Cleanup straggling syscall dependencies.

PiperOrigin-RevId: 257293198

19 files changed, 280 insertions, 298 deletions

diff --git a/pkg/sentry/syscalls/epoll.go b/pkg/sentry/syscalls/epoll.go
index 11850dd0f..87dcad18b 100644
--- a/pkg/sentry/syscalls/epoll.go
+++ b/pkg/sentry/syscalls/epoll.go
@@ -15,12 +15,12 @@
 package syscalls
 
 import (
-	"syscall"
 	"time"
 
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/epoll"
 	ktime "gvisor.dev/gvisor/pkg/sentry/kernel/time"
+	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
 
@@ -44,21 +44,21 @@ func AddEpoll(t *kernel.Task, epfd int32, fd int32, flags epoll.EntryFlags, mask
 	// Get epoll from the file descriptor.
 	epollfile := t.GetFile(epfd)
 	if epollfile == nil {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 	defer epollfile.DecRef()
 
 	// Get the target file id.
 	file := t.GetFile(fd)
 	if file == nil {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the epollPoll operations.
 	e, ok := epollfile.FileOperations.(*epoll.EventPoll)
 	if !ok {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 
 	// Try to add the entry.
@@ -70,21 +70,21 @@ func UpdateEpoll(t *kernel.Task, epfd int32, fd int32, flags epoll.EntryFlags, m
 	// Get epoll from the file descriptor.
 	epollfile := t.GetFile(epfd)
 	if epollfile == nil {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 	defer epollfile.DecRef()
 
 	// Get the target file id.
 	file := t.GetFile(fd)
 	if file == nil {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the epollPoll operations.
 	e, ok := epollfile.FileOperations.(*epoll.EventPoll)
 	if !ok {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 
 	// Try to update the entry.
@@ -96,21 +96,21 @@ func RemoveEpoll(t *kernel.Task, epfd int32, fd int32) error {
 	// Get epoll from the file descriptor.
 	epollfile := t.GetFile(epfd)
 	if epollfile == nil {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 	defer epollfile.DecRef()
 
 	// Get the target file id.
 	file := t.GetFile(fd)
 	if file == nil {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the epollPoll operations.
 	e, ok := epollfile.FileOperations.(*epoll.EventPoll)
 	if !ok {
-		return syscall.EBADF
+		return syserror.EBADF
 	}
 
 	// Try to remove the entry.
@@ -122,14 +122,14 @@ func WaitEpoll(t *kernel.Task, fd int32, max int, timeout int) ([]epoll.Event, e
 	// Get epoll from the file descriptor.
 	epollfile := t.GetFile(fd)
 	if epollfile == nil {
-		return nil, syscall.EBADF
+		return nil, syserror.EBADF
 	}
 	defer epollfile.DecRef()
 
 	// Extract the epollPoll operations.
 	e, ok := epollfile.FileOperations.(*epoll.EventPoll)
 	if !ok {
-		return nil, syscall.EBADF
+		return nil, syserror.EBADF
 	}
 
 	// Try to read events and return right away if we got them or if the
@@ -162,7 +162,7 @@ func WaitEpoll(t *kernel.Task, fd int32, max int, timeout int) ([]epoll.Event, e
 		}
 
 		if err := t.BlockWithDeadline(ch, haveDeadline, deadline); err != nil {
-			if err == syscall.ETIMEDOUT {
+			if err == syserror.ETIMEDOUT {
 				return nil, nil
 			}
 
