[op] Replace syscall package usage with golang.org/x/sys/unix in pkg/.

The syscall package has been deprecated in favor of golang.org/x/sys.

Note that syscall is still used in the following places:
- pkg/sentry/socket/hostinet/stack.go: some netlink related functionalities
  are not yet available in golang.org/x/sys.
- syscall.Stat_t is still used in some places because os.FileInfo.Sys() still
  returns it and not unix.Stat_t.

Updates #214

PiperOrigin-RevId: 360701387

21 files changed, 160 insertions, 157 deletions

diff --git a/pkg/tcpip/link/fdbased/BUILD b/pkg/tcpip/link/fdbased/BUILD
index ae1394ebf..f042df82e 100644
--- a/pkg/tcpip/link/fdbased/BUILD
+++ b/pkg/tcpip/link/fdbased/BUILD
@@ -37,5 +37,6 @@ go_test(
         "//pkg/tcpip/header",
         "//pkg/tcpip/stack",
         "@com_github_google_go_cmp//cmp:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/tcpip/link/fdbased/endpoint.go b/pkg/tcpip/link/fdbased/endpoint.go
index 0164d851b..72d3f70ac 100644
--- a/pkg/tcpip/link/fdbased/endpoint.go
+++ b/pkg/tcpip/link/fdbased/endpoint.go
@@ -41,7 +41,6 @@ package fdbased
 
 import (
 	"fmt"
-	"syscall"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/binary"
@@ -237,8 +236,8 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
 	// Create per channel dispatchers.
 	for i := 0; i < len(e.fds); i++ {
 		fd := e.fds[i]
-		if err := syscall.SetNonblock(fd, true); err != nil {
-			return nil, fmt.Errorf("syscall.SetNonblock(%v) failed: %v", fd, err)
+		if err := unix.SetNonblock(fd, true); err != nil {
+			return nil, fmt.Errorf("unix.SetNonblock(%v) failed: %v", fd, err)
 		}
 
 		isSocket, err := isSocketFD(fd)
@@ -291,7 +290,7 @@ func createInboundDispatcher(e *endpoint, fd int, isSocket bool) (linkDispatcher
 			// hard to test fragmentation reassembly code in Netstack.
 			const fanoutType = unix.PACKET_FANOUT_HASH
 			fanoutArg := fanoutID | fanoutType<<16
-			if err := syscall.SetsockoptInt(fd, syscall.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
+			if err := unix.SetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
 				return nil, fmt.Errorf("failed to enable PACKET_FANOUT option: %v", err)
 			}
 		}
@@ -316,11 +315,11 @@ func createInboundDispatcher(e *endpoint, fd int, isSocket bool) (linkDispatcher
 }
 
 func isSocketFD(fd int) (bool, error) {
-	var stat syscall.Stat_t
-	if err := syscall.Fstat(fd, &stat); err != nil {
-		return false, fmt.Errorf("syscall.Fstat(%v,...) failed: %v", fd, err)
+	var stat unix.Stat_t
+	if err := unix.Fstat(fd, &stat); err != nil {
+		return false, fmt.Errorf("unix.Fstat(%v,...) failed: %v", fd, err)
 	}
-	return (stat.Mode & syscall.S_IFSOCK) == syscall.S_IFSOCK, nil
+	return (stat.Mode & unix.S_IFSOCK) == unix.S_IFSOCK, nil
 }
 
 // Attach launches the goroutine that reads packets from the file descriptor and
@@ -614,7 +613,7 @@ func (e *InjectableEndpoint) InjectInbound(protocol tcpip.NetworkProtocolNumber,
 
 // NewInjectable creates a new fd-based InjectableEndpoint.
 func NewInjectable(fd int, mtu uint32, capabilities stack.LinkEndpointCapabilities) *InjectableEndpoint {
-	syscall.SetNonblock(fd, true)
+	unix.SetNonblock(fd, true)
 
 	return &InjectableEndpoint{endpoint: endpoint{
 		fds:  []int{fd},
diff --git a/pkg/tcpip/link/fdbased/endpoint_test.go b/pkg/tcpip/link/fdbased/endpoint_test.go
index e82371798..358a030d2 100644
--- a/pkg/tcpip/link/fdbased/endpoint_test.go
+++ b/pkg/tcpip/link/fdbased/endpoint_test.go
@@ -21,12 +21,12 @@ import (
 	"fmt"
 	"math/rand"
 	"reflect"
-	"syscall"
 	"testing"
 	"time"
 	"unsafe"
 
 	"github.com/google/go-cmp/cmp"
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -85,11 +85,11 @@ type context struct {
 }
 
 func newContext(t *testing.T, opt *Options) *context {
-	firstFDPair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET, 0)
+	firstFDPair, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_SEQPACKET, 0)
 	if err != nil {
 		t.Fatalf("Socketpair failed: %v", err)
 	}
-	secondFDPair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET, 0)
+	secondFDPair, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_SEQPACKET, 0)
 	if err != nil {
 		t.Fatalf("Socketpair failed: %v", err)
 	}
@@ -121,12 +121,12 @@ func newContext(t *testing.T, opt *Options) *context {
 
 func (c *context) cleanup() {
 	for _, fd := range c.readFDs {
-		syscall.Close(fd)
+		unix.Close(fd)
 	}
 	<-c.done
 	<-c.done
 	for _, fd := range c.writeFDs {
-		syscall.Close(fd)
+		unix.Close(fd)
 	}
 }
 
