chore: import upstream snapshot with attribution

Sources/CShim/capability.c

@@ -0,0 +1,32 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if defined(__linux__)
+
+#include <sys/syscall.h>
+#include <unistd.h>
+#include "capability.h"
+
+// Capability syscall wrappers
+int CZ_capget(void *header, void *data) {
+    return syscall(SYS_capget, header, data);
+}
+
+int CZ_capset(void *header, void *data) {
+    return syscall(SYS_capset, header, data);
+}
+
+#endif

Sources/CShim/cz_tap.c

@@ -0,0 +1,78 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if defined(__linux__)
+
+#include "cz_tap.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <net/if.h>     /* struct ifreq, IFNAMSIZ */
+#include <string.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+/*
+ * Avoid <linux/if_tun.h> — the Static Linux SDK (musl) used to cross-compile
+ * vminitd ships <net/if.h> from musl but not the linux kernel UAPI headers.
+ * The TUN ioctl number and flags are stable Linux ABI; redeclare locally.
+ *
+ * TUNSETIFF = _IOW('T', 202, int):
+ *   dir=IOC_WRITE(1)<<30 | size(4)<<16 | type('T'=0x54)<<8 | nr(202=0xCA)
+ *   = 0x400454CA
+ * Architecture-independent (Linux's ioctl encoding is the same on x86/arm).
+ */
+#ifndef TUNSETIFF
+#define TUNSETIFF 0x400454CAu
+#endif
+#ifndef IFF_TAP
+#define IFF_TAP 0x0002
+#endif
+#ifndef IFF_NO_PI
+#define IFF_NO_PI 0x1000
+#endif
+
+int cz_tap_create(const char *requested_name, char *out_name, size_t out_name_len) {
+    if (out_name == NULL || out_name_len < IFNAMSIZ) {
+        return -EINVAL;
+    }
+
+    int fd = open("/dev/net/tun", O_RDWR | O_CLOEXEC);
+    if (fd < 0) {
+        return -errno;
+    }
+
+    struct ifreq ifr;
+    memset(&ifr, 0, sizeof(ifr));
+    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
+    if (requested_name != NULL && requested_name[0] != '\0') {
+        strncpy(ifr.ifr_name, requested_name, IFNAMSIZ - 1);
+    }
+
+    if (ioctl(fd, TUNSETIFF, &ifr) < 0) {
+        int saved = errno;
+        close(fd);
+        return -saved;
+    }
+
+    /* Copy out the resolved name. ifr.ifr_name is always NUL-terminated
+     * within IFNAMSIZ by the kernel. */
+    memset(out_name, 0, out_name_len);
+    strncpy(out_name, ifr.ifr_name, IFNAMSIZ - 1);
+    return fd;
+}
+
+#endif /* __linux__ */