diff --git a/pkg/sentry/syscalls/linux/error.go b/pkg/sentry/syscalls/linux/error.go
index ac3905c5c..264301bfa 100644
--- a/pkg/sentry/syscalls/linux/error.go
+++ b/pkg/sentry/syscalls/linux/error.go
@@ -17,7 +17,6 @@ package linux
 import (
 	"io"
 	"sync"
-	"syscall"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/log"
@@ -54,7 +53,7 @@ func handleIOError(t *kernel.Task, partialResult bool, err, intr error, op strin
 		// Do not consume the error and return it as EFBIG.
 		// Simultaneously send a SIGXFSZ per setrlimit(2).
 		t.SendSignal(kernel.SignalInfoNoInfo(linux.SIGXFSZ, t, t))
-		return syscall.EFBIG
+		return syserror.EFBIG
 	case syserror.ErrInterrupted:
 		// The syscall was interrupted. Return nil if it completed
 		// partially, otherwise return the error code that the syscall
diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go
index 7bbbb5008..680c0c64c 100644
--- a/pkg/sentry/syscalls/linux/linux64.go
+++ b/pkg/sentry/syscalls/linux/linux64.go
@@ -16,8 +16,6 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -116,10 +114,10 @@ var AMD64 = &kernel.SyscallTable{
 		65:  syscalls.PartiallySupported("semop", Semop, "Option SEM_UNDO not supported.", nil),
 		66:  syscalls.PartiallySupported("semctl", Semctl, "Options IPC_INFO, SEM_INFO, IPC_STAT, SEM_STAT, SEM_STAT_ANY, GETNCNT, GETZCNT not supported.", nil),
 		67:  syscalls.Supported("shmdt", Shmdt),
-		68:  syscalls.ErrorWithEvent("msgget", syscall.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
-		69:  syscalls.ErrorWithEvent("msgsnd", syscall.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
-		70:  syscalls.ErrorWithEvent("msgrcv", syscall.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
-		71:  syscalls.ErrorWithEvent("msgctl", syscall.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
+		68:  syscalls.ErrorWithEvent("msgget", syserror.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
+		69:  syscalls.ErrorWithEvent("msgsnd", syserror.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
+		70:  syscalls.ErrorWithEvent("msgrcv", syserror.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
+		71:  syscalls.ErrorWithEvent("msgctl", syserror.ENOSYS, "", []string{"gvisor.dev/issue/135"}), // TODO(b/29354921)
 		72:  syscalls.PartiallySupported("fcntl", Fcntl, "Not all options are supported.", nil),
 		73:  syscalls.PartiallySupported("flock", Flock, "Locks are held within the sandbox only.", nil),
 		74:  syscalls.PartiallySupported("fsync", Fsync, "Full data flush is not guaranteed at this time.", nil),
@@ -170,8 +168,8 @@ var AMD64 = &kernel.SyscallTable{
 		119: syscalls.Supported("setresgid", Setresgid),
 		120: syscalls.Supported("getresgid", Getresgid),
 		121: syscalls.Supported("getpgid", Getpgid),
-		122: syscalls.ErrorWithEvent("setfsuid", syscall.ENOSYS, "", []string{"gvisor.dev/issue/260"}), // TODO(b/112851702)
-		123: syscalls.ErrorWithEvent("setfsgid", syscall.ENOSYS, "", []string{"gvisor.dev/issue/260"}), // TODO(b/112851702)
+		122: syscalls.ErrorWithEvent("setfsuid", syserror.ENOSYS, "", []string{"gvisor.dev/issue/260"}), // TODO(b/112851702)
+		123: syscalls.ErrorWithEvent("setfsgid", syserror.ENOSYS, "", []string{"gvisor.dev/issue/260"}), // TODO(b/112851702)
 		124: syscalls.Supported("getsid", Getsid),
 		125: syscalls.Supported("capget", Capget),
 		126: syscalls.Supported("capset", Capset),
@@ -182,12 +180,12 @@ var AMD64 = &kernel.SyscallTable{
 		131: syscalls.Supported("sigaltstack", Sigaltstack),
 		132: syscalls.Supported("utime", Utime),
 		133: syscalls.PartiallySupported("mknod", Mknod, "Device creation is not generally supported. Only regular file and FIFO creation are supported.", nil),
-		134: syscalls.Error("uselib", syscall.ENOSYS, "Obsolete", nil),
-		135: syscalls.ErrorWithEvent("personality", syscall.EINVAL, "Unable to change personality.", nil),
-		136: syscalls.ErrorWithEvent("ustat", syscall.ENOSYS, "Needs filesystem support.", nil),
+		134: syscalls.Error("uselib", syserror.ENOSYS, "Obsolete", nil),
+		135: syscalls.ErrorWithEvent("personality", syserror.EINVAL, "Unable to change personality.", nil),
+		136: syscalls.ErrorWithEvent("ustat", syserror.ENOSYS, "Needs filesystem support.", nil),
 		137: syscalls.PartiallySupported("statfs", Statfs, "Depends on the backing file system implementation.", nil),
 		138: syscalls.PartiallySupported("fstatfs", Fstatfs, "Depends on the backing file system implementation.", nil),
-		139: syscalls.ErrorWithEvent("sysfs", syscall.ENOSYS, "", []string{"gvisor.dev/issue/165"}),
+		139: syscalls.ErrorWithEvent("sysfs", syserror.ENOSYS, "", []string{"gvisor.dev/issue/165"}),
 		140: syscalls.PartiallySupported("getpriority", Getpriority, "Stub implementation.", nil),
 		141: syscalls.PartiallySupported("setpriority", Setpriority, "Stub implementation.", nil),
 		142: syscalls.CapError("sched_setparam", linux.CAP_SYS_NICE, "", nil),
@@ -196,15 +194,15 @@ var AMD64 = &kernel.SyscallTable{
 		145: syscalls.PartiallySupported("sched_getscheduler", SchedGetscheduler, "Stub implementation.", nil),
 		146: syscalls.PartiallySupported("sched_get_priority_max", SchedGetPriorityMax, "Stub implementation.", nil),
 		147: syscalls.PartiallySupported("sched_get_priority_min", SchedGetPriorityMin, "Stub implementation.", nil),
-		148: syscalls.ErrorWithEvent("sched_rr_get_interval", syscall.EPERM, "", nil),
+		148: syscalls.ErrorWithEvent("sched_rr_get_interval", syserror.EPERM, "", nil),
 		149: syscalls.PartiallySupported("mlock", Mlock, "Stub implementation. The sandbox lacks appropriate permissions.", nil),
 		150: syscalls.PartiallySupported("munlock", Munlock, "Stub implementation. The sandbox lacks appropriate permissions.", nil),
 		151: syscalls.PartiallySupported("mlockall", Mlockall, "Stub implementation. The sandbox lacks appropriate permissions.", nil),
 		152: syscalls.PartiallySupported("munlockall", Munlockall, "Stub implementation. The sandbox lacks appropriate permissions.", nil),
 		153: syscalls.CapError("vhangup", linux.CAP_SYS_TTY_CONFIG, "", nil),
-		154: syscalls.Error("modify_ldt", syscall.EPERM, "", nil),
-		155: syscalls.Error("pivot_root", syscall.EPERM, "", nil),
-		156: syscalls.Error("sysctl", syscall.EPERM, "Deprecated. Use /proc/sys instead.", nil),
+		154: syscalls.Error("modify_ldt", syserror.EPERM, "", nil),
+		155: syscalls.Error("pivot_root", syserror.EPERM, "", nil),
+		156: syscalls.Error("sysctl", syserror.EPERM, "Deprecated. Use /proc/sys instead.", nil),
 		157: syscalls.PartiallySupported("prctl", Prctl, "Not all options are supported.", nil),
 		158: syscalls.PartiallySupported("arch_prctl", ArchPrctl, "Options ARCH_GET_GS, ARCH_SET_GS not supported.", nil),
 		159: syscalls.CapError("adjtimex", linux.CAP_SYS_TIME, "", nil),
@@ -225,50 +223,50 @@ var AMD64 = &kernel.SyscallTable{
 		174: syscalls.CapError("create_module", linux.CAP_SYS_MODULE, "", nil),
 		175: syscalls.CapError("init_module", linux.CAP_SYS_MODULE, "", nil),
 		176: syscalls.CapError("delete_module", linux.CAP_SYS_MODULE, "", nil),
-		177: syscalls.Error("get_kernel_syms", syscall.ENOSYS, "Not supported in Linux > 2.6.", nil),
-		178: syscalls.Error("query_module", syscall.ENOSYS, "Not supported in Linux > 2.6.", nil),
+		177: syscalls.Error("get_kernel_syms", syserror.ENOSYS, "Not supported in Linux > 2.6.", nil),
+		178: syscalls.Error("query_module", syserror.ENOSYS, "Not supported in Linux > 2.6.", nil),
 		179: syscalls.CapError("quotactl", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_admin for most operations
-		180: syscalls.Error("nfsservctl", syscall.ENOSYS, "Removed after Linux 3.1.", nil),
-		181: syscalls.Error("getpmsg", syscall.ENOSYS, "Not implemented in Linux.", nil),
-		182: syscalls.Error("putpmsg", syscall.ENOSYS, "Not implemented in Linux.", nil),
-		183: syscalls.Error("afs_syscall", syscall.ENOSYS, "Not implemented in Linux.", nil),
-		184: syscalls.Error("tuxcall", syscall.ENOSYS, "Not implemented in Linux.", nil),
-		185: syscalls.Error("security", syscall.ENOSYS, "Not implemented in Linux.", nil),
+		180: syscalls.Error("nfsservctl", syserror.ENOSYS, "Removed after Linux 3.1.", nil),
+		181: syscalls.Error("getpmsg", syserror.ENOSYS, "Not implemented in Linux.", nil),
+		182: syscalls.Error("putpmsg", syserror.ENOSYS, "Not implemented in Linux.", nil),
+		183: syscalls.Error("afs_syscall", syserror.ENOSYS, "Not implemented in Linux.", nil),
+		184: syscalls.Error("tuxcall", syserror.ENOSYS, "Not implemented in Linux.", nil),
+		185: syscalls.Error("security", syserror.ENOSYS, "Not implemented in Linux.", nil),
 		186: syscalls.Supported("gettid", Gettid),
-		187: syscalls.ErrorWithEvent("readahead", syscall.ENOSYS, "", []string{"gvisor.dev/issue/261"}), // TODO(b/29351341)
-		188: syscalls.ErrorWithEvent("setxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		189: syscalls.ErrorWithEvent("lsetxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		190: syscalls.ErrorWithEvent("fsetxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		191: syscalls.ErrorWithEvent("getxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		192: syscalls.ErrorWithEvent("lgetxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		193: syscalls.ErrorWithEvent("fgetxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		194: syscalls.ErrorWithEvent("listxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		195: syscalls.ErrorWithEvent("llistxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		196: syscalls.ErrorWithEvent("flistxattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		197: syscalls.ErrorWithEvent("removexattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		198: syscalls.ErrorWithEvent("lremovexattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
-		199: syscalls.ErrorWithEvent("fremovexattr", syscall.ENOTSUP, "Requires filesystem support.", nil),
+		187: syscalls.ErrorWithEvent("readahead", syserror.ENOSYS, "", []string{"gvisor.dev/issue/261"}), // TODO(b/29351341)
+		188: syscalls.ErrorWithEvent("setxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		189: syscalls.ErrorWithEvent("lsetxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		190: syscalls.ErrorWithEvent("fsetxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		191: syscalls.ErrorWithEvent("getxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		192: syscalls.ErrorWithEvent("lgetxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		193: syscalls.ErrorWithEvent("fgetxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		194: syscalls.ErrorWithEvent("listxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		195: syscalls.ErrorWithEvent("llistxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		196: syscalls.ErrorWithEvent("flistxattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		197: syscalls.ErrorWithEvent("removexattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		198: syscalls.ErrorWithEvent("lremovexattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
+		199: syscalls.ErrorWithEvent("fremovexattr", syserror.ENOTSUP, "Requires filesystem support.", nil),
 		200: syscalls.Supported("tkill", Tkill),
 		201: syscalls.Supported("time", Time),
 		202: syscalls.PartiallySupported("futex", Futex, "Robust futexes not supported.", nil),
 		203: syscalls.PartiallySupported("sched_setaffinity", SchedSetaffinity, "Stub implementation.", nil),
 		204: syscalls.PartiallySupported("sched_getaffinity", SchedGetaffinity, "Stub implementation.", nil),
-		205: syscalls.Error("set_thread_area", syscall.ENOSYS, "Expected to return ENOSYS on 64-bit", nil),
+		205: syscalls.Error("set_thread_area", syserror.ENOSYS, "Expected to return ENOSYS on 64-bit", nil),
 		206: syscalls.PartiallySupported("io_setup", IoSetup, "Generally supported with exceptions. User ring optimizations are not implemented.", []string{"gvisor.dev/issue/204"}),
 		207: syscalls.PartiallySupported("io_destroy", IoDestroy, "Generally supported with exceptions. User ring optimizations are not implemented.", []string{"gvisor.dev/issue/204"}),
 		208: syscalls.PartiallySupported("io_getevents", IoGetevents, "Generally supported with exceptions. User ring optimizations are not implemented.", []string{"gvisor.dev/issue/204"}),
 		209: syscalls.PartiallySupported("io_submit", IoSubmit, "Generally supported with exceptions. User ring optimizations are not implemented.", []string{"gvisor.dev/issue/204"}),
 		210: syscalls.PartiallySupported("io_cancel", IoCancel, "Generally supported with exceptions. User ring optimizations are not implemented.", []string{"gvisor.dev/issue/204"}),
-		211: syscalls.Error("get_thread_area", syscall.ENOSYS, "Expected to return ENOSYS on 64-bit", nil),
+		211: syscalls.Error("get_thread_area", syserror.ENOSYS, "Expected to return ENOSYS on 64-bit", nil),
 		212: syscalls.CapError("lookup_dcookie", linux.CAP_SYS_ADMIN, "", nil),
 		213: syscalls.Supported("epoll_create", EpollCreate),
-		214: syscalls.ErrorWithEvent("epoll_ctl_old", syscall.ENOSYS, "Deprecated.", nil),
-		215: syscalls.ErrorWithEvent("epoll_wait_old", syscall.ENOSYS, "Deprecated.", nil),
-		216: syscalls.ErrorWithEvent("remap_file_pages", syscall.ENOSYS, "Deprecated since Linux 3.16.", nil),
+		214: syscalls.ErrorWithEvent("epoll_ctl_old", syserror.ENOSYS, "Deprecated.", nil),
+		215: syscalls.ErrorWithEvent("epoll_wait_old", syserror.ENOSYS, "Deprecated.", nil),
+		216: syscalls.ErrorWithEvent("remap_file_pages", syserror.ENOSYS, "Deprecated since Linux 3.16.", nil),
 		217: syscalls.Supported("getdents64", Getdents64),
 		218: syscalls.Supported("set_tid_address", SetTidAddress),
 		219: syscalls.Supported("restart_syscall", RestartSyscall),
-		220: syscalls.ErrorWithEvent("semtimedop", syscall.ENOSYS, "", []string{"gvisor.dev/issue/137"}), // TODO(b/29354920)
+		220: syscalls.ErrorWithEvent("semtimedop", syserror.ENOSYS, "", []string{"gvisor.dev/issue/137"}), // TODO(b/29354920)
 		221: syscalls.PartiallySupported("fadvise64", Fadvise64, "Not all options are supported.", nil),
 		222: syscalls.Supported("timer_create", TimerCreate),
 		223: syscalls.Supported("timer_settime", TimerSettime),
@@ -284,21 +282,21 @@ var AMD64 = &kernel.SyscallTable{
 		233: syscalls.Supported("epoll_ctl", EpollCtl),
 		234: syscalls.Supported("tgkill", Tgkill),
 		235: syscalls.Supported("utimes", Utimes),
-		236: syscalls.Error("vserver", syscall.ENOSYS, "Not implemented by Linux", nil),
+		236: syscalls.Error("vserver", syserror.ENOSYS, "Not implemented by Linux", nil),
 		237: syscalls.PartiallySupported("mbind", Mbind, "Stub implementation. Only a single NUMA node is advertised, and mempolicy is ignored accordingly, but mbind() will succeed and has effects reflected by get_mempolicy.", []string{"gvisor.dev/issue/262"}),
 		238: syscalls.PartiallySupported("set_mempolicy", SetMempolicy, "Stub implementation.", nil),
 		239: syscalls.PartiallySupported("get_mempolicy", GetMempolicy, "Stub implementation.", nil),
-		240: syscalls.ErrorWithEvent("mq_open", syscall.ENOSYS, "", []string{"gvisor.dev/issue/136"}),         // TODO(b/29354921)
-		241: syscalls.ErrorWithEvent("mq_unlink", syscall.ENOSYS, "", []string{"gvisor.dev/issue/136"}),       // TODO(b/29354921)
-		242: syscalls.ErrorWithEvent("mq_timedsend", syscall.ENOSYS, "", []string{"gvisor.dev/issue/136"}),    // TODO(b/29354921)
-		243: syscalls.ErrorWithEvent("mq_timedreceive", syscall.ENOSYS, "", []string{"gvisor.dev/issue/136"}), // TODO(b/29354921)
-		244: syscalls.ErrorWithEvent("mq_notify", syscall.ENOSYS, "", []string{"gvisor.dev/issue/136"}),       // TODO(b/29354921)
-		245: syscalls.ErrorWithEvent("mq_getsetattr", syscall.ENOSYS, "", []string{"gvisor.dev/issue/136"}),   // TODO(b/29354921)
+		240: syscalls.ErrorWithEvent("mq_open", syserror.ENOSYS, "", []string{"gvisor.dev/issue/136"}),         // TODO(b/29354921)
+		241: syscalls.ErrorWithEvent("mq_unlink", syserror.ENOSYS, "", []string{"gvisor.dev/issue/136"}),       // TODO(b/29354921)
+		242: syscalls.ErrorWithEvent("mq_timedsend", syserror.ENOSYS, "", []string{"gvisor.dev/issue/136"}),    // TODO(b/29354921)
+		243: syscalls.ErrorWithEvent("mq_timedreceive", syserror.ENOSYS, "", []string{"gvisor.dev/issue/136"}), // TODO(b/29354921)
+		244: syscalls.ErrorWithEvent("mq_notify", syserror.ENOSYS, "", []string{"gvisor.dev/issue/136"}),       // TODO(b/29354921)
+		245: syscalls.ErrorWithEvent("mq_getsetattr", syserror.ENOSYS, "", []string{"gvisor.dev/issue/136"}),   // TODO(b/29354921)
 		246: syscalls.CapError("kexec_load", linux.CAP_SYS_BOOT, "", nil),
 		247: syscalls.Supported("waitid", Waitid),
-		248: syscalls.Error("add_key", syscall.EACCES, "Not available to user.", nil),
-		249: syscalls.Error("request_key", syscall.EACCES, "Not available to user.", nil),
-		250: syscalls.Error("keyctl", syscall.EACCES, "Not available to user.", nil),
+		248: syscalls.Error("add_key", syserror.EACCES, "Not available to user.", nil),
+		249: syscalls.Error("request_key", syserror.EACCES, "Not available to user.", nil),
+		250: syscalls.Error("keyctl", syserror.EACCES, "Not available to user.", nil),
 		251: syscalls.CapError("ioprio_set", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending)
 		252: syscalls.CapError("ioprio_get", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_nice or cap_sys_admin (depending)
 		253: syscalls.PartiallySupported("inotify_init", InotifyInit, "inotify events are only available inside the sandbox.", nil),
@@ -321,23 +319,23 @@ var AMD64 = &kernel.SyscallTable{
 		270: syscalls.Supported("pselect", Pselect),
 		271: syscalls.Supported("ppoll", Ppoll),
 		272: syscalls.PartiallySupported("unshare", Unshare, "Mount, cgroup namespaces not supported. Network namespaces supported but must be empty.", nil),
-		273: syscalls.Error("set_robust_list", syscall.ENOSYS, "Obsolete.", nil),
-		274: syscalls.Error("get_robust_list", syscall.ENOSYS, "Obsolete.", nil),
+		273: syscalls.Error("set_robust_list", syserror.ENOSYS, "Obsolete.", nil),
+		274: syscalls.Error("get_robust_list", syserror.ENOSYS, "Obsolete.", nil),
 		275: syscalls.PartiallySupported("splice", Splice, "Stub implementation.", []string{"gvisor.dev/issue/138"}), // TODO(b/29354098)
-		276: syscalls.ErrorWithEvent("tee", syscall.ENOSYS, "", []string{"gvisor.dev/issue/138"}),                    // TODO(b/29354098)
+		276: syscalls.ErrorWithEvent("tee", syserror.ENOSYS, "", []string{"gvisor.dev/issue/138"}),                   // TODO(b/29354098)
 		277: syscalls.PartiallySupported("sync_file_range", SyncFileRange, "Full data flush is not guaranteed at this time.", nil),
-		278: syscalls.ErrorWithEvent("vmsplice", syscall.ENOSYS, "", []string{"gvisor.dev/issue/138"}), // TODO(b/29354098)
-		279: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil),                              // requires cap_sys_nice (mostly)
+		278: syscalls.ErrorWithEvent("vmsplice", syserror.ENOSYS, "", []string{"gvisor.dev/issue/138"}), // TODO(b/29354098)
+		279: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil),                               // requires cap_sys_nice (mostly)
 		280: syscalls.Supported("utimensat", Utimensat),
 		281: syscalls.Supported("epoll_pwait", EpollPwait),
-		282: syscalls.ErrorWithEvent("signalfd", syscall.ENOSYS, "", []string{"gvisor.dev/issue/139"}), // TODO(b/19846426)
+		282: syscalls.ErrorWithEvent("signalfd", syserror.ENOSYS, "", []string{"gvisor.dev/issue/139"}), // TODO(b/19846426)
 		283: syscalls.Supported("timerfd_create", TimerfdCreate),
 		284: syscalls.Supported("eventfd", Eventfd),
 		285: syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil),
 		286: syscalls.Supported("timerfd_settime", TimerfdSettime),
 		287: syscalls.Supported("timerfd_gettime", TimerfdGettime),
 		288: syscalls.Supported("accept4", Accept4),
-		289: syscalls.ErrorWithEvent("signalfd4", syscall.ENOSYS, "", []string{"gvisor.dev/issue/139"}), // TODO(b/19846426)
+		289: syscalls.ErrorWithEvent("signalfd4", syserror.ENOSYS, "", []string{"gvisor.dev/issue/139"}), // TODO(b/19846426)
 		290: syscalls.Supported("eventfd2", Eventfd2),
 		291: syscalls.Supported("epoll_create1", EpollCreate1),
 		292: syscalls.Supported("dup3", Dup3),
@@ -346,37 +344,37 @@ var AMD64 = &kernel.SyscallTable{
 		295: syscalls.Supported("preadv", Preadv),
 		296: syscalls.Supported("pwritev", Pwritev),
 		297: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo),
-		298: syscalls.ErrorWithEvent("perf_event_open", syscall.ENODEV, "No support for perf counters", nil),
+		298: syscalls.ErrorWithEvent("perf_event_open", syserror.ENODEV, "No support for perf counters", nil),
 		299: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil),
-		300: syscalls.ErrorWithEvent("fanotify_init", syscall.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
-		301: syscalls.ErrorWithEvent("fanotify_mark", syscall.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
+		300: syscalls.ErrorWithEvent("fanotify_init", syserror.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
+		301: syscalls.ErrorWithEvent("fanotify_mark", syserror.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
 		302: syscalls.Supported("prlimit64", Prlimit64),
-		303: syscalls.Error("name_to_handle_at", syscall.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),
-		304: syscalls.Error("open_by_handle_at", syscall.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),
+		303: syscalls.Error("name_to_handle_at", syserror.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),
+		304: syscalls.Error("open_by_handle_at", syserror.EOPNOTSUPP, "Not supported by gVisor filesystems", nil),
 		305: syscalls.CapError("clock_adjtime", linux.CAP_SYS_TIME, "", nil),
 		306: syscalls.PartiallySupported("syncfs", Syncfs, "Depends on backing file system.", nil),
 		307: syscalls.PartiallySupported("sendmmsg", SendMMsg, "Not all flags and control messages are supported.", nil),
-		308: syscalls.ErrorWithEvent("setns", syscall.EOPNOTSUPP, "Needs filesystem support", []string{"gvisor.dev/issue/140"}), // TODO(b/29354995)
+		308: syscalls.ErrorWithEvent("setns", syserror.EOPNOTSUPP, "Needs filesystem support", []string{"gvisor.dev/issue/140"}), // TODO(b/29354995)
 		309: syscalls.Supported("getcpu", Getcpu),
-		310: syscalls.ErrorWithEvent("process_vm_readv", syscall.ENOSYS, "", []string{"gvisor.dev/issue/158"}),
-		311: syscalls.ErrorWithEvent("process_vm_writev", syscall.ENOSYS, "", []string{"gvisor.dev/issue/158"}),
+		310: syscalls.ErrorWithEvent("process_vm_readv", syserror.ENOSYS, "", []string{"gvisor.dev/issue/158"}),
+		311: syscalls.ErrorWithEvent("process_vm_writev", syserror.ENOSYS, "", []string{"gvisor.dev/issue/158"}),
 		312: syscalls.CapError("kcmp", linux.CAP_SYS_PTRACE, "", nil),
 		313: syscalls.CapError("finit_module", linux.CAP_SYS_MODULE, "", nil),
-		314: syscalls.ErrorWithEvent("sched_setattr", syscall.ENOSYS, "gVisor does not implement a scheduler.", []string{"gvisor.dev/issue/264"}), // TODO(b/118902272)
-		315: syscalls.ErrorWithEvent("sched_getattr", syscall.ENOSYS, "gVisor does not implement a scheduler.", []string{"gvisor.dev/issue/264"}), // TODO(b/118902272)
-		316: syscalls.ErrorWithEvent("renameat2", syscall.ENOSYS, "", []string{"gvisor.dev/issue/263"}),                                           // TODO(b/118902772)
+		314: syscalls.ErrorWithEvent("sched_setattr", syserror.ENOSYS, "gVisor does not implement a scheduler.", []string{"gvisor.dev/issue/264"}), // TODO(b/118902272)
+		315: syscalls.ErrorWithEvent("sched_getattr", syserror.ENOSYS, "gVisor does not implement a scheduler.", []string{"gvisor.dev/issue/264"}), // TODO(b/118902272)
+		316: syscalls.ErrorWithEvent("renameat2", syserror.ENOSYS, "", []string{"gvisor.dev/issue/263"}),                                           // TODO(b/118902772)
 		317: syscalls.Supported("seccomp", Seccomp),
 		318: syscalls.Supported("getrandom", GetRandom),
 		319: syscalls.Supported("memfd_create", MemfdCreate),
 		320: syscalls.CapError("kexec_file_load", linux.CAP_SYS_BOOT, "", nil),
 		321: syscalls.CapError("bpf", linux.CAP_SYS_ADMIN, "", nil),
-		322: syscalls.ErrorWithEvent("execveat", syscall.ENOSYS, "", []string{"gvisor.dev/issue/265"}),    // TODO(b/118901836)
-		323: syscalls.ErrorWithEvent("userfaultfd", syscall.ENOSYS, "", []string{"gvisor.dev/issue/266"}), // TODO(b/118906345)
-		324: syscalls.ErrorWithEvent("membarrier", syscall.ENOSYS, "", []string{"gvisor.dev/issue/267"}),  // TODO(b/118904897)
+		322: syscalls.ErrorWithEvent("execveat", syserror.ENOSYS, "", []string{"gvisor.dev/issue/265"}),    // TODO(b/118901836)
+		323: syscalls.ErrorWithEvent("userfaultfd", syserror.ENOSYS, "", []string{"gvisor.dev/issue/266"}), // TODO(b/118906345)
+		324: syscalls.ErrorWithEvent("membarrier", syserror.ENOSYS, "", []string{"gvisor.dev/issue/267"}),  // TODO(b/118904897)
 		325: syscalls.PartiallySupported("mlock2", Mlock2, "Stub implementation. The sandbox lacks appropriate permissions.", nil),
 
