//go:build linux

package main

import "syscall"

// hardenProcess marks the agent as not dumpable (prctl PR_SET_DUMPABLE = 0). The kernel then makes /proc/<pid>/environ, mem and
// fd belong to root and refuses ptrace by other programs of the same user, so a program that runs as the same user as the
// agent (an AI engine started directly on the machine, a terminal) cannot read the machine's token from the agent. Children
// started later by exec are normal again.
func hardenProcess() error {
	if _, _, e := syscall.RawSyscall(syscall.SYS_PRCTL, 4, 0, 0); e != 0 {
		return e
	}
	return nil
}

// dumpable reports the flag (PR_GET_DUMPABLE), for the test.
func dumpable() int {
	r, _, _ := syscall.RawSyscall(syscall.SYS_PRCTL, 3, 0, 0)
	return int(r)
}