}
	case ir.ODEREF:
		n := n.(*ir.StarExpr)
		return s.exprPtr(n.X, n.Bounded(), n.Pos())
	case ir.ODOT:
		n := n.(*ir.SelectorExpr)
		p := s.addr(n.X)
		return s.newValue1I(ssa.OpOffPtr, t, n.Offset(), p)
	case ir.ODOTPTR:
		n := n.(*ir.SelectorExpr)
		p := s.exprPtr(n.X, n.Bounded(), n.Pos())
		return s.newValue1I(ssa.OpOffPtr, t, n.Offset(), p)
	case ir.OCONVNOP:

	if err := pledgeAvailable(); err != nil {
		return err
	}

	pptr, err := BytePtrFromString(promises)
	if err != nil {
		return err
	}

	exptr, err := BytePtrFromString(execpromises)
	if err != nil {
		return err
	}

	return pledge(pptr, exptr)
}

// PledgePromises implements the pledge syscall.
//
// This changes the promises and leaves the execpromises untouched.
//

	if err != nil {
		t.Fatalf("failed to create the JWT authenticator: %v", err)
	}

	// Create a valid JWT token
	expStr := strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10)
	claims := `{"iss": "` + server.URL + `", "aud": ["baz.svc.id.goog"], "sub": "system:serviceaccount:bar:foo", "exp": ` + expStr + `}`
	token, err := generateJWT(&key, []byte(claims))
	if err != nil {
		t.Fatalf("failed to generate JWT: %v", err)
	}

)

func updateClaimsExpiry(dsecs string, claims map[string]interface{}) error {
	expStr := claims["exp"]
	if expStr == "" {
		return ErrTokenExpired
	}

	// No custom duration requested, the claims can be used as is.
	if dsecs == "" {
		return nil
	}

	if _, err := auth.ExpToInt64(expStr); err != nil {
		return err
	}

	defaultExpiryDuration, err := GetDefaultExpiration(dsecs)

	var tests = []struct {
		testName string
		endpoint string
		expStr   []string
	}{
		{
			testName: "single stack ipv4",
			endpoint: "10.244.0.0:1234",
			expStr:   []string{"FileContent--proc-sys-net-ipv4-ip_forward"},
		},
		{
			testName: "single stack ipv6",
			endpoint: "[fda9:d324:354d:0::]:1234",
			expStr:   []string{"FileContent--proc-sys-net-ipv6-conf-default-forwarding"},
		},
	}