 		// Syscalls after 325 are "backports" from versions of Linux after 4.4.
-		326: syscalls.ErrorWithEvent("copy_file_range", syscall.ENOSYS, "", nil),
+		326: syscalls.ErrorWithEvent("copy_file_range", syserror.ENOSYS, "", nil),
 		327: syscalls.Supported("preadv2", Preadv2),
 		328: syscalls.PartiallySupported("pwritev2", Pwritev2, "Flag RWF_HIPRI is not supported.", nil),
 		332: syscalls.Supported("statx", Statx),
diff --git a/pkg/sentry/syscalls/linux/sigset.go b/pkg/sentry/syscalls/linux/sigset.go
index 00b7e7cf2..333013d8c 100644
--- a/pkg/sentry/syscalls/linux/sigset.go
+++ b/pkg/sentry/syscalls/linux/sigset.go
@@ -15,8 +15,6 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/usermem"
@@ -27,7 +25,7 @@ import (
 // STOP are clear.
 func copyInSigSet(t *kernel.Task, sigSetAddr usermem.Addr, size uint) (linux.SignalSet, error) {
 	if size != linux.SignalSetSize {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 	b := t.CopyScratchBuffer(8)
 	if _, err := t.CopyInBytes(sigSetAddr, b); err != nil {
diff --git a/pkg/sentry/syscalls/linux/sys_epoll.go b/pkg/sentry/syscalls/linux/sys_epoll.go
index a0dd4d4e3..4a2b9f061 100644
--- a/pkg/sentry/syscalls/linux/sys_epoll.go
+++ b/pkg/sentry/syscalls/linux/sys_epoll.go
@@ -15,8 +15,7 @@
 package linux
 
