Versions in this module Expand all Collapse all v0 v0.9.1 Sep 17, 2026 v0.9.0 Aug 14, 2026 Changes in this version + const CgroupScopePrefix — linux/amd64 + const DNSTCPPort — linux/amd64 + const DefaultMaxPIDs — linux/amd64 + const GlobScanMaxDepth — linux/amd64 + const IPProtoMPTCP — linux/amd64 + const ResOptionUseVC — linux/amd64 + const ResOptionsEnvKey — linux/amd64 + const SeccompOffArch — linux/amd64 + const SeccompOffNR — linux/amd64 + const SeccompX32SyscallBit — linux/amd64 + const Stage2RungOne — linux/amd64 + const Stage2SentinelEnv — linux/amd64 + const Stage2SentinelValue — linux/amd64 + const Stage2SpecFD — linux/amd64 + var ErrInitNotCalled = errors.New(...) — linux/amd64 + func BuildRung1Ruleset(conn *nftables.Conn, spec NftSpec) error — linux/amd64 + func BuildSeccompFilter() []unix.SockFilter — linux/amd64 + func CIDRVerdictRule(table *nftables.Table, chain *nftables.Chain, cidr string, ...) (*nftables.Rule, error) — linux/amd64 + func CgroupCompileReport(cg CompiledCgroup) profile.ReportEntry — linux/amd64 + func CompileNftPlan(n policy.NetPolicy) compiledNftPlan — linux/amd64 + func ConfigureRung1SysProcAttr(attr *syscall.SysProcAttr, netConfined bool) — linux/amd64 + func CreateTransientCgroup(cg CompiledCgroup) (*transientCgroup, error) — linux/amd64 + func DaddrMatchExprs(ipnet *net.IPNet) []expr.Any — linux/amd64 + func DportAcceptRule(table *nftables.Table, chain *nftables.Chain, proto byte, port uint16) *nftables.Rule — linux/amd64 + func EncodeStage2Spec(w io.Writer, spec Stage2Spec) error — linux/amd64 + func EnsureResOptionsUseVC(env []string) []string — linux/amd64 + func FormatCPUMax(pct int) string — linux/amd64 + func Ifname(n string) []byte — linux/amd64 + func Init() — linux/amd64 + func LandlockAccessSet(access policy.FSAccess, isDir bool) landlock.AccessFSSet — linux/amd64 + func LookPathIn(name string, env []string) (string, error) — linux/amd64 + func NetCompileReport(n policy.NetPolicy, cnet CompiledNet) []profile.ReportEntry — linux/amd64 + func ParseCIDR(s string) (*net.IPNet, error) — linux/amd64 + func PlatformBackend() (enforce.Backend, error) — linux/amd64 + func ProbeDelegatedPidsAncestor() string — linux/amd64 + func ProbeLandlockABI() int — linux/amd64 + func ProbeSeccompFilter() bool — linux/amd64 + func RunStage2() — linux/amd64 + func SelectBackend(r Rung, initCalled bool) (enforce.Backend, error) — linux/amd64 + func SelfCgroupDir() (string, bool) — linux/amd64 + type Backend struct — linux/amd64 + CgroupPids string + Rung Rung + func NewBackend() *Backend + func NewBackendRung1() *Backend + func (b Backend) Compile(p policy.Effective) (enforce.Spec, profile.CompileReport, uint8, uint64, error) + func (b Backend) CompileWithPathHandles(p policy.Effective, handles []*policy.PathHandle) (enforce.Spec, profile.CompileReport, uint8, uint64, error) + type BindSpec struct — linux/amd64 + IsDir bool + ReadOnly bool + Source string + Target string + type Caps struct — linux/amd64 + CgroupPids string + CgroupV2 bool + LandlockABI int + Mountns bool + Netns bool + Seccomp bool + Userns bool + func ProbeCaps() Caps + func (c Caps) SelectRung() Rung + type CgroupProofError struct — linux/amd64 + Err error + Op string + func (e *CgroupProofError) Error() string + func (e *CgroupProofError) Unwrap() error + type CompiledCgroup struct — linux/amd64 + Ancestor string + CPUPct int + Disabled bool + MemMax int64 + PidsMax int64 + func CompileCgroupPolicy(l policy.Limits, Ancestor string) CompiledCgroup + func (c CompiledCgroup) Enforced() bool + type CompiledNet struct — linux/amd64 + Confined bool + Dns bool + TcpPorts []uint16 + func CompileNetPolicy(n policy.NetPolicy) CompiledNet + type LifetimeScope interface — linux/amd64 + Join func(attr *syscall.SysProcAttr) + KillAndWait func(ctx context.Context) error + func NewLifetimeScope(ancestor string) (LifetimeScope, error) + type MaskSpec struct — linux/amd64 + IsDir bool + Target string + func ScanGlobDenies(roots, globs []string, maxDepth int) []MaskSpec + type MountViewPlan struct — linux/amd64 + DenyMasks []string + GlobDenies []string + ROBinds []string + RWBinds []string + func CompileMountView(p policy.Effective) MountViewPlan + type MountViewSpec struct — linux/amd64 + Binds []BindSpec + Masks []MaskSpec + func EnumerateMountView(plan MountViewPlan) (MountViewSpec, error) + type NftSpec struct — linux/amd64 + Confined bool + DNS bool + Loopback bool + MetadataCIDRs []string + Private bool + TCPPorts []uint16 + type Rung uint8 — linux/amd64 + const RungNone + const RungOne + const RungTwo + type Stage2Error struct — linux/amd64 + Err error + Op string + func (e *Stage2Error) Error() string + func (e *Stage2Error) Unwrap() error + type Stage2Spec struct — linux/amd64 + Argv []string + Dir string + Env []string + FSRules []policy.FSRule + GrantFDs []int + MountView MountViewSpec + NetConfined bool + NetTCPPorts []uint16 + NftRules NftSpec + Rung uint8 + Seccomp bool + func DecodeStage2Spec(f *os.File) (Stage2Spec, error) v0.8.1 Aug 11, 2026 v0.8.0 Aug 11, 2026 v0.7.0 Aug 7, 2026 v0.6.1 Aug 7, 2026 v0.6.0 Aug 7, 2026 v0.5.1 Aug 5, 2026 v0.5.0 Jul 30, 2026 v0.4.0 Jul 28, 2026
Go to main page