API musing

[reidpr]

This PR introduces the skeleton of a new wrapper command fakeroot, similar to the existing pseudo-cli but with no containerization and process management by the caller. It uses this as a vehicle to propose some API changes which would hopefully simplify things. (Honestly if this were built out well, I think it might be able to replace Debian’s fakeroot(1).)

The most significant proposed change is that the libpseudo API no longer deals with seccomp filters directly for most tasks. Instead, callers add to the config system calls they want to either fake (return 0) or emulate in user space (call a provided callback function). There is also a provision to add a filter fragment if the caller wants to add actual BPF code. libpseudo then compiles this config into a BPF program. This would eliminate the need to write BPF code manually.

The PR may also have a solution for dealing with re-parented children without races.

Caveat 1: I don’t know the existing API well, so take with a grain of salt.

Caveat 2: This only deals with the syscall phase, not any of the other callbacks.

[j-ogas]

Suggested change

	unlikely to even compile. In porticular, lots of this belongs elsewhere in
	unlikely to even compile. In particular, lots of this belongs elsewhere in

[j-ogas]

Suggested change

	simple Emulated system calls are intercepted and (fake) success is\n\
	stateless Emulated system calls are intercepted and (fake) success is\n\

[j-ogas]

Suggested change

	consistent Emulated system calls are interecepted FIXME.\n\
	stateful (default) Emulated system calls are interecepted FIXME.\n\

[j-ogas]

Suggested change

	If not specified, MODE is consistent.\n\
	If not specified, MODE is stateful.\n\

[j-ogas]

Initial suggestion proposes changing "simple" vs "consistent" to state{full,less}, which are is more explicit. Note that {in,}consistent may also work but they are, IMO, visually similar enough to be overlooked frequently(?).