 import (
-	"syscall"
-
+	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/epoll"
@@ -29,11 +28,11 @@ import (
 // EpollCreate1 implements the epoll_create1(2) linux syscall.
 func EpollCreate1(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
 	flags := args[0].Int()
-	if flags & ^syscall.EPOLL_CLOEXEC != 0 {
+	if flags & ^linux.EPOLL_CLOEXEC != 0 {
 		return 0, nil, syserror.EINVAL
 	}
 
-	closeOnExec := flags&syscall.EPOLL_CLOEXEC != 0
+	closeOnExec := flags&linux.EPOLL_CLOEXEC != 0
 	fd, err := syscalls.CreateEpoll(t, closeOnExec)
 	if err != nil {
 		return 0, nil, err
@@ -69,37 +68,34 @@ func EpollCtl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	flags := epoll.EntryFlags(0)
 	mask := waiter.EventMask(0)
 	var data [2]int32
-	if op != syscall.EPOLL_CTL_DEL {
-		var e syscall.EpollEvent
+	if op != linux.EPOLL_CTL_DEL {
+		var e linux.EpollEvent
 		if _, err := t.CopyIn(eventAddr, &e); err != nil {
 			return 0, nil, err
 		}
 
-		if e.Events&syscall.EPOLLONESHOT != 0 {
+		if e.Events&linux.EPOLLONESHOT != 0 {
 			flags |= epoll.OneShot
 		}
 
-		// syscall.EPOLLET is incorrectly generated as a negative number
-		// in Go, see https://github.com/golang/go/issues/5328 for
-		// details.
-		if e.Events&-syscall.EPOLLET != 0 {
+		if e.Events&linux.EPOLLET != 0 {
 			flags |= epoll.EdgeTriggered
 		}
 
 		mask = waiter.EventMaskFromLinux(e.Events)
 		data[0] = e.Fd
-		data[1] = e.Pad
+		data[1] = e.Data
 	}
 
 	// Perform the requested operations.
 	switch op {
-	case syscall.EPOLL_CTL_ADD:
+	case linux.EPOLL_CTL_ADD:
 		// See fs/eventpoll.c.
 		mask |= waiter.EventHUp | waiter.EventErr
 		return 0, nil, syscalls.AddEpoll(t, epfd, fd, flags, mask, data)
-	case syscall.EPOLL_CTL_DEL:
+	case linux.EPOLL_CTL_DEL:
 		return 0, nil, syscalls.RemoveEpoll(t, epfd, fd)
-	case syscall.EPOLL_CTL_MOD:
+	case linux.EPOLL_CTL_MOD:
 		// Same as EPOLL_CTL_ADD.
 		mask |= waiter.EventHUp | waiter.EventErr
 		return 0, nil, syscalls.UpdateEpoll(t, epfd, fd, flags, mask, data)
diff --git a/pkg/sentry/syscalls/linux/sys_eventfd.go b/pkg/sentry/syscalls/linux/sys_eventfd.go
index 5cfc2c3c8..8a34c4e99 100644
--- a/pkg/sentry/syscalls/linux/sys_eventfd.go
+++ b/pkg/sentry/syscalls/linux/sys_eventfd.go
@@ -15,12 +15,11 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/eventfd"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 const (
@@ -38,7 +37,7 @@ func Eventfd2(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	allOps := uint(EFD_SEMAPHORE | EFD_NONBLOCK | EFD_CLOEXEC)
 
 	if flags & ^allOps != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	event := eventfd.New(t, uint64(initVal), flags&EFD_SEMAPHORE != 0)
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 40722abc2..2e00a91ce 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -768,7 +768,7 @@ func Close(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	defer file.DecRef()
 
 	err := file.Flush(t)
-	return 0, nil, handleIOError(t, false /* partial */, err, syscall.EINTR, "close", file)
+	return 0, nil, handleIOError(t, false /* partial */, err, syserror.EINTR, "close", file)
 }
 
 // Dup implements linux syscall dup(2).
@@ -910,7 +910,7 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 
 		// Copy in the lock request.
 		flockAddr := args[2].Pointer()
-		var flock syscall.Flock_t
+		var flock linux.Flock
 		if _, err := t.CopyIn(flockAddr, &flock); err != nil {
 			return 0, nil, err
 		}
@@ -959,11 +959,11 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		// These locks don't block; execute the non-blocking operation using the inode's lock
 		// context directly.
 		switch flock.Type {
-		case syscall.F_RDLCK:
+		case linux.F_RDLCK:
 			if !file.Flags().Read {
 				return 0, nil, syserror.EBADF
 			}
-			if cmd == syscall.F_SETLK {
+			if cmd == linux.F_SETLK {
 				// Non-blocking lock, provide a nil lock.Blocker.
 				if !file.Dirent.Inode.LockCtx.Posix.LockRegion(lockUniqueID, lock.ReadLock, rng, nil) {
 					return 0, nil, syserror.EAGAIN
@@ -975,11 +975,11 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 				}
 			}
 			return 0, nil, nil
-		case syscall.F_WRLCK:
+		case linux.F_WRLCK:
 			if !file.Flags().Write {
 				return 0, nil, syserror.EBADF
 			}
-			if cmd == syscall.F_SETLK {
+			if cmd == linux.F_SETLK {
 				// Non-blocking lock, provide a nil lock.Blocker.
 				if !file.Dirent.Inode.LockCtx.Posix.LockRegion(lockUniqueID, lock.WriteLock, rng, nil) {
 					return 0, nil, syserror.EAGAIN
@@ -991,7 +991,7 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 				}
 			}
 			return 0, nil, nil
-		case syscall.F_UNLCK:
+		case linux.F_UNLCK:
 			file.Dirent.Inode.LockCtx.Posix.UnlockRegion(lockUniqueID, rng)
 			return 0, nil, nil
 		default:
@@ -1476,7 +1476,7 @@ func Truncate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 
 	if uint64(length) >= t.ThreadGroup().Limits().Get(limits.FileSize).Cur {
 		t.SendSignal(&arch.SignalInfo{
-			Signo: int32(syscall.SIGXFSZ),
+			Signo: int32(linux.SIGXFSZ),
 			Code:  arch.SignalInfoUser,
 		})
 		return 0, nil, syserror.EFBIG
@@ -1536,7 +1536,7 @@ func Ftruncate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 
 	if uint64(length) >= t.ThreadGroup().Limits().Get(limits.FileSize).Cur {
 		t.SendSignal(&arch.SignalInfo{
-			Signo: int32(syscall.SIGXFSZ),
+			Signo: int32(linux.SIGXFSZ),
 			Code:  arch.SignalInfoUser,
 		})
 		return 0, nil, syserror.EFBIG
@@ -1826,7 +1826,7 @@ func Utime(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	// No timesAddr argument will be interpreted as current system time.
 	ts := defaultSetToSystemTimeSpec()
 	if timesAddr != 0 {
-		var times syscall.Utimbuf
+		var times linux.Utime
 		if _, err := t.CopyIn(timesAddr, &times); err != nil {
 			return 0, nil, err
 		}
@@ -2018,7 +2018,7 @@ func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 	}
 	if uint64(size) >= t.ThreadGroup().Limits().Get(limits.FileSize).Cur {
 		t.SendSignal(&arch.SignalInfo{
-			Signo: int32(syscall.SIGXFSZ),
+			Signo: int32(linux.SIGXFSZ),
 			Code:  arch.SignalInfoUser,
 		})
 		return 0, nil, syserror.EFBIG
diff --git a/pkg/sentry/syscalls/linux/sys_getdents.go b/pkg/sentry/syscalls/linux/sys_getdents.go
index 7a2beda23..63e2c5a5d 100644
--- a/pkg/sentry/syscalls/linux/sys_getdents.go
+++ b/pkg/sentry/syscalls/linux/sys_getdents.go
@@ -17,8 +17,8 @@ package linux
 import (
 	"bytes"
 	"io"
-	"syscall"
 
