper = $num\n";
-			print "	\"$name\": SYS_$name_upper,\n";
-		}
-		else{
-			print " SYS_$name_upper = $num;\n";
-		}
 	}
-	elsif($state < 0){
+	elsif($state == -1){
-		print "	\"$name\": SYS_$name_upper,\n";
+		print "	\"$name\": SNR_$name_upper,\n";
+	}
+	elsif($state == 1){
+		print " SNR_$name_upper ScmpSyscall = SYS_$name_upper\n";
 	}
 	else{
 		return;
@@ -81,10 +79,16 @@ while(<GCC>){
 	}
 }
 
-if($state < 0){
+if($state == -1){
-	$state = $state + 1;
 	print "}\n\nconst (\n";
-	goto GENERATE;
 }
+elsif($state == 0){
+	print ")\n\nconst (\n";
+}
+elsif($state == 1){
+	print ")";
+	exit;
+}
+++$state;
+goto GENERATE;
 
-print ")";

container/std/seccomp.go

@@ -46,7 +46,7 @@ type (
 // MarshalJSON resolves the name of [ScmpSyscall] and encodes it as a [json] string.
 // If such a name does not exist, the syscall number is encoded instead.
 func (num *ScmpSyscall) MarshalJSON() ([]byte, error) {
-	n := int(*num)
+	n := *num
 	for name, cur := range Syscalls() {
 		if cur == n {
 			return json.Marshal(name)
@@ -70,7 +70,7 @@ func (num *ScmpSyscall) UnmarshalJSON(data []byte) error {
 	if n, ok := SyscallResolveName(name); !ok {
 		return SyscallNameError(name)
 	} else {
-		*num = ScmpSyscall(n)
+		*num = n
 		return nil
 	}
 }

container/std/seccomp_test.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"math"
 	"reflect"
-	"syscall"
 	"testing"
 
 	"hakurei.app/container/std"
@@ -20,8 +19,8 @@ func TestScmpSyscall(t *testing.T) {
 		want std.ScmpSyscall
 		err  error
 	}{
-		{"select", `"select"`, syscall.SYS_SELECT, nil},
+		{"epoll_create1", `"epoll_create1"`, std.SNR_EPOLL_CREATE1, nil},
-		{"clone3", `"clone3"`, std.SYS_CLONE3, nil},
+		{"clone3", `"clone3"`, std.SNR_CLONE3, nil},
 
 		{"oob", `-2147483647`, -math.MaxInt32,
 			&json.UnmarshalTypeError{Value: "number", Type: reflect.TypeFor[string](), Offset: 11}},

container/std/syscall.go

@@ -3,8 +3,8 @@ package std
 import "iter"
 
 // Syscalls returns an iterator over all wired syscalls.
-func Syscalls() iter.Seq2[string, int] {
+func Syscalls() iter.Seq2[string, ScmpSyscall] {
-	return func(yield func(string, int) bool) {
+	return func(yield func(string, ScmpSyscall) bool) {
 		for name, num := range syscallNum {
 			if !yield(name, num) {
 				return
@@ -19,7 +19,7 @@ func Syscalls() iter.Seq2[string, int] {
 }
 
 // SyscallResolveName resolves a syscall number from its string representation.
-func SyscallResolveName(name string) (num int, ok bool) {
+func SyscallResolveName(name string) (num ScmpSyscall, ok bool) {
 	if num, ok = syscallNum[name]; ok {
 		return
 	}

container/std/syscall_extra_linux_386.go

@@ -1,13 +1,13 @@
 package std
 
-var syscallNumExtra = map[string]int{
+var syscallNumExtra = map[string]ScmpSyscall{
-	"kexec_file_load": SYS_KEXEC_FILE_LOAD,
+	"kexec_file_load": SNR_KEXEC_FILE_LOAD,
-	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"switch_endian":   SNR_SWITCH_ENDIAN,
 }
 
 const (
-	SYS_KEXEC_FILE_LOAD = __PNR_kexec_file_load
+	SNR_KEXEC_FILE_LOAD ScmpSyscall = __PNR_kexec_file_load
-	SYS_SUBPAGE_PROT    = __PNR_subpage_prot
+	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SYS_SWITCH_ENDIAN   = __PNR_switch_endian
+	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
 )

container/std/syscall_extra_linux_amd64.go

@@ -1,41 +1,41 @@
 package std
 
-var syscallNumExtra = map[string]int{
+var syscallNumExtra = map[string]ScmpSyscall{
-	"umount":          SYS_UMOUNT,
+	"umount":          SNR_UMOUNT,
-	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"switch_endian":   SNR_SWITCH_ENDIAN,
-	"vm86":            SYS_VM86,
+	"vm86":            SNR_VM86,
-	"vm86old":         SYS_VM86OLD,
+	"vm86old":         SNR_VM86OLD,
-	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
+	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
-	"clock_settime64": SYS_CLOCK_SETTIME64,
+	"clock_settime64": SNR_CLOCK_SETTIME64,
-	"chown32":         SYS_CHOWN32,
+	"chown32":         SNR_CHOWN32,
-	"fchown32":        SYS_FCHOWN32,
+	"fchown32":        SNR_FCHOWN32,
-	"lchown32":        SYS_LCHOWN32,
+	"lchown32":        SNR_LCHOWN32,
-	"setgid32":        SYS_SETGID32,
+	"setgid32":        SNR_SETGID32,
-	"setgroups32":     SYS_SETGROUPS32,
+	"setgroups32":     SNR_SETGROUPS32,
-	"setregid32":      SYS_SETREGID32,
+	"setregid32":      SNR_SETREGID32,
-	"setresgid32":     SYS_SETRESGID32,
+	"setresgid32":     SNR_SETRESGID32,
-	"setresuid32":     SYS_SETRESUID32,
+	"setresuid32":     SNR_SETRESUID32,
-	"setreuid32":      SYS_SETREUID32,
+	"setreuid32":      SNR_SETREUID32,
-	"setuid32":        SYS_SETUID32,
+	"setuid32":        SNR_SETUID32,
 }
 
 const (
-	SYS_UMOUNT          = __PNR_umount
+	SNR_UMOUNT          ScmpSyscall = __PNR_umount
-	SYS_SUBPAGE_PROT    = __PNR_subpage_prot
+	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SYS_SWITCH_ENDIAN   = __PNR_switch_endian
+	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
-	SYS_VM86            = __PNR_vm86
+	SNR_VM86            ScmpSyscall = __PNR_vm86
-	SYS_VM86OLD         = __PNR_vm86old
+	SNR_VM86OLD         ScmpSyscall = __PNR_vm86old
-	SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64
+	SNR_CLOCK_ADJTIME64 ScmpSyscall = __PNR_clock_adjtime64
-	SYS_CLOCK_SETTIME64 = __PNR_clock_settime64
+	SNR_CLOCK_SETTIME64 ScmpSyscall = __PNR_clock_settime64
-	SYS_CHOWN32         = __PNR_chown32
+	SNR_CHOWN32         ScmpSyscall = __PNR_chown32
-	SYS_FCHOWN32        = __PNR_fchown32
+	SNR_FCHOWN32        ScmpSyscall = __PNR_fchown32
-	SYS_LCHOWN32        = __PNR_lchown32
+	SNR_LCHOWN32        ScmpSyscall = __PNR_lchown32
-	SYS_SETGID32        = __PNR_setgid32
+	SNR_SETGID32        ScmpSyscall = __PNR_setgid32
-	SYS_SETGROUPS32     = __PNR_setgroups32
+	SNR_SETGROUPS32     ScmpSyscall = __PNR_setgroups32
-	SYS_SETREGID32      = __PNR_setregid32
+	SNR_SETREGID32      ScmpSyscall = __PNR_setregid32
-	SYS_SETRESGID32     = __PNR_setresgid32
+	SNR_SETRESGID32     ScmpSyscall = __PNR_setresgid32
-	SYS_SETRESUID32     = __PNR_setresuid32
+	SNR_SETRESUID32     ScmpSyscall = __PNR_setresuid32
-	SYS_SETREUID32      = __PNR_setreuid32
+	SNR_SETREUID32      ScmpSyscall = __PNR_setreuid32
-	SYS_SETUID32        = __PNR_setuid32
+	SNR_SETUID32        ScmpSyscall = __PNR_setuid32
 )

container/std/syscall_extra_linux_arm64.go

@@ -6,50 +6,50 @@ const (
 	SYS_NEWFSTATAT = syscall.SYS_FSTATAT
 )
 
-var syscallNumExtra = map[string]int{
+var syscallNumExtra = map[string]ScmpSyscall{
-	"uselib":          SYS_USELIB,
+	"uselib":          SNR_USELIB,
-	"clock_adjtime64": SYS_CLOCK_ADJTIME64,
+	"clock_adjtime64": SNR_CLOCK_ADJTIME64,
-	"clock_settime64": SYS_CLOCK_SETTIME64,
+	"clock_settime64": SNR_CLOCK_SETTIME64,
-	"umount":          SYS_UMOUNT,
+	"umount":          SNR_UMOUNT,
-	"chown":           SYS_CHOWN,
+	"chown":           SNR_CHOWN,
-	"chown32":         SYS_CHOWN32,
+	"chown32":         SNR_CHOWN32,
-	"fchown32":        SYS_FCHOWN32,
+	"fchown32":        SNR_FCHOWN32,
-	"lchown":          SYS_LCHOWN,
+	"lchown":          SNR_LCHOWN,
-	"lchown32":        SYS_LCHOWN32,
+	"lchown32":        SNR_LCHOWN32,
-	"setgid32":        SYS_SETGID32,
+	"setgid32":        SNR_SETGID32,
-	"setgroups32":     SYS_SETGROUPS32,
+	"setgroups32":     SNR_SETGROUPS32,
-	"setregid32":      SYS_SETREGID32,
+	"setregid32":      SNR_SETREGID32,
-	"setresgid32":     SYS_SETRESGID32,
+	"setresgid32":     SNR_SETRESGID32,
-	"setresuid32":     SYS_SETRESUID32,
+	"setresuid32":     SNR_SETRESUID32,
-	"setreuid32":      SYS_SETREUID32,
+	"setreuid32":      SNR_SETREUID32,
-	"setuid32":        SYS_SETUID32,
+	"setuid32":        SNR_SETUID32,
-	"modify_ldt":      SYS_MODIFY_LDT,
+	"modify_ldt":      SNR_MODIFY_LDT,
-	"subpage_prot":    SYS_SUBPAGE_PROT,
+	"subpage_prot":    SNR_SUBPAGE_PROT,
-	"switch_endian":   SYS_SWITCH_ENDIAN,
+	"switch_endian":   SNR_SWITCH_ENDIAN,
-	"vm86":            SYS_VM86,
+	"vm86":            SNR_VM86,
-	"vm86old":         SYS_VM86OLD,
+	"vm86old":         SNR_VM86OLD,
 }
 