Sources/CShim/exec_command.c

@@ -0,0 +1,393 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if defined(__linux__) || defined(__APPLE__)
+
+#include <errno.h>
+#include <fcntl.h>
+#include <dirent.h>
+#include <limits.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#if defined(__linux__)
+#include <sys/prctl.h>
+#endif
+
+#include "exec_command.h"
+
+#ifndef SYS_close_range
+#define SYS_close_range 436
+#endif
+
+#ifndef CLOSE_RANGE_CLOEXEC
+#define CLOSE_RANGE_CLOEXEC 0x4
+#endif
+
+static int mark_cloexec(int fd) {
+    int flags = fcntl(fd, F_GETFD);
+
+    if (flags == -1) return flags;
+    if (flags & FD_CLOEXEC) return 0;
+
+    return fcntl(fd, F_SETFD, flags | FD_CLOEXEC);
+}
+
+static int cloexec_from(int min_fd) {
+#if defined(__linux__)
+    // First try close_range.
+    long ret = syscall(SYS_close_range, min_fd, ~0U, CLOSE_RANGE_CLOEXEC);
+    if (ret == 0) {
+      return 0;
+    }
+    const char* dirpath = "/proc/self/fd";
+#elif defined(__APPLE__)
+    const char* dirpath = "/dev/fd";
+#endif
+    DIR *dp = opendir(dirpath);
+    if (!dp) return -1;
+
+    int dp_fd = dirfd(dp);
+    struct dirent *de;
+
+    while ((de = readdir(dp))) {
+      if (de->d_name[0] == '.') continue;
+
+      char *end;
+      long val = strtol(de->d_name, &end, 10);
+      if (*end || val < 0 || val > INT_MAX) continue;
+
+      int fd = (int)val;
+      if (fd < min_fd || fd == dp_fd) continue;
+
+      int ret = mark_cloexec(fd);
+      if (ret != 0) {
+        return ret;
+      }
+    }
+    close(dp_fd);
+    closedir(dp);
+    return 0;
+}
+
+void exec_command_attrs_init(struct exec_command_attrs *attrs) {
+  attrs->setpgid = 0;
+  attrs->pgid = 0;
+  attrs->setsid = 0;
+  attrs->setctty = 0;
+  attrs->ctty = 0;
+  attrs->mask = 0;
+  attrs->uid = -1;
+  attrs->gid = -1;
+  attrs->pdeathSignal = 0;
+  attrs->setfgpgrp = 0;
+}
+
+static void child_handler(const int sync_pipes[2], const char *executable,
+                          char *const args[], char *const environment[],
+                          const int file_handles[], const int file_handle_count,
+                          const char *cwd, const sigset_t old_mask,
+                          const struct exec_command_attrs attrs) {
+  int i = 0;
+  int err = 0;
+  int fd_index = 0;
+  int fd_table[file_handle_count];
+  struct rlimit limits = {0};
+  int syncfd = sync_pipes[1];
+  struct sigaction action = {0};
+
+  // Closing our parent's side of the pipe
+  if (close(sync_pipes[0]) < 0) {
+    goto fail;
+  }
+
+  // Setup process group and foreground before clearing signal mask.
+  if (attrs.setpgid) {
+    if (setpgid(0, attrs.pgid) < 0) {
+      goto fail;
+    }
+  }
+
+  // Make the new process group the foreground process group so it can read from the TTY.
+  if (attrs.setfgpgrp) {
+    if (tcsetpgrp(STDIN_FILENO, getpgrp()) < 0) {
+      if (errno != ENOTTY && errno != ENXIO) {
+        goto fail;
+      }
+    }
+  }
+
+  // clear sighandlers
+  action.sa_flags = 0;
+  action.sa_handler = SIG_DFL;
+  sigemptyset(&action.sa_mask);
+  for (i = 0; i < NSIG; i++) {
+    sigaction(i, &action, 0);
+  }
+
+  sigset_t local_mask;
+  sigemptyset(&local_mask);
+  if (pthread_sigmask(SIG_SETMASK, &local_mask, NULL) < 0) {
+    goto fail;
+  }
+
+  // start shuffling fds.
+  // look at all the file handles and find the highest one,
+  // use that for our pipe,
+  //
+  // Then, we need to start dup2 the fds starting for the final process
+  // at 0-n.
+  // as an example we have this list of FDs that should be passed to the
+  // process:
+  //
+  /*
+   The index of this list is the final result that the new process expects.
+   The values are open fds provided from the parent process.
+   [0] == 12
+   [1] == 7
+   [2] == 9
+   [3] == 0
+
+   We also have a pipe to sync the child and parent so that adds an additional
+   parameter to consider.
+
+   So we start by finding the highest open fd in the list, then move our pipe to
+   the next.
+
+   i.e. fd12 is highest so move our pipe to fd13
+
+   Now start moving all the fds above our pipe as we will need to start placing
+   the fds in the child process into the right order. Make sure they are all
+   marked cloexec.
+
+   pipe == 13
+   [0] == 12 dup2 14
+   [1] == 7 dup2 15
+   [2] == 9 dup2 16
+   [3] == 0 dup2 17
+
+   Now overwrite the fd table for the child with the current index.
+
