[op] Replace syscall package usage with golang.org/x/sys/unix in runsc/.

The syscall package has been deprecated in favor of golang.org/x/sys.

Note that syscall is still used in some places because the following don't seem
to have an equivalent in unix package:
- syscall.SysProcIDMap
- syscall.Credential

Updates #214

PiperOrigin-RevId: 361381490

3 files changed, 25 insertions, 23 deletions

diff --git a/runsc/specutils/seccomp/BUILD b/runsc/specutils/seccomp/BUILD
index 3520f2d6d..e9e647d82 100644
--- a/runsc/specutils/seccomp/BUILD
+++ b/runsc/specutils/seccomp/BUILD
@@ -18,6 +18,7 @@ go_library(
         "//pkg/sentry/kernel",
         "//pkg/sentry/syscalls/linux",
         "@com_github_opencontainers_runtime_spec//specs-go:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
 
@@ -30,5 +31,6 @@ go_test(
         "//pkg/binary",
         "//pkg/bpf",
         "@com_github_opencontainers_runtime_spec//specs-go:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/runsc/specutils/seccomp/seccomp.go b/runsc/specutils/seccomp/seccomp.go
index 5932f7a41..0ef7a4d54 100644
--- a/runsc/specutils/seccomp/seccomp.go
+++ b/runsc/specutils/seccomp/seccomp.go
@@ -18,9 +18,9 @@ package seccomp
 
 import (
 	"fmt"
-	"syscall"
 
 	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/bpf"
 	"gvisor.dev/gvisor/pkg/log"
@@ -33,9 +33,9 @@ var (
 	killThreadAction = linux.SECCOMP_RET_KILL_THREAD
 	trapAction       = linux.SECCOMP_RET_TRAP
 	// runc always returns EPERM as the errorcode for SECCOMP_RET_ERRNO
-	errnoAction = linux.SECCOMP_RET_ERRNO.WithReturnCode(uint16(syscall.EPERM))
+	errnoAction = linux.SECCOMP_RET_ERRNO.WithReturnCode(uint16(unix.EPERM))
 	// runc always returns EPERM as the errorcode for SECCOMP_RET_TRACE
-	traceAction = linux.SECCOMP_RET_TRACE.WithReturnCode(uint16(syscall.EPERM))
+	traceAction = linux.SECCOMP_RET_TRACE.WithReturnCode(uint16(unix.EPERM))
 	allowAction = linux.SECCOMP_RET_ALLOW
 )
 
diff --git a/runsc/specutils/seccomp/seccomp_test.go b/runsc/specutils/seccomp/seccomp_test.go
index 850c237ba..11a6c8daa 100644
--- a/runsc/specutils/seccomp/seccomp_test.go
+++ b/runsc/specutils/seccomp/seccomp_test.go
@@ -16,10 +16,10 @@ package seccomp
 
 import (
 	"fmt"
-	"syscall"
 	"testing"
 
 	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/binary"
 	"gvisor.dev/gvisor/pkg/bpf"
 )
@@ -184,7 +184,7 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index: 0,
-								Value: syscall.CLONE_FS,
+								Value: unix.CLONE_FS,
 								Op:    specs.OpEqualTo,
 							},
 						},
@@ -192,7 +192,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{syscall.CLONE_FS}),
+			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{unix.CLONE_FS}),
 			expected: uint32(errnoAction),
 		},
 		{
@@ -207,12 +207,12 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index: 0,
-								Value: syscall.CLONE_FS,
+								Value: unix.CLONE_FS,
 								Op:    specs.OpEqualTo,
 							},
 							{
 								Index: 0,
-								Value: syscall.CLONE_VM,
+								Value: unix.CLONE_VM,
 								Op:    specs.OpEqualTo,
 							},
 						},
@@ -220,7 +220,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{syscall.CLONE_FS}),
+			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{unix.CLONE_FS}),
 			expected: uint32(errnoAction),
 		},
 		{
@@ -235,12 +235,12 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index: 1,
-								Value: syscall.SOL_SOCKET,
+								Value: unix.SOL_SOCKET,
 								Op:    specs.OpEqualTo,
 							},
 							{
 								Index: 2,
-								Value: syscall.SO_PEERCRED,
+								Value: unix.SO_PEERCRED,
 								Op:    specs.OpEqualTo,
 							},
 						},
@@ -248,7 +248,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "getsockopt", &[6]uint64{0, syscall.SOL_SOCKET, syscall.SO_PEERCRED}),
+			input:    testInput(nativeArchAuditNo, "getsockopt", &[6]uint64{0, unix.SOL_SOCKET, unix.SO_PEERCRED}),
 			expected: uint32(errnoAction),
 		},
 		{
@@ -263,12 +263,12 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index: 1,
-								Value: syscall.SOL_SOCKET,
+								Value: unix.SOL_SOCKET,
 								Op:    specs.OpEqualTo,
 							},
 							{
 								Index: 2,
-								Value: syscall.SO_PEERCRED,
+								Value: unix.SO_PEERCRED,
 								Op:    specs.OpEqualTo,
 							},
 						},
@@ -276,7 +276,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "getsockopt", &[6]uint64{0, syscall.SOL_SOCKET}),
+			input:    testInput(nativeArchAuditNo, "getsockopt", &[6]uint64{0, unix.SOL_SOCKET}),
 			expected: uint32(allowAction),
 		},
 		{
@@ -291,7 +291,7 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index: 0,
-								Value: syscall.CLONE_FS,
+								Value: unix.CLONE_FS,
 								Op:    specs.OpEqualTo,
 							},
 						},
@@ -299,7 +299,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{syscall.CLONE_VM}),
+			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{unix.CLONE_VM}),
 			expected: uint32(allowAction),
 		},
 		{
@@ -314,8 +314,8 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index:    0,
-								Value:    syscall.CLONE_FS,
-								ValueTwo: syscall.CLONE_FS,
+								Value:    unix.CLONE_FS,
+								ValueTwo: unix.CLONE_FS,
 								Op:       specs.OpMaskedEqual,
 							},
 						},
@@ -323,7 +323,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{syscall.CLONE_FS | syscall.CLONE_VM}),
+			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{unix.CLONE_FS | unix.CLONE_VM}),
 			expected: uint32(errnoAction),
 		},
 		{
@@ -338,8 +338,8 @@ var (
 						Args: []specs.LinuxSeccompArg{
 							{
 								Index:    0,
-								Value:    syscall.CLONE_FS | syscall.CLONE_VM,
-								ValueTwo: syscall.CLONE_FS | syscall.CLONE_VM,
+								Value:    unix.CLONE_FS | unix.CLONE_VM,
+								ValueTwo: unix.CLONE_FS | unix.CLONE_VM,
 								Op:       specs.OpMaskedEqual,
 							},
 						},
@@ -347,7 +347,7 @@ var (
 					},
 				},
 			},
-			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{syscall.CLONE_FS}),
+			input:    testInput(nativeArchAuditNo, "clone", &[6]uint64{unix.CLONE_FS}),
 			expected: uint32(allowAction),
 		},
 		{