diff --git a/pkg/sentry/kernel/time/time.go b/pkg/sentry/kernel/time/time.go
index e7652282a..9f7201a7f 100644
--- a/pkg/sentry/kernel/time/time.go
+++ b/pkg/sentry/kernel/time/time.go
@@ -113,6 +113,12 @@ func (t Time) Nanoseconds() int64 {
 	return t.ns
 }
 
+// Microseconds returns microseconds elapsed since the zero time in t's Clock
+// domain. If t represents walltime, this is microseconds since the Unix epoch.
+func (t Time) Microseconds() int64 {
+	return t.ns / 1000
+}
+
 // Seconds returns seconds elapsed since the zero time in t's Clock domain. If
 // t represents walltime, this is seconds since Unix epoch.
 func (t Time) Seconds() int64 {
diff --git a/pkg/sentry/seccheck/clone.go b/pkg/sentry/seccheck/clone.go
index 7546fa021..d635d8e59 100644
--- a/pkg/sentry/seccheck/clone.go
+++ b/pkg/sentry/seccheck/clone.go
@@ -38,12 +38,12 @@ type CloneInfo struct {
 }
 
 // CloneReq returns fields required by the Clone checkpoint.
-func (s *state) CloneReq() CloneFieldSet {
+func (s *State) CloneReq() CloneFieldSet {
 	return s.cloneReq.Load()
 }
 
 // Clone is called at the Clone checkpoint.
-func (s *state) Clone(ctx context.Context, mask CloneFieldSet, info *CloneInfo) error {
+func (s *State) Clone(ctx context.Context, mask CloneFieldSet, info *CloneInfo) error {
 	for _, c := range s.getCheckers() {
 		if err := c.Clone(ctx, mask, *info); err != nil {
 			return err
diff --git a/pkg/sentry/seccheck/execve.go b/pkg/sentry/seccheck/execve.go
index f36e0730e..dd6d0b92e 100644
--- a/pkg/sentry/seccheck/execve.go
+++ b/pkg/sentry/seccheck/execve.go
@@ -50,12 +50,12 @@ type ExecveInfo struct {
 }
 
 // ExecveReq returns fields required by the Execve checkpoint.
-func (s *state) ExecveReq() ExecveFieldSet {
+func (s *State) ExecveReq() ExecveFieldSet {
 	return s.execveReq.Load()
 }
 
 // Execve is called at the Execve checkpoint.
-func (s *state) Execve(ctx context.Context, mask ExecveFieldSet, info *ExecveInfo) error {
+func (s *State) Execve(ctx context.Context, mask ExecveFieldSet, info *ExecveInfo) error {
 	for _, c := range s.getCheckers() {
 		if err := c.Execve(ctx, mask, *info); err != nil {
 			return err
diff --git a/pkg/sentry/seccheck/exit.go b/pkg/sentry/seccheck/exit.go
index 69cb6911c..15bc5879b 100644
--- a/pkg/sentry/seccheck/exit.go
+++ b/pkg/sentry/seccheck/exit.go
@@ -37,7 +37,7 @@ type ExitNotifyParentInfo struct {
 
 // ExitNotifyParentReq returns fields required by the ExitNotifyParent
 // checkpoint.
-func (s *state) ExitNotifyParentReq() ExitNotifyParentFieldSet {
+func (s *State) ExitNotifyParentReq() ExitNotifyParentFieldSet {
 	return s.exitNotifyParentReq.Load()
 }
 
@@ -47,7 +47,7 @@ func (s *state) ExitNotifyParentReq() ExitNotifyParentFieldSet {
 // not waiting for exit acknowledgement from a non-parent ptracer, becomes the
 // last non-dead thread in its thread group and notifies its parent of its
 // exiting.
-func (s *state) ExitNotifyParent(ctx context.Context, mask ExitNotifyParentFieldSet, info *ExitNotifyParentInfo) error {
+func (s *State) ExitNotifyParent(ctx context.Context, mask ExitNotifyParentFieldSet, info *ExitNotifyParentInfo) error {
 	for _, c := range s.getCheckers() {
 		if err := c.ExitNotifyParent(ctx, mask, *info); err != nil {
 			return err
diff --git a/pkg/sentry/seccheck/seccheck.go b/pkg/sentry/seccheck/seccheck.go
index e13274096..3156c103d 100644
--- a/pkg/sentry/seccheck/seccheck.go
+++ b/pkg/sentry/seccheck/seccheck.go
@@ -89,10 +89,10 @@ type CheckerReq struct {
 }
 