+   Make index == fd.
+
+   pipe == 13
+   [0] == 14 dup2 0
+   [1] == 15 dup2 1
+   [2] == 16 dup2 2
+   [3] == 17 dup2 3
+
+   Clear cloexec on this new fds.
+   */
+
+  // find the highest fd value in our list.
+  for (i = 0; i < file_handle_count; i++) {
+    if (file_handles[i] > fd_index) {
+      fd_index = file_handles[i];
+    }
+    fd_table[i] = file_handles[i];
+  }
+  // now fd_index is == to the highest fd in our list of handles.
+  // Increment it and set our pipe to it.
+  fd_index++;
+
+  if (syncfd != fd_index) {
+    if (dup2(syncfd, fd_index) < 0) {
+      goto fail;
+    }
+    if (close(syncfd) < 0) {
+      goto fail;
+    }
+    syncfd = fd_index;
+  }
+  fd_index++;
+
+  // make sure our syncfd retains its cloexec
+  if (fcntl(syncfd, F_SETFD, FD_CLOEXEC) == -1) {
+    goto fail;
+  }
+
+  // move the rest of the fds up above our index if they don't match the index.
+  for (i = 0; i < file_handle_count; i++) {
+    if (fd_table[i] == i) {
+      continue;
+    }
+    if (dup2(fd_table[i], fd_index) < 0) {
+      goto fail;
+    }
+    if (fcntl(fd_index, F_SETFD, FD_CLOEXEC) == -1) {
+      goto fail;
+    }
+    fd_table[i] = fd_index;
+    fd_index++;
+  }
+
+  // now create the child process's final fd table. where i == i
+  for (i = 0; i < file_handle_count; i++) {
+    if (fd_table[i] != i) {
+      if (dup2(fd_table[i], i) < 0) {
+        goto fail;
+      }
+    }
+    // now fd[i] should == i
+    // clear cloexec as this fd is where we want it.
+    if (fcntl(i, F_SETFD, 0) == -1) {
+      goto fail;
+    }
+  }
+
+  if (attrs.setsid) {
+    if (setsid() == -1) {
+      goto fail;
+    }
+  }
+
+  if (attrs.setctty) {
+    if (ioctl(attrs.ctty, TIOCSCTTY, 0)) {
+      goto fail;
+    }
+  }
+
+#if defined(__linux__)
+  // Set parent death signal if specified
+  if (attrs.pdeathSignal != 0) {
+    if (prctl(PR_SET_PDEATHSIG, attrs.pdeathSignal) != 0) {
+      goto fail;
+    }
+  }
+#endif
+
+  // close exec everything outside of our child's fd_table.
+  if (cloexec_from(file_handle_count) != 0) {
+    goto fail;
+  }
+
+  // set gid
+  if (attrs.gid != -1) {
+    if (setgid(attrs.gid) != 0) {
+      goto fail;
+    }
+  }
+
+  // set uid
+  if (attrs.uid != -1) {
+    if (setreuid(attrs.uid, attrs.uid) != 0) {
+      goto fail;
+    }
+  }
+
+  if (cwd != NULL) {
+    if (chdir(cwd)) {
+      goto fail;
+    }
+  }
+
+  execve(executable, args, environment);
+fail:
+  err = errno;
+  if (err) {
+    // send our error to the parent
+    while (write(syncfd, &err, sizeof(err)) < 0)
+      ;
+  }
+  exit(127);
+}
+
+int exec_command(pid_t *result, const char *executable, char *const args[],
+                 char *const envp[], const int file_handles[],
+                 const int file_handle_count, const char *working_directory,
+                 struct exec_command_attrs *attrs) {
+  pid_t pid = 0;
+  int err = 0;
+  int sync_pipe[2];
+  sigset_t old_mask;
+
+  sigset_t all;
+  sigfillset(&all);
+
+  if (pipe(sync_pipe)) {
+    goto fail;
+  }
+
+  if (pthread_sigmask(SIG_SETMASK, &all, &old_mask) < 0) {
+    goto fail;
+  }
+
+  pid = fork();
+  if (pid == -1) {
+    close(sync_pipe[0]);
+    close(sync_pipe[1]);
+    goto fail;
+  }
+
+  if (pid == 0) {
+    // hand off to child
+    child_handler(sync_pipe, executable, args, envp, file_handles,
+                  file_handle_count, working_directory, old_mask, *attrs);
+    exit(EXIT_FAILURE);
+  }
+
+  // handle parent operations
+  if (close(sync_pipe[1]) < 0) {
+    goto fail;
+  }
+
+  // sync with our child process
+  err = 0;
+  ssize_t size = read(sync_pipe[0], &err, sizeof(err));
+  // -- we didn't get an errno back
+  if (size != sizeof(err)) {
+    // will be used as return result
+    err = 0;
+  } else {
+    // we did get an errno back from the child process and our
+    // err var is set to that errno
+    // lets set our errno and then reap the process
+    errno = err;
+    int status = 0;
+    waitpid(pid, &status, 0);
+    // lets continue our journey below
+  }
+
+  if (close(sync_pipe[0]) < 0) {
+    goto fail;
+  }
+  if (err) {
+    goto fail;
+  }
+
+  (*result) = pid;
+  err = 0;
+fail:
+  if (pthread_sigmask(SIG_SETMASK, &old_mask, 0) < 0) {
+    printf("restoring signal mask: %s\n", strerror(errno));
+  }
+  if (err) {
+    printf("exec_command execve: %s\n", strerror(err));
+    return -1;
+  }
+  return 0;
+}
+
+#endif