@@ -225,7 +225,7 @@ func testWritePacket(t *testing.T, plen int, eth bool, gsoMaxSize uint32, hash u
 	// Read from the corresponding FD, then compare with what we wrote.
 	b = make([]byte, mtu)
 	fd := c.readFDs[hash%uint32(len(c.readFDs))]
-	n, err := syscall.Read(fd, b)
+	n, err := unix.Read(fd, b)
 	if err != nil {
 		t.Fatalf("Read failed: %v", err)
 	}
@@ -339,7 +339,7 @@ func TestPreserveSrcAddress(t *testing.T) {
 
 	// Read from the FD, then compare with what we wrote.
 	b := make([]byte, mtu)
-	n, err := syscall.Read(c.readFDs[0], b)
+	n, err := unix.Read(c.readFDs[0], b)
 	if err != nil {
 		t.Fatalf("Read failed: %v", err)
 	}
@@ -384,7 +384,7 @@ func TestDeliverPacket(t *testing.T) {
 				}
 
 				// Write packet via the file descriptor.
-				if _, err := syscall.Write(c.readFDs[0], all); err != nil {
+				if _, err := unix.Write(c.readFDs[0], all); err != nil {
 					t.Fatalf("Write failed: %v", err)
 				}
 
@@ -481,7 +481,7 @@ func TestIovecBuffer(t *testing.T) {
 
 			// Make a copy as iovecs points to internal slice. We will need this state
 			// later.
-			oldIovecs := append([]syscall.Iovec(nil), iovecs...)
+			oldIovecs := append([]unix.Iovec(nil), iovecs...)
 
 			// Test the views that get pulled.
 			vv := b.pullViews(c.n)
@@ -575,12 +575,12 @@ func TestDispatchPacketFormat(t *testing.T) {
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			// Create a socket pair to send/recv.
-			fds, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_DGRAM, 0)
+			fds, err := unix.Socketpair(unix.AF_UNIX, unix.SOCK_DGRAM, 0)
 			if err != nil {
 				t.Fatal(err)
 			}
-			defer syscall.Close(fds[0])
-			defer syscall.Close(fds[1])
+			defer unix.Close(fds[0])
+			defer unix.Close(fds[1])
 
 			data := []byte{
 				// Ethernet header.
@@ -590,7 +590,7 @@ func TestDispatchPacketFormat(t *testing.T) {
 				// Mock network header.
 				40, 41, 42, 43,
 			}
-			err = syscall.Sendmsg(fds[1], data, nil, nil, 0)
+			err = unix.Sendmsg(fds[1], data, nil, nil, 0)
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/pkg/tcpip/link/fdbased/mmap.go b/pkg/tcpip/link/fdbased/mmap.go
index a2b63fe6b..5d698a5e9 100644
--- a/pkg/tcpip/link/fdbased/mmap.go
+++ b/pkg/tcpip/link/fdbased/mmap.go
@@ -19,7 +19,6 @@ package fdbased
 import (
 	"encoding/binary"
 	"fmt"
-	"syscall"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -137,7 +136,7 @@ func (d *packetMMapDispatcher) readMMappedPacket() ([]byte, tcpip.Error) {
 			Events: unix.POLLIN | unix.POLLERR,
 		}
 		if _, errno := rawfile.BlockingPoll(&event, 1, nil); errno != 0 {
-			if errno == syscall.EINTR {
+			if errno == unix.EINTR {
 				continue
 			}
 			return nil, rawfile.TranslateErrno(errno)
diff --git a/pkg/tcpip/link/fdbased/mmap_unsafe.go b/pkg/tcpip/link/fdbased/mmap_unsafe.go
index 3894185ae..1293f68a2 100644
--- a/pkg/tcpip/link/fdbased/mmap_unsafe.go
+++ b/pkg/tcpip/link/fdbased/mmap_unsafe.go
@@ -19,14 +19,13 @@ package fdbased
 import (
 	"fmt"
 	"sync/atomic"
-	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/unix"
 )
 
 // tPacketHdrlen is the TPACKET_HDRLEN variable defined in <linux/if_packet.h>.
-var tPacketHdrlen = tPacketAlign(unsafe.Sizeof(tPacketHdr{}) + unsafe.Sizeof(syscall.RawSockaddrLinklayer{}))
+var tPacketHdrlen = tPacketAlign(unsafe.Sizeof(tPacketHdr{}) + unsafe.Sizeof(unix.RawSockaddrLinklayer{}))
 
 // tpStatus returns the frame status field.
 // The status is concurrently updated by the kernel as a result we must
@@ -62,21 +61,21 @@ func newPacketMMapDispatcher(fd int, e *endpoint) (linkDispatcher, error) {
 		tpFrameNR:   uint32(tpFrameNR),
 	}
 	// Setup PACKET_RX_RING.
-	if err := setsockopt(d.fd, syscall.SOL_PACKET, syscall.PACKET_RX_RING, unsafe.Pointer(&tReq), unsafe.Sizeof(tReq)); err != nil {
+	if err := setsockopt(d.fd, unix.SOL_PACKET, unix.PACKET_RX_RING, unsafe.Pointer(&tReq), unsafe.Sizeof(tReq)); err != nil {
 		return nil, fmt.Errorf("failed to enable PACKET_RX_RING: %v", err)
 	}
 	// Let's mmap the blocks.
 	sz := tpBlockSize * tpBlockNR
-	buf, err := syscall.Mmap(d.fd, 0, sz, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED)
+	buf, err := unix.Mmap(d.fd, 0, sz, unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED)
 	if err != nil {
-		return nil, fmt.Errorf("syscall.Mmap(...,0, %v, ...) failed = %v", sz, err)
+		return nil, fmt.Errorf("unix.Mmap(...,0, %v, ...) failed = %v", sz, err)
 	}
 	d.ringBuffer = buf
 	return d, nil
 }
 
