restrict

Ergonomic and DX-first Linux syscall filtering crate

restrict offers a clean, expressive API to allow or deny syscalls on Linux. It generates a system-aware Syscall enum at build time and exposes a safe policy manager to configure syscall rules for your application.

✨ Features

• 🚀 Auto-generated Syscall enum tailored to your host architecture
• 📝 Ergonomic API: policy.allow(Syscall::Write)?;
• 🔒 Safe wrapper: no unsafe blocks or raw pointers
• 🎛️ Allow-by-default or deny-by-default policy modes
• 🔍 Runtime inspection: list allowed or killed syscalls

Prerequisites

You need libseccomp-dev installed in your Linux

sudo apt-get update && sudo apt-get install -y libseccomp-dev

🚀 Quickstart

✅ allow_all() is the recommended default for most use cases to avoid unintentionally blocking essential syscalls.

use restrict::{Policy, Syscall, Action};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Start with all syscalls allowed
    let mut policy = Policy::allow_all()?; // recommended

    policy
        .deny(Syscall::Execve)?   // prevent process spawning
        .deny(Syscall::Ptrace)?   // prevent tracing/hijacking
        .apply()?;                // apply the final filter set

    // Your program continues safely here
    Ok(())
}

Or fail the syscall with a specific error number:

    let mut policy = Policy::allow_all()?;
    policy
        .fail_with(Syscall::Execve, 5)?   // this syscall will return errno 5
        .fail_with(Syscall::Ptrace, 5)? 
        .apply()?;             

Or, for a stricter base policy:

    let mut policy = Policy::deny_all()?;  
    policy
        .allow(Syscall::Read)?
        .allow(Syscall::Write)?
        .apply()?;  

🛠️ API Overview

• Policy::allow_all() Starts with all syscalls allowed; then call .deny(...) for any you want to block.

• Policy::deny_all() Starts with all syscalls denied; then call .allow(...) for any you need.

• policy.allow(syscall: Syscall) Will allow this syscall

• policy.fail_with(syscall: Syscall, errno: u16) Will fail this syscall

• policy.deny(syscall: Syscall) Will kill this syscall

• policy.apply() Finalize and load all collected filters into the kernel.

• policy.list_allowed_syscalls() -> Vec<Syscall> Retrieve the list of syscalls you’ve allowed(by allow()).

• policy.list_killed_syscalls() -> Vec<Syscall> Retrieve the list of syscalls you’ve denied(by deny()).

📦 Generated Syscall Enum

During build, restrict parses your system headers (e.g. /usr/include/asm/unistd_64.h) and emits:

/// System call list generated from `/usr/include/asm/unistd_64.h`
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum Syscall {
    Read = 0,
    Write = 1,
    Open = 2,
    // … etc …
}

This ensures accuracy across architectures (x86_64, aarch64, etc.). To override the header location:

SYSCALL_INCLUDE_DIR=/path/to/other/asm cargo build

License

This project is licensed under the terms of the MIT license.

See the LICENSE file for more details.