Crate capsicum

Entering capability mode

 use capsicum::{enter, sandboxed};
 use std::fs::File;
 use std::io::Read;

 let mut ok_file = File::open("/etc/passwd").unwrap();
 let mut s = String::new();

 enter().expect("enter failed!");
 assert!(sandboxed(), "application is not sandboxed!");

 match File::create("/tmp/cant_touch_this") {
     Ok(_) => panic!("application is not properly sandboxed!"),
     Err(e) => println!("properly sandboxed: {:?}", e)
 }

 match ok_file.read_to_string(&mut s) {
     Ok(_) => println!("This is okay since we opened the descriptor before sandboxing"),
     Err(_) => panic!("application is not properly sandboxed!")
 }

Limit capability rights to files

use capsicum::{CapRights, Right, FileRights};
use std::fs::File;
use std::io::Read;
let mut ok_file = File::open("/etc/passwd").unwrap();
let mut s = String::new();

FileRights::new()
    .allow(Right::Seek)
    .allow(Right::Read)
    .limit(&ok_file).unwrap();

assert!(ok_file.read_to_string(&mut s).is_ok());

Opening new files in a subdirectory after entering capability mode

 use std::fs::File;
 use std::io::Read;

 // Before entering capability mode, we can open files in the global namespace.
 let aa = cap_std::ambient_authority();
 let etc = cap_std::fs::Dir::open_ambient_dir("/etc", aa).unwrap();

 capsicum::enter().expect("enter failed!");

 // Now, we can no longer access the global file system namespace.
 let aa = cap_std::ambient_authority();
 cap_std::fs::Dir::open_ambient_dir("/etc", aa).unwrap_err();
 std::fs::File::open("/etc/passwd").unwrap_err();

 // But we can still open children of our already-open directory
 let passwd = etc.open("passwd").unwrap();

Modules

• caspercasper
  Rust bindings to FreeBSD’s libcasper
• util
  Deprecated utilities

Macros

• servicecasper
  Declare a Casper service.
• service_connectioncasper
  Declare a connection to an existing Casper service.

Structs

• FcntlRights
  Used to limit which fcntl(2) commands can be used on a file in capability mode.
• FcntlsBuilderDeprecated
  Used to construct a new set of allowed fcntl commands.
• FileRights
  Used to reduce (but never expand) the capabilities on a file descriptor.
• IoctlsBuilder
  Used to construct a new set of allowed ioctl commands.
• RightsBuilderDeprecated
  Used to construct a new set of allowed file rights.

Enums

• Fcntl
  Fcntl commands that may be limited on file descriptors.
• IoctlRights
  Used to reduce (but never expand) the ioctl commands that may be used on a file descriptor.
• Right
  Capsicum capability rights for file descriptors.

Traits

• CapRights
  A set of capabilities that may be restricted on file descriptors.

Functions

• enter
  Actually enter capability mode.
• get_mode
  Returns true if the process is in a capability mode.
• sandboxed
  Returns true if the process is in a capability mode.