chore: import upstream snapshot with attribution

Sources/CShim/include/capability.h

@@ -0,0 +1,28 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CAPABILITY_H
+#define __CAPABILITY_H
+
+#if defined(__linux__)
+
+// Capability syscall wrappers
+int CZ_capget(void *header, void *data);
+int CZ_capset(void *header, void *data);
+
+#endif
+
+#endif

Sources/CShim/include/cz_tap.h

@@ -0,0 +1,39 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CZ_TAP_H
+#define __CZ_TAP_H
+
+#include <stddef.h>
+
+/*
+ * Open /dev/net/tun, ioctl(TUNSETIFF) with IFF_TAP|IFF_NO_PI, and write the
+ * resolved interface name into `out_name` (must be at least 16 bytes).
+ *
+ * If `requested_name` is non-NULL and non-empty, it is the desired name; the
+ * kernel may rename it on collision (rare). If NULL or empty, the kernel
+ * picks a name like "tap%d".
+ *
+ * Returns the open fd on success, -errno on failure.
+ *
+ * Linux-only — the implementation in cz_tap.c is gated on __linux__. The
+ * declaration is left unconditional so Swift's clang importer can see it
+ * regardless of whose target's preprocessor defines reach the modulemap.
+ * On non-Linux targets the symbol is not provided; do not call.
+ */
+int cz_tap_create(const char *requested_name, char *out_name, size_t out_name_len);
+
+#endif /* __CZ_TAP_H */

Sources/CShim/include/exec_command.h

@@ -0,0 +1,56 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef exec_command_h
+#define exec_command_h
+
+#if defined(__linux__) || defined(__APPLE__)
+
+#include <sys/types.h>
+#include <unistd.h>
+
+struct exec_command_attrs {
+  int setpgid;
+  /// parent group id
+  pid_t pgid;
+  /// set the controlling terminal
+  int setctty;
+  /// controlling terminal fd
+  int ctty;
+  /// set the process as session leader
+  int setsid;
+  /// set the process user id
+  uid_t uid;
+  /// set the process group id
+  gid_t gid;
+  /// signal mask for the child process
+  int mask;
+  /// parent death signal (Linux only, 0 to disable)
+  int pdeathSignal;
+  /// make the new process group the foreground process group
+  int setfgpgrp;
+};
+
+void exec_command_attrs_init(struct exec_command_attrs *attrs);
+
+/// spawn a new child process with the provided attrs
+int exec_command(pid_t *result, const char *executable, char *const argv[],
+                 char *const envp[], const int file_handles[],
+                 const int file_handle_count, const char *working_directory,
+                 struct exec_command_attrs *attrs);
+
+#endif /* defined(__linux__) || defined(__APPLE__) */
+#endif /* exec_command_h */

Sources/CShim/include/linux_shim.h

@@ -0,0 +1,32 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// The below fall into two main categories:
+// 1. Aren't exposed by Swifts glibc modulemap.
+// 2. Don't have syscall wrappers/definitions in glibc/musl.
+
+#ifndef __LINUX_SHIM_H
+#define __LINUX_SHIM_H
+
+#if defined(__linux__)
+
+#include <sys/epoll.h>
+#include <sys/eventfd.h>
+#include <sys/vfs.h>
+
+#endif /* __linux__ */
+
+#endif /* __LINUX_SHIM_H */

Sources/CShim/include/openat2.h

@@ -0,0 +1,37 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __OPENAT2_H
+#define __OPENAT2_H
+
+#include <sys/types.h>
+
+#ifndef RESOLVE_IN_ROOT
+#define RESOLVE_IN_ROOT 0x10
+#endif
+
+struct cz_open_how {
+  unsigned long long flags;
+  unsigned long long mode;
+  unsigned long long resolve;
+};
+
+/// openat2(2) wrapper. Musl does not provide openat2 so we invoke the syscall
+/// directly. Requires Linux 5.6+.
+int CZ_openat2(int dirfd, const char *pathname, struct cz_open_how *how,
+               size_t size);
+
+#endif

Sources/CShim/include/prctl.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __PRCTL_H
+#define __PRCTL_H
+
+#if defined(__linux__)
+
+#include <sys/types.h>
+
+// Capability management prctl wrappers
+int CZ_prctl_set_keepcaps();
+int CZ_prctl_clear_keepcaps();
+int CZ_prctl_capbset_drop(unsigned int capability);
+int CZ_prctl_cap_ambient_clear_all();
+int CZ_prctl_cap_ambient_raise(unsigned int capability);
+
+#endif
+
+#endif

Sources/CShim/include/socket_helpers.h

@@ -0,0 +1,29 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef socket_helpers_h
+#define socket_helpers_h
+
+#include <sys/socket.h>
+#include <stdint.h>
+
+// Helper functions to access CMSG macros from Swift
+struct cmsghdr* CZ_CMSG_FIRSTHDR(struct msghdr *msg);
+void* CZ_CMSG_DATA(struct cmsghdr *cmsg);
+size_t CZ_CMSG_SPACE(size_t length);
+size_t CZ_CMSG_LEN(size_t length);
+
+#endif /* socket_helpers_h */

Sources/CShim/include/vsock.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//
+
+#ifndef vsock_h
+#define vsock_h
+
+#include <sys/ioctl.h>
+
+#ifdef __APPLE__
+    #include <sys/vsock.h>
+#else
+    #include <sys/socket.h>
+    #include <linux/vm_sockets.h>
+#endif /* __APPLE__ */
+
+extern const unsigned long VsockLocalCIDIoctl;
+
+#endif /* vsock_h */