OXYGENHUB

The x86_64 seccomp block builds for Android too (refs oxygenhub-android#8) fa963b1b7eb6

Its BPF_JGE came from libc, which lacks it for Android: the app's
x86_64 (emulator) build of the runner failed where arm64's passed.
Spelled out like the others, and in the test against glibc's values;
both Android targets checked.
Author
Andy McCall @andymccall <[email protected]>
via
agent agent:claude@andymccall <[email protected]> · keyless, under your grant for changes,refs,seal · key 535b53b57524
When
· 2026-10-25 15:03 UTC
Signature
◈ sealed by agent:claude@andymccall
Hash
fa963b1b7eb66f963195a8a9f39c2a356cc99fdc9225223e28039fab947b099d
Depends on
28cc603f737d 5cf1e8aefbb6 c3db750ed96e ea56c56eaf90
Depended on by
nothing yet
In bookmarks
main
In tags
v0.4.0 v0.5.0 v0.5.1 v0.5.2 v0.5.3
Edits
6 atoms, 0 tree operations, 2 files

Browse the tree at this change

show whitespace changes
modified CHANGELOG.md +1 −1
… 
4 unchanged lines
5 5 
## Unreleased
6 6 

    

  
    

      7
      7
       
      
- **The WASM tier (#75):** `runtime "wasm"` runs WASI preview 1 modules with wasmtime 49 on any runner (`flow tiers` offers `wasm` everywhere): no rootfs, no network, the job's files at `/src`, its mounts at their targets, the memory limit enforced by wasmtime. `exec` names a module or a glob of them (`target/wasm32-wasip1/debug/deps/*.wasm` runs each test binary in turn); the receipt names wasmtime's version and every module's hash. The tier phones and browsers will run (docs/handover.md). Secrets and identities are not offered in it yet.

    

  
    

      8
      
      -
      
- **The runner as a library, for the phone (oxygenhub-android#8):** `flow` is now a library and the command built on it, and the whole runner builds for Android (`aarch64-linux-android`); `runner::serve_embedded` and `runner::stop` run it inside an app and drain it. There the WASM tier runs modules in a thread rather than a child process (also with `FLOW_WASM_IN_PROCESS`), streaming their output from pipes, stopping them at the time limit or when the run is cancelled through wasmtime's epoch, and reporting the most memory they asked for. Two portability fixes on the way (the seccomp filter's BPF opcodes and an ioctl request type).

    

  
    

      
      8
      +
      
- **The runner as a library, for the phone (oxygenhub-android#8):** `flow` is now a library and the command built on it, and the whole runner builds for Android (`aarch64-linux-android`); `runner::serve_embedded` and `runner::stop` run it inside an app and drain it. There the WASM tier runs modules in a thread rather than a child process (also with `FLOW_WASM_IN_PROCESS`), streaming their output from pipes, stopping them at the time limit or when the run is cancelled through wasmtime's epoch, and reporting the most memory they asked for. Two portability fixes on the way (the seccomp filter's BPF opcodes, for arm64 and x86_64, and an ioctl request type).

    

  
    

      9
      9
       
      
- **cargo-nextest in the Rust image (#81):** for JUnit test reports beside `cargo llvm-cov`'s coverage.

    

  
    

      10
      10
       
      
## 0.3.1 (2026-10-25)

    

  
    

      11
      11
       
      

    

  
    

      
      
      …
      
85 unchanged lines

    

  
  

  





  
    modified
    crates/flow/src/syscall.rs
    +5 −3
  
  
  

  
    

      
      
      …
      
836 unchanged lines

    

  
    

      837
      837
       
      
const BPF_ABS: u16 = 0x20;

    

  
    

      838
      838
       
      
const BPF_JMP: u16 = 0x05;

    

  
    

      839
      839
       
      
const BPF_JEQ: u16 = 0x10;

    

  
    

      
      840
      +
      
const BPF_JGE: u16 = 0x30;

    

  
    

      840
      841
       
      
const BPF_K: u16 = 0x00;

    

  
    

      841
      842
       
      
const BPF_RET: u16 = 0x06;

    

  
    

      842
      843
       
      

    

  
    

      
      
      …
      
12 unchanged lines

    

  
    

      855
      856
       
      
    #[cfg(target_arch = "x86_64")]

    

  
    

      856
      857
       
      
    {

    

  
    

      857
      858
       
      
        // x32 calls carry this bit; there are none in a 64-bit job.

    

  
    

      858
      
      -
      
        const JGE: u16 = (libc::BPF_JMP | libc::BPF_JGE | libc::BPF_K) as u16;

    

  
    

      
      859
      +
      
        const JGE: u16 = BPF_JMP | BPF_JGE | BPF_K;

    

  
    

      859
      860
       
      
        f.push(op(JGE, 0x4000_0000, 0, 1));

    

  
    

      860
      861
       
      
        f.push(op(RET, errno(libc::EPERM), 0, 0));

    

  
    

      861
      862
       
      
    }

    

  
    

      
      
      …
      
20 unchanged lines

    

  
    

      882
      883
       
      
    fn bpf_opcodes_are_the_kernels() {

    

  
    

      883
      884
       
      
        use super::*;

    

  
    

      884
      885
       
      
        assert_eq!(

    

  
    

      885
      
      -
      
            [BPF_LD, BPF_W, BPF_ABS, BPF_JMP, BPF_JEQ, BPF_K, BPF_RET],

    

  
    

      886
      
      -
      
            [libc::BPF_LD, libc::BPF_W, libc::BPF_ABS, libc::BPF_JMP, libc::BPF_JEQ, libc::BPF_K, libc::BPF_RET].map(|v| v as u16)

    

  
    

      
      886
      +
      
            [BPF_LD, BPF_W, BPF_ABS, BPF_JMP, BPF_JEQ, BPF_JGE, BPF_K, BPF_RET],

    

  
    

      
      887
      +
      
            [libc::BPF_LD, libc::BPF_W, libc::BPF_ABS, libc::BPF_JMP, libc::BPF_JEQ, libc::BPF_JGE, libc::BPF_K, libc::BPF_RET]

    

  
    

      
      888
      +
      
                .map(|v| v as u16)

    

  
    

      887
      889
       
      
        );

    

  
    

      888
      890
       
      
    }

    

  
    

      889
      891
       
      
}