Sources/CShim/include/capability.h

@@ -0,0 +1,28 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CAPABILITY_H
+#define __CAPABILITY_H
+
+#if defined(__linux__)
+
+// Capability syscall wrappers
+int CZ_capget(void *header, void *data);
+int CZ_capset(void *header, void *data);
+
+#endif
+
+#endif

Sources/CShim/include/cz_tap.h

@@ -0,0 +1,39 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CZ_TAP_H
+#define __CZ_TAP_H
+
+#include <stddef.h>
+
+/*
+ * Open /dev/net/tun, ioctl(TUNSETIFF) with IFF_TAP|IFF_NO_PI, and write the
+ * resolved interface name into `out_name` (must be at least 16 bytes).
+ *
+ * If `requested_name` is non-NULL and non-empty, it is the desired name; the
+ * kernel may rename it on collision (rare). If NULL or empty, the kernel
+ * picks a name like "tap%d".
+ *
+ * Returns the open fd on success, -errno on failure.
+ *
+ * Linux-only — the implementation in cz_tap.c is gated on __linux__. The
+ * declaration is left unconditional so Swift's clang importer can see it
+ * regardless of whose target's preprocessor defines reach the modulemap.
+ * On non-Linux targets the symbol is not provided; do not call.
+ */
+int cz_tap_create(const char *requested_name, char *out_name, size_t out_name_len);
+
+#endif /* __CZ_TAP_H */

Sources/CShim/include/exec_command.h

@@ -0,0 +1,56 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef exec_command_h
+#define exec_command_h
+
+#if defined(__linux__) || defined(__APPLE__)
+
+#include <sys/types.h>
+#include <unistd.h>
+
+struct exec_command_attrs {
+  int setpgid;
+  /// parent group id
+  pid_t pgid;
+  /// set the controlling terminal
+  int setctty;
+  /// controlling terminal fd
+  int ctty;
+  /// set the process as session leader
+  int setsid;
+  /// set the process user id
+  uid_t uid;
+  /// set the process group id
+  gid_t gid;
+  /// signal mask for the child process
+  int mask;
+  /// parent death signal (Linux only, 0 to disable)
+  int pdeathSignal;
+  /// make the new process group the foreground process group
+  int setfgpgrp;
+};
+
+void exec_command_attrs_init(struct exec_command_attrs *attrs);
+
+/// spawn a new child process with the provided attrs
+int exec_command(pid_t *result, const char *executable, char *const argv[],
+                 char *const envp[], const int file_handles[],
+                 const int file_handle_count, const char *working_directory,
+                 struct exec_command_attrs *attrs);
+
+#endif /* defined(__linux__) || defined(__APPLE__) */
+#endif /* exec_command_h */

Sources/CShim/include/linux_shim.h

@@ -0,0 +1,32 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// The below fall into two main categories:
+// 1. Aren't exposed by Swifts glibc modulemap.
+// 2. Don't have syscall wrappers/definitions in glibc/musl.
+
+#ifndef __LINUX_SHIM_H
+#define __LINUX_SHIM_H
+
+#if defined(__linux__)
+
+#include <sys/epoll.h>
+#include <sys/eventfd.h>
+#include <sys/vfs.h>
+
+#endif /* __linux__ */
+
+#endif /* __LINUX_SHIM_H */