+	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/binary"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
@@ -82,7 +82,7 @@ func getdents(t *kernel.Task, fd int32, addr usermem.Addr, size int, f func(*dir
 
 	switch err := handleIOError(t, ds.Written() > 0, rerr, kernel.ERESTARTSYS, "getdents", dir); err {
 	case nil:
-		dir.Dirent.InotifyEvent(syscall.IN_ACCESS, 0)
+		dir.Dirent.InotifyEvent(linux.IN_ACCESS, 0)
 		return uintptr(ds.Written()), nil
 	case io.EOF:
 		return 0, nil
@@ -146,21 +146,21 @@ func smallestDirent64(a arch.Context) uint {
 func toType(nodeType fs.InodeType) uint8 {
 	switch nodeType {
 	case fs.RegularFile, fs.SpecialFile:
-		return syscall.DT_REG
+		return linux.DT_REG
 	case fs.Symlink:
-		return syscall.DT_LNK
+		return linux.DT_LNK
 	case fs.Directory, fs.SpecialDirectory:
-		return syscall.DT_DIR
+		return linux.DT_DIR
 	case fs.Pipe:
-		return syscall.DT_FIFO
+		return linux.DT_FIFO
 	case fs.CharacterDevice:
-		return syscall.DT_CHR
+		return linux.DT_CHR
 	case fs.BlockDevice:
-		return syscall.DT_BLK
+		return linux.DT_BLK
 	case fs.Socket:
-		return syscall.DT_SOCK
+		return linux.DT_SOCK
 	default:
-		return syscall.DT_UNKNOWN
+		return linux.DT_UNKNOWN
 	}
 }
 
diff --git a/pkg/sentry/syscalls/linux/sys_inotify.go b/pkg/sentry/syscalls/linux/sys_inotify.go
index a4f36e01f..b2c7b3444 100644
--- a/pkg/sentry/syscalls/linux/sys_inotify.go
+++ b/pkg/sentry/syscalls/linux/sys_inotify.go
@@ -15,13 +15,12 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/fs/anon"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 const allFlags = int(linux.IN_NONBLOCK | linux.IN_CLOEXEC)
@@ -31,7 +30,7 @@ func InotifyInit1(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.
 	flags := int(args[0].Int())
 
 	if flags&^allFlags != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	dirent := fs.NewDirent(t, anon.NewInode(t), "inotify")
@@ -66,14 +65,14 @@ func fdToInotify(t *kernel.Task, fd int32) (*fs.Inotify, *fs.File, error) {
 	file := t.GetFile(fd)
 	if file == nil {
 		// Invalid fd.
-		return nil, nil, syscall.EBADF
+		return nil, nil, syserror.EBADF
 	}
 
 	ino, ok := file.FileOperations.(*fs.Inotify)
 	if !ok {
 		// Not an inotify fd.
 		file.DecRef()
-		return nil, nil, syscall.EINVAL
+		return nil, nil, syserror.EINVAL
 	}
 
 	return ino, file, nil
@@ -92,7 +91,7 @@ func InotifyAddWatch(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kern
 	// "EINVAL: The given event mask contains no valid events."
 	// -- inotify_add_watch(2)
 	if validBits := mask & linux.ALL_INOTIFY_BITS; validBits == 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	ino, file, err := fdToInotify(t, fd)
@@ -109,7 +108,7 @@ func InotifyAddWatch(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kern
 	err = fileOpOn(t, linux.AT_FDCWD, path, resolve, func(root *fs.Dirent, dirent *fs.Dirent, _ uint) error {
 		// "IN_ONLYDIR: Only watch pathname if it is a directory." -- inotify(7)
 		if onlyDir := mask&linux.IN_ONLYDIR != 0; onlyDir && !fs.IsDir(dirent.Inode.StableAttr) {
-			return syscall.ENOTDIR
+			return syserror.ENOTDIR
 		}
 
 		// Copy out to the return frame.
diff --git a/pkg/sentry/syscalls/linux/sys_pipe.go b/pkg/sentry/syscalls/linux/sys_pipe.go
index 576022dd5..418d7fa5f 100644
--- a/pkg/sentry/syscalls/linux/sys_pipe.go
+++ b/pkg/sentry/syscalls/linux/sys_pipe.go
@@ -15,20 +15,19 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/pipe"
 	"gvisor.dev/gvisor/pkg/sentry/usermem"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // pipe2 implements the actual system call with flags.
 func pipe2(t *kernel.Task, addr usermem.Addr, flags uint) (uintptr, error) {
 	if flags&^(linux.O_NONBLOCK|linux.O_CLOEXEC) != 0 {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 	r, w := pipe.NewConnectedPipe(t, pipe.DefaultPipeSize, usermem.PageSize)
 
@@ -49,7 +48,7 @@ func pipe2(t *kernel.Task, addr usermem.Addr, flags uint) (uintptr, error) {
 		// The files are not closed in this case, the exact semantics
 		// of this error case are not well defined, but they could have
 		// already been observed by user space.
-		return 0, syscall.EFAULT
+		return 0, syserror.EFAULT
 	}
 	return 0, nil
 }
diff --git a/pkg/sentry/syscalls/linux/sys_prctl.go b/pkg/sentry/syscalls/linux/sys_prctl.go
index 5329023e6..98db32d77 100644
--- a/pkg/sentry/syscalls/linux/sys_prctl.go
+++ b/pkg/sentry/syscalls/linux/sys_prctl.go
@@ -16,7 +16,6 @@ package linux
 
 import (
 	"fmt"
-	"syscall"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -24,6 +23,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/mm"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // Prctl implements linux syscall prctl(2).
@@ -36,7 +36,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	case linux.PR_SET_PDEATHSIG:
 		sig := linux.Signal(args[1].Int())
 		if sig != 0 && !sig.IsValid() {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		t.SetParentDeathSignal(sig)
 		return 0, nil, nil
@@ -67,7 +67,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 			d = mm.UserDumpable
 		default:
 			// N.B. Userspace may not pass SUID_DUMP_ROOT.
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		t.MemoryManager().SetDumpability(d)
 		return 0, nil, nil
@@ -88,7 +88,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		} else if val == 1 {
 			t.SetKeepCaps(true)
 		} else {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 
 		return 0, nil, nil
@@ -96,7 +96,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	case linux.PR_SET_NAME:
 		addr := args[1].Pointer()
 		name, err := t.CopyInString(addr, linux.TASK_COMM_LEN-1)
-		if err != nil && err != syscall.ENAMETOOLONG {
+		if err != nil && err != syserror.ENAMETOOLONG {
 			return 0, nil, err
 		}
 		t.SetName(name)
@@ -116,7 +116,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 
 	case linux.PR_SET_MM:
 		if !t.HasCapability(linux.CAP_SYS_RESOURCE) {
-			return 0, nil, syscall.EPERM
+			return 0, nil, syserror.EPERM
 		}
 
 		switch args[1].Int() {
@@ -125,13 +125,13 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 
 			file := t.GetFile(fd)
 			if file == nil {
-				return 0, nil, syscall.EBADF
+				return 0, nil, syserror.EBADF
 			}
 			defer file.DecRef()
 
 			// They trying to set exe to a non-file?
 			if !fs.IsFile(file.Dirent.Inode.StableAttr) {
-				return 0, nil, syscall.EBADF
+				return 0, nil, syserror.EBADF
 			}
 
 			// Set the underlying executable.
@@ -153,12 +153,12 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 			t.Kernel().EmitUnimplementedEvent(t)
 			fallthrough
 		default:
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 
 	case linux.PR_SET_NO_NEW_PRIVS:
 		if args[1].Int() != 1 || args[2].Int() != 0 || args[3].Int() != 0 || args[4].Int() != 0 {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		// no_new_privs is assumed to always be set. See
 		// kernel.Task.updateCredsForExec.
@@ -166,14 +166,14 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 
 	case linux.PR_GET_NO_NEW_PRIVS:
 		if args[1].Int() != 0 || args[2].Int() != 0 || args[3].Int() != 0 || args[4].Int() != 0 {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		return 1, nil, nil
 
 	case linux.PR_SET_SECCOMP:
 		if args[1].Int() != linux.SECCOMP_MODE_FILTER {
 			// Unsupported mode.
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 
 		return 0, nil, seccomp(t, linux.SECCOMP_SET_MODE_FILTER, 0, args[2].Pointer())
@@ -184,7 +184,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	case linux.PR_CAPBSET_READ:
 		cp := linux.Capability(args[1].Uint64())
 		if !cp.Ok() {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		var rv uintptr
 		if auth.CapabilitySetOf(cp)&t.Credentials().BoundingCaps != 0 {
@@ -195,7 +195,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	case linux.PR_CAPBSET_DROP:
 		cp := linux.Capability(args[1].Uint64())
 		if !cp.Ok() {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		return 0, nil, t.DropBoundingCapability(cp)
 
@@ -220,7 +220,7 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		t.Kernel().EmitUnimplementedEvent(t)
 		fallthrough
 	default:
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	return 0, nil, nil
diff --git a/pkg/sentry/syscalls/linux/sys_sched.go b/pkg/sentry/syscalls/linux/sys_sched.go
index 434bbb322..99f6993f5 100644
--- a/pkg/sentry/syscalls/linux/sys_sched.go
+++ b/pkg/sentry/syscalls/linux/sys_sched.go
@@ -15,11 +15,10 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 const (
@@ -37,13 +36,13 @@ func SchedGetparam(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel
 	pid := args[0].Int()
 	param := args[1].Pointer()
 	if param == 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if pid < 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if pid != 0 && t.PIDNamespace().TaskWithID(kernel.ThreadID(pid)) == nil {
-		return 0, nil, syscall.ESRCH
+		return 0, nil, syserror.ESRCH
 	}
 	r := SchedParam{schedPriority: onlyPriority}
 	if _, err := t.CopyOut(param, r); err != nil {
@@ -57,10 +56,10 @@ func SchedGetparam(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel
 func SchedGetscheduler(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
 	pid := args[0].Int()
 	if pid < 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if pid != 0 && t.PIDNamespace().TaskWithID(kernel.ThreadID(pid)) == nil {
-		return 0, nil, syscall.ESRCH
+		return 0, nil, syserror.ESRCH
 	}
 	return onlyScheduler, nil, nil
 }
@@ -71,20 +70,20 @@ func SchedSetscheduler(t *kernel.Task, args arch.SyscallArguments) (uintptr, *ke
 	policy := args[1].Int()
 	param := args[2].Pointer()
 	if pid < 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if policy != onlyScheduler {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if pid != 0 && t.PIDNamespace().TaskWithID(kernel.ThreadID(pid)) == nil {
-		return 0, nil, syscall.ESRCH
+		return 0, nil, syserror.ESRCH
 	}
 	var r SchedParam
 	if _, err := t.CopyIn(param, &r); err != nil {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if r.schedPriority != onlyPriority {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	return 0, nil, nil
 }
diff --git a/pkg/sentry/syscalls/linux/sys_seccomp.go b/pkg/sentry/syscalls/linux/sys_seccomp.go
index 4885b5e40..18510ead8 100644
--- a/pkg/sentry/syscalls/linux/sys_seccomp.go
+++ b/pkg/sentry/syscalls/linux/sys_seccomp.go
@@ -15,13 +15,12 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/bpf"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/usermem"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // userSockFprog is equivalent to Linux's struct sock_fprog on amd64.
@@ -43,7 +42,7 @@ func seccomp(t *kernel.Task, mode, flags uint64, addr usermem.Addr) error {
 	// We only support SECCOMP_SET_MODE_FILTER at the moment.
 	if mode != linux.SECCOMP_SET_MODE_FILTER {
 		// Unsupported mode.
-		return syscall.EINVAL
+		return syserror.EINVAL
 	}
 
