func AreNamespacesActivated(nsList []specs.LinuxNamespace, namespaces []specs.LinuxNamespaceType) bool {
	for _, namespace := range namespaces {
		if !isNamespaceActived(nsList, namespace) {
			return false
		}
	}
	return true
}
AreNamespacesActivated checks that the namespaces in the provided ns list are enabled
package testutils
import (
	"reflect"
	"github.com/moby/libentitlement/types"
	"github.com/opencontainers/runtime-spec/specs-go"
)
func capListContains(capList []string, capability types.Capability) bool {
	capStr := string(capability)
	for _, capElt := range capList {
		if capElt == capStr {
			return true
		}
	}
	return false
}
func TestSpec() *specs.Spec {
	s := &specs.Spec{
		Process: &specs.Process{
			Capabilities: &specs.LinuxCapabilities{
				Bounding:    []string{},
				Effective:   []string{},
				Inheritable: []string{},
				Permitted:   []string{},
				Ambient:     []string{},
			},
		},
		Linux: &specs.Linux{
			Seccomp:   &specs.LinuxSeccomp{},
			Resources: &specs.LinuxResources{},
			IntelRdt:  &specs.LinuxIntelRdt{},
		},
		Windows: &specs.Windows{
			Resources: &specs.WindowsResources{
				Memory:  &specs.WindowsMemoryResources{},
				CPU:     &specs.WindowsCPUResources{},
				Storage: &specs.WindowsStorageResources{},
			},
			Network: &specs.WindowsNetwork{},
		},
	}
	seccomp, err := getDefaultSeccompProfile()
	if err != nil {
		s.Linux.Seccomp = &specs.LinuxSeccomp{DefaultAction: specs.ActErrno}
	} else {
		s.Linux.Seccomp = seccomp
	}
	s.Process.Capabilities.Bounding = getDefaultCapList()
	s.Process.Capabilities.Effective = getDefaultCapList()
	s.Process.Capabilities.Inheritable = getDefaultCapList()
	s.Process.Capabilities.Permitted = getDefaultCapList()
	return s
}
func areSyscallArgsMatchedBySeccompRuleArgs(argsFromRule, argsFromSyscall []specs.LinuxSeccompArg) bool {
	if len(argsFromRule) < len(argsFromSyscall) ||
		(len(argsFromSyscall) == 0 && len(argsFromRule) != 0) {
		return false
	}
	for _, argFromSyscall := range argsFromSyscall {
		found := false
		for _, argFromRule := range argsFromRule {
			if reflect.DeepEqual(argFromSyscall, argFromRule) {
				found = true
				break
			}
		}
		if !found {
			return false
		}
	}
	return true
}
func isSyscallWithArgsMatchedBySeccompRule(seccompRule specs.LinuxSyscall, syscallName string, syscallArgs []specs.LinuxSeccompArg) bool {
	for _, name := range seccompRule.Names {
		if name == syscallName {
			if areSyscallArgsMatchedBySeccompRuleArgs(seccompRule.Args, syscallArgs) {
				return true
			}
		}
	}
	return false
}
func isSyscallWithArgsBlockedBySeccomp(seccompProfile specs.LinuxSeccomp, syscallName types.Syscall, syscallArgs []specs.LinuxSeccompArg) bool {
	syscallNameStr := string(syscallName)
	blocked := seccompProfile.DefaultAction == specs.ActErrno
	if blocked {
		for _, seccompRule := range seccompProfile.Syscalls {
			if seccompRule.Action == specs.ActAllow {
				if isSyscallWithArgsMatchedBySeccompRule(seccompRule, syscallNameStr, syscallArgs) {
					return false
				}
			}
		}
	} else {
		for _, seccompRule := range seccompProfile.Syscalls {
			if seccompRule.Action == specs.ActErrno {
				if isSyscallWithArgsMatchedBySeccompRule(seccompRule, syscallNameStr, syscallArgs) {
					return true
				}
			}
		}
	}
	return blocked
}
func AreSyscallsWithArgsBlockedBySeccomp(seccompProfile specs.LinuxSeccomp, syscallsWithArgs map[types.Syscall][]specs.LinuxSeccompArg) bool {
	for syscallName, syscallArgs := range syscallsWithArgs {
		if !isSyscallWithArgsBlockedBySeccomp(seccompProfile, syscallName, syscallArgs) {
			return false
		}
	}
	return true
}
