Struct SecurityConfig 

pub struct SecurityConfig {
    pub seccomp: SeccompMode,
    pub no_new_privileges: bool,
    pub cap_add: Vec<String>,
    pub cap_drop: Vec<String>,
    pub privileged: bool,
}

Parsed security configuration for guest process enforcement.

Fields

seccomp: SeccompMode

Seccomp filter mode.

no_new_privileges: bool

Set PR_SET_NO_NEW_PRIVS before exec.

cap_add: Vec<String>

Linux capabilities to add.

cap_drop: Vec<String>

Linux capabilities to drop.

privileged: bool

Privileged mode (disables all restrictions).

Implementations

impl SecurityConfig

pub fn validate(&self) -> Result<(), String>

Validate that the security configuration can be enforced at runtime.

Returns an error if custom seccomp profiles are specified, since they are not yet supported and would silently fall through to no filtering.

pub fn from_options( security_opt: &[String], cap_add: &[String], cap_drop: &[String], privileged: bool, ) -> Self

Parse guest-enforceable security config from CLI-style options.

Backend compatibility is validated by crate::resolve_execution before the MicroVM specification is built. This parser only translates options that guest-init can enforce.

Accepts the same format as Docker:

• seccomp=default — apply the built-in profile
• seccomp=unconfined — disable seccomp
• seccomp=<path> — custom profile
• no-new-privileges or no-new-privileges=true — enable (default)
• no-new-privileges=false — disable

pub fn to_env_vars(&self) -> Vec<(String, String)>

Encode as environment variables for passing to guest-init.

Returns a list of (key, value) pairs with A3S_SEC_* prefix.

pub fn from_env_vars() -> Self

Parse from guest-init environment variables.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.