 func setsockopt(fd, level, name int, val unsafe.Pointer, vallen uintptr) error {
-	if _, _, errno := syscall.Syscall6(syscall.SYS_SETSOCKOPT, uintptr(fd), uintptr(level), uintptr(name), uintptr(val), vallen, 0); errno != 0 {
+	if _, _, errno := unix.Syscall6(unix.SYS_SETSOCKOPT, uintptr(fd), uintptr(level), uintptr(name), uintptr(val), vallen, 0); errno != 0 {
 		return error(errno)
 	}
 
diff --git a/pkg/tcpip/link/fdbased/packet_dispatchers.go b/pkg/tcpip/link/fdbased/packet_dispatchers.go
index ecae1ad2d..736871d1c 100644
--- a/pkg/tcpip/link/fdbased/packet_dispatchers.go
+++ b/pkg/tcpip/link/fdbased/packet_dispatchers.go
@@ -17,8 +17,7 @@
 package fdbased
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -38,7 +37,7 @@ type iovecBuffer struct {
 	// (skipsVnetHdr) then the first iovec points to a buffer for the vnet header
 	// which is stripped before the views are passed up the stack for further
 	// processing.
-	iovecs []syscall.Iovec
+	iovecs []unix.Iovec
 
 	// sizes is an array of buffer sizes for the underlying views. sizes is
 	// immutable.
@@ -58,18 +57,18 @@ func newIovecBuffer(sizes []int, skipsVnetHdr bool) *iovecBuffer {
 	if b.skipsVnetHdr {
 		niov++
 	}
-	b.iovecs = make([]syscall.Iovec, niov)
+	b.iovecs = make([]unix.Iovec, niov)
 	return b
 }
 
-func (b *iovecBuffer) nextIovecs() []syscall.Iovec {
+func (b *iovecBuffer) nextIovecs() []unix.Iovec {
 	vnetHdrOff := 0
 	if b.skipsVnetHdr {
 		var vnetHdr [virtioNetHdrSize]byte
 		// The kernel adds virtioNetHdr before each packet, but
 		// we don't use it, so so we allocate a buffer for it,
 		// add it in iovecs but don't add it in a view.
-		b.iovecs[0] = syscall.Iovec{
+		b.iovecs[0] = unix.Iovec{
 			Base: &vnetHdr[0],
 			Len:  uint64(virtioNetHdrSize),
 		}
@@ -81,7 +80,7 @@ func (b *iovecBuffer) nextIovecs() []syscall.Iovec {
 		}
 		v := buffer.NewView(b.sizes[i])
 		b.views[i] = v
-		b.iovecs[i+vnetHdrOff] = syscall.Iovec{
+		b.iovecs[i+vnetHdrOff] = unix.Iovec{
 			Base: &v[0],
 			Len:  uint64(len(v)),
 		}
@@ -200,7 +199,7 @@ type recvMMsgDispatcher struct {
 	// msgHdrs is an array of MMsgHdr objects where each MMsghdr is used to
 	// reference an array of iovecs in the iovecs field defined above.  This
 	// array is passed as the parameter to recvmmsg call to retrieve
-	// potentially more than 1 packet per syscall.
+	// potentially more than 1 packet per unix.
 	msgHdrs []rawfile.MMsgHdr
 }
 
diff --git a/pkg/tcpip/link/muxed/BUILD b/pkg/tcpip/link/muxed/BUILD
index cbda59775..193524525 100644
--- a/pkg/tcpip/link/muxed/BUILD
+++ b/pkg/tcpip/link/muxed/BUILD
@@ -24,5 +24,6 @@ go_test(
         "//pkg/tcpip/link/fdbased",
         "//pkg/tcpip/network/ipv4",
         "//pkg/tcpip/stack",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/tcpip/link/muxed/injectable_test.go b/pkg/tcpip/link/muxed/injectable_test.go
index ba30287bc..5806f7fdf 100644
--- a/pkg/tcpip/link/muxed/injectable_test.go
+++ b/pkg/tcpip/link/muxed/injectable_test.go
@@ -18,9 +18,9 @@ import (
 	"bytes"
 	"net"
 	"os"
-	"syscall"
 	"testing"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
@@ -89,8 +89,8 @@ func TestInjectableEndpointDispatchHdrOnly(t *testing.T) {
 
 func makeTestInjectableEndpoint(t *testing.T) (*InjectableEndpoint, *os.File, tcpip.Address) {
 	dstIP := tcpip.Address(net.ParseIP("1.2.3.4").To4())
-	pair, err := syscall.Socketpair(syscall.AF_UNIX,
-		syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC|syscall.SOCK_NONBLOCK, 0)
+	pair, err := unix.Socketpair(unix.AF_UNIX,
+		unix.SOCK_SEQPACKET|unix.SOCK_CLOEXEC|unix.SOCK_NONBLOCK, 0)
 	if err != nil {
 		t.Fatal("Failed to create socket pair:", err)
 	}
diff --git a/pkg/tcpip/link/rawfile/BUILD b/pkg/tcpip/link/rawfile/BUILD
index e1047da50..4efd7c45e 100644
--- a/pkg/tcpip/link/rawfile/BUILD
+++ b/pkg/tcpip/link/rawfile/BUILD
@@ -28,5 +28,6 @@ go_test(
     deps = [
         "//pkg/tcpip",
         "@com_github_google_go_cmp//cmp:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go
index 621ab8d29..2206fe0e6 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go
@@ -17,14 +17,15 @@
 package rawfile
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // BlockingPoll is just a stub function that forwards to the ppoll() system call
 // on non-amd64 and non-arm64 platforms.
-func BlockingPoll(fds *PollEvent, nfds int, timeout *syscall.Timespec) (int, syscall.Errno) {
-	n, _, e := syscall.Syscall6(syscall.SYS_PPOLL, uintptr(unsafe.Pointer(fds)),
+func BlockingPoll(fds *PollEvent, nfds int, timeout *unix.Timespec) (int, unix.Errno) {
+	n, _, e := unix.Syscall6(unix.SYS_PPOLL, uintptr(unsafe.Pointer(fds)),
 		uintptr(nfds), uintptr(unsafe.Pointer(timeout)), 0, 0, 0)
 
