nordisk/heimdall

profiles/src/lib.rs

// SPDX-License-Identifier: AGPL-3.0-only
// Copyright (C) 2026 Ignalina ApS and Vetra Automation AB

//! The checked-in seccomp profiles, generated by `heimdall profile gen` and
//! reviewed. **Heimdall is a defensive sandbox.** Each module `include!`s one
//! `profiles/<workload>/<arch>-<libc>.rs`; [`ALL`] lists them with their
//! `.json` and `.oci.json`, which the tests hold the `.rs` to.

use heimdall_seccomp::StaticProfile;

/// The heimdall wasm host (`heimdall run --job wasm`).
pub mod heimdall_wasm_host {
    /// x86_64, glibc.
    pub mod x86_64_glibc {
        include!("../heimdall-wasm-host/x86_64-glibc.rs");
    }
    /// x86_64, musl (the static release binary).
    pub mod x86_64_musl {
        include!("../heimdall-wasm-host/x86_64-musl.rs");
    }
}

/// One checked-in profile and its generated siblings.
pub struct Entry {
    pub profile: &'static StaticProfile,
    pub json: &'static str,
    pub oci_json: &'static str,
}

/// Every checked-in profile.
pub const ALL: &[Entry] = &[
    Entry {
        profile: &heimdall_wasm_host::x86_64_glibc::PROFILE,
        json: include_str!("../heimdall-wasm-host/x86_64-glibc.json"),
        oci_json: include_str!("../heimdall-wasm-host/x86_64-glibc.oci.json"),
    },
    Entry {
        profile: &heimdall_wasm_host::x86_64_musl::PROFILE,
        json: include_str!("../heimdall-wasm-host/x86_64-musl.json"),
        oci_json: include_str!("../heimdall-wasm-host/x86_64-musl.oci.json"),
    },
];