helper

type Arch struct {
	Name string
	// AuditArch is the AUDIT_ARCH_* value in seccomp_data.arch.
	AuditArch uint32
	// X32 marks x86_64, whose x32 ABI shares the arch value but sets bit 30
	// of the syscall number; x32 calls are refused outright.
	X32 bool

	Mount, Umount2, PivotRoot, Unshare, Setns, Clone, Ioctl uint32
	Socket, Connect, Bind, Sendto, Sendmsg, Sendmmsg        uint32
	Listen, Accept, Accept4                                 uint32
}

type FilterOptions struct {
	// RestrictNetwork adds the network set.
	RestrictNetwork bool
	// AllowUnixSockets (with RestrictNetwork) refuses only socket(2) of non
	// AF_UNIX families and io_uring, keeping local IPC usable.
	AllowUnixSockets bool
}

type SockFilter struct {
	Code uint16
	Jt   uint8
	Jf   uint8
	K    uint32
}

type Spec struct {
	// V is SpecVersion.
	V int `json:"v"`
	// Path is the executable to run (exec.Cmd.Path). Empty means: look up
	// argv[0] in PATH.
	Path string `json:"path,omitempty"`
	// ReadDirs may be read and executed recursively ("/" means everything).
	ReadDirs []string `json:"readDirs,omitempty"`
	// WriteDirs may be read, written, created in and removed from
	// recursively.
	WriteDirs []string `json:"writeDirs,omitempty"`
	// WriteFiles are individual files that may be read and written (the
	// Landlock-only protected-path fallback grants the top-level files of a
	// writable root one by one).
	WriteFiles []string `json:"writeFiles,omitempty"`
	// Devices are device files and directories granted read/write/ioctl.
	// Missing ones, and ones that cannot be opened (a /dev/tty without a
	// controlling terminal), are skipped.
	Devices []string `json:"devices,omitempty"`
	// Network is NetworkAllowed or NetworkRestricted.
	Network string `json:"network"`
	// AllowUnixSockets keeps AF_UNIX usable under NetworkRestricted: only
	// socket(2) of other families (and io_uring) is refused. The parent sets
	// it only when it could mask the dangerous sockets (container runtimes,
	// D-Bus) with bubblewrap; otherwise every connect/bind/listen/accept and
	// addressed send is refused, whatever the family.
	AllowUnixSockets bool `json:"allowUnixSockets,omitempty"`
	// DenyConnectPorts are TCP ports the command must not connect to while
	// the network is allowed (Pando's own listeners). Enforced with Landlock
	// network rules when the kernel has them (ABI >= LandlockNetABI): every
	// other port is granted LANDLOCK_ACCESS_NET_CONNECT_TCP. Ignored under
	// NetworkRestricted, which already refuses every TCP connection.
	DenyConnectPorts []int `json:"denyConnectPorts,omitempty"`
	// PolicyHash is sandbox.Policy.Hash(), for diagnostics only.
	PolicyHash string `json:"policyHash,omitempty"`
}