 	return int(n), e
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go
index 7f238102e..5002245a1 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go
@@ -21,8 +21,9 @@
 package rawfile
 
 import (
-	"syscall"
 	_ "unsafe" // for go:linkname
+
+	"golang.org/x/sys/unix"
 )
 
 // BlockingPoll on amd64/arm64 makes the ppoll() syscall while calling the
@@ -32,7 +33,7 @@ import (
 // call.
 //
 //go:noescape
-func BlockingPoll(fds *PollEvent, nfds int, timeout *syscall.Timespec) (int, syscall.Errno)
+func BlockingPoll(fds *PollEvent, nfds int, timeout *unix.Timespec) (int, unix.Errno)
 
 // Use go:linkname to call into the runtime. As of Go 1.12 this has to
 // be done from Go code so that we make an ABIInternal call to an
diff --git a/pkg/tcpip/link/rawfile/errors.go b/pkg/tcpip/link/rawfile/errors.go
index 406b97709..9743e70ea 100644
--- a/pkg/tcpip/link/rawfile/errors.go
+++ b/pkg/tcpip/link/rawfile/errors.go
@@ -17,8 +17,7 @@
 package rawfile
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 )
 
@@ -29,47 +28,47 @@ const maxErrno = 134
 //
 // Valid, but unrecognized errnos will be translated to
 // *tcpip.ErrInvalidEndpointState (EINVAL).
-func TranslateErrno(e syscall.Errno) tcpip.Error {
+func TranslateErrno(e unix.Errno) tcpip.Error {
 	switch e {
-	case syscall.EEXIST:
+	case unix.EEXIST:
 		return &tcpip.ErrDuplicateAddress{}
-	case syscall.ENETUNREACH:
+	case unix.ENETUNREACH:
 		return &tcpip.ErrNoRoute{}
-	case syscall.EINVAL:
+	case unix.EINVAL:
 		return &tcpip.ErrInvalidEndpointState{}
-	case syscall.EALREADY:
+	case unix.EALREADY:
 		return &tcpip.ErrAlreadyConnecting{}
-	case syscall.EISCONN:
+	case unix.EISCONN:
 		return &tcpip.ErrAlreadyConnected{}
-	case syscall.EADDRINUSE:
+	case unix.EADDRINUSE:
 		return &tcpip.ErrPortInUse{}
-	case syscall.EADDRNOTAVAIL:
+	case unix.EADDRNOTAVAIL:
 		return &tcpip.ErrBadLocalAddress{}
-	case syscall.EPIPE:
+	case unix.EPIPE:
 		return &tcpip.ErrClosedForSend{}
-	case syscall.EWOULDBLOCK:
+	case unix.EWOULDBLOCK:
 		return &tcpip.ErrWouldBlock{}
-	case syscall.ECONNREFUSED:
+	case unix.ECONNREFUSED:
 		return &tcpip.ErrConnectionRefused{}
-	case syscall.ETIMEDOUT:
+	case unix.ETIMEDOUT:
 		return &tcpip.ErrTimeout{}
-	case syscall.EINPROGRESS:
+	case unix.EINPROGRESS:
 		return &tcpip.ErrConnectStarted{}
-	case syscall.EDESTADDRREQ:
+	case unix.EDESTADDRREQ:
 		return &tcpip.ErrDestinationRequired{}
-	case syscall.ENOTSUP:
+	case unix.ENOTSUP:
 		return &tcpip.ErrNotSupported{}
-	case syscall.ENOTTY:
+	case unix.ENOTTY:
 		return &tcpip.ErrQueueSizeNotSupported{}
-	case syscall.ENOTCONN:
+	case unix.ENOTCONN:
 		return &tcpip.ErrNotConnected{}
-	case syscall.ECONNRESET:
+	case unix.ECONNRESET:
 		return &tcpip.ErrConnectionReset{}
-	case syscall.ECONNABORTED:
+	case unix.ECONNABORTED:
 		return &tcpip.ErrConnectionAborted{}
-	case syscall.EMSGSIZE:
+	case unix.EMSGSIZE:
 		return &tcpip.ErrMessageTooLong{}
-	case syscall.ENOBUFS:
+	case unix.ENOBUFS:
 		return &tcpip.ErrNoBufferSpace{}
 	default:
 		return &tcpip.ErrInvalidEndpointState{}
diff --git a/pkg/tcpip/link/rawfile/errors_test.go b/pkg/tcpip/link/rawfile/errors_test.go
index 61aea1744..8f4bd60da 100644
--- a/pkg/tcpip/link/rawfile/errors_test.go
+++ b/pkg/tcpip/link/rawfile/errors_test.go
@@ -17,32 +17,32 @@
 package rawfile
 
 import (
-	"syscall"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 )
 