 const (
-	SYS_USELIB          = __PNR_uselib
+	SNR_USELIB          ScmpSyscall = __PNR_uselib
-	SYS_CLOCK_ADJTIME64 = __PNR_clock_adjtime64
+	SNR_CLOCK_ADJTIME64 ScmpSyscall = __PNR_clock_adjtime64
-	SYS_CLOCK_SETTIME64 = __PNR_clock_settime64
+	SNR_CLOCK_SETTIME64 ScmpSyscall = __PNR_clock_settime64
-	SYS_UMOUNT          = __PNR_umount
+	SNR_UMOUNT          ScmpSyscall = __PNR_umount
-	SYS_CHOWN           = __PNR_chown
+	SNR_CHOWN           ScmpSyscall = __PNR_chown
-	SYS_CHOWN32         = __PNR_chown32
+	SNR_CHOWN32         ScmpSyscall = __PNR_chown32
-	SYS_FCHOWN32        = __PNR_fchown32
+	SNR_FCHOWN32        ScmpSyscall = __PNR_fchown32
-	SYS_LCHOWN          = __PNR_lchown
+	SNR_LCHOWN          ScmpSyscall = __PNR_lchown
-	SYS_LCHOWN32        = __PNR_lchown32
+	SNR_LCHOWN32        ScmpSyscall = __PNR_lchown32
-	SYS_SETGID32        = __PNR_setgid32
+	SNR_SETGID32        ScmpSyscall = __PNR_setgid32
-	SYS_SETGROUPS32     = __PNR_setgroups32
+	SNR_SETGROUPS32     ScmpSyscall = __PNR_setgroups32
-	SYS_SETREGID32      = __PNR_setregid32
+	SNR_SETREGID32      ScmpSyscall = __PNR_setregid32
-	SYS_SETRESGID32     = __PNR_setresgid32
+	SNR_SETRESGID32     ScmpSyscall = __PNR_setresgid32
-	SYS_SETRESUID32     = __PNR_setresuid32
+	SNR_SETRESUID32     ScmpSyscall = __PNR_setresuid32
-	SYS_SETREUID32      = __PNR_setreuid32
+	SNR_SETREUID32      ScmpSyscall = __PNR_setreuid32
-	SYS_SETUID32        = __PNR_setuid32
+	SNR_SETUID32        ScmpSyscall = __PNR_setuid32
-	SYS_MODIFY_LDT      = __PNR_modify_ldt
+	SNR_MODIFY_LDT      ScmpSyscall = __PNR_modify_ldt
-	SYS_SUBPAGE_PROT    = __PNR_subpage_prot
+	SNR_SUBPAGE_PROT    ScmpSyscall = __PNR_subpage_prot
-	SYS_SWITCH_ENDIAN   = __PNR_switch_endian
+	SNR_SWITCH_ENDIAN   ScmpSyscall = __PNR_switch_endian
-	SYS_VM86            = __PNR_vm86
+	SNR_VM86            ScmpSyscall = __PNR_vm86
-	SYS_VM86OLD         = __PNR_vm86old
+	SNR_VM86OLD         ScmpSyscall = __PNR_vm86old
 )

container/std/syscall_linux_arm64.go

@@ -5,325 +5,325 @@ package std
 
 import . "syscall"
 
