restrict 0.2.1

A crate to allow, deny, or trace Linux syscalls with an ergonomic, auto-generated enum customized for your system architecture.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

use restrict::*;

use policy::Policy;
use syscall::Syscall;
fn main() -> Result<(), SeccompError> {
    let mut filter = Policy::allow_all()?;

    filter.entry_intercept(Syscall::Write, move |mut interceptor| {
        if interceptor.registers.get("rdi").unwrap() == 1 as u64 {
            interceptor.registers.set("rdx", 12).unwrap();
            interceptor.commit_regs().unwrap();
        }
        TraceAction::Continue
    });

    filter.apply()?;

    let msg = b"Hello, restrict world! only the first 12 char should be printed ";
    let _ = unsafe { libc::write(1, msg.as_ptr() as *const _, msg.len()) };

    // let _read_fs = fs::read("test.txt").unwrap();
    // println!("____{}____", String::from_utf8_lossy(_read_fs.as_slice()));
    Ok(())
}