 func TestTranslateErrno(t *testing.T) {
 	for _, test := range []struct {
-		errno      syscall.Errno
+		errno      unix.Errno
 		translated tcpip.Error
 	}{
 		{
-			errno:      syscall.Errno(0),
+			errno:      unix.Errno(0),
 			translated: &tcpip.ErrInvalidEndpointState{},
 		},
 		{
-			errno:      syscall.Errno(maxErrno),
+			errno:      unix.Errno(maxErrno),
 			translated: &tcpip.ErrInvalidEndpointState{},
 		},
 		{
-			errno:      syscall.Errno(514),
+			errno:      unix.Errno(514),
 			translated: &tcpip.ErrInvalidEndpointState{},
 		},
 		{
-			errno:      syscall.EEXIST,
+			errno:      unix.EEXIST,
 			translated: &tcpip.ErrDuplicateAddress{},
 		},
 	} {
diff --git a/pkg/tcpip/link/rawfile/rawfile_unsafe.go b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
index 06f3ee21e..ba92aedbc 100644
--- a/pkg/tcpip/link/rawfile/rawfile_unsafe.go
+++ b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
@@ -19,7 +19,6 @@
 package rawfile
 
 import (
-	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/unix"
@@ -28,12 +27,12 @@ import (
 
 // GetMTU determines the MTU of a network interface device.
 func GetMTU(name string) (uint32, error) {
-	fd, err := syscall.Socket(syscall.AF_UNIX, syscall.SOCK_DGRAM, 0)
+	fd, err := unix.Socket(unix.AF_UNIX, unix.SOCK_DGRAM, 0)
 	if err != nil {
 		return 0, err
 	}
 
-	defer syscall.Close(fd)
+	defer unix.Close(fd)
 
 	var ifreq struct {
 		name [16]byte
@@ -42,7 +41,7 @@ func GetMTU(name string) (uint32, error) {
 	}
 
 	copy(ifreq.name[:], name)
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.SIOCGIFMTU, uintptr(unsafe.Pointer(&ifreq)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), unix.SIOCGIFMTU, uintptr(unsafe.Pointer(&ifreq)))
 	if errno != 0 {
 		return 0, errno
 	}
@@ -58,7 +57,7 @@ func NonBlockingWrite(fd int, buf []byte) tcpip.Error {
 		ptr = unsafe.Pointer(&buf[0])
 	}
 
-	_, _, e := syscall.RawSyscall(syscall.SYS_WRITE, uintptr(fd), uintptr(ptr), uintptr(len(buf)))
+	_, _, e := unix.RawSyscall(unix.SYS_WRITE, uintptr(fd), uintptr(ptr), uintptr(len(buf)))
 	if e != 0 {
 		return TranslateErrno(e)
 	}
@@ -66,11 +65,11 @@ func NonBlockingWrite(fd int, buf []byte) tcpip.Error {
 	return nil
 }
 
-// NonBlockingWriteIovec writes iovec to a file descriptor in a single syscall.
+// NonBlockingWriteIovec writes iovec to a file descriptor in a single unix.
 // It fails if partial data is written.
-func NonBlockingWriteIovec(fd int, iovec []syscall.Iovec) tcpip.Error {
+func NonBlockingWriteIovec(fd int, iovec []unix.Iovec) tcpip.Error {
 	iovecLen := uintptr(len(iovec))
-	_, _, e := syscall.RawSyscall(syscall.SYS_WRITEV, uintptr(fd), uintptr(unsafe.Pointer(&iovec[0])), iovecLen)
+	_, _, e := unix.RawSyscall(unix.SYS_WRITEV, uintptr(fd), uintptr(unsafe.Pointer(&iovec[0])), iovecLen)
 	if e != 0 {
 		return TranslateErrno(e)
 	}
@@ -79,7 +78,7 @@ func NonBlockingWriteIovec(fd int, iovec []syscall.Iovec) tcpip.Error {
 
 // NonBlockingSendMMsg sends multiple messages on a socket.
 func NonBlockingSendMMsg(fd int, msgHdrs []MMsgHdr) (int, tcpip.Error) {
-	n, _, e := syscall.RawSyscall6(unix.SYS_SENDMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), syscall.MSG_DONTWAIT, 0, 0)
+	n, _, e := unix.RawSyscall6(unix.SYS_SENDMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), unix.MSG_DONTWAIT, 0, 0)
 	if e != 0 {
 		return 0, TranslateErrno(e)
 	}
@@ -99,7 +98,7 @@ type PollEvent struct {
 // descriptor becomes readable.
 func BlockingRead(fd int, b []byte) (int, tcpip.Error) {
 	for {
-		n, _, e := syscall.RawSyscall(syscall.SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)))
+		n, _, e := unix.RawSyscall(unix.SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)))
 		if e == 0 {
 			return int(n), nil
 		}
@@ -110,7 +109,7 @@ func BlockingRead(fd int, b []byte) (int, tcpip.Error) {
 		}
 
 		_, e = BlockingPoll(&event, 1, nil)
-		if e != 0 && e != syscall.EINTR {
+		if e != 0 && e != unix.EINTR {
 			return 0, TranslateErrno(e)
 		}
 	}
@@ -119,9 +118,9 @@ func BlockingRead(fd int, b []byte) (int, tcpip.Error) {
 // BlockingReadv reads from a file descriptor that is set up as non-blocking and
 // stores the data in a list of iovecs buffers. If no data is available, it will
 // block in a poll() syscall until the file descriptor becomes readable.
-func BlockingReadv(fd int, iovecs []syscall.Iovec) (int, tcpip.Error) {
+func BlockingReadv(fd int, iovecs []unix.Iovec) (int, tcpip.Error) {
 	for {
-		n, _, e := syscall.RawSyscall(syscall.SYS_READV, uintptr(fd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(len(iovecs)))
+		n, _, e := unix.RawSyscall(unix.SYS_READV, uintptr(fd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(len(iovecs)))
 		if e == 0 {
 			return int(n), nil
 		}
@@ -132,7 +131,7 @@ func BlockingReadv(fd int, iovecs []syscall.Iovec) (int, tcpip.Error) {
 		}
 