-var syscallNum = map[string]int{
+var syscallNum = map[string]ScmpSyscall{
-	"io_setup":                SYS_IO_SETUP,
+	"io_setup":                SNR_IO_SETUP,
-	"io_destroy":              SYS_IO_DESTROY,
+	"io_destroy":              SNR_IO_DESTROY,
-	"io_submit":               SYS_IO_SUBMIT,
+	"io_submit":               SNR_IO_SUBMIT,
-	"io_cancel":               SYS_IO_CANCEL,
+	"io_cancel":               SNR_IO_CANCEL,
-	"io_getevents":            SYS_IO_GETEVENTS,
+	"io_getevents":            SNR_IO_GETEVENTS,
-	"setxattr":                SYS_SETXATTR,
+	"setxattr":                SNR_SETXATTR,
-	"lsetxattr":               SYS_LSETXATTR,
+	"lsetxattr":               SNR_LSETXATTR,
-	"fsetxattr":               SYS_FSETXATTR,
+	"fsetxattr":               SNR_FSETXATTR,
-	"getxattr":                SYS_GETXATTR,
+	"getxattr":                SNR_GETXATTR,
-	"lgetxattr":               SYS_LGETXATTR,
+	"lgetxattr":               SNR_LGETXATTR,
-	"fgetxattr":               SYS_FGETXATTR,
+	"fgetxattr":               SNR_FGETXATTR,
-	"listxattr":               SYS_LISTXATTR,
+	"listxattr":               SNR_LISTXATTR,
-	"llistxattr":              SYS_LLISTXATTR,
+	"llistxattr":              SNR_LLISTXATTR,
-	"flistxattr":              SYS_FLISTXATTR,
+	"flistxattr":              SNR_FLISTXATTR,
-	"removexattr":             SYS_REMOVEXATTR,
+	"removexattr":             SNR_REMOVEXATTR,
-	"lremovexattr":            SYS_LREMOVEXATTR,
+	"lremovexattr":            SNR_LREMOVEXATTR,
-	"fremovexattr":            SYS_FREMOVEXATTR,
+	"fremovexattr":            SNR_FREMOVEXATTR,
-	"getcwd":                  SYS_GETCWD,
+	"getcwd":                  SNR_GETCWD,
-	"lookup_dcookie":          SYS_LOOKUP_DCOOKIE,
+	"lookup_dcookie":          SNR_LOOKUP_DCOOKIE,
-	"eventfd2":                SYS_EVENTFD2,
+	"eventfd2":                SNR_EVENTFD2,
-	"epoll_create1":           SYS_EPOLL_CREATE1,
+	"epoll_create1":           SNR_EPOLL_CREATE1,
-	"epoll_ctl":               SYS_EPOLL_CTL,
+	"epoll_ctl":               SNR_EPOLL_CTL,
-	"epoll_pwait":             SYS_EPOLL_PWAIT,
+	"epoll_pwait":             SNR_EPOLL_PWAIT,
-	"dup":                     SYS_DUP,
+	"dup":                     SNR_DUP,
-	"dup3":                    SYS_DUP3,
+	"dup3":                    SNR_DUP3,
-	"fcntl":                   SYS_FCNTL,
+	"fcntl":                   SNR_FCNTL,
-	"inotify_init1":           SYS_INOTIFY_INIT1,
+	"inotify_init1":           SNR_INOTIFY_INIT1,
-	"inotify_add_watch":       SYS_INOTIFY_ADD_WATCH,
+	"inotify_add_watch":       SNR_INOTIFY_ADD_WATCH,
-	"inotify_rm_watch":        SYS_INOTIFY_RM_WATCH,
+	"inotify_rm_watch":        SNR_INOTIFY_RM_WATCH,
-	"ioctl":                   SYS_IOCTL,
+	"ioctl":                   SNR_IOCTL,
-	"ioprio_set":              SYS_IOPRIO_SET,
+	"ioprio_set":              SNR_IOPRIO_SET,
-	"ioprio_get":              SYS_IOPRIO_GET,
+	"ioprio_get":              SNR_IOPRIO_GET,
-	"flock":                   SYS_FLOCK,
+	"flock":                   SNR_FLOCK,
-	"mknodat":                 SYS_MKNODAT,
+	"mknodat":                 SNR_MKNODAT,
-	"mkdirat":                 SYS_MKDIRAT,
+	"mkdirat":                 SNR_MKDIRAT,
-	"unlinkat":                SYS_UNLINKAT,
+	"unlinkat":                SNR_UNLINKAT,
-	"symlinkat":               SYS_SYMLINKAT,
+	"symlinkat":               SNR_SYMLINKAT,
-	"linkat":                  SYS_LINKAT,
+	"linkat":                  SNR_LINKAT,
-	"renameat":                SYS_RENAMEAT,
+	"renameat":                SNR_RENAMEAT,
-	"umount2":                 SYS_UMOUNT2,
+	"umount2":                 SNR_UMOUNT2,
-	"mount":                   SYS_MOUNT,
+	"mount":                   SNR_MOUNT,
-	"pivot_root":              SYS_PIVOT_ROOT,
+	"pivot_root":              SNR_PIVOT_ROOT,
-	"nfsservctl":              SYS_NFSSERVCTL,
+	"nfsservctl":              SNR_NFSSERVCTL,
-	"statfs":                  SYS_STATFS,
+	"statfs":                  SNR_STATFS,
-	"fstatfs":                 SYS_FSTATFS,
+	"fstatfs":                 SNR_FSTATFS,
-	"truncate":                SYS_TRUNCATE,
+	"truncate":                SNR_TRUNCATE,
-	"ftruncate":               SYS_FTRUNCATE,
+	"ftruncate":               SNR_FTRUNCATE,
-	"fallocate":               SYS_FALLOCATE,
+	"fallocate":               SNR_FALLOCATE,
-	"faccessat":               SYS_FACCESSAT,
+	"faccessat":               SNR_FACCESSAT,
-	"chdir":                   SYS_CHDIR,
+	"chdir":                   SNR_CHDIR,
-	"fchdir":                  SYS_FCHDIR,
+	"fchdir":                  SNR_FCHDIR,
-	"chroot":                  SYS_CHROOT,
+	"chroot":                  SNR_CHROOT,
-	"fchmod":                  SYS_FCHMOD,
+	"fchmod":                  SNR_FCHMOD,
-	"fchmodat":                SYS_FCHMODAT,
+	"fchmodat":                SNR_FCHMODAT,
-	"fchownat":                SYS_FCHOWNAT,
+	"fchownat":                SNR_FCHOWNAT,
-	"fchown":                  SYS_FCHOWN,
+	"fchown":                  SNR_FCHOWN,
-	"openat":                  SYS_OPENAT,
+	"openat":                  SNR_OPENAT,
-	"close":                   SYS_CLOSE,
+	"close":                   SNR_CLOSE,
-	"vhangup":                 SYS_VHANGUP,
+	"vhangup":                 SNR_VHANGUP,
-	"pipe2":                   SYS_PIPE2,
+	"pipe2":                   SNR_PIPE2,
-	"quotactl":                SYS_QUOTACTL,
+	"quotactl":                SNR_QUOTACTL,
-	"getdents64":              SYS_GETDENTS64,
+	"getdents64":              SNR_GETDENTS64,
-	"lseek":                   SYS_LSEEK,
+	"lseek":                   SNR_LSEEK,
-	"read":                    SYS_READ,
+	"read":                    SNR_READ,
-	"write":                   SYS_WRITE,
+	"write":                   SNR_WRITE,
-	"readv":                   SYS_READV,
+	"readv":                   SNR_READV,
-	"writev":                  SYS_WRITEV,
+	"writev":                  SNR_WRITEV,
-	"pread64":                 SYS_PREAD64,
+	"pread64":                 SNR_PREAD64,
-	"pwrite64":                SYS_PWRITE64,
+	"pwrite64":                SNR_PWRITE64,
-	"preadv":                  SYS_PREADV,
+	"preadv":                  SNR_PREADV,
-	"pwritev":                 SYS_PWRITEV,
+	"pwritev":                 SNR_PWRITEV,
-	"sendfile":                SYS_SENDFILE,
+	"sendfile":                SNR_SENDFILE,
-	"pselect6":                SYS_PSELECT6,
+	"pselect6":                SNR_PSELECT6,
-	"ppoll":                   SYS_PPOLL,
+	"ppoll":                   SNR_PPOLL,
-	"signalfd4":               SYS_SIGNALFD4,
+	"signalfd4":               SNR_SIGNALFD4,
-	"vmsplice":                SYS_VMSPLICE,
+	"vmsplice":                SNR_VMSPLICE,
-	"splice":                  SYS_SPLICE,
+	"splice":                  SNR_SPLICE,
-	"tee":                     SYS_TEE,
+	"tee":                     SNR_TEE,
-	"readlinkat":              SYS_READLINKAT,
+	"readlinkat":              SNR_READLINKAT,
-	"newfstatat":              SYS_NEWFSTATAT,
+	"newfstatat":              SNR_NEWFSTATAT,
-	"fstat":                   SYS_FSTAT,
+	"fstat":                   SNR_FSTAT,
-	"sync":                    SYS_SYNC,
+	"sync":                    SNR_SYNC,
-	"fsync":                   SYS_FSYNC,
+	"fsync":                   SNR_FSYNC,
-	"fdatasync":               SYS_FDATASYNC,
+	"fdatasync":               SNR_FDATASYNC,
-	"sync_file_range":         SYS_SYNC_FILE_RANGE,
+	"sync_file_range":         SNR_SYNC_FILE_RANGE,
-	"timerfd_create":          SYS_TIMERFD_CREATE,
+	"timerfd_create":          SNR_TIMERFD_CREATE,
-	"timerfd_settime":         SYS_TIMERFD_SETTIME,
+	"timerfd_settime":         SNR_TIMERFD_SETTIME,
-	"timerfd_gettime":         SYS_TIMERFD_GETTIME,
+	"timerfd_gettime":         SNR_TIMERFD_GETTIME,
-	"utimensat":               SYS_UTIMENSAT,
+	"utimensat":               SNR_UTIMENSAT,
-	"acct":                    SYS_ACCT,
+	"acct":                    SNR_ACCT,
-	"capget":                  SYS_CAPGET,
+	"capget":                  SNR_CAPGET,
-	"capset":                  SYS_CAPSET,
+	"capset":                  SNR_CAPSET,
-	"personality":             SYS_PERSONALITY,
+	"personality":             SNR_PERSONALITY,
-	"exit":                    SYS_EXIT,
+	"exit":                    SNR_EXIT,
-	"exit_group":              SYS_EXIT_GROUP,
+	"exit_group":              SNR_EXIT_GROUP,
-	"waitid":                  SYS_WAITID,
+	"waitid":                  SNR_WAITID,
-	"set_tid_address":         SYS_SET_TID_ADDRESS,
+	"set_tid_address":         SNR_SET_TID_ADDRESS,
-	"unshare":                 SYS_UNSHARE,
+	"unshare":                 SNR_UNSHARE,
-	"futex":                   SYS_FUTEX,
+	"futex":                   SNR_FUTEX,
-	"set_robust_list":         SYS_SET_ROBUST_LIST,
+	"set_robust_list":         SNR_SET_ROBUST_LIST,
-	"get_robust_list":         SYS_GET_ROBUST_LIST,
+	"get_robust_list":         SNR_GET_ROBUST_LIST,
-	"nanosleep":               SYS_NANOSLEEP,
+	"nanosleep":               SNR_NANOSLEEP,
-	"getitimer":               SYS_GETITIMER,
+	"getitimer":               SNR_GETITIMER,
-	"setitimer":               SYS_SETITIMER,
+	"setitimer":               SNR_SETITIMER,
-	"kexec_load":              SYS_KEXEC_LOAD,
+	"kexec_load":              SNR_KEXEC_LOAD,
-	"init_module":             SYS_INIT_MODULE,
+	"init_module":             SNR_INIT_MODULE,
-	"delete_module":           SYS_DELETE_MODULE,
+	"delete_module":           SNR_DELETE_MODULE,
-	"timer_create":            SYS_TIMER_CREATE,
+	"timer_create":            SNR_TIMER_CREATE,
