MountsInGlobalPDPath = "mounts"

	// VolumeGidAnnotationKey is the of the annotation on the PersistentVolume
	// object that specifies a supplemental GID.
	VolumeGidAnnotationKey = "pv.beta.kubernetes.io/gid"

	// VolumeDynamicallyCreatedByKey is the key of the annotation on PersistentVolume
	// object created dynamically
	VolumeDynamicallyCreatedByKey = "kubernetes.io/createdby"

	// PluginIsDeviceMountable indicates that the plugin for this volume implements
	// the volume.DeviceMounter interface
	PluginIsDeviceMountable bool

	// VolumeGidValue contains the value of the GID annotation, if present.
	VolumeGidValue string

	// DevicePath contains the path on the node where the volume is attached.
	// For non-attachable volumes this is empty.
	DevicePath string

	MOVW	sig+0(FP), R4	// arg 2
	SYSCALL	$SYS_kill
	RET

TEXT ·getpid(SB),NOSPLIT|NOFRAME,$0-8
	SYSCALL $SYS_getpid
	MOVD	R3, ret+0(FP)
	RET

TEXT ·tgkill(SB),NOSPLIT|NOFRAME,$0-24
	MOVD	tgid+0(FP), R3
	MOVD	tid+8(FP), R4
	MOVD	sig+16(FP), R5
	SYSCALL $SYS_tgkill
	RET

TEXT runtime·setitimer(SB),NOSPLIT|NOFRAME,$0-24
	MOVW	mode+0(FP), R3
	MOVD	new+8(FP), R4
	MOVD	old+16(FP), R5

			})
		}
	}
}

// rt_sigaction is implemented in assembly.
//
//go:noescape
func rt_sigaction(sig uintptr, new, old *sigactiont, size uintptr) int32

func getpid() int
func tgkill(tgid, tid, sig int)

// signalM sends a signal to mp.
func signalM(mp *m, sig int) {
	tgkill(getpid(), int(mp.procid), sig)
}

// validSIGPROF compares this signal delivery's code against the signal sources

type LinuxContainerUser struct {
	// UID is the primary uid initially attached to the first process in the container
	UID int64
	// GID is the primary gid initially attached to the first process in the container
	GID int64
	// SupplementalGroups are the supplemental groups initially attached to the first process in the container
	SupplementalGroups []int64
}

	"":                   "LinuxContainerUser represents user identity information in Linux containers",
	"uid":                "UID is the primary uid initially attached to the first process in the container",
	"gid":                "GID is the primary gid initially attached to the first process in the container",
	"supplementalGroups": "SupplementalGroups are the supplemental groups initially attached to the first process in the container",
}

message LinuxContainerUser {
  // UID is the primary uid initially attached to the first process in the container
  optional int64 uid = 1;

  // GID is the primary gid initially attached to the first process in the container
  optional int64 gid = 2;

  // SupplementalGroups are the supplemental groups initially attached to the first process in the container
  // +optional
  // +listType=atomic

			// Should not happen
			log.Warn("Could not find the istio-proxy container")
			return
		}
		*sidecar.SecurityContext.RunAsUser = 0
	}

	// Make sure the validation container runs with the same uid/gid as the proxy (init container is untouched, it must run with 0)
	if !tproxy && initContainer.Name == ValidationContainerName {
		if initContainer.SecurityContext == nil {
			initContainer.SecurityContext = &corev1.SecurityContext{}

	Sec  int64
	Nsec uint32
	_    int32
}

type Statx_t struct {
	Mask             uint32
	Blksize          uint32
	Attributes       uint64
	Nlink            uint32
	Uid              uint32
	Gid              uint32
	Mode             uint16
	_                [1]uint16
	Ino              uint64
	Size             uint64
	Blocks           uint64
	Attributes_mask  uint64
	Atime            StatxTimestamp

  // for that container.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  optional int64 runAsUser = 2;

  // The GID to run the entrypoint of the container process.
  // Uses runtime default if unset.
  // May also be set in SecurityContext.  If set in both SecurityContext and