 		_, e = BlockingPoll(&event, 1, nil)
-		if e != 0 && e != syscall.EINTR {
+		if e != 0 && e != unix.EINTR {
 			return 0, TranslateErrno(e)
 		}
 	}
@@ -140,7 +139,7 @@ func BlockingReadv(fd int, iovecs []syscall.Iovec) (int, tcpip.Error) {
 
 // MMsgHdr represents the mmsg_hdr structure required by recvmmsg() on linux.
 type MMsgHdr struct {
-	Msg syscall.Msghdr
+	Msg unix.Msghdr
 	Len uint32
 	_   [4]byte
 }
@@ -151,7 +150,7 @@ type MMsgHdr struct {
 // becomes readable.
 func BlockingRecvMMsg(fd int, msgHdrs []MMsgHdr) (int, tcpip.Error) {
 	for {
-		n, _, e := syscall.RawSyscall6(syscall.SYS_RECVMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), syscall.MSG_DONTWAIT, 0, 0)
+		n, _, e := unix.RawSyscall6(unix.SYS_RECVMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), unix.MSG_DONTWAIT, 0, 0)
 		if e == 0 {
 			return int(n), nil
 		}
@@ -161,7 +160,7 @@ func BlockingRecvMMsg(fd int, msgHdrs []MMsgHdr) (int, tcpip.Error) {
 			Events: 1, // POLLIN
 		}
 
-		if _, e := BlockingPoll(&event, 1, nil); e != 0 && e != syscall.EINTR {
+		if _, e := BlockingPoll(&event, 1, nil); e != 0 && e != unix.EINTR {
 			return 0, TranslateErrno(e)
 		}
 	}
diff --git a/pkg/tcpip/link/sharedmem/BUILD b/pkg/tcpip/link/sharedmem/BUILD
index 13243ebbb..4215ee852 100644
--- a/pkg/tcpip/link/sharedmem/BUILD
+++ b/pkg/tcpip/link/sharedmem/BUILD
@@ -20,6 +20,7 @@ go_library(
         "//pkg/tcpip/link/rawfile",
         "//pkg/tcpip/link/sharedmem/queue",
         "//pkg/tcpip/stack",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
 
@@ -37,5 +38,6 @@ go_test(
         "//pkg/tcpip/link/sharedmem/pipe",
         "//pkg/tcpip/link/sharedmem/queue",
         "//pkg/tcpip/stack",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/tcpip/link/sharedmem/rx.go b/pkg/tcpip/link/sharedmem/rx.go
index eec11e4cb..8e6f3e5e3 100644
--- a/pkg/tcpip/link/sharedmem/rx.go
+++ b/pkg/tcpip/link/sharedmem/rx.go
@@ -18,8 +18,8 @@ package sharedmem
 
 import (
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip/link/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip/link/sharedmem/queue"
 )
@@ -46,43 +46,43 @@ func (r *rx) init(mtu uint32, c *QueueConfig) error {
 
 	rxPipe, err := getBuffer(c.RxPipeFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
+		unix.Munmap(txPipe)
 		return err
 	}
 
 	data, err := getBuffer(c.DataFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
 		return err
 	}
 
 	sharedData, err := getBuffer(c.SharedDataFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
-		syscall.Munmap(data)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
+		unix.Munmap(data)
 		return err
 	}
 
 	// Duplicate the eventFD so that caller can close it but we can still
 	// use it.
-	efd, err := syscall.Dup(c.EventFD)
+	efd, err := unix.Dup(c.EventFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
-		syscall.Munmap(data)
-		syscall.Munmap(sharedData)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
+		unix.Munmap(data)
+		unix.Munmap(sharedData)
 		return err
 	}
 
 	// Set the eventfd as non-blocking.
-	if err := syscall.SetNonblock(efd, true); err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
-		syscall.Munmap(data)
-		syscall.Munmap(sharedData)
-		syscall.Close(efd)
+	if err := unix.SetNonblock(efd, true); err != nil {
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
+		unix.Munmap(data)
+		unix.Munmap(sharedData)
+		unix.Close(efd)
 		return err
 	}
 
@@ -99,12 +99,12 @@ func (r *rx) init(mtu uint32, c *QueueConfig) error {
 // called if init() has previously succeeded.
 func (r *rx) cleanup() {
 	a, b := r.q.Bytes()
-	syscall.Munmap(a)
-	syscall.Munmap(b)
+	unix.Munmap(a)
+	unix.Munmap(b)
 
-	syscall.Munmap(r.data)
-	syscall.Munmap(r.sharedData)
-	syscall.Close(r.eventFD)
+	unix.Munmap(r.data)
+	unix.Munmap(r.sharedData)
+	unix.Close(r.eventFD)
 }
 