-	"timer_gettime":           SYS_TIMER_GETTIME,
+	"timer_gettime":           SNR_TIMER_GETTIME,
-	"timer_getoverrun":        SYS_TIMER_GETOVERRUN,
+	"timer_getoverrun":        SNR_TIMER_GETOVERRUN,
-	"timer_settime":           SYS_TIMER_SETTIME,
+	"timer_settime":           SNR_TIMER_SETTIME,
-	"timer_delete":            SYS_TIMER_DELETE,
+	"timer_delete":            SNR_TIMER_DELETE,
-	"clock_settime":           SYS_CLOCK_SETTIME,
+	"clock_settime":           SNR_CLOCK_SETTIME,
-	"clock_gettime":           SYS_CLOCK_GETTIME,
+	"clock_gettime":           SNR_CLOCK_GETTIME,
-	"clock_getres":            SYS_CLOCK_GETRES,
+	"clock_getres":            SNR_CLOCK_GETRES,
-	"clock_nanosleep":         SYS_CLOCK_NANOSLEEP,
+	"clock_nanosleep":         SNR_CLOCK_NANOSLEEP,
-	"syslog":                  SYS_SYSLOG,
+	"syslog":                  SNR_SYSLOG,
-	"ptrace":                  SYS_PTRACE,
+	"ptrace":                  SNR_PTRACE,
-	"sched_setparam":          SYS_SCHED_SETPARAM,
+	"sched_setparam":          SNR_SCHED_SETPARAM,
-	"sched_setscheduler":      SYS_SCHED_SETSCHEDULER,
+	"sched_setscheduler":      SNR_SCHED_SETSCHEDULER,
-	"sched_getscheduler":      SYS_SCHED_GETSCHEDULER,
+	"sched_getscheduler":      SNR_SCHED_GETSCHEDULER,
-	"sched_getparam":          SYS_SCHED_GETPARAM,
+	"sched_getparam":          SNR_SCHED_GETPARAM,
-	"sched_setaffinity":       SYS_SCHED_SETAFFINITY,
+	"sched_setaffinity":       SNR_SCHED_SETAFFINITY,
-	"sched_getaffinity":       SYS_SCHED_GETAFFINITY,
+	"sched_getaffinity":       SNR_SCHED_GETAFFINITY,
-	"sched_yield":             SYS_SCHED_YIELD,
+	"sched_yield":             SNR_SCHED_YIELD,
-	"sched_get_priority_max":  SYS_SCHED_GET_PRIORITY_MAX,
+	"sched_get_priority_max":  SNR_SCHED_GET_PRIORITY_MAX,
-	"sched_get_priority_min":  SYS_SCHED_GET_PRIORITY_MIN,
+	"sched_get_priority_min":  SNR_SCHED_GET_PRIORITY_MIN,
-	"sched_rr_get_interval":   SYS_SCHED_RR_GET_INTERVAL,
+	"sched_rr_get_interval":   SNR_SCHED_RR_GET_INTERVAL,
-	"restart_syscall":         SYS_RESTART_SYSCALL,
+	"restart_syscall":         SNR_RESTART_SYSCALL,
-	"kill":                    SYS_KILL,
+	"kill":                    SNR_KILL,
-	"tkill":                   SYS_TKILL,
+	"tkill":                   SNR_TKILL,
-	"tgkill":                  SYS_TGKILL,
+	"tgkill":                  SNR_TGKILL,
-	"sigaltstack":             SYS_SIGALTSTACK,
+	"sigaltstack":             SNR_SIGALTSTACK,
-	"rt_sigsuspend":           SYS_RT_SIGSUSPEND,
+	"rt_sigsuspend":           SNR_RT_SIGSUSPEND,
-	"rt_sigaction":            SYS_RT_SIGACTION,
+	"rt_sigaction":            SNR_RT_SIGACTION,
-	"rt_sigprocmask":          SYS_RT_SIGPROCMASK,
+	"rt_sigprocmask":          SNR_RT_SIGPROCMASK,
-	"rt_sigpending":           SYS_RT_SIGPENDING,
+	"rt_sigpending":           SNR_RT_SIGPENDING,
-	"rt_sigtimedwait":         SYS_RT_SIGTIMEDWAIT,
+	"rt_sigtimedwait":         SNR_RT_SIGTIMEDWAIT,
-	"rt_sigqueueinfo":         SYS_RT_SIGQUEUEINFO,
+	"rt_sigqueueinfo":         SNR_RT_SIGQUEUEINFO,
-	"rt_sigreturn":            SYS_RT_SIGRETURN,
+	"rt_sigreturn":            SNR_RT_SIGRETURN,
-	"setpriority":             SYS_SETPRIORITY,
+	"setpriority":             SNR_SETPRIORITY,
-	"getpriority":             SYS_GETPRIORITY,
+	"getpriority":             SNR_GETPRIORITY,
-	"reboot":                  SYS_REBOOT,
+	"reboot":                  SNR_REBOOT,
-	"setregid":                SYS_SETREGID,
+	"setregid":                SNR_SETREGID,
-	"setgid":                  SYS_SETGID,
+	"setgid":                  SNR_SETGID,
-	"setreuid":                SYS_SETREUID,
+	"setreuid":                SNR_SETREUID,
-	"setuid":                  SYS_SETUID,
+	"setuid":                  SNR_SETUID,
-	"setresuid":               SYS_SETRESUID,
+	"setresuid":               SNR_SETRESUID,
-	"getresuid":               SYS_GETRESUID,
+	"getresuid":               SNR_GETRESUID,
-	"setresgid":               SYS_SETRESGID,
+	"setresgid":               SNR_SETRESGID,
-	"getresgid":               SYS_GETRESGID,
+	"getresgid":               SNR_GETRESGID,
-	"setfsuid":                SYS_SETFSUID,
+	"setfsuid":                SNR_SETFSUID,
-	"setfsgid":                SYS_SETFSGID,
+	"setfsgid":                SNR_SETFSGID,
-	"times":                   SYS_TIMES,
+	"times":                   SNR_TIMES,
-	"setpgid":                 SYS_SETPGID,
+	"setpgid":                 SNR_SETPGID,
-	"getpgid":                 SYS_GETPGID,
+	"getpgid":                 SNR_GETPGID,
-	"getsid":                  SYS_GETSID,
+	"getsid":                  SNR_GETSID,
-	"setsid":                  SYS_SETSID,
+	"setsid":                  SNR_SETSID,
-	"getgroups":               SYS_GETGROUPS,
+	"getgroups":               SNR_GETGROUPS,
-	"setgroups":               SYS_SETGROUPS,
+	"setgroups":               SNR_SETGROUPS,
-	"uname":                   SYS_UNAME,
+	"uname":                   SNR_UNAME,
-	"sethostname":             SYS_SETHOSTNAME,
+	"sethostname":             SNR_SETHOSTNAME,
-	"setdomainname":           SYS_SETDOMAINNAME,
+	"setdomainname":           SNR_SETDOMAINNAME,
-	"getrlimit":               SYS_GETRLIMIT,
+	"getrlimit":               SNR_GETRLIMIT,
-	"setrlimit":               SYS_SETRLIMIT,
+	"setrlimit":               SNR_SETRLIMIT,
-	"getrusage":               SYS_GETRUSAGE,
+	"getrusage":               SNR_GETRUSAGE,
-	"umask":                   SYS_UMASK,
+	"umask":                   SNR_UMASK,
-	"prctl":                   SYS_PRCTL,
+	"prctl":                   SNR_PRCTL,
-	"getcpu":                  SYS_GETCPU,
+	"getcpu":                  SNR_GETCPU,
-	"gettimeofday":            SYS_GETTIMEOFDAY,
+	"gettimeofday":            SNR_GETTIMEOFDAY,
-	"settimeofday":            SYS_SETTIMEOFDAY,
+	"settimeofday":            SNR_SETTIMEOFDAY,
-	"adjtimex":                SYS_ADJTIMEX,
+	"adjtimex":                SNR_ADJTIMEX,
-	"getpid":                  SYS_GETPID,
+	"getpid":                  SNR_GETPID,
-	"getppid":                 SYS_GETPPID,
+	"getppid":                 SNR_GETPPID,
-	"getuid":                  SYS_GETUID,
+	"getuid":                  SNR_GETUID,
-	"geteuid":                 SYS_GETEUID,
+	"geteuid":                 SNR_GETEUID,
-	"getgid":                  SYS_GETGID,
+	"getgid":                  SNR_GETGID,
-	"getegid":                 SYS_GETEGID,
+	"getegid":                 SNR_GETEGID,
-	"gettid":                  SYS_GETTID,
+	"gettid":                  SNR_GETTID,
-	"sysinfo":                 SYS_SYSINFO,
+	"sysinfo":                 SNR_SYSINFO,
-	"mq_open":                 SYS_MQ_OPEN,
+	"mq_open":                 SNR_MQ_OPEN,
-	"mq_unlink":               SYS_MQ_UNLINK,
+	"mq_unlink":               SNR_MQ_UNLINK,
-	"mq_timedsend":            SYS_MQ_TIMEDSEND,
+	"mq_timedsend":            SNR_MQ_TIMEDSEND,
-	"mq_timedreceive":         SYS_MQ_TIMEDRECEIVE,
+	"mq_timedreceive":         SNR_MQ_TIMEDRECEIVE,
-	"mq_notify":               SYS_MQ_NOTIFY,
+	"mq_notify":               SNR_MQ_NOTIFY,
-	"mq_getsetattr":           SYS_MQ_GETSETATTR,
+	"mq_getsetattr":           SNR_MQ_GETSETATTR,
-	"msgget":                  SYS_MSGGET,
+	"msgget":                  SNR_MSGGET,
-	"msgctl":                  SYS_MSGCTL,
+	"msgctl":                  SNR_MSGCTL,
-	"msgrcv":                  SYS_MSGRCV,
+	"msgrcv":                  SNR_MSGRCV,
-	"msgsnd":                  SYS_MSGSND,
+	"msgsnd":                  SNR_MSGSND,
-	"semget":                  SYS_SEMGET,
+	"semget":                  SNR_SEMGET,
-	"semctl":                  SYS_SEMCTL,
+	"semctl":                  SNR_SEMCTL,
-	"semtimedop":              SYS_SEMTIMEDOP,
+	"semtimedop":              SNR_SEMTIMEDOP,
-	"semop":                   SYS_SEMOP,
+	"semop":                   SNR_SEMOP,
-	"shmget":                  SYS_SHMGET,
+	"shmget":                  SNR_SHMGET,
-	"shmctl":                  SYS_SHMCTL,
+	"shmctl":                  SNR_SHMCTL,
-	"shmat":                   SYS_SHMAT,
+	"shmat":                   SNR_SHMAT,
-	"shmdt":                   SYS_SHMDT,
+	"shmdt":                   SNR_SHMDT,
-	"socket":                  SYS_SOCKET,
+	"socket":                  SNR_SOCKET,
-	"socketpair":              SYS_SOCKETPAIR,
+	"socketpair":              SNR_SOCKETPAIR,
-	"bind":                    SYS_BIND,
+	"bind":                    SNR_BIND,
-	"listen":                  SYS_LISTEN,
+	"listen":                  SNR_LISTEN,
-	"accept":                  SYS_ACCEPT,
+	"accept":                  SNR_ACCEPT,
-	"connect":                 SYS_CONNECT,
+	"connect":                 SNR_CONNECT,
-	"getsockname":             SYS_GETSOCKNAME,
+	"getsockname":             SNR_GETSOCKNAME,
-	"getpeername":             SYS_GETPEERNAME,
+	"getpeername":             SNR_GETPEERNAME,
-	"sendto":                  SYS_SENDTO,
+	"sendto":                  SNR_SENDTO,
-	"recvfrom":                SYS_RECVFROM,
+	"recvfrom":                SNR_RECVFROM,
-	"setsockopt":              SYS_SETSOCKOPT,
+	"setsockopt":              SNR_SETSOCKOPT,
-	"getsockopt":              SYS_GETSOCKOPT,
+	"getsockopt":              SNR_GETSOCKOPT,
-	"shutdown":                SYS_SHUTDOWN,
+	"shutdown":                SNR_SHUTDOWN,
-	"sendmsg":                 SYS_SENDMSG,
+	"sendmsg":                 SNR_SENDMSG,
-	"recvmsg":                 SYS_RECVMSG,
+	"recvmsg":                 SNR_RECVMSG,
-	"readahead":               SYS_READAHEAD,
+	"readahead":               SNR_READAHEAD,