func AreSyscallsBlockedBySeccomp(seccompProfile specs.LinuxSeccomp, syscallNames []types.Syscall) bool {
	for _, syscallName := range syscallNames {
		if !isSyscallWithArgsBlockedBySeccomp(seccompProfile, syscallName, []specs.LinuxSeccompArg{}) {
			return false
		}
	}
	return true
}
func isSyscallWithArgsAllowedBySeccomp(seccompProfile specs.LinuxSeccomp, syscallName types.Syscall, syscallArgs []specs.LinuxSeccompArg) bool {
	return !isSyscallWithArgsBlockedBySeccomp(seccompProfile, syscallName, syscallArgs)
}
func AreSeccompSyscallsWithArgsAllowed(seccompProfile specs.LinuxSeccomp, syscallsWithArgs map[types.Syscall][]specs.LinuxSeccompArg) bool {
	for syscallName, syscallArgs := range syscallsWithArgs {
		if !isSyscallWithArgsAllowedBySeccomp(seccompProfile, syscallName, syscallArgs) {
			return false
		}
	}
	return true
}
func AreSyscallsAllowedBySeccomp(seccompProfile specs.LinuxSeccomp, syscallNames []types.Syscall) bool {
	for _, syscallName := range syscallNames {
		if !isSyscallWithArgsAllowedBySeccomp(seccompProfile, syscallName, []specs.LinuxSeccompArg{}) {
			return false
		}
	}
	return true
}
func isCapBlocked(linuxCaps specs.LinuxCapabilities, capability types.Capability) bool {
	return !(capListContains(linuxCaps.Bounding, capability) || capListContains(linuxCaps.Permitted, capability) ||
		capListContains(linuxCaps.Inheritable, capability) || capListContains(linuxCaps.Effective, capability))
}
func AreCapsBlocked(linuxCaps specs.LinuxCapabilities, capabilities []types.Capability) bool {
	for _, capability := range capabilities {
		if !isCapBlocked(linuxCaps, capability) {
			return false
		}
	}
	return true
}
func isCapAllowed(linuxCaps specs.LinuxCapabilities, capability types.Capability) bool {
	return capListContains(linuxCaps.Bounding, capability) && capListContains(linuxCaps.Permitted, capability) &&
		capListContains(linuxCaps.Inheritable, capability) && capListContains(linuxCaps.Effective, capability)
}
func AreCapsAllowed(linuxCaps specs.LinuxCapabilities, capabilities []types.Capability) bool {
	for _, capability := range capabilities {
		if !isCapAllowed(linuxCaps, capability) {
			return false
		}
	}
	return true
}
func capsListMatchRefSet(refWithConstraints map[types.Capability]bool, capList []string) bool {
	if len(refWithConstraints) != len(capList) {
		return false
	}
	refWithConstraintsStr := make(map[string]bool)
	for cap, val := range refWithConstraints {
		refWithConstraintsStr[string(cap)] = val
	}
	for _, cap := range capList {
		if _, ok := refWithConstraintsStr[cap]; !ok {
			return false
		}
	}
	return true
}
func capsListMatchRefWithConstraints(capList []string, capsToAdd, capsToRemove []types.Capability) bool {
	refWithConstraints := getDefaultCapSet()
	for _, capToAdd := range capsToAdd {
		if _, ok := refWithConstraints[capToAdd]; !ok {
			refWithConstraints[capToAdd] = true
		}
	}
	for _, capToRemove := range capsToRemove {
		if _, ok := refWithConstraints[capToRemove]; ok {
			delete(refWithConstraints, capToRemove)
		}
	}
	return capsListMatchRefSet(refWithConstraints, capList)
}
func OCICapsMatchRefWithConstraints(capabilities specs.LinuxCapabilities, capsToAdd, capsToRemove []types.Capability) bool {
	capStrLists := [][]string{
		capabilities.Permitted,
		capabilities.Inheritable,
		capabilities.Effective,
		capabilities.Bounding,
	}
	match := true
	for _, capStrList := range capStrLists {
		match = match && capsListMatchRefWithConstraints(capStrList, capsToAdd, capsToRemove)
	}
	return match
}
func isNamespaceActived(nsList []specs.LinuxNamespace, namespace specs.LinuxNamespaceType) bool {
	for _, ns := range nsList {
		if ns.Type == namespace {
			return true
		}
	}
	return false
}