 // postAndReceive posts the provided buffers (if any), and then tries to read
diff --git a/pkg/tcpip/link/sharedmem/sharedmem.go b/pkg/tcpip/link/sharedmem/sharedmem.go
index 2599bc406..d8d0b16b2 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem.go
@@ -24,8 +24,8 @@ package sharedmem
 
 import (
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -118,7 +118,7 @@ func (e *endpoint) Close() {
 	// Tell dispatch goroutine to stop, then write to the eventfd so that
 	// it wakes up in case it's sleeping.
 	atomic.StoreUint32(&e.stopRequested, 1)
-	syscall.Write(e.rx.eventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+	unix.Write(e.rx.eventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 	// Cleanup the queues inline if the worker hasn't started yet; we also
 	// know it won't start from now on because stopRequested is set to 1.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem_test.go b/pkg/tcpip/link/sharedmem/sharedmem_test.go
index d480ad656..def47772f 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem_test.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem_test.go
@@ -22,10 +22,10 @@ import (
 	"math/rand"
 	"os"
 	"strings"
-	"syscall"
 	"testing"
 	"time"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
@@ -72,9 +72,9 @@ func initQueue(t *testing.T, q *queueBuffers, c *QueueConfig) {
 }
 
 func (q *queueBuffers) cleanup() {
-	syscall.Munmap(q.tx.Bytes())
-	syscall.Munmap(q.rx.Bytes())
-	syscall.Munmap(q.data)
+	unix.Munmap(q.tx.Bytes())
+	unix.Munmap(q.rx.Bytes())
+	unix.Munmap(q.data)
 }
 
 type packetInfo struct {
@@ -200,7 +200,7 @@ func createFile(t *testing.T, size int64, initQueue bool) int {
 		t.Fatalf("TempFile failed: %v", err)
 	}
 	defer f.Close()
-	syscall.Unlink(f.Name())
+	unix.Unlink(f.Name())
 
 	if initQueue {
 		// Write the "slot-free" flag in the initial queue.
@@ -210,13 +210,13 @@ func createFile(t *testing.T, size int64, initQueue bool) int {
 		}
 	}
 
-	fd, err := syscall.Dup(int(f.Fd()))
+	fd, err := unix.Dup(int(f.Fd()))
 	if err != nil {
 		t.Fatalf("Dup failed: %v", err)
 	}
 
-	if err := syscall.Ftruncate(fd, size); err != nil {
-		syscall.Close(fd)
+	if err := unix.Ftruncate(fd, size); err != nil {
+		unix.Close(fd)
 		t.Fatalf("Ftruncate failed: %v", err)
 	}
 
@@ -224,11 +224,11 @@ func createFile(t *testing.T, size int64, initQueue bool) int {
 }
 
 func closeFDs(c *QueueConfig) {
-	syscall.Close(c.DataFD)
-	syscall.Close(c.EventFD)
-	syscall.Close(c.TxPipeFD)
-	syscall.Close(c.RxPipeFD)
-	syscall.Close(c.SharedDataFD)
+	unix.Close(c.DataFD)
+	unix.Close(c.EventFD)
+	unix.Close(c.TxPipeFD)
+	unix.Close(c.RxPipeFD)
+	unix.Close(c.SharedDataFD)
 }
 
 type queueSizes struct {
@@ -239,7 +239,7 @@ type queueSizes struct {
 }
 
 func createQueueFDs(t *testing.T, s queueSizes) QueueConfig {
-	fd, _, err := syscall.RawSyscall(syscall.SYS_EVENTFD2, 0, 0, 0)
+	fd, _, err := unix.RawSyscall(unix.SYS_EVENTFD2, 0, 0, 0)
 	if err != 0 {
 		t.Fatalf("eventfd failed: %v", error(err))
 	}
@@ -671,7 +671,7 @@ func TestSimpleReceive(t *testing.T) {
 		// Push completion.
 		c.pushRxCompletion(uint32(len(contents)), bufs)
 		c.rxq.rx.Flush()
-		syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+		unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 		// Wait for packet to be received, then check it.
 		c.waitForPackets(1, time.After(5*time.Second), "Timeout waiting for packet")
@@ -717,7 +717,7 @@ func TestRxBuffersReposted(t *testing.T) {
 		// Complete the buffer.
 		c.pushRxCompletion(buffers[i].Size, buffers[i:][:1])
 		c.rxq.rx.Flush()
-		syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+		unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 		// Wait for it to be reposted.
 		bi := queue.DecodeRxBufferHeader(pollPull(t, &c.rxq.tx, timeout, "Timeout waiting for buffer to be reposted"))
@@ -733,7 +733,7 @@ func TestRxBuffersReposted(t *testing.T) {
 		// Complete with two buffers.
 		c.pushRxCompletion(2*bufferSize, buffers[2*i:][:2])
 		c.rxq.rx.Flush()
-		syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+		unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 		// Wait for them to be reposted.
 		for j := 0; j < 2; j++ {
@@ -758,7 +758,7 @@ func TestReceivePostingIsFull(t *testing.T) {
 	first := queue.DecodeRxBufferHeader(pollPull(t, &c.rxq.tx, time.After(time.Second), "Timeout waiting for first buffer to be posted"))
 	c.pushRxCompletion(first.Size, []queue.RxBuffer{first})
 	c.rxq.rx.Flush()
-	syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+	unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 	// Check that packet is received.
 	c.waitForPackets(1, time.After(time.Second), "Timeout waiting for completed packet")
@@ -767,7 +767,7 @@ func TestReceivePostingIsFull(t *testing.T) {
 	second := queue.DecodeRxBufferHeader(pollPull(t, &c.rxq.tx, time.After(time.Second), "Timeout waiting for second buffer to be posted"))
 	c.pushRxCompletion(second.Size, []queue.RxBuffer{second})
 	c.rxq.rx.Flush()
-	syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+	unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 	// Check that no packet is received yet, as the worker is blocked trying
 	// to repost.
@@ -780,7 +780,7 @@ func TestReceivePostingIsFull(t *testing.T) {
 	// Flush tx queue, which will allow the first buffer to be reposted,
 	// and the second completion to be pulled.
 	c.rxq.tx.Flush()
-	syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+	unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 	// Check that second packet completes.
 	c.waitForPackets(1, time.After(time.Second), "Timeout waiting for second completed packet")
@@ -802,7 +802,7 @@ func TestCloseWhileWaitingToPost(t *testing.T) {
 	bi := queue.DecodeRxBufferHeader(pollPull(t, &c.rxq.tx, time.After(time.Second), "Timeout waiting for initial buffer to be posted"))
 	c.pushRxCompletion(bi.Size, []queue.RxBuffer{bi})
 	c.rxq.rx.Flush()
-	syscall.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+	unix.Write(c.rxCfg.EventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 	// Wait for packet to be indicated.
 	c.waitForPackets(1, time.After(time.Second), "Timeout waiting for completed packet")
diff --git a/pkg/tcpip/link/sharedmem/tx.go b/pkg/tcpip/link/sharedmem/tx.go
index 44f421c2d..e3210051f 100644
--- a/pkg/tcpip/link/sharedmem/tx.go
+++ b/pkg/tcpip/link/sharedmem/tx.go
@@ -16,8 +16,8 @@ package sharedmem
 
