Struct SyscallAllowlist 

pub struct SyscallAllowlist {
    pub syscalls: BTreeSet<Syscall>,
}

A per-workload kernel syscall allowlist node on the canonical policy AST.

Membership is the set of permitted syscalls; the enforcement probe default-denies any syscall not in this set for a monitored PID. The set is a BTreeSet so it is inherently de-duplicated and order-stable, which keeps the AAASM-3635 lowering deterministic.

Fields

syscalls: BTreeSet<Syscall>

The permitted syscalls.

Implementations

impl SyscallAllowlist

pub fn from_names<I, S>(names: I) -> Result<Self, String>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Build an allowlist from syscall name strings, validating each name and de-duplicating. Returns the first unknown name as an error so a typo can never silently widen (or no-op) the allowlist.

pub fn permits(&self, syscall: Syscall) -> bool

Whether the allowlist permits the given syscall.

pub fn iter(&self) -> impl Iterator<Item = Syscall> + '_

The permitted syscalls, ordered, as an iterator.

Trait Implementations

impl Clone for SyscallAllowlist

fn clone(&self) -> SyscallAllowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SyscallAllowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SyscallAllowlist

fn default() -> SyscallAllowlist

Returns the “default value” for a type.

impl Eq for SyscallAllowlist

impl PartialEq for SyscallAllowlist

fn eq(&self, other: &SyscallAllowlist) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for SyscallAllowlist