A sandboxed process execution library for Linux and macOS.

This crate provides a Command API similar to std::process::Command but with the ability to restrict process execution using platform-native sandboxing:

• Linux: Uses Landlock (requires kernel 5.13+)
• macOS: Uses the native sandbox framework

The API mirrors systemd's execution environment options where applicable.

Example

use std::path::Path;
use sandbox_run::{Command, Sandbox, ProtectSystem, ProtectHome};

// Create a sandbox with systemd-style options
let sandbox = Sandbox::new()
    .protect_system(ProtectSystem::Strict)
    .protect_home(ProtectHome::Yes)
    .read_write_paths([Path::new("/tmp/myapp")])
    .private_network(true)
    .no_new_privileges(true)
    .limit_nofile(256)
    .build()
    .unwrap();

// Run a command under the sandbox
let status = Command::new("myapp")
    .sandbox(sandbox)
    .status()
    .expect("failed to execute process");

Systemd-Compatible Options

Platform Notes

Linux

The Linux implementation uses Landlock, which is an allow-list based sandboxing mechanism. ProtectSystem::Strict works best as it makes the entire filesystem read-only and you can add exceptions with read_write_paths().

macOS

The macOS implementation uses the native sandbox framework with generated profiles. All protection modes work well on macOS.