 import (
 	"math"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/link/sharedmem/queue"
 )
@@ -48,14 +48,14 @@ func (t *tx) init(mtu uint32, c *QueueConfig) error {
 
 	rxPipe, err := getBuffer(c.RxPipeFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
+		unix.Munmap(txPipe)
 		return err
 	}
 
 	data, err := getBuffer(c.DataFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
 		return err
 	}
 
@@ -72,9 +72,9 @@ func (t *tx) init(mtu uint32, c *QueueConfig) error {
 // called if init() has previously succeeded.
 func (t *tx) cleanup() {
 	a, b := t.q.Bytes()
-	syscall.Munmap(a)
-	syscall.Munmap(b)
-	syscall.Munmap(t.data)
+	unix.Munmap(a)
+	unix.Munmap(b)
+	unix.Munmap(t.data)
 }
 
 // transmit sends a packet made of bufs. Returns a boolean that specifies
@@ -145,17 +145,17 @@ func (t *tx) transmit(bufs ...buffer.View) bool {
 // getBuffer returns a memory region mapped to the full contents of the given
 // file descriptor.
 func getBuffer(fd int) ([]byte, error) {
-	var s syscall.Stat_t
-	if err := syscall.Fstat(fd, &s); err != nil {
+	var s unix.Stat_t
+	if err := unix.Fstat(fd, &s); err != nil {
 		return nil, err
 	}
 
 	// Check that size doesn't overflow an int.
 	if s.Size > int64(^uint(0)>>1) {
-		return nil, syscall.EDOM
+		return nil, unix.EDOM
 	}
 
-	return syscall.Mmap(fd, 0, int(s.Size), syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED|syscall.MAP_FILE)
+	return unix.Mmap(fd, 0, int(s.Size), unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED|unix.MAP_FILE)
 }
 
 // idDescriptor is used by idManager to either point to a tx buffer (in case
diff --git a/pkg/tcpip/link/tun/BUILD b/pkg/tcpip/link/tun/BUILD
index 86f14db76..7656cca6a 100644
--- a/pkg/tcpip/link/tun/BUILD
+++ b/pkg/tcpip/link/tun/BUILD
@@ -37,5 +37,6 @@ go_library(
         "//pkg/tcpip/link/channel",
         "//pkg/tcpip/stack",
         "//pkg/waiter",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/tcpip/link/tun/tun_unsafe.go b/pkg/tcpip/link/tun/tun_unsafe.go
index 09ca9b527..0591fbd63 100644
--- a/pkg/tcpip/link/tun/tun_unsafe.go
+++ b/pkg/tcpip/link/tun/tun_unsafe.go
@@ -18,24 +18,25 @@
 package tun
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // Open opens the specified TUN device, sets it to non-blocking mode, and
 // returns its file descriptor.
 func Open(name string) (int, error) {
-	return open(name, syscall.IFF_TUN|syscall.IFF_NO_PI)
+	return open(name, unix.IFF_TUN|unix.IFF_NO_PI)
 }
 
 // OpenTAP opens the specified TAP device, sets it to non-blocking mode, and
 // returns its file descriptor.
 func OpenTAP(name string) (int, error) {
-	return open(name, syscall.IFF_TAP|syscall.IFF_NO_PI)
+	return open(name, unix.IFF_TAP|unix.IFF_NO_PI)
 }
 
 func open(name string, flags uint16) (int, error) {
-	fd, err := syscall.Open("/dev/net/tun", syscall.O_RDWR, 0)
+	fd, err := unix.Open("/dev/net/tun", unix.O_RDWR, 0)
 	if err != nil {
 		return -1, err
 	}
@@ -48,14 +49,14 @@ func open(name string, flags uint16) (int, error) {
 
 	copy(ifr.name[:], name)
 	ifr.flags = flags
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.TUNSETIFF, uintptr(unsafe.Pointer(&ifr)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), unix.TUNSETIFF, uintptr(unsafe.Pointer(&ifr)))
 	if errno != 0 {
-		syscall.Close(fd)
+		unix.Close(fd)
 		return -1, errno
 	}
 
-	if err = syscall.SetNonblock(fd, true); err != nil {
-		syscall.Close(fd)
+	if err = unix.SetNonblock(fd, true); err != nil {
+		unix.Close(fd)
 		return -1, err
 	}