applyProfile will apply the profile with the specified name to the process after the next exec.

changeOnExec reimplements aa_change_onexec from libapparmor in Go.

checkPtmxHandle checks that the given file handle points to a real dev/pts/ptmx device inode on a real devpts mount. We cannot (trivially) check that

cloneCmd creates a copy of exec.Cmd. It is needed because cmd.Start must only be used once, and go1.26 actually enforces that (see https://go-review.g

Some systemd properties are documented as having "Sec" suffix (e.g. TimeoutStopSec) but are expected to have "USec" suffix here, so let's provide conv

copyBusybox copies the rootfs for a busybox container created for the test image into the new directory for the specific test

Creates the device node in the rootfs of the container.

Create the device nodes in the container.

createPidFile creates a file containing the PID, doing so atomically (via create and rename).

devChangeNetNamespace allows to move a device given by name to a network namespace given by nsPath and optionally change the device name. The device n

dupStdio replaces stdio with the given peerPty.

execSetns runs the process that executes C code to perform the setns calls because setns support requires the C process to fork off a child and perfor

fakeConfig generates a fake libcontainer seccomp configuration. The syscalls are added with an action distinct from the default action.

finalizeRootfs sets anything to ro if necessary. You must call prepareRootfs first.

findIntelRdtMountpointDir returns the mount point of the Intel RDT "resource control" filesystem.

Figure out largest syscall number referenced in the filter for each architecture. We will be generating code based on the native architecture represen

fixStdioPermissions fixes the permissions of PID 1's STDIO within the container to the specified uid. The ownership needs to match because it is creat

forward handles the main signal event loop forwarding, resizing, or reaping depending on the signal received.

FIXME FIXME FIXME This solution is less than ideal. In the future it would be great to have per-arch information about which syscalls were added in w

getChildPid receives the final child's pid over the provided pipe.

Convert Libcontainer Arg to Libseccomp ScmpCondition

Get the read-only L3 cache information

Get diagnostics for last filesystem operation error from file info/last_cmd_status

getLinuxPersonalityFromStr converts the string domain received from spec to equivalent integer.

Get the read-only memory bandwidth information

Returns the network statistics for the network interfaces represented by the NetworkRuntimeInfo.

Convert Libcontainer Operator to Libseccomp ScmpCompareOp

getSubCgroupPaths parses --cgroup arguments, which can either be - a single "path" argument (for cgroup v2); - one or more controller[,controller[,...

goCreateMountSources spawns a goroutine which creates open_tree(2)-style mountfds based on the requested configs.Mount configuration. The returned req

ignoreCgroupError filters out cgroup-related errors that can be ignored, because the container is stopped and its cgroup is gone.

includeExecFifo opens the container's execfifo as a pathfd, so that the container cannot access the statedir (and the FIFO itself remains un-opened).

isEnabled returns true if apparmor is enabled for the host.

lockNetwork blocks any external network activity.

maskPaths masks the top of the specified paths inside a container to avoid security issues from processes reading information from non-namespace aware

Add a rule to match a single syscall