-	"brk":                     SYS_BRK,
+	"brk":                     SNR_BRK,
-	"munmap":                  SYS_MUNMAP,
+	"munmap":                  SNR_MUNMAP,
-	"mremap":                  SYS_MREMAP,
+	"mremap":                  SNR_MREMAP,
-	"add_key":                 SYS_ADD_KEY,
+	"add_key":                 SNR_ADD_KEY,
-	"request_key":             SYS_REQUEST_KEY,
+	"request_key":             SNR_REQUEST_KEY,
-	"keyctl":                  SYS_KEYCTL,
+	"keyctl":                  SNR_KEYCTL,
-	"clone":                   SYS_CLONE,
+	"clone":                   SNR_CLONE,
-	"execve":                  SYS_EXECVE,
+	"execve":                  SNR_EXECVE,
-	"mmap":                    SYS_MMAP,
+	"mmap":                    SNR_MMAP,
-	"fadvise64":               SYS_FADVISE64,
+	"fadvise64":               SNR_FADVISE64,
-	"swapon":                  SYS_SWAPON,
+	"swapon":                  SNR_SWAPON,
-	"swapoff":                 SYS_SWAPOFF,
+	"swapoff":                 SNR_SWAPOFF,
-	"mprotect":                SYS_MPROTECT,
+	"mprotect":                SNR_MPROTECT,
-	"msync":                   SYS_MSYNC,
+	"msync":                   SNR_MSYNC,
-	"mlock":                   SYS_MLOCK,
+	"mlock":                   SNR_MLOCK,
-	"munlock":                 SYS_MUNLOCK,
+	"munlock":                 SNR_MUNLOCK,
-	"mlockall":                SYS_MLOCKALL,
+	"mlockall":                SNR_MLOCKALL,
-	"munlockall":              SYS_MUNLOCKALL,
+	"munlockall":              SNR_MUNLOCKALL,
-	"mincore":                 SYS_MINCORE,
+	"mincore":                 SNR_MINCORE,
-	"madvise":                 SYS_MADVISE,
+	"madvise":                 SNR_MADVISE,
-	"remap_file_pages":        SYS_REMAP_FILE_PAGES,
+	"remap_file_pages":        SNR_REMAP_FILE_PAGES,
-	"mbind":                   SYS_MBIND,
+	"mbind":                   SNR_MBIND,
-	"get_mempolicy":           SYS_GET_MEMPOLICY,
+	"get_mempolicy":           SNR_GET_MEMPOLICY,
-	"set_mempolicy":           SYS_SET_MEMPOLICY,
+	"set_mempolicy":           SNR_SET_MEMPOLICY,
-	"migrate_pages":           SYS_MIGRATE_PAGES,
+	"migrate_pages":           SNR_MIGRATE_PAGES,
-	"move_pages":              SYS_MOVE_PAGES,
+	"move_pages":              SNR_MOVE_PAGES,
-	"rt_tgsigqueueinfo":       SYS_RT_TGSIGQUEUEINFO,
+	"rt_tgsigqueueinfo":       SNR_RT_TGSIGQUEUEINFO,
-	"perf_event_open":         SYS_PERF_EVENT_OPEN,
+	"perf_event_open":         SNR_PERF_EVENT_OPEN,
-	"accept4":                 SYS_ACCEPT4,
+	"accept4":                 SNR_ACCEPT4,
-	"recvmmsg":                SYS_RECVMMSG,
+	"recvmmsg":                SNR_RECVMMSG,
-	"wait4":                   SYS_WAIT4,
+	"wait4":                   SNR_WAIT4,
-	"prlimit64":               SYS_PRLIMIT64,
+	"prlimit64":               SNR_PRLIMIT64,
-	"fanotify_init":           SYS_FANOTIFY_INIT,
+	"fanotify_init":           SNR_FANOTIFY_INIT,
-	"fanotify_mark":           SYS_FANOTIFY_MARK,
+	"fanotify_mark":           SNR_FANOTIFY_MARK,
-	"name_to_handle_at":       SYS_NAME_TO_HANDLE_AT,
+	"name_to_handle_at":       SNR_NAME_TO_HANDLE_AT,
-	"open_by_handle_at":       SYS_OPEN_BY_HANDLE_AT,
+	"open_by_handle_at":       SNR_OPEN_BY_HANDLE_AT,
-	"clock_adjtime":           SYS_CLOCK_ADJTIME,
+	"clock_adjtime":           SNR_CLOCK_ADJTIME,
-	"syncfs":                  SYS_SYNCFS,
+	"syncfs":                  SNR_SYNCFS,
-	"setns":                   SYS_SETNS,
+	"setns":                   SNR_SETNS,
-	"sendmmsg":                SYS_SENDMMSG,
+	"sendmmsg":                SNR_SENDMMSG,
-	"process_vm_readv":        SYS_PROCESS_VM_READV,
+	"process_vm_readv":        SNR_PROCESS_VM_READV,
-	"process_vm_writev":       SYS_PROCESS_VM_WRITEV,
+	"process_vm_writev":       SNR_PROCESS_VM_WRITEV,
-	"kcmp":                    SYS_KCMP,
+	"kcmp":                    SNR_KCMP,
-	"finit_module":            SYS_FINIT_MODULE,
+	"finit_module":            SNR_FINIT_MODULE,
-	"sched_setattr":           SYS_SCHED_SETATTR,
+	"sched_setattr":           SNR_SCHED_SETATTR,
-	"sched_getattr":           SYS_SCHED_GETATTR,
+	"sched_getattr":           SNR_SCHED_GETATTR,
-	"renameat2":               SYS_RENAMEAT2,
+	"renameat2":               SNR_RENAMEAT2,
-	"seccomp":                 SYS_SECCOMP,
+	"seccomp":                 SNR_SECCOMP,
-	"getrandom":               SYS_GETRANDOM,
+	"getrandom":               SNR_GETRANDOM,
-	"memfd_create":            SYS_MEMFD_CREATE,
+	"memfd_create":            SNR_MEMFD_CREATE,
-	"bpf":                     SYS_BPF,
+	"bpf":                     SNR_BPF,
-	"execveat":                SYS_EXECVEAT,
+	"execveat":                SNR_EXECVEAT,
-	"userfaultfd":             SYS_USERFAULTFD,
+	"userfaultfd":             SNR_USERFAULTFD,
-	"membarrier":              SYS_MEMBARRIER,
+	"membarrier":              SNR_MEMBARRIER,
-	"mlock2":                  SYS_MLOCK2,
+	"mlock2":                  SNR_MLOCK2,
-	"copy_file_range":         SYS_COPY_FILE_RANGE,
+	"copy_file_range":         SNR_COPY_FILE_RANGE,
-	"preadv2":                 SYS_PREADV2,
+	"preadv2":                 SNR_PREADV2,
-	"pwritev2":                SYS_PWRITEV2,
+	"pwritev2":                SNR_PWRITEV2,
-	"pkey_mprotect":           SYS_PKEY_MPROTECT,
+	"pkey_mprotect":           SNR_PKEY_MPROTECT,
-	"pkey_alloc":              SYS_PKEY_ALLOC,
+	"pkey_alloc":              SNR_PKEY_ALLOC,
-	"pkey_free":               SYS_PKEY_FREE,
+	"pkey_free":               SNR_PKEY_FREE,
-	"statx":                   SYS_STATX,
+	"statx":                   SNR_STATX,
-	"io_pgetevents":           SYS_IO_PGETEVENTS,
+	"io_pgetevents":           SNR_IO_PGETEVENTS,
-	"rseq":                    SYS_RSEQ,
+	"rseq":                    SNR_RSEQ,
-	"kexec_file_load":         SYS_KEXEC_FILE_LOAD,
+	"kexec_file_load":         SNR_KEXEC_FILE_LOAD,
-	"pidfd_send_signal":       SYS_PIDFD_SEND_SIGNAL,
+	"pidfd_send_signal":       SNR_PIDFD_SEND_SIGNAL,
-	"io_uring_setup":          SYS_IO_URING_SETUP,
+	"io_uring_setup":          SNR_IO_URING_SETUP,
-	"io_uring_enter":          SYS_IO_URING_ENTER,
+	"io_uring_enter":          SNR_IO_URING_ENTER,
-	"io_uring_register":       SYS_IO_URING_REGISTER,
+	"io_uring_register":       SNR_IO_URING_REGISTER,
-	"open_tree":               SYS_OPEN_TREE,
+	"open_tree":               SNR_OPEN_TREE,
-	"move_mount":              SYS_MOVE_MOUNT,
+	"move_mount":              SNR_MOVE_MOUNT,
-	"fsopen":                  SYS_FSOPEN,
+	"fsopen":                  SNR_FSOPEN,
-	"fsconfig":                SYS_FSCONFIG,
+	"fsconfig":                SNR_FSCONFIG,
-	"fsmount":                 SYS_FSMOUNT,
+	"fsmount":                 SNR_FSMOUNT,
-	"fspick":                  SYS_FSPICK,
+	"fspick":                  SNR_FSPICK,
-	"pidfd_open":              SYS_PIDFD_OPEN,
+	"pidfd_open":              SNR_PIDFD_OPEN,
-	"clone3":                  SYS_CLONE3,
+	"clone3":                  SNR_CLONE3,
-	"close_range":             SYS_CLOSE_RANGE,
+	"close_range":             SNR_CLOSE_RANGE,
-	"openat2":                 SYS_OPENAT2,
+	"openat2":                 SNR_OPENAT2,
-	"pidfd_getfd":             SYS_PIDFD_GETFD,
+	"pidfd_getfd":             SNR_PIDFD_GETFD,
-	"faccessat2":              SYS_FACCESSAT2,
+	"faccessat2":              SNR_FACCESSAT2,
-	"process_madvise":         SYS_PROCESS_MADVISE,
+	"process_madvise":         SNR_PROCESS_MADVISE,
-	"epoll_pwait2":            SYS_EPOLL_PWAIT2,
+	"epoll_pwait2":            SNR_EPOLL_PWAIT2,
-	"mount_setattr":           SYS_MOUNT_SETATTR,
+	"mount_setattr":           SNR_MOUNT_SETATTR,
-	"quotactl_fd":             SYS_QUOTACTL_FD,
+	"quotactl_fd":             SNR_QUOTACTL_FD,
-	"landlock_create_ruleset": SYS_LANDLOCK_CREATE_RULESET,
+	"landlock_create_ruleset": SNR_LANDLOCK_CREATE_RULESET,
-	"landlock_add_rule":       SYS_LANDLOCK_ADD_RULE,
+	"landlock_add_rule":       SNR_LANDLOCK_ADD_RULE,
-	"landlock_restrict_self":  SYS_LANDLOCK_RESTRICT_SELF,
+	"landlock_restrict_self":  SNR_LANDLOCK_RESTRICT_SELF,
-	"memfd_secret":            SYS_MEMFD_SECRET,
+	"memfd_secret":            SNR_MEMFD_SECRET,
-	"process_mrelease":        SYS_PROCESS_MRELEASE,
+	"process_mrelease":        SNR_PROCESS_MRELEASE,
-	"futex_waitv":             SYS_FUTEX_WAITV,
+	"futex_waitv":             SNR_FUTEX_WAITV,
-	"set_mempolicy_home_node": SYS_SET_MEMPOLICY_HOME_NODE,
+	"set_mempolicy_home_node": SNR_SET_MEMPOLICY_HOME_NODE,
-	"cachestat":               SYS_CACHESTAT,
+	"cachestat":               SNR_CACHESTAT,
-	"fchmodat2":               SYS_FCHMODAT2,
+	"fchmodat2":               SNR_FCHMODAT2,
-	"map_shadow_stack":        SYS_MAP_SHADOW_STACK,
+	"map_shadow_stack":        SNR_MAP_SHADOW_STACK,
-	"futex_wake":              SYS_FUTEX_WAKE,
+	"futex_wake":              SNR_FUTEX_WAKE,
-	"futex_wait":              SYS_FUTEX_WAIT,
+	"futex_wait":              SNR_FUTEX_WAIT,
-	"futex_requeue":           SYS_FUTEX_REQUEUE,
+	"futex_requeue":           SNR_FUTEX_REQUEUE,
-	"statmount":               SYS_STATMOUNT,
+	"statmount":               SNR_STATMOUNT,
-	"listmount":               SYS_LISTMOUNT,
+	"listmount":               SNR_LISTMOUNT,
-	"lsm_get_self_attr":       SYS_LSM_GET_SELF_ATTR,
+	"lsm_get_self_attr":       SNR_LSM_GET_SELF_ATTR,
-	"lsm_set_self_attr":       SYS_LSM_SET_SELF_ATTR,
+	"lsm_set_self_attr":       SNR_LSM_SET_SELF_ATTR,
-	"lsm_list_modules":        SYS_LSM_LIST_MODULES,
+	"lsm_list_modules":        SNR_LSM_LIST_MODULES,
-	"mseal":                   SYS_MSEAL,
+	"mseal":                   SNR_MSEAL,
 }
 
