containerization-framework 0.3.0

Rust bindings for Apple's Containerization framework: Linux containers in lightweight VMs, in-process and without a daemon.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

use super::strings;

/// `LinuxCapabilities`. Each set holds `CapabilityName`s by name, e.g.
/// `CAP_CHOWN`.
#[derive(Clone, Debug, Default, Eq, PartialEq)]
pub struct LinuxCapabilities {
  pub bounding: Vec<String>,
  pub effective: Vec<String>,
  pub inheritable: Vec<String>,
  pub permitted: Vec<String>,
  pub ambient: Vec<String>,
}

impl LinuxCapabilities {
  /// `LinuxCapabilities.defaultOCICapabilities`.
  pub fn default_oci_capabilities() -> Self {
    let defaults = strings(&[
      "CAP_CHOWN",
      "CAP_DAC_OVERRIDE",
      "CAP_FSETID",
      "CAP_FOWNER",
      "CAP_MKNOD",
      "CAP_NET_RAW",
      "CAP_SETGID",
      "CAP_SETUID",
      "CAP_SETFCAP",
      "CAP_SETPCAP",
      "CAP_NET_BIND_SERVICE",
      "CAP_SYS_CHROOT",
      "CAP_KILL",
      "CAP_AUDIT_WRITE",
    ]);

    Self {
      bounding: defaults.clone(),
      effective: defaults.clone(),
      inheritable: Vec::new(),
      permitted: defaults,
      ambient: Vec::new(),
    }
  }
}