From 45df4d0d9b577fecee798d672695fe24ff57fb1b Mon Sep 17 00:00:00 2001 From: mo khan Date: Tue, 15 Jul 2025 16:37:08 -0600 Subject: feat: migrate from Cedar to SpiceDB authorization system This is a major architectural change that replaces the Cedar policy-based authorization system with SpiceDB's relation-based authorization. Key changes: - Migrate from Rust to Go implementation - Replace Cedar policies with SpiceDB schema and relationships - Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks - Update build system and dependencies for Go ecosystem - Maintain Envoy integration for external authorization This change enables more flexible permission modeling through SpiceDB's Google Zanzibar inspired relation-based system, supporting complex hierarchical permissions that were difficult to express in Cedar. Breaking change: Existing Cedar policies and Rust-based configuration will no longer work and need to be migrated to SpiceDB schema. --- vendor/rustix/src/process/pidfd.rs | 43 -------------------------------------- 1 file changed, 43 deletions(-) delete mode 100644 vendor/rustix/src/process/pidfd.rs (limited to 'vendor/rustix/src/process/pidfd.rs') diff --git a/vendor/rustix/src/process/pidfd.rs b/vendor/rustix/src/process/pidfd.rs deleted file mode 100644 index f812a9f6..00000000 --- a/vendor/rustix/src/process/pidfd.rs +++ /dev/null @@ -1,43 +0,0 @@ -use crate::fd::OwnedFd; -use crate::process::{Pid, Signal}; -use crate::{backend, ffi, io}; -use backend::fd::AsFd; - -bitflags::bitflags! { - /// `PIDFD_*` flags for use with [`pidfd_open`]. - /// - /// [`pidfd_open`]: crate::process::pidfd_open - #[repr(transparent)] - #[derive(Copy, Clone, Eq, PartialEq, Hash, Debug)] - pub struct PidfdFlags: ffi::c_uint { - /// `PIDFD_NONBLOCK` - const NONBLOCK = backend::c::PIDFD_NONBLOCK; - - /// - const _ = !0; - } -} - -/// `syscall(SYS_pidfd_open, pid, flags)`—Creates a file descriptor for a -/// process. -/// -/// # References -/// - [Linux] -/// -/// [Linux]: https://man7.org/linux/man-pages/man2/pidfd_open.2.html -#[inline] -pub fn pidfd_open(pid: Pid, flags: PidfdFlags) -> io::Result { - backend::process::syscalls::pidfd_open(pid, flags) -} - -/// `syscall(SYS_pidfd_send_signal, pidfd, sig, NULL, 0)`—Send a signal to a -/// process specified by a file descriptor. -/// -/// # References -/// - [Linux] -/// -/// [Linux]: https://man7.org/linux/man-pages/man2/pidfd_send_signal.2.html -#[inline] -pub fn pidfd_send_signal(pidfd: Fd, sig: Signal) -> io::Result<()> { - backend::process::syscalls::pidfd_send_signal(pidfd.as_fd(), sig) -} -- cgit v1.2.3