 const (
@@ -380,3 +380,324 @@ const (
 	SYS_LSM_LIST_MODULES        = 461
 	SYS_MSEAL                   = 462
 )
+
+const (
+	SNR_IO_SETUP                ScmpSyscall = SYS_IO_SETUP
+	SNR_IO_DESTROY              ScmpSyscall = SYS_IO_DESTROY
+	SNR_IO_SUBMIT               ScmpSyscall = SYS_IO_SUBMIT
+	SNR_IO_CANCEL               ScmpSyscall = SYS_IO_CANCEL
+	SNR_IO_GETEVENTS            ScmpSyscall = SYS_IO_GETEVENTS
+	SNR_SETXATTR                ScmpSyscall = SYS_SETXATTR
+	SNR_LSETXATTR               ScmpSyscall = SYS_LSETXATTR
+	SNR_FSETXATTR               ScmpSyscall = SYS_FSETXATTR
+	SNR_GETXATTR                ScmpSyscall = SYS_GETXATTR
+	SNR_LGETXATTR               ScmpSyscall = SYS_LGETXATTR
+	SNR_FGETXATTR               ScmpSyscall = SYS_FGETXATTR
+	SNR_LISTXATTR               ScmpSyscall = SYS_LISTXATTR
+	SNR_LLISTXATTR              ScmpSyscall = SYS_LLISTXATTR
+	SNR_FLISTXATTR              ScmpSyscall = SYS_FLISTXATTR
+	SNR_REMOVEXATTR             ScmpSyscall = SYS_REMOVEXATTR
+	SNR_LREMOVEXATTR            ScmpSyscall = SYS_LREMOVEXATTR
+	SNR_FREMOVEXATTR            ScmpSyscall = SYS_FREMOVEXATTR
+	SNR_GETCWD                  ScmpSyscall = SYS_GETCWD
+	SNR_LOOKUP_DCOOKIE          ScmpSyscall = SYS_LOOKUP_DCOOKIE
+	SNR_EVENTFD2                ScmpSyscall = SYS_EVENTFD2
+	SNR_EPOLL_CREATE1           ScmpSyscall = SYS_EPOLL_CREATE1
+	SNR_EPOLL_CTL               ScmpSyscall = SYS_EPOLL_CTL
+	SNR_EPOLL_PWAIT             ScmpSyscall = SYS_EPOLL_PWAIT
+	SNR_DUP                     ScmpSyscall = SYS_DUP
+	SNR_DUP3                    ScmpSyscall = SYS_DUP3
+	SNR_FCNTL                   ScmpSyscall = SYS_FCNTL
+	SNR_INOTIFY_INIT1           ScmpSyscall = SYS_INOTIFY_INIT1
+	SNR_INOTIFY_ADD_WATCH       ScmpSyscall = SYS_INOTIFY_ADD_WATCH
+	SNR_INOTIFY_RM_WATCH        ScmpSyscall = SYS_INOTIFY_RM_WATCH
+	SNR_IOCTL                   ScmpSyscall = SYS_IOCTL
+	SNR_IOPRIO_SET              ScmpSyscall = SYS_IOPRIO_SET
+	SNR_IOPRIO_GET              ScmpSyscall = SYS_IOPRIO_GET
+	SNR_FLOCK                   ScmpSyscall = SYS_FLOCK
+	SNR_MKNODAT                 ScmpSyscall = SYS_MKNODAT
+	SNR_MKDIRAT                 ScmpSyscall = SYS_MKDIRAT
+	SNR_UNLINKAT                ScmpSyscall = SYS_UNLINKAT
+	SNR_SYMLINKAT               ScmpSyscall = SYS_SYMLINKAT
+	SNR_LINKAT                  ScmpSyscall = SYS_LINKAT
+	SNR_RENAMEAT                ScmpSyscall = SYS_RENAMEAT
+	SNR_UMOUNT2                 ScmpSyscall = SYS_UMOUNT2
+	SNR_MOUNT                   ScmpSyscall = SYS_MOUNT
+	SNR_PIVOT_ROOT              ScmpSyscall = SYS_PIVOT_ROOT
+	SNR_NFSSERVCTL              ScmpSyscall = SYS_NFSSERVCTL
+	SNR_STATFS                  ScmpSyscall = SYS_STATFS
+	SNR_FSTATFS                 ScmpSyscall = SYS_FSTATFS
+	SNR_TRUNCATE                ScmpSyscall = SYS_TRUNCATE
+	SNR_FTRUNCATE               ScmpSyscall = SYS_FTRUNCATE
+	SNR_FALLOCATE               ScmpSyscall = SYS_FALLOCATE
+	SNR_FACCESSAT               ScmpSyscall = SYS_FACCESSAT
+	SNR_CHDIR                   ScmpSyscall = SYS_CHDIR
+	SNR_FCHDIR                  ScmpSyscall = SYS_FCHDIR
+	SNR_CHROOT                  ScmpSyscall = SYS_CHROOT
+	SNR_FCHMOD                  ScmpSyscall = SYS_FCHMOD
+	SNR_FCHMODAT                ScmpSyscall = SYS_FCHMODAT
+	SNR_FCHOWNAT                ScmpSyscall = SYS_FCHOWNAT
+	SNR_FCHOWN                  ScmpSyscall = SYS_FCHOWN
+	SNR_OPENAT                  ScmpSyscall = SYS_OPENAT
+	SNR_CLOSE                   ScmpSyscall = SYS_CLOSE
+	SNR_VHANGUP                 ScmpSyscall = SYS_VHANGUP
+	SNR_PIPE2                   ScmpSyscall = SYS_PIPE2
+	SNR_QUOTACTL                ScmpSyscall = SYS_QUOTACTL
+	SNR_GETDENTS64              ScmpSyscall = SYS_GETDENTS64
+	SNR_LSEEK                   ScmpSyscall = SYS_LSEEK
+	SNR_READ                    ScmpSyscall = SYS_READ
+	SNR_WRITE                   ScmpSyscall = SYS_WRITE
+	SNR_READV                   ScmpSyscall = SYS_READV
+	SNR_WRITEV                  ScmpSyscall = SYS_WRITEV
+	SNR_PREAD64                 ScmpSyscall = SYS_PREAD64
+	SNR_PWRITE64                ScmpSyscall = SYS_PWRITE64
+	SNR_PREADV                  ScmpSyscall = SYS_PREADV
+	SNR_PWRITEV                 ScmpSyscall = SYS_PWRITEV
+	SNR_SENDFILE                ScmpSyscall = SYS_SENDFILE
+	SNR_PSELECT6                ScmpSyscall = SYS_PSELECT6
+	SNR_PPOLL                   ScmpSyscall = SYS_PPOLL
+	SNR_SIGNALFD4               ScmpSyscall = SYS_SIGNALFD4
+	SNR_VMSPLICE                ScmpSyscall = SYS_VMSPLICE
+	SNR_SPLICE                  ScmpSyscall = SYS_SPLICE
+	SNR_TEE                     ScmpSyscall = SYS_TEE
+	SNR_READLINKAT              ScmpSyscall = SYS_READLINKAT
+	SNR_NEWFSTATAT              ScmpSyscall = SYS_NEWFSTATAT
+	SNR_FSTAT                   ScmpSyscall = SYS_FSTAT
+	SNR_SYNC                    ScmpSyscall = SYS_SYNC
+	SNR_FSYNC                   ScmpSyscall = SYS_FSYNC
+	SNR_FDATASYNC               ScmpSyscall = SYS_FDATASYNC
+	SNR_SYNC_FILE_RANGE         ScmpSyscall = SYS_SYNC_FILE_RANGE
+	SNR_TIMERFD_CREATE          ScmpSyscall = SYS_TIMERFD_CREATE
+	SNR_TIMERFD_SETTIME         ScmpSyscall = SYS_TIMERFD_SETTIME
+	SNR_TIMERFD_GETTIME         ScmpSyscall = SYS_TIMERFD_GETTIME
+	SNR_UTIMENSAT               ScmpSyscall = SYS_UTIMENSAT
+	SNR_ACCT                    ScmpSyscall = SYS_ACCT
+	SNR_CAPGET                  ScmpSyscall = SYS_CAPGET
+	SNR_CAPSET                  ScmpSyscall = SYS_CAPSET
+	SNR_PERSONALITY             ScmpSyscall = SYS_PERSONALITY
+	SNR_EXIT                    ScmpSyscall = SYS_EXIT
+	SNR_EXIT_GROUP              ScmpSyscall = SYS_EXIT_GROUP
+	SNR_WAITID                  ScmpSyscall = SYS_WAITID
+	SNR_SET_TID_ADDRESS         ScmpSyscall = SYS_SET_TID_ADDRESS
+	SNR_UNSHARE                 ScmpSyscall = SYS_UNSHARE
+	SNR_FUTEX                   ScmpSyscall = SYS_FUTEX
+	SNR_SET_ROBUST_LIST         ScmpSyscall = SYS_SET_ROBUST_LIST
+	SNR_GET_ROBUST_LIST         ScmpSyscall = SYS_GET_ROBUST_LIST
+	SNR_NANOSLEEP               ScmpSyscall = SYS_NANOSLEEP
+	SNR_GETITIMER               ScmpSyscall = SYS_GETITIMER
+	SNR_SETITIMER               ScmpSyscall = SYS_SETITIMER
+	SNR_KEXEC_LOAD              ScmpSyscall = SYS_KEXEC_LOAD
+	SNR_INIT_MODULE             ScmpSyscall = SYS_INIT_MODULE
+	SNR_DELETE_MODULE           ScmpSyscall = SYS_DELETE_MODULE
+	SNR_TIMER_CREATE            ScmpSyscall = SYS_TIMER_CREATE
+	SNR_TIMER_GETTIME           ScmpSyscall = SYS_TIMER_GETTIME
+	SNR_TIMER_GETOVERRUN        ScmpSyscall = SYS_TIMER_GETOVERRUN
+	SNR_TIMER_SETTIME           ScmpSyscall = SYS_TIMER_SETTIME
+	SNR_TIMER_DELETE            ScmpSyscall = SYS_TIMER_DELETE
+	SNR_CLOCK_SETTIME           ScmpSyscall = SYS_CLOCK_SETTIME
+	SNR_CLOCK_GETTIME           ScmpSyscall = SYS_CLOCK_GETTIME
+	SNR_CLOCK_GETRES            ScmpSyscall = SYS_CLOCK_GETRES
+	SNR_CLOCK_NANOSLEEP         ScmpSyscall = SYS_CLOCK_NANOSLEEP
+	SNR_SYSLOG                  ScmpSyscall = SYS_SYSLOG
+	SNR_PTRACE                  ScmpSyscall = SYS_PTRACE
+	SNR_SCHED_SETPARAM          ScmpSyscall = SYS_SCHED_SETPARAM
+	SNR_SCHED_SETSCHEDULER      ScmpSyscall = SYS_SCHED_SETSCHEDULER
+	SNR_SCHED_GETSCHEDULER      ScmpSyscall = SYS_SCHED_GETSCHEDULER
+	SNR_SCHED_GETPARAM          ScmpSyscall = SYS_SCHED_GETPARAM
+	SNR_SCHED_SETAFFINITY       ScmpSyscall = SYS_SCHED_SETAFFINITY
+	SNR_SCHED_GETAFFINITY       ScmpSyscall = SYS_SCHED_GETAFFINITY
+	SNR_SCHED_YIELD             ScmpSyscall = SYS_SCHED_YIELD
+	SNR_SCHED_GET_PRIORITY_MAX  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MAX
+	SNR_SCHED_GET_PRIORITY_MIN  ScmpSyscall = SYS_SCHED_GET_PRIORITY_MIN
+	SNR_SCHED_RR_GET_INTERVAL   ScmpSyscall = SYS_SCHED_RR_GET_INTERVAL
+	SNR_RESTART_SYSCALL         ScmpSyscall = SYS_RESTART_SYSCALL
+	SNR_KILL                    ScmpSyscall = SYS_KILL
+	SNR_TKILL                   ScmpSyscall = SYS_TKILL
+	SNR_TGKILL                  ScmpSyscall = SYS_TGKILL
+	SNR_SIGALTSTACK             ScmpSyscall = SYS_SIGALTSTACK
+	SNR_RT_SIGSUSPEND           ScmpSyscall = SYS_RT_SIGSUSPEND
+	SNR_RT_SIGACTION            ScmpSyscall = SYS_RT_SIGACTION
+	SNR_RT_SIGPROCMASK          ScmpSyscall = SYS_RT_SIGPROCMASK
+	SNR_RT_SIGPENDING           ScmpSyscall = SYS_RT_SIGPENDING
+	SNR_RT_SIGTIMEDWAIT         ScmpSyscall = SYS_RT_SIGTIMEDWAIT
+	SNR_RT_SIGQUEUEINFO         ScmpSyscall = SYS_RT_SIGQUEUEINFO
+	SNR_RT_SIGRETURN            ScmpSyscall = SYS_RT_SIGRETURN
+	SNR_SETPRIORITY             ScmpSyscall = SYS_SETPRIORITY
+	SNR_GETPRIORITY             ScmpSyscall = SYS_GETPRIORITY
+	SNR_REBOOT                  ScmpSyscall = SYS_REBOOT
+	SNR_SETREGID                ScmpSyscall = SYS_SETREGID
+	SNR_SETGID                  ScmpSyscall = SYS_SETGID
+	SNR_SETREUID                ScmpSyscall = SYS_SETREUID
+	SNR_SETUID                  ScmpSyscall = SYS_SETUID
+	SNR_SETRESUID               ScmpSyscall = SYS_SETRESUID
+	SNR_GETRESUID               ScmpSyscall = SYS_GETRESUID
+	SNR_SETRESGID               ScmpSyscall = SYS_SETRESGID
+	SNR_GETRESGID               ScmpSyscall = SYS_GETRESGID
+	SNR_SETFSUID                ScmpSyscall = SYS_SETFSUID
+	SNR_SETFSGID                ScmpSyscall = SYS_SETFSGID
+	SNR_TIMES                   ScmpSyscall = SYS_TIMES
+	SNR_SETPGID                 ScmpSyscall = SYS_SETPGID
+	SNR_GETPGID                 ScmpSyscall = SYS_GETPGID
+	SNR_GETSID                  ScmpSyscall = SYS_GETSID
+	SNR_SETSID                  ScmpSyscall = SYS_SETSID
