RunSeccomp

---

Object Hierarchy:

Description:

Content:

Constants:

• public const int SYNC_SOCK_CHILD_FD
  Fixed child fd for the sync socket end (must not collide with stdio 0–2).

Properties:

• public unowned Bubble bubble { get; }
  Sandbox profile for this run; set at construction, must outlive this object.
• public string fs { get; }
• public string network { get; }
• public string skipped { get; }

Creation methods:

• public RunSeccomp (Bubble sandbox_bubble)

Methods:

• public void attach_notify_loop ()
  Attach an IO watch on the default main context for NOTIFY while the subprocess runs.
• public void detach_sources ()
  Remove fd source and close fds (safe from exec finally if spawn failed early).
• public void drain_notify_readable ()
  Drain the notify fd until EAGAIN (non-blocking).
• public void finish_evidence_formatting ()
  Build network/fs appendix strings from counters (call after process exit + drain).
• public void finish_handshake ()
  After spawn: receive notify fd from child setup.
• public void wire_launcher (SubprocessLauncher launcher)
  Prepare a launcher: socketpair, map child end to SYNC_SOCK_CHILD_FD, child_setup installs filter. NOTIFY policy is read from #bubble in the child (see #child_seccomp_handshake).

Inherited Members: