Merge release-20210301.0-5-ga9441aea2 (automated)

9 files changed, 66 insertions, 69 deletions

diff --git a/pkg/sentry/fsimpl/host/control.go b/pkg/sentry/fsimpl/host/control.go
index 13ef48cb5..1680d456e 100644
--- a/pkg/sentry/fsimpl/host/control.go
+++ b/pkg/sentry/fsimpl/host/control.go
@@ -15,8 +15,7 @@
 package host
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
@@ -60,7 +59,7 @@ func (c *scmRights) Clone() transport.RightsControlMessage {
 // Release implements transport.RightsControlMessage.Release.
 func (c *scmRights) Release(ctx context.Context) {
 	for _, fd := range c.fds {
-		syscall.Close(fd)
+		unix.Close(fd)
 	}
 	c.fds = nil
 }
@@ -72,7 +71,7 @@ func fdsToFiles(ctx context.Context, fds []int) []*vfs.FileDescription {
 	for _, fd := range fds {
 		// Get flags. We do it here because they may be modified
 		// by subsequent functions.
-		fileFlags, _, errno := syscall.Syscall(syscall.SYS_FCNTL, uintptr(fd), syscall.F_GETFL, 0)
+		fileFlags, _, errno := unix.Syscall(unix.SYS_FCNTL, uintptr(fd), unix.F_GETFL, 0)
 		if errno != 0 {
 			ctx.Warningf("Error retrieving host FD flags: %v", error(errno))
 			break
diff --git a/pkg/sentry/fsimpl/host/host.go b/pkg/sentry/fsimpl/host/host.go
index 05f11fbd5..ad5de80dc 100644
--- a/pkg/sentry/fsimpl/host/host.go
+++ b/pkg/sentry/fsimpl/host/host.go
@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"math"
 	"sync/atomic"
-	"syscall"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -112,7 +111,7 @@ func newInode(ctx context.Context, fs *filesystem, hostFD int, savable bool, fil
 	seekable := err != syserror.ESPIPE
 	// We expect regular files to be seekable, as this is required for them to
 	// be memory-mappable.
-	if !seekable && fileType == syscall.S_IFREG {
+	if !seekable && fileType == unix.S_IFREG {
 		ctx.Infof("host.newInode: host FD %d is a non-seekable regular file", hostFD)
 		return nil, syserror.ESPIPE
 	}
@@ -121,7 +120,7 @@ func newInode(ctx context.Context, fs *filesystem, hostFD int, savable bool, fil
 		hostFD:   hostFD,
 		ino:      fs.NextIno(),
 		ftype:    uint16(fileType),
-		mayBlock: fileType != syscall.S_IFREG && fileType != syscall.S_IFDIR,
+		mayBlock: fileType != unix.S_IFREG && fileType != unix.S_IFDIR,
 		seekable: seekable,
 		isTTY:    isTTY,
 		savable:  savable,
@@ -132,7 +131,7 @@ func newInode(ctx context.Context, fs *filesystem, hostFD int, savable bool, fil
 	// If the hostFD can return EWOULDBLOCK when set to non-blocking, do so and
 	// handle blocking behavior in the sentry.
 	if i.mayBlock {
-		if err := syscall.SetNonblock(i.hostFD, true); err != nil {
+		if err := unix.SetNonblock(i.hostFD, true); err != nil {
 			return nil, err
 		}
 		if err := fdnotifier.AddFD(int32(i.hostFD), &i.queue); err != nil {
@@ -175,7 +174,7 @@ func NewFD(ctx context.Context, mnt *vfs.Mount, hostFD int, opts *NewFDOptions)
 	flags := opts.Flags
 	if !opts.HaveFlags {
 		// Get flags for the imported FD.
-		flagsInt, err := unix.FcntlInt(uintptr(hostFD), syscall.F_GETFL, 0)
+		flagsInt, err := unix.FcntlInt(uintptr(hostFD), unix.F_GETFL, 0)
 		if err != nil {
 			return nil, err
 		}
@@ -263,8 +262,8 @@ func (fs *filesystem) PrependPath(ctx context.Context, vfsroot, vd vfs.VirtualDe
 
 // CheckPermissions implements kernfs.Inode.CheckPermissions.
 func (i *inode) CheckPermissions(ctx context.Context, creds *auth.Credentials, ats vfs.AccessTypes) error {
-	var s syscall.Stat_t
-	if err := syscall.Fstat(i.hostFD, &s); err != nil {
+	var s unix.Stat_t
+	if err := unix.Fstat(i.hostFD, &s); err != nil {
 		return err
 	}
 	return vfs.GenericCheckPermissions(creds, ats, linux.FileMode(s.Mode), auth.KUID(s.Uid), auth.KGID(s.Gid))
@@ -272,8 +271,8 @@ func (i *inode) CheckPermissions(ctx context.Context, creds *auth.Credentials, a
 
 // Mode implements kernfs.Inode.Mode.
 func (i *inode) Mode() linux.FileMode {
-	var s syscall.Stat_t
-	if err := syscall.Fstat(i.hostFD, &s); err != nil {
+	var s unix.Stat_t
+	if err := unix.Fstat(i.hostFD, &s); err != nil {
 		// Retrieving the mode from the host fd using fstat(2) should not fail.
 		// If the syscall does not succeed, something is fundamentally wrong.
 		panic(fmt.Sprintf("failed to retrieve mode from host fd %d: %v", i.hostFD, err))
@@ -405,8 +404,8 @@ func (i *inode) SetStat(ctx context.Context, fs *vfs.Filesystem, creds *auth.Cre
 	if m&^(linux.STATX_MODE|linux.STATX_SIZE|linux.STATX_ATIME|linux.STATX_MTIME) != 0 {
 		return syserror.EPERM
 	}
-	var hostStat syscall.Stat_t
-	if err := syscall.Fstat(i.hostFD, &hostStat); err != nil {
+	var hostStat unix.Stat_t
+	if err := unix.Fstat(i.hostFD, &hostStat); err != nil {
 		return err
 	}
 	if err := vfs.CheckSetStat(ctx, creds, &opts, linux.FileMode(hostStat.Mode), auth.KUID(hostStat.Uid), auth.KGID(hostStat.Gid)); err != nil {
@@ -414,7 +413,7 @@ func (i *inode) SetStat(ctx context.Context, fs *vfs.Filesystem, creds *auth.Cre
 	}
 
 	if m&linux.STATX_MODE != 0 {
-		if err := syscall.Fchmod(i.hostFD, uint32(s.Mode)); err != nil {
+		if err := unix.Fchmod(i.hostFD, uint32(s.Mode)); err != nil {
 			return err
 		}
 	}
@@ -422,7 +421,7 @@ func (i *inode) SetStat(ctx context.Context, fs *vfs.Filesystem, creds *auth.Cre
 		if hostStat.Mode&linux.S_IFMT != linux.S_IFREG {
 			return syserror.EINVAL
 		}
-		if err := syscall.Ftruncate(i.hostFD, int64(s.Size)); err != nil {
+		if err := unix.Ftruncate(i.hostFD, int64(s.Size)); err != nil {
 			return err
 		}
 		oldSize := uint64(hostStat.Size)
@@ -435,7 +434,7 @@ func (i *inode) SetStat(ctx context.Context, fs *vfs.Filesystem, creds *auth.Cre
 		}
 	}
 	if m&(linux.STATX_ATIME|linux.STATX_MTIME) != 0 {
-		ts := [2]syscall.Timespec{
+		ts := [2]unix.Timespec{
 			toTimespec(s.Atime, m&linux.STATX_ATIME == 0),
 			toTimespec(s.Mtime, m&linux.STATX_MTIME == 0),
 		}
@@ -468,8 +467,8 @@ func (i *inode) Open(ctx context.Context, rp *vfs.ResolvingPath, d *kernfs.Dentr
 }
 
 func (i *inode) open(ctx context.Context, d *kernfs.Dentry, mnt *vfs.Mount, flags uint32) (*vfs.FileDescription, error) {
-	var s syscall.Stat_t
-	if err := syscall.Fstat(i.hostFD, &s); err != nil {
+	var s unix.Stat_t
+	if err := unix.Fstat(i.hostFD, &s); err != nil {
 		return nil, err
 	}
 	fileType := s.Mode & linux.FileTypeMask
@@ -477,10 +476,10 @@ func (i *inode) open(ctx context.Context, d *kernfs.Dentry, mnt *vfs.Mount, flag
 	// Constrain flags to a subset we can handle.
 	//
 	// TODO(gvisor.dev/issue/2601): Support O_NONBLOCK by adding RWF_NOWAIT to pread/pwrite calls.
-	flags &= syscall.O_ACCMODE | syscall.O_NONBLOCK | syscall.O_DSYNC | syscall.O_SYNC | syscall.O_APPEND
+	flags &= unix.O_ACCMODE | unix.O_NONBLOCK | unix.O_DSYNC | unix.O_SYNC | unix.O_APPEND
 
 	switch fileType {
-	case syscall.S_IFSOCK:
+	case unix.S_IFSOCK:
 		if i.isTTY {
 			log.Warningf("cannot use host socket fd %d as TTY", i.hostFD)
 			return nil, syserror.ENOTTY
@@ -493,7 +492,7 @@ func (i *inode) open(ctx context.Context, d *kernfs.Dentry, mnt *vfs.Mount, flag
 		// Currently, we only allow Unix sockets to be imported.
 		return unixsocket.NewFileDescription(ep, ep.Type(), flags, mnt, d.VFSDentry(), &i.locks)
 
-	case syscall.S_IFREG, syscall.S_IFIFO, syscall.S_IFCHR:
+	case unix.S_IFREG, unix.S_IFIFO, unix.S_IFCHR:
 		if i.isTTY {
 			fd := &TTYFileDescription{
 				fileDescription: fileDescription{inode: i},
@@ -675,8 +674,8 @@ func (f *fileDescription) Write(ctx context.Context, src usermem.IOSequence, opt
 	// and writing to the host fd. This is an unavoidable race condition because
 	// we cannot enforce synchronization on the host.
 	if f.vfsfd.StatusFlags()&linux.O_APPEND != 0 {
-		var s syscall.Stat_t
-		if err := syscall.Fstat(i.hostFD, &s); err != nil {
+		var s unix.Stat_t
+		if err := unix.Fstat(i.hostFD, &s); err != nil {
 			f.offsetMu.Unlock()
 			return 0, err
 		}
@@ -737,8 +736,8 @@ func (f *fileDescription) Seek(_ context.Context, offset int64, whence int32) (i
 		f.offset += offset
 
 	case linux.SEEK_END:
-		var s syscall.Stat_t
-		if err := syscall.Fstat(i.hostFD, &s); err != nil {
+		var s unix.Stat_t
+		if err := unix.Fstat(i.hostFD, &s); err != nil {
 			return f.offset, err
 		}
 		size := s.Size
@@ -781,7 +780,7 @@ func (f *fileDescription) Sync(ctx context.Context) error {
 func (f *fileDescription) ConfigureMMap(_ context.Context, opts *memmap.MMapOpts) error {
 	// NOTE(b/38213152): Technically, some obscure char devices can be memory
 	// mapped, but we only allow regular files.
-	if f.inode.ftype != syscall.S_IFREG {
+	if f.inode.ftype != unix.S_IFREG {
 		return syserror.ENODEV
 	}
 	i := f.inode
diff --git a/pkg/sentry/fsimpl/host/ioctl_unsafe.go b/pkg/sentry/fsimpl/host/ioctl_unsafe.go
index 0983bf7d8..f666a5875 100644
--- a/pkg/sentry/fsimpl/host/ioctl_unsafe.go
+++ b/pkg/sentry/fsimpl/host/ioctl_unsafe.go
@@ -15,15 +15,15 @@
 package host
 
 import (
-	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 )
 
 func ioctlGetTermios(fd int) (*linux.Termios, error) {
 	var t linux.Termios
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), linux.TCGETS, uintptr(unsafe.Pointer(&t)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), linux.TCGETS, uintptr(unsafe.Pointer(&t)))
 	if errno != 0 {
 		return nil, errno
 	}
@@ -31,7 +31,7 @@ func ioctlGetTermios(fd int) (*linux.Termios, error) {
 }
 
 func ioctlSetTermios(fd int, req uint64, t *linux.Termios) error {
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(unsafe.Pointer(t)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(unsafe.Pointer(t)))
 	if errno != 0 {
 		return errno
 	}
@@ -40,7 +40,7 @@ func ioctlSetTermios(fd int, req uint64, t *linux.Termios) error {
 
 func ioctlGetWinsize(fd int) (*linux.Winsize, error) {
 	var w linux.Winsize
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), linux.TIOCGWINSZ, uintptr(unsafe.Pointer(&w)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), linux.TIOCGWINSZ, uintptr(unsafe.Pointer(&w)))
 	if errno != 0 {
 		return nil, errno
 	}
@@ -48,7 +48,7 @@ func ioctlGetWinsize(fd int) (*linux.Winsize, error) {
 }
 
 func ioctlSetWinsize(fd int, w *linux.Winsize) error {
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), linux.TIOCSWINSZ, uintptr(unsafe.Pointer(w)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), linux.TIOCSWINSZ, uintptr(unsafe.Pointer(w)))
 	if errno != 0 {
 		return errno
 	}
diff --git a/pkg/sentry/fsimpl/host/save_restore.go b/pkg/sentry/fsimpl/host/save_restore.go
index 8800652a9..5688bddc8 100644
--- a/pkg/sentry/fsimpl/host/save_restore.go
+++ b/pkg/sentry/fsimpl/host/save_restore.go
@@ -18,8 +18,8 @@ import (
 	"fmt"
 	"io"
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/fdnotifier"
 	"gvisor.dev/gvisor/pkg/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/hostfd"
@@ -31,7 +31,7 @@ func (i *inode) beforeSave() {
 	if !i.savable {
 		panic("host.inode is not savable")
 	}
-	if i.ftype == syscall.S_IFIFO {
+	if i.ftype == unix.S_IFIFO {
 		// If this pipe FD is readable, drain it so that bytes in the pipe can
 		// be read after restore. (This is a legacy VFS1 feature.) We don't
 		// know if the pipe FD is readable, so just try reading and tolerate
@@ -45,7 +45,7 @@ func (i *inode) beforeSave() {
 				i.buf = append(i.buf, buf[:n]...)
 			}
 			if err != nil {
-				if err == io.EOF || err == syscall.EAGAIN || err == syscall.EBADF {
+				if err == io.EOF || err == unix.EAGAIN || err == unix.EBADF {
 					break
 				}
 				panic(fmt.Errorf("host.inode.beforeSave: buffering from pipe failed: %v", err))
@@ -60,7 +60,7 @@ func (i *inode) beforeSave() {
 // afterLoad is invoked by stateify.
 func (i *inode) afterLoad() {
 	if i.mayBlock {
-		if err := syscall.SetNonblock(i.hostFD, true); err != nil {
+		if err := unix.SetNonblock(i.hostFD, true); err != nil {
 			panic(fmt.Sprintf("host.inode.afterLoad: failed to set host FD %d non-blocking: %v", i.hostFD, err))
 		}
 		if err := fdnotifier.AddFD(int32(i.hostFD), &i.queue); err != nil {
diff --git a/pkg/sentry/fsimpl/host/socket.go b/pkg/sentry/fsimpl/host/socket.go
index 6763f5b0c..056f910aa 100644
--- a/pkg/sentry/fsimpl/host/socket.go
+++ b/pkg/sentry/fsimpl/host/socket.go
@@ -17,8 +17,8 @@ package host
 import (
 	"fmt"
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/fdnotifier"
@@ -87,26 +87,26 @@ type ConnectedEndpoint struct {
 func (c *ConnectedEndpoint) init() *syserr.Error {
 	c.InitRefs()
 
-	family, err := syscall.GetsockoptInt(c.fd, syscall.SOL_SOCKET, syscall.SO_DOMAIN)
+	family, err := unix.GetsockoptInt(c.fd, unix.SOL_SOCKET, unix.SO_DOMAIN)
 	if err != nil {
 		return syserr.FromError(err)
 	}
 
-	if family != syscall.AF_UNIX {
+	if family != unix.AF_UNIX {
 		// We only allow Unix sockets.
 		return syserr.ErrInvalidEndpointState
 	}
 
-	stype, err := syscall.GetsockoptInt(c.fd, syscall.SOL_SOCKET, syscall.SO_TYPE)
+	stype, err := unix.GetsockoptInt(c.fd, unix.SOL_SOCKET, unix.SO_TYPE)
 	if err != nil {
 		return syserr.FromError(err)
 	}
 
-	if err := syscall.SetNonblock(c.fd, true); err != nil {
+	if err := unix.SetNonblock(c.fd, true); err != nil {
 		return syserr.FromError(err)
 	}
 
-	sndbuf, err := syscall.GetsockoptInt(c.fd, syscall.SOL_SOCKET, syscall.SO_SNDBUF)
+	sndbuf, err := unix.GetsockoptInt(c.fd, unix.SOL_SOCKET, unix.SO_SNDBUF)
 	if err != nil {
 		return syserr.FromError(err)
 	}
@@ -177,7 +177,7 @@ func (c *ConnectedEndpoint) CloseSend() {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	if err := syscall.Shutdown(c.fd, syscall.SHUT_WR); err != nil {
+	if err := unix.Shutdown(c.fd, unix.SHUT_WR); err != nil {
 		// A well-formed UDS shutdown can't fail. See
 		// net/unix/af_unix.c:unix_shutdown.
 		panic(fmt.Sprintf("failed write shutdown on host socket %+v: %v", c, err))
@@ -270,7 +270,7 @@ func (c *ConnectedEndpoint) CloseRecv() {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	if err := syscall.Shutdown(c.fd, syscall.SHUT_RD); err != nil {
+	if err := unix.Shutdown(c.fd, unix.SHUT_RD); err != nil {
 		// A well-formed UDS shutdown can't fail. See
 		// net/unix/af_unix.c:unix_shutdown.
 		panic(fmt.Sprintf("failed read shutdown on host socket %+v: %v", c, err))
@@ -358,7 +358,7 @@ func (e *SCMConnectedEndpoint) Release(ctx context.Context) {
 	e.DecRef(func() {
 		e.mu.Lock()
 		fdnotifier.RemoveFD(int32(e.fd))
-		if err := syscall.Close(e.fd); err != nil {
+		if err := unix.Close(e.fd); err != nil {
 			log.Warningf("Failed to close host fd %d: %v", err)
 		}
 		e.destroyLocked()
diff --git a/pkg/sentry/fsimpl/host/socket_iovec.go b/pkg/sentry/fsimpl/host/socket_iovec.go
index fc0d5fd38..b123a63ee 100644
--- a/pkg/sentry/fsimpl/host/socket_iovec.go
+++ b/pkg/sentry/fsimpl/host/socket_iovec.go
@@ -15,8 +15,7 @@
 package host
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/iovec"
 	"gvisor.dev/gvisor/pkg/syserror"
 )
@@ -52,7 +51,7 @@ func copyFromMulti(dst []byte, src [][]byte) {
 //
 // If intermediate != nil, iovecs references intermediate rather than bufs and
 // the caller must copy to/from bufs as necessary.
-func buildIovec(bufs [][]byte, maxlen int64, truncate bool) (length int64, iovecs []syscall.Iovec, intermediate []byte, err error) {
+func buildIovec(bufs [][]byte, maxlen int64, truncate bool) (length int64, iovecs []unix.Iovec, intermediate []byte, err error) {
 	var iovsRequired int
 	for _, b := range bufs {
 		length += int64(len(b))
@@ -76,14 +75,14 @@ func buildIovec(bufs [][]byte, maxlen int64, truncate bool) (length int64, iovec
 		// Use a single intermediate buffer instead.
 		b := make([]byte, stopLen)
 
-		return stopLen, []syscall.Iovec{{
+		return stopLen, []unix.Iovec{{
 			Base: &b[0],
 			Len:  uint64(stopLen),
 		}}, b, err
 	}
 
 	var total int64
-	iovecs = make([]syscall.Iovec, 0, iovsRequired)
+	iovecs = make([]unix.Iovec, 0, iovsRequired)
 	for i := range bufs {
 		l := len(bufs[i])
 		if l == 0 {
@@ -95,7 +94,7 @@ func buildIovec(bufs [][]byte, maxlen int64, truncate bool) (length int64, iovec
 			stop = stopLen - total
 		}
 
-		iovecs = append(iovecs, syscall.Iovec{
+		iovecs = append(iovecs, unix.Iovec{
 			Base: &bufs[i][0],
 			Len:  uint64(stop),
 		})
diff --git a/pkg/sentry/fsimpl/host/socket_unsafe.go b/pkg/sentry/fsimpl/host/socket_unsafe.go
index c0bf45f08..34f24e95c 100644
--- a/pkg/sentry/fsimpl/host/socket_unsafe.go
+++ b/pkg/sentry/fsimpl/host/socket_unsafe.go
@@ -15,8 +15,9 @@
 package host
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // fdReadVec receives from fd to bufs.
@@ -24,9 +25,9 @@ import (
 // If the total length of bufs is > maxlen, fdReadVec will do a partial read
 // and err will indicate why the message was truncated.
 func fdReadVec(fd int, bufs [][]byte, control []byte, peek bool, maxlen int64) (readLen int64, msgLen int64, controlLen uint64, controlTrunc bool, err error) {
-	flags := uintptr(syscall.MSG_DONTWAIT | syscall.MSG_TRUNC)
+	flags := uintptr(unix.MSG_DONTWAIT | unix.MSG_TRUNC)
 	if peek {
-		flags |= syscall.MSG_PEEK
+		flags |= unix.MSG_PEEK
 	}
 