+	SNR_GETGROUPS               ScmpSyscall = SYS_GETGROUPS
+	SNR_SETGROUPS               ScmpSyscall = SYS_SETGROUPS
+	SNR_UNAME                   ScmpSyscall = SYS_UNAME
+	SNR_SETHOSTNAME             ScmpSyscall = SYS_SETHOSTNAME
+	SNR_SETDOMAINNAME           ScmpSyscall = SYS_SETDOMAINNAME
+	SNR_GETRLIMIT               ScmpSyscall = SYS_GETRLIMIT
+	SNR_SETRLIMIT               ScmpSyscall = SYS_SETRLIMIT
+	SNR_GETRUSAGE               ScmpSyscall = SYS_GETRUSAGE
+	SNR_UMASK                   ScmpSyscall = SYS_UMASK
+	SNR_PRCTL                   ScmpSyscall = SYS_PRCTL
+	SNR_GETCPU                  ScmpSyscall = SYS_GETCPU
+	SNR_GETTIMEOFDAY            ScmpSyscall = SYS_GETTIMEOFDAY
+	SNR_SETTIMEOFDAY            ScmpSyscall = SYS_SETTIMEOFDAY
+	SNR_ADJTIMEX                ScmpSyscall = SYS_ADJTIMEX
+	SNR_GETPID                  ScmpSyscall = SYS_GETPID
+	SNR_GETPPID                 ScmpSyscall = SYS_GETPPID
+	SNR_GETUID                  ScmpSyscall = SYS_GETUID
+	SNR_GETEUID                 ScmpSyscall = SYS_GETEUID
+	SNR_GETGID                  ScmpSyscall = SYS_GETGID
+	SNR_GETEGID                 ScmpSyscall = SYS_GETEGID
+	SNR_GETTID                  ScmpSyscall = SYS_GETTID
+	SNR_SYSINFO                 ScmpSyscall = SYS_SYSINFO
+	SNR_MQ_OPEN                 ScmpSyscall = SYS_MQ_OPEN
+	SNR_MQ_UNLINK               ScmpSyscall = SYS_MQ_UNLINK
+	SNR_MQ_TIMEDSEND            ScmpSyscall = SYS_MQ_TIMEDSEND
+	SNR_MQ_TIMEDRECEIVE         ScmpSyscall = SYS_MQ_TIMEDRECEIVE
+	SNR_MQ_NOTIFY               ScmpSyscall = SYS_MQ_NOTIFY
+	SNR_MQ_GETSETATTR           ScmpSyscall = SYS_MQ_GETSETATTR
+	SNR_MSGGET                  ScmpSyscall = SYS_MSGGET
+	SNR_MSGCTL                  ScmpSyscall = SYS_MSGCTL
+	SNR_MSGRCV                  ScmpSyscall = SYS_MSGRCV
+	SNR_MSGSND                  ScmpSyscall = SYS_MSGSND
+	SNR_SEMGET                  ScmpSyscall = SYS_SEMGET
+	SNR_SEMCTL                  ScmpSyscall = SYS_SEMCTL
+	SNR_SEMTIMEDOP              ScmpSyscall = SYS_SEMTIMEDOP
+	SNR_SEMOP                   ScmpSyscall = SYS_SEMOP
+	SNR_SHMGET                  ScmpSyscall = SYS_SHMGET
+	SNR_SHMCTL                  ScmpSyscall = SYS_SHMCTL
+	SNR_SHMAT                   ScmpSyscall = SYS_SHMAT
+	SNR_SHMDT                   ScmpSyscall = SYS_SHMDT
+	SNR_SOCKET                  ScmpSyscall = SYS_SOCKET
+	SNR_SOCKETPAIR              ScmpSyscall = SYS_SOCKETPAIR
+	SNR_BIND                    ScmpSyscall = SYS_BIND
+	SNR_LISTEN                  ScmpSyscall = SYS_LISTEN
+	SNR_ACCEPT                  ScmpSyscall = SYS_ACCEPT
+	SNR_CONNECT                 ScmpSyscall = SYS_CONNECT
+	SNR_GETSOCKNAME             ScmpSyscall = SYS_GETSOCKNAME
+	SNR_GETPEERNAME             ScmpSyscall = SYS_GETPEERNAME
+	SNR_SENDTO                  ScmpSyscall = SYS_SENDTO
+	SNR_RECVFROM                ScmpSyscall = SYS_RECVFROM
+	SNR_SETSOCKOPT              ScmpSyscall = SYS_SETSOCKOPT
+	SNR_GETSOCKOPT              ScmpSyscall = SYS_GETSOCKOPT
+	SNR_SHUTDOWN                ScmpSyscall = SYS_SHUTDOWN
+	SNR_SENDMSG                 ScmpSyscall = SYS_SENDMSG
+	SNR_RECVMSG                 ScmpSyscall = SYS_RECVMSG
+	SNR_READAHEAD               ScmpSyscall = SYS_READAHEAD
+	SNR_BRK                     ScmpSyscall = SYS_BRK
+	SNR_MUNMAP                  ScmpSyscall = SYS_MUNMAP
+	SNR_MREMAP                  ScmpSyscall = SYS_MREMAP
+	SNR_ADD_KEY                 ScmpSyscall = SYS_ADD_KEY
+	SNR_REQUEST_KEY             ScmpSyscall = SYS_REQUEST_KEY
+	SNR_KEYCTL                  ScmpSyscall = SYS_KEYCTL
+	SNR_CLONE                   ScmpSyscall = SYS_CLONE
+	SNR_EXECVE                  ScmpSyscall = SYS_EXECVE
+	SNR_MMAP                    ScmpSyscall = SYS_MMAP
+	SNR_FADVISE64               ScmpSyscall = SYS_FADVISE64
+	SNR_SWAPON                  ScmpSyscall = SYS_SWAPON
+	SNR_SWAPOFF                 ScmpSyscall = SYS_SWAPOFF
+	SNR_MPROTECT                ScmpSyscall = SYS_MPROTECT
+	SNR_MSYNC                   ScmpSyscall = SYS_MSYNC
+	SNR_MLOCK                   ScmpSyscall = SYS_MLOCK
+	SNR_MUNLOCK                 ScmpSyscall = SYS_MUNLOCK
+	SNR_MLOCKALL                ScmpSyscall = SYS_MLOCKALL
+	SNR_MUNLOCKALL              ScmpSyscall = SYS_MUNLOCKALL
+	SNR_MINCORE                 ScmpSyscall = SYS_MINCORE
+	SNR_MADVISE                 ScmpSyscall = SYS_MADVISE
+	SNR_REMAP_FILE_PAGES        ScmpSyscall = SYS_REMAP_FILE_PAGES
+	SNR_MBIND                   ScmpSyscall = SYS_MBIND
+	SNR_GET_MEMPOLICY           ScmpSyscall = SYS_GET_MEMPOLICY
+	SNR_SET_MEMPOLICY           ScmpSyscall = SYS_SET_MEMPOLICY
+	SNR_MIGRATE_PAGES           ScmpSyscall = SYS_MIGRATE_PAGES
+	SNR_MOVE_PAGES              ScmpSyscall = SYS_MOVE_PAGES
+	SNR_RT_TGSIGQUEUEINFO       ScmpSyscall = SYS_RT_TGSIGQUEUEINFO
+	SNR_PERF_EVENT_OPEN         ScmpSyscall = SYS_PERF_EVENT_OPEN
+	SNR_ACCEPT4                 ScmpSyscall = SYS_ACCEPT4
+	SNR_RECVMMSG                ScmpSyscall = SYS_RECVMMSG
+	SNR_WAIT4                   ScmpSyscall = SYS_WAIT4
+	SNR_PRLIMIT64               ScmpSyscall = SYS_PRLIMIT64
+	SNR_FANOTIFY_INIT           ScmpSyscall = SYS_FANOTIFY_INIT
+	SNR_FANOTIFY_MARK           ScmpSyscall = SYS_FANOTIFY_MARK
+	SNR_NAME_TO_HANDLE_AT       ScmpSyscall = SYS_NAME_TO_HANDLE_AT
+	SNR_OPEN_BY_HANDLE_AT       ScmpSyscall = SYS_OPEN_BY_HANDLE_AT
+	SNR_CLOCK_ADJTIME           ScmpSyscall = SYS_CLOCK_ADJTIME
+	SNR_SYNCFS                  ScmpSyscall = SYS_SYNCFS
+	SNR_SETNS                   ScmpSyscall = SYS_SETNS
+	SNR_SENDMMSG                ScmpSyscall = SYS_SENDMMSG
+	SNR_PROCESS_VM_READV        ScmpSyscall = SYS_PROCESS_VM_READV
+	SNR_PROCESS_VM_WRITEV       ScmpSyscall = SYS_PROCESS_VM_WRITEV
+	SNR_KCMP                    ScmpSyscall = SYS_KCMP
+	SNR_FINIT_MODULE            ScmpSyscall = SYS_FINIT_MODULE
+	SNR_SCHED_SETATTR           ScmpSyscall = SYS_SCHED_SETATTR
+	SNR_SCHED_GETATTR           ScmpSyscall = SYS_SCHED_GETATTR
+	SNR_RENAMEAT2               ScmpSyscall = SYS_RENAMEAT2
+	SNR_SECCOMP                 ScmpSyscall = SYS_SECCOMP
+	SNR_GETRANDOM               ScmpSyscall = SYS_GETRANDOM
+	SNR_MEMFD_CREATE            ScmpSyscall = SYS_MEMFD_CREATE
+	SNR_BPF                     ScmpSyscall = SYS_BPF
+	SNR_EXECVEAT                ScmpSyscall = SYS_EXECVEAT
+	SNR_USERFAULTFD             ScmpSyscall = SYS_USERFAULTFD
+	SNR_MEMBARRIER              ScmpSyscall = SYS_MEMBARRIER
+	SNR_MLOCK2                  ScmpSyscall = SYS_MLOCK2
+	SNR_COPY_FILE_RANGE         ScmpSyscall = SYS_COPY_FILE_RANGE
+	SNR_PREADV2                 ScmpSyscall = SYS_PREADV2
+	SNR_PWRITEV2                ScmpSyscall = SYS_PWRITEV2
+	SNR_PKEY_MPROTECT           ScmpSyscall = SYS_PKEY_MPROTECT
+	SNR_PKEY_ALLOC              ScmpSyscall = SYS_PKEY_ALLOC
+	SNR_PKEY_FREE               ScmpSyscall = SYS_PKEY_FREE
+	SNR_STATX                   ScmpSyscall = SYS_STATX
+	SNR_IO_PGETEVENTS           ScmpSyscall = SYS_IO_PGETEVENTS
+	SNR_RSEQ                    ScmpSyscall = SYS_RSEQ
+	SNR_KEXEC_FILE_LOAD         ScmpSyscall = SYS_KEXEC_FILE_LOAD
+	SNR_PIDFD_SEND_SIGNAL       ScmpSyscall = SYS_PIDFD_SEND_SIGNAL
+	SNR_IO_URING_SETUP          ScmpSyscall = SYS_IO_URING_SETUP
+	SNR_IO_URING_ENTER          ScmpSyscall = SYS_IO_URING_ENTER
+	SNR_IO_URING_REGISTER       ScmpSyscall = SYS_IO_URING_REGISTER
+	SNR_OPEN_TREE               ScmpSyscall = SYS_OPEN_TREE
+	SNR_MOVE_MOUNT              ScmpSyscall = SYS_MOVE_MOUNT
+	SNR_FSOPEN                  ScmpSyscall = SYS_FSOPEN
+	SNR_FSCONFIG                ScmpSyscall = SYS_FSCONFIG
+	SNR_FSMOUNT                 ScmpSyscall = SYS_FSMOUNT
+	SNR_FSPICK                  ScmpSyscall = SYS_FSPICK
+	SNR_PIDFD_OPEN              ScmpSyscall = SYS_PIDFD_OPEN
+	SNR_CLONE3                  ScmpSyscall = SYS_CLONE3
+	SNR_CLOSE_RANGE             ScmpSyscall = SYS_CLOSE_RANGE
+	SNR_OPENAT2                 ScmpSyscall = SYS_OPENAT2
+	SNR_PIDFD_GETFD             ScmpSyscall = SYS_PIDFD_GETFD
+	SNR_FACCESSAT2              ScmpSyscall = SYS_FACCESSAT2
+	SNR_PROCESS_MADVISE         ScmpSyscall = SYS_PROCESS_MADVISE
+	SNR_EPOLL_PWAIT2            ScmpSyscall = SYS_EPOLL_PWAIT2
+	SNR_MOUNT_SETATTR           ScmpSyscall = SYS_MOUNT_SETATTR
+	SNR_QUOTACTL_FD             ScmpSyscall = SYS_QUOTACTL_FD
+	SNR_LANDLOCK_CREATE_RULESET ScmpSyscall = SYS_LANDLOCK_CREATE_RULESET
+	SNR_LANDLOCK_ADD_RULE       ScmpSyscall = SYS_LANDLOCK_ADD_RULE
+	SNR_LANDLOCK_RESTRICT_SELF  ScmpSyscall = SYS_LANDLOCK_RESTRICT_SELF
+	SNR_MEMFD_SECRET            ScmpSyscall = SYS_MEMFD_SECRET
+	SNR_PROCESS_MRELEASE        ScmpSyscall = SYS_PROCESS_MRELEASE
+	SNR_FUTEX_WAITV             ScmpSyscall = SYS_FUTEX_WAITV
+	SNR_SET_MEMPOLICY_HOME_NODE ScmpSyscall = SYS_SET_MEMPOLICY_HOME_NODE
+	SNR_CACHESTAT               ScmpSyscall = SYS_CACHESTAT
+	SNR_FCHMODAT2               ScmpSyscall = SYS_FCHMODAT2
+	SNR_MAP_SHADOW_STACK        ScmpSyscall = SYS_MAP_SHADOW_STACK
+	SNR_FUTEX_WAKE              ScmpSyscall = SYS_FUTEX_WAKE
+	SNR_FUTEX_WAIT              ScmpSyscall = SYS_FUTEX_WAIT
+	SNR_FUTEX_REQUEUE           ScmpSyscall = SYS_FUTEX_REQUEUE
+	SNR_STATMOUNT               ScmpSyscall = SYS_STATMOUNT
+	SNR_LISTMOUNT               ScmpSyscall = SYS_LISTMOUNT
+	SNR_LSM_GET_SELF_ATTR       ScmpSyscall = SYS_LSM_GET_SELF_ATTR
+	SNR_LSM_SET_SELF_ATTR       ScmpSyscall = SYS_LSM_SET_SELF_ATTR
+	SNR_LSM_LIST_MODULES        ScmpSyscall = SYS_LSM_LIST_MODULES
+	SNR_MSEAL                   ScmpSyscall = SYS_MSEAL
+)

