restrict 0.2.1

A crate to allow, deny, or trace Linux syscalls with an ergonomic, auto-generated enum customized for your system architecture.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

use std::{
    os::unix::process::{CommandExt, ExitStatusExt},
    process::Command,
};

use restrict::{
    policy::{Policy, Syscall},
    SeccompError, TraceAction,
};

fn main() -> Result<(), SeccompError> {
    let mut child = unsafe {
        println!("> Running ls");
        Command::new("ls")
            .pre_exec(|| {
                let mut policy = Policy::allow_all().unwrap();
                policy
                    .trace(Syscall::Openat, |syscall| {
                        println!("Syscall {:?} triggered ", syscall);
                        return TraceAction::Continue;
                    })
                    .trace(Syscall::Read, |syscall| {
                        println!("Syscall {:?} triggered ", syscall);
                        return TraceAction::Continue;
                    });
                policy.apply().unwrap();
                Ok(())
            })
            .spawn()
            .expect("Failed to start process")
    };

    let status = child.wait().expect("Failed to wait on process");
    if let Some(signal) = status.signal() {
        println!("Child killed by signal: {}", signal);
    } else {
        println!("Child exited normally: {}", status);
    }
    println!("Child exited with status: {status}");
    Ok(())
}