iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 2 -j RETURN

import (
	"unsafe"
)

// pgid should really be pid_t, however _C_int (aka int32) is generally
// equivalent.

func Tcgetpgrp(fd int) (pgid int32, err error) {
	if err := ioctlPtr(fd, TIOCGPGRP, unsafe.Pointer(&pgid)); err != nil {
		return -1, err
	}
	return pgid, nil
}

func Tcsetpgrp(fd int, pgid int32) (err error) {
	return ioctlPtr(fd, TIOCSPGRP, unsafe.Pointer(&pgid))

)

func Tcgetpgrp(fd int) (pgid int32, err error) {
	_, _, errno := Syscall6(SYS_IOCTL, uintptr(fd), uintptr(TIOCGPGRP), uintptr(unsafe.Pointer(&pgid)), 0, 0, 0)
	if errno != 0 {
		return -1, errno
	}
	return pgid, nil
}

func Tcsetpgrp(fd int, pgid int32) (err error) {
	_, _, errno := Syscall6(SYS_IOCTL, uintptr(fd), uintptr(TIOCSPGRP), uintptr(unsafe.Pointer(&pgid)), 0, 0, 0)
	if errno != 0 {
		return errno
	}

)

//go:linkname ioctlPtr syscall.ioctlPtr
func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error)

// Note that pgid should really be pid_t, however _C_int (aka int32) is
// generally equivalent.

func Tcsetpgrp(fd int, pgid int32) (err error) {
	return ioctlPtr(fd, syscall.TIOCSPGRP, unsafe.Pointer(&pgid))

		return -1, errno
	}
	return pgid, nil
}

func Tcsetpgrp(fd int, pgid int32) (err error) {
	return ioctlPtr(uintptr(fd), TIOCSPGRP, unsafe.Pointer(&pgid))

package unix

import (
	"syscall"
	"unsafe"
)

// Note that pgid should really be pid_t, however _C_int (aka int32) is
// generally equivalent.

func Tcsetpgrp(fd int, pgid int32) (err error) {
	_, _, errno := syscall.Syscall6(syscall.SYS_IOCTL, uintptr(fd), uintptr(syscall.TIOCSPGRP), uintptr(unsafe.Pointer(&pgid)), 0, 0, 0)
	if errno != 0 {
		return errno
	}
	return nil

	PPS_GETCAP    = 0x400470a3
	PPS_FETCH     = 0xc00470a4
)

const (
	PIDFD_NONBLOCK = 0x800
)

type SysvIpcPerm struct {
	Key  int32
	Uid  uint32
	Gid  uint32
	Cuid uint32
	Cgid uint32
	Mode uint32
	Seq  uint32
	_    uint32
	_    uint64
	_    uint64
}
type SysvShmDesc struct {
	Perm       SysvIpcPerm
	Atime_high uint32
	Atime      uint32

	PPS_GETCAP    = 0x400870a3
	PPS_FETCH     = 0xc00870a4
)

const (
	PIDFD_NONBLOCK = 0x800
)

type SysvIpcPerm struct {
	Key  int32
	Uid  uint32
	Gid  uint32
	Cuid uint32
	Cgid uint32
	Mode uint32
	Seq  uint32
	_    uint32
	_    uint64
	_    uint64
}
type SysvShmDesc struct {
	Perm   SysvIpcPerm
	Atime  int64
	Dtime  int64
	Ctime  int64

	PPS_GETCAP    = 0x800870a3
	PPS_FETCH     = 0xc00870a4
)

const (
	PIDFD_NONBLOCK = 0x800
)

type SysvIpcPerm struct {
	Key  int32
	Uid  uint32
	Gid  uint32
	Cuid uint32
	Cgid uint32
	Mode uint32
	_    [0]uint8
	Seq  uint16
	_    uint16
	_    uint64
	_    uint64
}
type SysvShmDesc struct {
	Perm   SysvIpcPerm
	Segsz  uint64
	Atime  int64

	PPS_GETCAP    = 0x800470a3
	PPS_FETCH     = 0xc00470a4
)

const (
	PIDFD_NONBLOCK = 0x800
)

type SysvIpcPerm struct {
	Key  int32
	Uid  uint32
	Gid  uint32
	Cuid uint32
	Cgid uint32
	Mode uint16
	_    [2]uint8
	Seq  uint16
	_    uint16
	_    uint32
	_    uint32
}
type SysvShmDesc struct {
	Perm       SysvIpcPerm
	Segsz      uint32