container/stub/exit_test.go

@@ -2,7 +2,7 @@ package stub_test
 
 import (
 	"testing"
-	_ "unsafe"
+	_ "unsafe" // for go:linkname
 
 	"hakurei.app/container/stub"
 )

internal/outcome/finalise.go

@@ -55,7 +55,7 @@ func (k *outcome) finalise(ctx context.Context, msg message.Msg, id *hst.ID, con
 			if errors.As(err, &unknownGroupError) {
 				return newWithMessageError(fmt.Sprintf("unknown group %q", name), unknownGroupError)
 			} else {
-				return &hst.AppError{Step: "look up group by name", Err: err}
+				return &hst.AppError{Step: "look up group by name", Err: err, Msg: err.Error()}
 			}
 		} else {
 			supp[i] = gid

internal/outcome/main.go

@@ -4,27 +4,40 @@ import (
 	"context"
 	"log"
 	"time"
+	_ "unsafe" // for go:linkname
 
 	"hakurei.app/hst"
 	"hakurei.app/message"
 )
 
+// IsPollDescriptor reports whether fd is the descriptor being used by the poller.
+//
+//go:linkname IsPollDescriptor internal/poll.IsPollDescriptor
+func IsPollDescriptor(fd uintptr) bool
+
 // Main runs an app according to [hst.Config] and terminates. Main does not return.
-func Main(ctx context.Context, msg message.Msg, config *hst.Config) {
+func Main(ctx context.Context, msg message.Msg, config *hst.Config, fd int) {
+	// avoids runtime internals or standard streams
+	if fd >= 0 {
+		if IsPollDescriptor(uintptr(fd)) || fd < 3 {
+			log.Fatalf("invalid identifier fd %d", fd)
+		}
+	}
+
 	var id hst.ID
 	if err := hst.NewInstanceID(&id); err != nil {
 		log.Fatal(err.Error())
 	}
 
-	seal := outcome{syscallDispatcher: direct{msg}}
+	k := outcome{syscallDispatcher: direct{msg}}
 
 	finaliseTime := time.Now()
-	if err := seal.finalise(ctx, msg, &id, config); err != nil {
+	if err := k.finalise(ctx, msg, &id, config); err != nil {
 		printMessageError(msg.GetLogger().Fatalln, "cannot seal app:", err)
 		panic("unreachable")
 	}
 	msg.Verbosef("finalise took %.2f ms", float64(time.Since(finaliseTime).Nanoseconds())/1e6)
 
-	seal.main(msg)
+	k.main(msg, fd)
 	panic("unreachable")
 }

internal/outcome/process.go

@@ -33,7 +33,7 @@ const (
 func NewStore(sc *hst.Paths) *store.Store { return store.New(sc.SharePath.Append("state")) }
 
 // main carries out outcome and terminates. main does not return.
-func (k *outcome) main(msg message.Msg) {
+func (k *outcome) main(msg message.Msg, identifierFd int) {
 	if k.ctx == nil || k.sys == nil || k.state == nil {
 		panic("outcome: did not finalise")
 	}
@@ -163,6 +163,21 @@ func (k *outcome) main(msg message.Msg) {
 				continue
 			}
 
+			if f := os.NewFile(uintptr(identifierFd), "identifier"); f != nil {
+				_, err = f.Write(k.state.id.v[:])
+				if err != nil {
+					unlock()
+					// transition here to avoid the commit/revert cycle on the doomed instance
+					perrorFatal(&hst.AppError{Step: "write instance identifier", Err: err},
+						"write instance identifier", processLifecycle)
+					continue
+				}
+				msg.Verbosef("wrote identifier to %d", identifierFd)
+				if err = f.Close(); err != nil {
+					msg.Verbose(err.Error())
+				}
+			}
+
 			err = k.sys.Commit()
 			unlock()
 			if err != nil {

nixos.nix

@@ -68,7 +68,7 @@ in
 
     home-manager =
       let
-        privPackages = mapAttrs (username: fid: {
+        privPackages = mapAttrs (username: userid: {
           home.packages = foldlAttrs (
             acc: id: app:
             [
@@ -199,15 +199,15 @@ in
                         ++ [
                           {
                             type = "bind";
-                            src = getsubhome fid app.identity;
+                            src = getsubhome userid app.identity;
                             write = true;
                             ensure = true;
                           }
                         ];
 
-                      username = getsubname fid app.identity;
+                      username = getsubname userid app.identity;
                       inherit (cfg) shell;
-                      home = getsubhome fid app.identity;
+                      home = getsubhome userid app.identity;
 
                       path =
                         if app.path == null then
@@ -310,15 +310,15 @@ in
 
     users =
       let
-        getuser = fid: aid: {
+        getuser = userid: appid: {
           isSystemUser = true;
           createHome = true;
-          description = "Hakurei subordinate user ${toString aid} (u${toString fid})";
+          description = "Hakurei subordinate user ${toString appid} (u${toString userid})";
-          group = getsubname fid aid;
+          group = getsubname userid appid;
-          home = getsubhome fid aid;
+          home = getsubhome userid appid;
-          uid = getsubuid fid aid;
+          uid = getsubuid userid appid;
         };
-        getgroup = fid: aid: { gid = getsubuid fid aid; };
+        getgroup = userid: appid: { gid = getsubuid userid appid; };
       in
       {
         users = mkMerge (

options.md

@@ -35,7 +35,7 @@ package
 
 
 *Default:*
-` <derivation hakurei-static-x86_64-unknown-linux-musl-0.2.2> `
+` <derivation hakurei-static-x86_64-unknown-linux-musl-0.3.1> `
 
 
 
@@ -579,6 +579,52 @@ null or package
 
 
 
+## environment\.hakurei\.apps\.\<name>\.shareRuntime
+
+
+
+Whether to enable sharing of XDG_RUNTIME_DIR between containers under the same identity\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+` false `
+
+
+
+*Example:*
+` true `
+
+
+
+## environment\.hakurei\.apps\.\<name>\.shareTmpdir
+
+
+
+Whether to enable sharing of TMPDIR between containers under the same identity\.
+
+
+
+*Type:*
+boolean
+
+
+
+*Default:*
+` false `
+
+
+
+*Example:*
+` true `
+
+
+
 ## environment\.hakurei\.apps\.\<name>\.shareUid
 
 
@@ -759,7 +805,7 @@ package
 
 
 *Default:*
-` <derivation hakurei-hsu-0.2.2> `
+` <derivation hakurei-hsu-0.3.1> `
 
 
 

package.nix

@@ -31,7 +31,7 @@
 
 buildGoModule rec {
   pname = "hakurei";
-  version = "0.3.0";
+  version = "0.3.1";
 
   srcFiltered = builtins.path {
     name = "${pname}-src";

test/sandbox/test.py

@@ -45,6 +45,12 @@ machine.wait_for_file("/tmp/sway-ipc.sock")
 swaymsg("exec hakurei run cat")
 check_filter(0, "pdlike", "cat")
 
+# Check fd leak:
+swaymsg("exec exec 127</proc/cmdline && hakurei -v run sleep infinity")
+pd_identity0_sleep_pid = int(machine.wait_until_succeeds("pgrep -U 10000 -x sleep", timeout=60))
+print(machine.succeed(f"hakurei-test fd {pd_identity0_sleep_pid}"))
+machine.succeed(f"kill -INT {pd_identity0_sleep_pid}")
+
 # Verify capabilities/securebits in user namespace:
 print(machine.succeed("sudo -u alice -i hakurei run capsh --print"))
 print(machine.succeed("sudo -u alice -i hakurei run capsh --has-no-new-privs"))

test/sandbox/tool/main.go

@@ -67,6 +67,39 @@ func main() {
 	case "hash": // this eases the pain of passing the hash to python
 		fmt.Print(flagBpfHash)
 
+	case "fd":
+		if len(args) != 2 {
+			log.Fatal("invalid argument")
+		}
+		prefix := fmt.Sprintf("/proc/%s/fd/", args[1])
+
+		var fail bool
+		if entries, err := os.ReadDir(prefix); err != nil {
+			log.Fatal(err.Error())
+		} else {
+			for _, ent := range entries {
+				var fd int
+				if fd, err = strconv.Atoi(ent.Name()); err != nil {
+					log.Fatal(err.Error())
+				}
+
+				// skip standard streams
+				if fd <= 2 {
+					continue
+				}
+				fail = true
+
+				var d string
+				if d, err = os.Readlink(prefix + ent.Name()); err != nil {
+					log.Fatal(err.Error())
+				}
+				log.Printf("[FAIL] extra fd %d -> %s", fd, d)
+			}
+		}
+		if fail {
+			log.Fatal("[FAIL] file descriptors leaked")
+		}
+
 	default:
 		log.Fatal("invalid argument")
 	}

test/test.py

@@ -172,6 +172,11 @@ machine.send_chars("exit\n")
 machine.wait_for_file("/tmp/p0-exit-ok", timeout=15)
 machine.fail("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 10000")
 
+# Check invalid identifier fd behaviour:
+machine.fail('echo \'{"container":{"shell":"/proc/nonexistent","home":"/proc/nonexistent","path":"/proc/nonexistent"}}\' | sudo -u alice -i hakurei -v app --identifier-fd 32767 - 2>&1 | tee > /tmp/invalid-identifier-fd')
+machine.wait_for_file("/tmp/invalid-identifier-fd")
+print(machine.succeed('grep "^hakurei: cannot write identifier: bad file descriptor$" /tmp/invalid-identifier-fd'))
+
 # Check interrupt shim behaviour:
 swaymsg("exec sh -c 'ne-foot; echo -n $? > /tmp/monitor-exit-code'")
 wait_for_window(f"u0_a{hakurei_identity(0)}@machine")