sandbox: replace libseccomp with chaseccomp

This drops libseccomp as a dependency.

Also, move the capsicum/pledge definitions from bindings to sandbox.nim
because they are only used there.

Interestingly, after integrating chaseccomp I found that the
stbi process would mysteriously crash by a getrandom(2) syscall.
Closer investigation revealed it is only called on the initialization
of glibc's malloc; presumably it had never surfaced before because
libseccomp would always allocate before entering the sandbox.

So I've added getrandom to our filter as well.

1 files changed, 2 insertions, 3 deletions

diff --git a/res/license.md b/res/license.md
index 0abe612b..4872fc54 100644
--- a/res/license.md
+++ b/res/license.md
@@ -7,9 +7,8 @@ depends on projects with different licensing terms.
 
 This document attempts to list licensing terms of projects included in the
 Chawan repository. Note that Chawan is dynamically linked against your copy
-of libcurl, (on Linux) libseccomp, your C library, and if exists, your termcap
-library. For licensing terms of these, please consult the appropriate library's
-documentation.
+of libcurl, your C library, and if exists, your termcap library. For licensing
+terms of these, please consult the appropriate library's documentation.
 
 Also, Chawan is statically linked to the Nim standard library. At the time
 of writing, (i.e. as of Nim 2.0.8) this is the MIT license (same terms as