containerization-framework 0.4.0

Rust bindings for Apple's Containerization framework: Linux containers in lightweight VMs, in-process and without a daemon.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

use crate::containerization_oci;
use crate::containerization_os::CapabilityName;
use crate::error::Error;
use crate::platform;
use crate::platform::ffi;

/// `LinuxCapabilities`.
#[derive(Clone, Debug, Default, Eq, PartialEq)]
pub struct LinuxCapabilities {
  pub bounding: Vec<CapabilityName>,
  pub effective: Vec<CapabilityName>,
  pub inheritable: Vec<CapabilityName>,
  pub permitted: Vec<CapabilityName>,
  pub ambient: Vec<CapabilityName>,
}

impl LinuxCapabilities {
  /// `LinuxCapabilities.allCapabilities`, which holds every capability in
  /// every set.
  pub fn all_capabilities() -> Self {
    let all = CapabilityName::ALL_CASES.to_vec();

    Self {
      bounding: all.clone(),
      effective: all.clone(),
      inheritable: all.clone(),
      permitted: all.clone(),
      ambient: all,
    }
  }

  /// `LinuxCapabilities.defaultOCICapabilities`.
  pub fn default_oci_capabilities() -> Self {
    Self::with(vec![
      CapabilityName::Chown,
      CapabilityName::DacOverride,
      CapabilityName::Fsetid,
      CapabilityName::Fowner,
      CapabilityName::Mknod,
      CapabilityName::NetRaw,
      CapabilityName::Setgid,
      CapabilityName::Setuid,
      CapabilityName::Setfcap,
      CapabilityName::Setpcap,
      CapabilityName::NetBindService,
      CapabilityName::SysChroot,
      CapabilityName::Kill,
      CapabilityName::AuditWrite,
    ])
  }

  /// `LinuxCapabilities(capabilities:)`, which puts the capabilities in the
  /// bounding, effective and permitted sets, and leaves the others empty.
  pub fn with(capabilities: Vec<CapabilityName>) -> Self {
    Self {
      bounding: capabilities.clone(),
      effective: capabilities.clone(),
      inheritable: Vec::new(),
      permitted: capabilities,
      ambient: Vec::new(),
    }
  }

  /// `LinuxCapabilities.toOCI()`, which leaves out empty sets.
  pub fn to_oci(&self) -> Result<containerization_oci::runtime::LinuxCapabilities, Error> {
    platform::outcome(
      ffi::cz_linux_capabilities_to_oci(self.clone()),
      "convert capabilities to OCI's",
    )
    .map(|outcome| outcome.oci_linux_capabilities())
  }
}