 	tsync := flags&linux.SECCOMP_FILTER_FLAG_TSYNC != 0
@@ -51,7 +50,7 @@ func seccomp(t *kernel.Task, mode, flags uint64, addr usermem.Addr) error {
 	// The only flag we support now is SECCOMP_FILTER_FLAG_TSYNC.
 	if flags&^linux.SECCOMP_FILTER_FLAG_TSYNC != 0 {
 		// Unsupported flag.
-		return syscall.EINVAL
+		return syserror.EINVAL
 	}
 
 	var fprog userSockFprog
@@ -65,7 +64,7 @@ func seccomp(t *kernel.Task, mode, flags uint64, addr usermem.Addr) error {
 	compiledFilter, err := bpf.Compile(filter)
 	if err != nil {
 		t.Debugf("Invalid seccomp-bpf filter: %v", err)
-		return syscall.EINVAL
+		return syserror.EINVAL
 	}
 
 	return t.AppendSyscallFilter(compiledFilter, tsync)
diff --git a/pkg/sentry/syscalls/linux/sys_socket.go b/pkg/sentry/syscalls/linux/sys_socket.go
index d1165a57a..195734257 100644
--- a/pkg/sentry/syscalls/linux/sys_socket.go
+++ b/pkg/sentry/syscalls/linux/sys_socket.go
@@ -15,7 +15,6 @@
 package linux
 
 import (
-	"syscall"
 	"time"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -131,7 +130,7 @@ func CopyInMessageHeader64(t *kernel.Task, addr usermem.Addr, msg *MessageHeader
 // from the untrusted address space range.
 func CaptureAddress(t *kernel.Task, addr usermem.Addr, addrlen uint32) ([]byte, error) {
 	if addrlen > maxAddrLen {
-		return nil, syscall.EINVAL
+		return nil, syserror.EINVAL
 	}
 
 	addrBuf := make([]byte, addrlen)
@@ -153,7 +152,7 @@ func writeAddress(t *kernel.Task, addr interface{}, addrLen uint32, addrPtr user
 	}
 
 	if int32(bufLen) < 0 {
-		return syscall.EINVAL
+		return syserror.EINVAL
 	}
 
 	// Write the length unconditionally.
@@ -186,7 +185,7 @@ func Socket(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 
 	// Check and initialize the flags.
 	if stype & ^(0xf|linux.SOCK_NONBLOCK|linux.SOCK_CLOEXEC) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	// Create the new socket.
@@ -218,7 +217,7 @@ func SocketPair(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sy
 
 	// Check and initialize the flags.
 	if stype & ^(0xf|linux.SOCK_NONBLOCK|linux.SOCK_CLOEXEC) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	fileFlags := fs.SettableFileFlags{
@@ -261,14 +260,14 @@ func Connect(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Capture address and call syscall implementation.
@@ -286,20 +285,20 @@ func Connect(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 func accept(t *kernel.Task, fd int32, addr usermem.Addr, addrLen usermem.Addr, flags int) (uintptr, error) {
 	// Check that no unsupported flags are passed in.
 	if flags & ^(linux.SOCK_NONBLOCK|linux.SOCK_CLOEXEC) != 0 {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, syscall.EBADF
+		return 0, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, syscall.ENOTSOCK
+		return 0, syserror.ENOTSOCK
 	}
 
 	// Call the syscall implementation for this socket, then copy the
@@ -314,7 +313,7 @@ func accept(t *kernel.Task, fd int32, addr usermem.Addr, addrLen usermem.Addr, f
 	if peerRequested {
 		// NOTE(magi): Linux does not give you an error if it can't
 		// write the data back out so neither do we.
-		if err := writeAddress(t, peer, peerLen, addr, addrLen); err == syscall.EINVAL {
+		if err := writeAddress(t, peer, peerLen, addr, addrLen); err == syserror.EINVAL {
 			return 0, err
 		}
 	}
@@ -351,14 +350,14 @@ func Bind(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallC
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Capture address and call syscall implementation.
@@ -378,14 +377,14 @@ func Listen(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Per Linux, the backlog is silently capped to reasonable values.
@@ -407,21 +406,21 @@ func Shutdown(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Validate how, then call syscall implementation.
 	switch how {
 	case linux.SHUT_RD, linux.SHUT_WR, linux.SHUT_RDWR:
 	default:
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	return 0, nil, s.Shutdown(t, int(how)).ToError()
@@ -438,14 +437,14 @@ func GetSockOpt(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sy
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Read the length if present. Reject negative values.
@@ -456,7 +455,7 @@ func GetSockOpt(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sy
 		}
 
 		if optLen < 0 {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 	}
 
@@ -522,21 +521,21 @@ func SetSockOpt(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sy
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	if optLen <= 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if optLen > maxOptLen {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	buf := t.CopyScratchBuffer(int(optLen))
 	if _, err := t.CopyIn(optValAddr, &buf); err != nil {
@@ -560,14 +559,14 @@ func GetSockName(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Get the socket name and copy it to the caller.
@@ -588,14 +587,14 @@ func GetPeerName(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Get the socket peer name and copy it to the caller.
@@ -615,25 +614,25 @@ func RecvMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 
 	if t.Arch().Width() != 8 {
 		// We only handle 64-bit for now.
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Reject flags that we don't handle yet.
 	if flags & ^(baseRecvFlags|linux.MSG_PEEK|linux.MSG_CMSG_CLOEXEC|linux.MSG_ERRQUEUE) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	if file.Flags().NonBlocking {
@@ -663,25 +662,25 @@ func RecvMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 
 	if t.Arch().Width() != 8 {
 		// We only handle 64-bit for now.
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	// Reject flags that we don't handle yet.
 	if flags & ^(baseRecvFlags|linux.MSG_CMSG_CLOEXEC|linux.MSG_ERRQUEUE) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	if file.Flags().NonBlocking {
@@ -696,7 +695,7 @@ func RecvMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 			return 0, nil, err
 		}
 		if !ts.Valid() {
-			return 0, nil, syscall.EINVAL
+			return 0, nil, syserror.EINVAL
 		}
 		deadline = t.Kernel().MonotonicClock().Now().Add(ts.ToDuration())
 		haveDeadline = true
@@ -716,7 +715,7 @@ func RecvMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	for i := uint64(0); i < uint64(vlen); i++ {
 		mp, ok := msgPtr.AddLength(i * multipleMessageHeader64Len)
 		if !ok {
-			return 0, nil, syscall.EFAULT
+			return 0, nil, syserror.EFAULT
 		}
 		var n uintptr
 		if n, err = recvSingleMsg(t, s, mp, flags, haveDeadline, deadline); err != nil {
@@ -726,7 +725,7 @@ func RecvMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		// Copy the received length to the caller.
 		lp, ok := mp.AddLength(messageHeader64Len)
 		if !ok {
-			return 0, nil, syscall.EFAULT
+			return 0, nil, syserror.EFAULT
 		}
 		if _, err = t.CopyOut(lp, uint32(n)); err != nil {
 			break
@@ -748,7 +747,7 @@ func recvSingleMsg(t *kernel.Task, s socket.Socket, msgPtr usermem.Addr, flags i
 	}
 
 	if msg.IovLen > linux.UIO_MAXIOV {
-		return 0, syscall.EMSGSIZE
+		return 0, syserror.EMSGSIZE
 	}
 	dst, err := t.IovecsIOSequence(usermem.Addr(msg.Iov), int(msg.IovLen), usermem.IOOpts{
 		AddressSpaceActive: true,
@@ -759,7 +758,7 @@ func recvSingleMsg(t *kernel.Task, s socket.Socket, msgPtr usermem.Addr, flags i
 
 	// FIXME(b/63594852): Pretend we have an empty error queue.
 	if flags&linux.MSG_ERRQUEUE != 0 {
-		return 0, syscall.EAGAIN
+		return 0, syserror.EAGAIN
 	}
 
 	// Fast path when no control message nor name buffers are provided.
@@ -784,7 +783,7 @@ func recvSingleMsg(t *kernel.Task, s socket.Socket, msgPtr usermem.Addr, flags i
 	}
 
 	if msg.ControlLen > maxControlLen {
-		return 0, syscall.ENOBUFS
+		return 0, syserror.ENOBUFS
 	}
 	n, mflags, sender, senderLen, cms, e := s.RecvMsg(t, dst, int(flags), haveDeadline, deadline, msg.NameLen != 0, msg.ControlLen)
 	if e != nil {
@@ -836,25 +835,25 @@ func recvSingleMsg(t *kernel.Task, s socket.Socket, msgPtr usermem.Addr, flags i
 // recvfrom and recv syscall handlers.
 func recvFrom(t *kernel.Task, fd int32, bufPtr usermem.Addr, bufLen uint64, flags int32, namePtr usermem.Addr, nameLenPtr usermem.Addr) (uintptr, error) {
 	if int(bufLen) < 0 {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 
 	// Reject flags that we don't handle yet.
 	if flags & ^(baseRecvFlags|linux.MSG_PEEK|linux.MSG_CONFIRM) != 0 {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, syscall.EBADF
+		return 0, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, syscall.ENOTSOCK
+		return 0, syserror.ENOTSOCK
 	}
 
 	if file.Flags().NonBlocking {
@@ -914,25 +913,25 @@ func SendMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 
 	if t.Arch().Width() != 8 {
 		// We only handle 64-bit for now.
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Reject flags that we don't handle yet.
 	if flags & ^(linux.MSG_DONTWAIT|linux.MSG_EOR|linux.MSG_MORE|linux.MSG_NOSIGNAL) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	if file.Flags().NonBlocking {
@@ -952,25 +951,25 @@ func SendMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 
 	if t.Arch().Width() != 8 {
 		// We only handle 64-bit for now.
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, nil, syscall.EBADF
+		return 0, nil, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, nil, syscall.ENOTSOCK
+		return 0, nil, syserror.ENOTSOCK
 	}
 