 // Global is the method receiver of all seccheck functions.
-var Global state
+var Global State
 
-// state is the type of global, and is separated out for testing.
-type state struct {
+// State is the type of global, and is separated out for testing.
+type State struct {
 	// registrationMu serializes all changes to the set of registered Checkers
 	// for all checkpoints.
 	registrationMu sync.Mutex
@@ -125,7 +125,7 @@ type state struct {
 // AppendChecker registers the given Checker to execute at checkpoints. The
 // Checker will execute after all previously-registered Checkers, and only if
 // those Checkers return a nil error.
-func (s *state) AppendChecker(c Checker, req *CheckerReq) {
+func (s *State) AppendChecker(c Checker, req *CheckerReq) {
 	s.registrationMu.Lock()
 	defer s.registrationMu.Unlock()
 
@@ -141,17 +141,17 @@ func (s *state) AppendChecker(c Checker, req *CheckerReq) {
 }
 
 // Enabled returns true if any Checker is registered for the given checkpoint.
-func (s *state) Enabled(p Point) bool {
+func (s *State) Enabled(p Point) bool {
 	word, bit := p/32, p%32
 	return atomic.LoadUint32(&s.enabledPoints[word])&(uint32(1)<<bit) != 0
 }
 
-func (s *state) getCheckers() []Checker {
+func (s *State) getCheckers() []Checker {
 	return SeqAtomicLoadCheckerSlice(&s.registrationSeq, &s.checkers)
 }
 
 // Preconditions: s.registrationMu must be locked.
-func (s *state) appendCheckerLocked(c Checker) {
+func (s *State) appendCheckerLocked(c Checker) {
 	s.registrationSeq.BeginWrite()
 	s.checkers = append(s.checkers, c)
 	s.registrationSeq.EndWrite()
diff --git a/pkg/sentry/seccheck/seccheck_test.go b/pkg/sentry/seccheck/seccheck_test.go
index 687810d18..158a2da31 100644
--- a/pkg/sentry/seccheck/seccheck_test.go
+++ b/pkg/sentry/seccheck/seccheck_test.go
@@ -36,14 +36,14 @@ func (c *testChecker) Clone(ctx context.Context, mask CloneFieldSet, info CloneI
 }
 
 func TestNoChecker(t *testing.T) {
-	var s state
+	var s State
 	if s.Enabled(PointClone) {
 		t.Errorf("Enabled(PointClone): got true, wanted false")
 	}
 }
 
 func TestCheckerNotRegisteredForPoint(t *testing.T) {
-	var s state
+	var s State
 	s.AppendChecker(&testChecker{}, &CheckerReq{})
 	if s.Enabled(PointClone) {
 		t.Errorf("Enabled(PointClone): got true, wanted false")
@@ -51,7 +51,7 @@ func TestCheckerNotRegisteredForPoint(t *testing.T) {
 }
 
 func TestCheckerRegistered(t *testing.T) {
-	var s state
+	var s State
 	checkerCalled := false
 	s.AppendChecker(&testChecker{onClone: func(ctx context.Context, mask CloneFieldSet, info CloneInfo) error {
 		checkerCalled = true
@@ -78,7 +78,7 @@ func TestCheckerRegistered(t *testing.T) {
 }
 
 func TestMultipleCheckersRegistered(t *testing.T) {
-	var s state
+	var s State
 	checkersCalled := [2]bool{}
 	s.AppendChecker(&testChecker{onClone: func(ctx context.Context, mask CloneFieldSet, info CloneInfo) error {
 		checkersCalled[0] = true
@@ -127,7 +127,7 @@ func TestCheckpointReturnsFirstCheckerError(t *testing.T) {
 	errFirstChecker := errors.New("first Checker error")
 	errSecondChecker := errors.New("second Checker error")
 
-	var s state
+	var s State
 	checkersCalled := [2]bool{}
 	s.AppendChecker(&testChecker{onClone: func(ctx context.Context, mask CloneFieldSet, info CloneInfo) error {
 		checkersCalled[0] = true