Sources/CShim/include/openat2.h

@@ -0,0 +1,37 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __OPENAT2_H
+#define __OPENAT2_H
+
+#include <sys/types.h>
+
+#ifndef RESOLVE_IN_ROOT
+#define RESOLVE_IN_ROOT 0x10
+#endif
+
+struct cz_open_how {
+  unsigned long long flags;
+  unsigned long long mode;
+  unsigned long long resolve;
+};
+
+/// openat2(2) wrapper. Musl does not provide openat2 so we invoke the syscall
+/// directly. Requires Linux 5.6+.
+int CZ_openat2(int dirfd, const char *pathname, struct cz_open_how *how,
+               size_t size);
+
+#endif

Sources/CShim/include/prctl.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __PRCTL_H
+#define __PRCTL_H
+
+#if defined(__linux__)
+
+#include <sys/types.h>
+
+// Capability management prctl wrappers
+int CZ_prctl_set_keepcaps();
+int CZ_prctl_clear_keepcaps();
+int CZ_prctl_capbset_drop(unsigned int capability);
+int CZ_prctl_cap_ambient_clear_all();
+int CZ_prctl_cap_ambient_raise(unsigned int capability);
+
+#endif
+
+#endif

Sources/CShim/include/socket_helpers.h

@@ -0,0 +1,29 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef socket_helpers_h
+#define socket_helpers_h
+
+#include <sys/socket.h>
+#include <stdint.h>
+
+// Helper functions to access CMSG macros from Swift
+struct cmsghdr* CZ_CMSG_FIRSTHDR(struct msghdr *msg);
+void* CZ_CMSG_DATA(struct cmsghdr *cmsg);
+size_t CZ_CMSG_SPACE(size_t length);
+size_t CZ_CMSG_LEN(size_t length);
+
+#endif /* socket_helpers_h */

Sources/CShim/include/vsock.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+
+#ifndef vsock_h
+#define vsock_h
+
+#include <sys/ioctl.h>
+
+#ifdef __APPLE__
+    #include <sys/vsock.h>
+#else
+    #include <sys/socket.h>
+    #include <linux/vm_sockets.h>
+#endif /* __APPLE__ */
+
+extern const unsigned long VsockLocalCIDIoctl;
+
+#endif /* vsock_h */

Sources/CShim/openat2.c

@@ -0,0 +1,33 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if defined(__linux__)
+
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#include "openat2.h"
+
+#ifndef SYS_openat2
+#define SYS_openat2 437
+#endif
+
+int CZ_openat2(int dirfd, const char *pathname, struct cz_open_how *how,
+               size_t size) {
+  return syscall(SYS_openat2, dirfd, pathname, how, size);
+}
+
+#endif

Sources/CShim/prctl.c

@@ -0,0 +1,47 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if defined(__linux__)
+
+#include <sys/prctl.h>
+#include "prctl.h"
+
+// Set keep caps to preserve capabilities across setuid()
+int CZ_prctl_set_keepcaps() {
+    return prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
+}
+
+// Clear keep caps after user change
+int CZ_prctl_clear_keepcaps() {
+    return prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
+}
+
+// Drop capability from bounding set
+int CZ_prctl_capbset_drop(unsigned int capability) {
+    return prctl(PR_CAPBSET_DROP, capability, 0, 0, 0);
+}
+
+// Clear all ambient capabilities
+int CZ_prctl_cap_ambient_clear_all() {
+    return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
+}
+
+// Raise ambient capability
+int CZ_prctl_cap_ambient_raise(unsigned int capability) {
+    return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, capability, 0, 0);
+}
+
+#endif

Sources/CShim/socket_helpers.c

@@ -0,0 +1,33 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "socket_helpers.h"
+
+struct cmsghdr* CZ_CMSG_FIRSTHDR(struct msghdr *msg) {
+    return CMSG_FIRSTHDR(msg);
+}
+
+void* CZ_CMSG_DATA(struct cmsghdr *cmsg) {
+    return CMSG_DATA(cmsg);
+}
+
+size_t CZ_CMSG_SPACE(size_t length) {
+    return CMSG_SPACE(length);
+}
+
+size_t CZ_CMSG_LEN(size_t length) {
+    return CMSG_LEN(length);
+}

Sources/CShim/vsock.c

@@ -0,0 +1,19 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vsock.h"
+
+const unsigned long VsockLocalCIDIoctl = IOCTL_VM_SOCKETS_GET_LOCAL_CID;