 	// Reject flags that we don't handle yet.
 	if flags & ^(linux.MSG_DONTWAIT|linux.MSG_EOR|linux.MSG_MORE|linux.MSG_NOSIGNAL) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	if file.Flags().NonBlocking {
@@ -982,7 +981,7 @@ func SendMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	for i := uint64(0); i < uint64(vlen); i++ {
 		mp, ok := msgPtr.AddLength(i * multipleMessageHeader64Len)
 		if !ok {
-			return 0, nil, syscall.EFAULT
+			return 0, nil, syserror.EFAULT
 		}
 		var n uintptr
 		if n, err = sendSingleMsg(t, s, file, mp, flags); err != nil {
@@ -992,7 +991,7 @@ func SendMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		// Copy the received length to the caller.
 		lp, ok := mp.AddLength(messageHeader64Len)
 		if !ok {
-			return 0, nil, syscall.EFAULT
+			return 0, nil, syserror.EFAULT
 		}
 		if _, err = t.CopyOut(lp, uint32(n)); err != nil {
 			break
@@ -1017,7 +1016,7 @@ func sendSingleMsg(t *kernel.Task, s socket.Socket, file *fs.File, msgPtr userme
 	if msg.ControlLen > 0 {
 		// Put an upper bound to prevent large allocations.
 		if msg.ControlLen > maxControlLen {
-			return 0, syscall.ENOBUFS
+			return 0, syserror.ENOBUFS
 		}
 		controlData = make([]byte, msg.ControlLen)
 		if _, err := t.CopyIn(usermem.Addr(msg.Control), &controlData); err != nil {
@@ -1037,7 +1036,7 @@ func sendSingleMsg(t *kernel.Task, s socket.Socket, file *fs.File, msgPtr userme
 
 	// Read data then call the sendmsg implementation.
 	if msg.IovLen > linux.UIO_MAXIOV {
-		return 0, syscall.EMSGSIZE
+		return 0, syserror.EMSGSIZE
 	}
 	src, err := t.IovecsIOSequence(usermem.Addr(msg.Iov), int(msg.IovLen), usermem.IOOpts{
 		AddressSpaceActive: true,
@@ -1074,20 +1073,20 @@ func sendSingleMsg(t *kernel.Task, s socket.Socket, file *fs.File, msgPtr userme
 func sendTo(t *kernel.Task, fd int32, bufPtr usermem.Addr, bufLen uint64, flags int32, namePtr usermem.Addr, nameLen uint32) (uintptr, error) {
 	bl := int(bufLen)
 	if bl < 0 {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {
-		return 0, syscall.EBADF
+		return 0, syserror.EBADF
 	}
 	defer file.DecRef()
 
 	// Extract the socket.
 	s, ok := file.FileOperations.(socket.Socket)
 	if !ok {
-		return 0, syscall.ENOTSOCK
+		return 0, syserror.ENOTSOCK
 	}
 
 	if file.Flags().NonBlocking {
diff --git a/pkg/sentry/syscalls/linux/sys_thread.go b/pkg/sentry/syscalls/linux/sys_thread.go
index 9e037bd7b..595eb9155 100644
--- a/pkg/sentry/syscalls/linux/sys_thread.go
+++ b/pkg/sentry/syscalls/linux/sys_thread.go
@@ -123,29 +123,29 @@ func ExitGroup(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 func clone(t *kernel.Task, flags int, stack usermem.Addr, parentTID usermem.Addr, childTID usermem.Addr, tls usermem.Addr) (uintptr, *kernel.SyscallControl, error) {
 	opts := kernel.CloneOptions{
 		SharingOptions: kernel.SharingOptions{
-			NewAddressSpace:     flags&syscall.CLONE_VM == 0,
-			NewSignalHandlers:   flags&syscall.CLONE_SIGHAND == 0,
-			NewThreadGroup:      flags&syscall.CLONE_THREAD == 0,
+			NewAddressSpace:     flags&linux.CLONE_VM == 0,
+			NewSignalHandlers:   flags&linux.CLONE_SIGHAND == 0,
+			NewThreadGroup:      flags&linux.CLONE_THREAD == 0,
 			TerminationSignal:   linux.Signal(flags & exitSignalMask),
-			NewPIDNamespace:     flags&syscall.CLONE_NEWPID == syscall.CLONE_NEWPID,
-			NewUserNamespace:    flags&syscall.CLONE_NEWUSER == syscall.CLONE_NEWUSER,
-			NewNetworkNamespace: flags&syscall.CLONE_NEWNET == syscall.CLONE_NEWNET,
-			NewFiles:            flags&syscall.CLONE_FILES == 0,
-			NewFSContext:        flags&syscall.CLONE_FS == 0,
-			NewUTSNamespace:     flags&syscall.CLONE_NEWUTS == syscall.CLONE_NEWUTS,
-			NewIPCNamespace:     flags&syscall.CLONE_NEWIPC == syscall.CLONE_NEWIPC,
+			NewPIDNamespace:     flags&linux.CLONE_NEWPID == linux.CLONE_NEWPID,
+			NewUserNamespace:    flags&linux.CLONE_NEWUSER == linux.CLONE_NEWUSER,
+			NewNetworkNamespace: flags&linux.CLONE_NEWNET == linux.CLONE_NEWNET,
+			NewFiles:            flags&linux.CLONE_FILES == 0,
+			NewFSContext:        flags&linux.CLONE_FS == 0,
+			NewUTSNamespace:     flags&linux.CLONE_NEWUTS == linux.CLONE_NEWUTS,
+			NewIPCNamespace:     flags&linux.CLONE_NEWIPC == linux.CLONE_NEWIPC,
 		},
 		Stack:         stack,
-		SetTLS:        flags&syscall.CLONE_SETTLS == syscall.CLONE_SETTLS,
+		SetTLS:        flags&linux.CLONE_SETTLS == linux.CLONE_SETTLS,
 		TLS:           tls,
-		ChildClearTID: flags&syscall.CLONE_CHILD_CLEARTID == syscall.CLONE_CHILD_CLEARTID,
-		ChildSetTID:   flags&syscall.CLONE_CHILD_SETTID == syscall.CLONE_CHILD_SETTID,
+		ChildClearTID: flags&linux.CLONE_CHILD_CLEARTID == linux.CLONE_CHILD_CLEARTID,
+		ChildSetTID:   flags&linux.CLONE_CHILD_SETTID == linux.CLONE_CHILD_SETTID,
 		ChildTID:      childTID,
-		ParentSetTID:  flags&syscall.CLONE_PARENT_SETTID == syscall.CLONE_PARENT_SETTID,
+		ParentSetTID:  flags&linux.CLONE_PARENT_SETTID == linux.CLONE_PARENT_SETTID,
 		ParentTID:     parentTID,
-		Vfork:         flags&syscall.CLONE_VFORK == syscall.CLONE_VFORK,
-		Untraced:      flags&syscall.CLONE_UNTRACED == syscall.CLONE_UNTRACED,
-		InheritTracer: flags&syscall.CLONE_PTRACE == syscall.CLONE_PTRACE,
+		Vfork:         flags&linux.CLONE_VFORK == linux.CLONE_VFORK,
+		Untraced:      flags&linux.CLONE_UNTRACED == linux.CLONE_UNTRACED,
+		InheritTracer: flags&linux.CLONE_PTRACE == linux.CLONE_PTRACE,
 	}
 	ntid, ctrl, err := t.Clone(&opts)
 	return uintptr(ntid), ctrl, err
@@ -168,7 +168,7 @@ func Clone(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 func Fork(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
 	// "A call to fork() is equivalent to a call to clone(2) specifying flags
 	// as just SIGCHLD." - fork(2)
-	return clone(t, int(syscall.SIGCHLD), 0, 0, 0, 0)
+	return clone(t, int(linux.SIGCHLD), 0, 0, 0, 0)
 }
 
 // Vfork implements Linux syscall vfork(2).
@@ -178,7 +178,7 @@ func Vfork(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	//
 	//     CLONE_VM | CLONE_VFORK | SIGCHLD
 	// """ - vfork(2)
-	return clone(t, syscall.CLONE_VM|syscall.CLONE_VFORK|int(syscall.SIGCHLD), 0, 0, 0, 0)
+	return clone(t, linux.CLONE_VM|linux.CLONE_VFORK|int(linux.SIGCHLD), 0, 0, 0, 0)
 }
 
 // parseCommonWaitOptions applies the options common to wait4 and waitid to
@@ -193,7 +193,7 @@ func parseCommonWaitOptions(wopts *kernel.WaitOptions, options int) error {
 		wopts.NonCloneTasks = true
 		wopts.CloneTasks = true
 	default:
-		return syscall.EINVAL
+		return syserror.EINVAL
 	}
 	if options&linux.WCONTINUED != 0 {
 		wopts.Events |= kernel.EventGroupContinue
@@ -210,7 +210,7 @@ func parseCommonWaitOptions(wopts *kernel.WaitOptions, options int) error {
 // wait4 waits for the given child process to exit.
 func wait4(t *kernel.Task, pid int, statusAddr usermem.Addr, options int, rusageAddr usermem.Addr) (uintptr, error) {
 	if options&^(linux.WNOHANG|linux.WUNTRACED|linux.WCONTINUED|linux.WNOTHREAD|linux.WALL|linux.WCLONE) != 0 {
-		return 0, syscall.EINVAL
+		return 0, syserror.EINVAL
 	}
 	wopts := kernel.WaitOptions{
 		Events:       kernel.EventExit | kernel.EventTraceeStop,
@@ -291,10 +291,10 @@ func Waitid(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 	rusageAddr := args[4].Pointer()
 