 	// Always truncate the receive buffer. All socket types will truncate
@@ -37,7 +38,7 @@ func fdReadVec(fd int, bufs [][]byte, control []byte, peek bool, maxlen int64) (
 		return 0, 0, 0, false, err
 	}
 
-	var msg syscall.Msghdr
+	var msg unix.Msghdr
 	if len(control) != 0 {
 		msg.Control = &control[0]
 		msg.Controllen = uint64(len(control))
@@ -48,7 +49,7 @@ func fdReadVec(fd int, bufs [][]byte, control []byte, peek bool, maxlen int64) (
 		msg.Iovlen = uint64(len(iovecs))
 	}
 
-	rawN, _, e := syscall.RawSyscall(syscall.SYS_RECVMSG, uintptr(fd), uintptr(unsafe.Pointer(&msg)), flags)
+	rawN, _, e := unix.RawSyscall(unix.SYS_RECVMSG, uintptr(fd), uintptr(unsafe.Pointer(&msg)), flags)
 	if e != 0 {
 		// N.B. prioritize the syscall error over the buildIovec error.
 		return 0, 0, 0, false, e
@@ -60,7 +61,7 @@ func fdReadVec(fd int, bufs [][]byte, control []byte, peek bool, maxlen int64) (
 		copyToMulti(bufs, intermediate)
 	}
 
-	controlTrunc = msg.Flags&syscall.MSG_CTRUNC == syscall.MSG_CTRUNC
+	controlTrunc = msg.Flags&unix.MSG_CTRUNC == unix.MSG_CTRUNC
 
 	if n > length {
 		return length, n, msg.Controllen, controlTrunc, nil
@@ -85,13 +86,13 @@ func fdWriteVec(fd int, bufs [][]byte, maxlen int64, truncate bool) (int64, int6
 		copyFromMulti(intermediate, bufs)
 	}
 
-	var msg syscall.Msghdr
+	var msg unix.Msghdr
 	if len(iovecs) > 0 {
 		msg.Iov = &iovecs[0]
 		msg.Iovlen = uint64(len(iovecs))
 	}
 
-	n, _, e := syscall.RawSyscall(syscall.SYS_SENDMSG, uintptr(fd), uintptr(unsafe.Pointer(&msg)), syscall.MSG_DONTWAIT|syscall.MSG_NOSIGNAL)
+	n, _, e := unix.RawSyscall(unix.SYS_SENDMSG, uintptr(fd), uintptr(unsafe.Pointer(&msg)), unix.MSG_DONTWAIT|unix.MSG_NOSIGNAL)
 	if e != 0 {
 		// N.B. prioritize the syscall error over the buildIovec error.
 		return 0, length, e
diff --git a/pkg/sentry/fsimpl/host/util.go b/pkg/sentry/fsimpl/host/util.go
index b2f43a119..63b465859 100644
--- a/pkg/sentry/fsimpl/host/util.go
+++ b/pkg/sentry/fsimpl/host/util.go
@@ -15,21 +15,19 @@
 package host
 
 import (
-	"syscall"
-
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/syserror"
 )
 
-func toTimespec(ts linux.StatxTimestamp, omit bool) syscall.Timespec {
+func toTimespec(ts linux.StatxTimestamp, omit bool) unix.Timespec {
 	if omit {
-		return syscall.Timespec{
+		return unix.Timespec{
 			Sec:  0,
 			Nsec: unix.UTIME_OMIT,
 		}
 	}
-	return syscall.Timespec{
+	return unix.Timespec{
 		Sec:  ts.Sec,
 		Nsec: int64(ts.Nsec),
 	}
diff --git a/pkg/sentry/fsimpl/host/util_unsafe.go b/pkg/sentry/fsimpl/host/util_unsafe.go
index 5136ac844..b36eed2e2 100644
--- a/pkg/sentry/fsimpl/host/util_unsafe.go
+++ b/pkg/sentry/fsimpl/host/util_unsafe.go
@@ -15,13 +15,14 @@
 package host
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
-func setTimestamps(fd int, ts *[2]syscall.Timespec) error {
-	_, _, errno := syscall.Syscall6(
-		syscall.SYS_UTIMENSAT,
+func setTimestamps(fd int, ts *[2]unix.Timespec) error {
+	_, _, errno := unix.Syscall6(
+		unix.SYS_UTIMENSAT,
 		uintptr(fd),
 		0, /* path */
 		uintptr(unsafe.Pointer(ts)),