Merge changes I45d3895f,I541be3ea,Ibe51416d into main

* changes:
  libstore/build: block io_uring
  libstore/build: use an allowlist approach to syscall filtering
  libstore/build: always treat seccomp setup failures as fatal

1 files changed, 19 insertions, 0 deletions

diff --git a/tests/nixos/io_uring/package.nix b/tests/nixos/io_uring/package.nix
new file mode 100644
index 000000000..8f980183a
--- /dev/null
+++ b/tests/nixos/io_uring/package.nix
@@ -0,0 +1,19 @@
+{ runCommandCC }:
+runCommandCC "io_uring-is-blocked" { } ''
+  cat > test.c <<EOF
+  #include <errno.h>
+  #include <sys/syscall.h>
+  #include <unistd.h>
+
+  int main() {
+      int res = syscall(SYS_io_uring_setup, 0, NULL);
+      return res == -1 && errno == ENOSYS ? 0 : 1;
+  }
+  EOF
+  "$CC" -o test test.c
+  if ! ./test; then
+    echo "Oh no! io_uring is available!"
+    exit 1
+  fi
+  touch "$out"
+''