 	if options&^(linux.WNOHANG|linux.WEXITED|linux.WSTOPPED|linux.WCONTINUED|linux.WNOWAIT|linux.WNOTHREAD|linux.WALL|linux.WCLONE) != 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	if options&(linux.WEXITED|linux.WSTOPPED|linux.WCONTINUED) == 0 {
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 	wopts := kernel.WaitOptions{
 		Events:       kernel.EventTraceeStop,
@@ -307,7 +307,7 @@ func Waitid(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 	case linux.P_PGID:
 		wopts.SpecificPGID = kernel.ProcessGroupID(id)
 	default:
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	if err := parseCommonWaitOptions(&wopts, options); err != nil {
@@ -347,12 +347,12 @@ func Waitid(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 		return 0, nil, nil
 	}
 	si := arch.SignalInfo{
-		Signo: int32(syscall.SIGCHLD),
+		Signo: int32(linux.SIGCHLD),
 	}
 	si.SetPid(int32(wr.TID))
 	si.SetUid(int32(wr.UID))
 	// TODO(b/73541790): convert kernel.ExitStatus to functions and make
-	// WaitResult.Status a linux.WaitStatus
+	// WaitResult.Status a linux.WaitStatus.
 	s := syscall.WaitStatus(wr.Status)
 	switch {
 	case s.Exited():
@@ -374,7 +374,7 @@ func Waitid(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 		}
 	case s.Continued():
 		si.Code = arch.CLD_CONTINUED
-		si.SetStatus(int32(syscall.SIGCONT))
+		si.SetStatus(int32(linux.SIGCONT))
 	default:
 		t.Warningf("waitid got incomprehensible wait status %d", s)
 	}
@@ -395,16 +395,16 @@ func SetTidAddress(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel
 func Unshare(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
 	flags := args[0].Int()
 	opts := kernel.SharingOptions{
-		NewAddressSpace:     flags&syscall.CLONE_VM == syscall.CLONE_VM,
-		NewSignalHandlers:   flags&syscall.CLONE_SIGHAND == syscall.CLONE_SIGHAND,
-		NewThreadGroup:      flags&syscall.CLONE_THREAD == syscall.CLONE_THREAD,
-		NewPIDNamespace:     flags&syscall.CLONE_NEWPID == syscall.CLONE_NEWPID,
-		NewUserNamespace:    flags&syscall.CLONE_NEWUSER == syscall.CLONE_NEWUSER,
-		NewNetworkNamespace: flags&syscall.CLONE_NEWNET == syscall.CLONE_NEWNET,
-		NewFiles:            flags&syscall.CLONE_FILES == syscall.CLONE_FILES,
-		NewFSContext:        flags&syscall.CLONE_FS == syscall.CLONE_FS,
-		NewUTSNamespace:     flags&syscall.CLONE_NEWUTS == syscall.CLONE_NEWUTS,
-		NewIPCNamespace:     flags&syscall.CLONE_NEWIPC == syscall.CLONE_NEWIPC,
+		NewAddressSpace:     flags&linux.CLONE_VM == linux.CLONE_VM,
+		NewSignalHandlers:   flags&linux.CLONE_SIGHAND == linux.CLONE_SIGHAND,
+		NewThreadGroup:      flags&linux.CLONE_THREAD == linux.CLONE_THREAD,
+		NewPIDNamespace:     flags&linux.CLONE_NEWPID == linux.CLONE_NEWPID,
+		NewUserNamespace:    flags&linux.CLONE_NEWUSER == linux.CLONE_NEWUSER,
+		NewNetworkNamespace: flags&linux.CLONE_NEWNET == linux.CLONE_NEWNET,
+		NewFiles:            flags&linux.CLONE_FILES == linux.CLONE_FILES,
+		NewFSContext:        flags&linux.CLONE_FS == linux.CLONE_FS,
+		NewUTSNamespace:     flags&linux.CLONE_NEWUTS == linux.CLONE_NEWUTS,
+		NewIPCNamespace:     flags&linux.CLONE_NEWIPC == linux.CLONE_NEWIPC,
 	}
 	// "CLONE_NEWPID automatically implies CLONE_THREAD as well." - unshare(2)
 	if opts.NewPIDNamespace {
@@ -623,7 +623,7 @@ func Getpriority(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 	who := kernel.ThreadID(args[1].Int())
 
 	switch which {
-	case syscall.PRIO_PROCESS:
+	case linux.PRIO_PROCESS:
 		// Look for who, return ESRCH if not found.
 		var task *kernel.Task
 		if who == 0 {
@@ -633,7 +633,7 @@ func Getpriority(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 		}
 
 		if task == nil {
-			return 0, nil, syscall.ESRCH
+			return 0, nil, syserror.ESRCH
 		}
 
 		// From kernel/sys.c:getpriority:
@@ -641,13 +641,13 @@ func Getpriority(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 		// will not return the normal nice-value, but a negated
 		// value that has been offset by 20"
 		return uintptr(20 - task.Niceness()), nil, nil
-	case syscall.PRIO_USER:
+	case linux.PRIO_USER:
 		fallthrough
-	case syscall.PRIO_PGRP:
+	case linux.PRIO_PGRP:
 		// PRIO_USER and PRIO_PGRP have no further implementation yet.
 		return 0, nil, nil
 	default:
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 }
 
@@ -669,7 +669,7 @@ func Setpriority(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 	}
 
 	switch which {
-	case syscall.PRIO_PROCESS:
+	case linux.PRIO_PROCESS:
 		// Look for who, return ESRCH if not found.
 		var task *kernel.Task
 		if who == 0 {
@@ -679,17 +679,17 @@ func Setpriority(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 		}
 
 		if task == nil {
-			return 0, nil, syscall.ESRCH
+			return 0, nil, syserror.ESRCH
 		}
 
 		task.SetNiceness(niceval)
-	case syscall.PRIO_USER:
+	case linux.PRIO_USER:
 		fallthrough
-	case syscall.PRIO_PGRP:
+	case linux.PRIO_PGRP:
 		// PRIO_USER and PRIO_PGRP have no further implementation yet.
 		return 0, nil, nil
 	default:
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	return 0, nil, nil
diff --git a/pkg/sentry/syscalls/linux/sys_timer.go b/pkg/sentry/syscalls/linux/sys_timer.go
index ca5ccb7c3..d4134207b 100644
--- a/pkg/sentry/syscalls/linux/sys_timer.go
+++ b/pkg/sentry/syscalls/linux/sys_timer.go
@@ -15,13 +15,13 @@
 package linux
 
 import (
-	"syscall"
 	"time"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/usermem"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 const nsecPerSec = int64(time.Second)
@@ -47,7 +47,7 @@ func copyItimerValIn(t *kernel.Task, addr usermem.Addr) (linux.ItimerVal, error)
 
 		return itv, nil
 	default:
-		return linux.ItimerVal{}, syscall.ENOSYS
+		return linux.ItimerVal{}, syserror.ENOSYS
 	}
 }
 
@@ -65,7 +65,7 @@ func copyItimerValOut(t *kernel.Task, addr usermem.Addr, itv *linux.ItimerVal) e
 		_, err := t.CopyOut(addr, itv)
 		return err
 	default:
-		return syscall.ENOSYS
+		return syserror.ENOSYS
 	}
 }
 
diff --git a/pkg/sentry/syscalls/linux/sys_tls.go b/pkg/sentry/syscalls/linux/sys_tls.go
index e3d1c6201..b3eb96a1c 100644
--- a/pkg/sentry/syscalls/linux/sys_tls.go
+++ b/pkg/sentry/syscalls/linux/sys_tls.go
@@ -17,11 +17,10 @@
 package linux
 
 import (
-	"syscall"
-
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
+	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // ArchPrctl implements linux syscall arch_prctl(2).
@@ -39,14 +38,14 @@ func ArchPrctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 	case linux.ARCH_SET_FS:
 		fsbase := args[1].Uint64()
 		if !t.Arch().SetTLS(uintptr(fsbase)) {
-			return 0, nil, syscall.EPERM
+			return 0, nil, syserror.EPERM
 		}
 
 	case linux.ARCH_GET_GS, linux.ARCH_SET_GS:
 		t.Kernel().EmitUnimplementedEvent(t)
 		fallthrough
 	default:
-		return 0, nil, syscall.EINVAL
+		return 0, nil, syserror.EINVAL
 	}
 
 	return 0, nil, nil
diff --git a/pkg/sentry/syscalls/linux/timespec.go b/pkg/sentry/syscalls/linux/timespec.go
index 9ba0eba7a..4ff8f9234 100644
--- a/pkg/sentry/syscalls/linux/timespec.go
+++ b/pkg/sentry/syscalls/linux/timespec.go
@@ -15,7 +15,6 @@
 package linux
 
 import (
-	"syscall"
 	"time"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -70,7 +69,7 @@ func copyTimevalIn(t *kernel.Task, addr usermem.Addr) (linux.Timeval, error) {
 		tv.Usec = int64(usermem.ByteOrder.Uint64(in[8:]))
 		return tv, nil
 	default:
-		return linux.Timeval{}, syscall.ENOSYS
+		return linux.Timeval{}, syserror.ENOSYS
 	}
 }
 
@@ -84,7 +83,7 @@ func copyTimevalOut(t *kernel.Task, addr usermem.Addr, tv *linux.Timeval) error
 		_, err := t.CopyOutBytes(addr, out)
 		return err
 	default:
-		return syscall.ENOSYS
+		return syserror.ENOSYS
 	}
 }
 
@@ -104,7 +103,7 @@ func copyTimespecInToDuration(t *kernel.Task, timespecAddr usermem.Addr) (time.D
 			return 0, err
 		}
 		if !timespec.Valid() {
-			return 0, syscall.EINVAL
+			return 0, syserror.EINVAL
 		}
 		timeout = time.Duration(timespec.ToNsecCapped())
 	}
diff --git a/pkg/sentry/syscalls/syscalls.go b/pkg/sentry/syscalls/syscalls.go
index 94d52d5d5..f88055676 100644
--- a/pkg/sentry/syscalls/syscalls.go
+++ b/pkg/sentry/syscalls/syscalls.go
@@ -26,7 +26,6 @@ package syscalls
 
 import (
 	"fmt"
-	"syscall"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -56,7 +55,7 @@ func PartiallySupported(name string, fn kernel.SyscallFn, note string, urls []st
 }
 
 // Error returns a syscall handler that will always give the passed error.
-func Error(name string, err syscall.Errno, note string, urls []string) kernel.Syscall {
+func Error(name string, err error, note string, urls []string) kernel.Syscall {
 	if note != "" {
 		note = note + "; "
 	}
@@ -73,7 +72,7 @@ func Error(name string, err syscall.Errno, note string, urls []string) kernel.Sy
 
 // ErrorWithEvent gives a syscall function that sends an unimplemented
 // syscall event via the event channel and returns the passed error.
-func ErrorWithEvent(name string, err syscall.Errno, note string, urls []string) kernel.Syscall {
+func ErrorWithEvent(name string, err error, note string, urls []string) kernel.Syscall {
 	if note != "" {
 		note = note + "; "
 	}