tr1pd 0.3.1

tamper resistant audit log
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

use config::Config;

mod errors {
    #[cfg(target_os="linux")]
    use sandbox::capabilities;
    use sandbox::chroot;
    #[cfg(target_os="openbsd")]
    use sandbox::pledge;
    #[cfg(target_os="linux")]
    use sandbox::seccomp;

    error_chain! {
        links {
            Capabilities(capabilities::Error, capabilities::ErrorKind)  #[cfg(target_os="linux")];
            Chroot(chroot::Error, chroot::ErrorKind);
            Pledge(pledge::Error, pledge::ErrorKind) #[cfg(target_os="openbsd")];
            Seccomp(seccomp::Error, seccomp::ErrorKind) #[cfg(target_os="linux")];
        }
    }
}
pub use self::errors::{Result, Error, ErrorKind};

#[cfg(target_os="linux")]
pub mod capabilities;
pub mod chroot;
#[cfg(target_os="openbsd")]
pub mod pledge;
#[cfg(target_os="linux")]
pub mod seccomp;
#[cfg(target_os="linux")]
pub mod syscalls;


pub fn activate_stage1() -> Result<()> {
    #[cfg(target_os="linux")]
    seccomp::activate_stage1()?;

    #[cfg(target_os="openbsd")]
    pledge::activate_stage1()?;

    info!("stage 1/2 is active");

    Ok(())
}

pub fn activate_stage2(mut config: &mut Config) -> Result<()> {
    chroot::lock_to_datadir(&mut config)?;

    #[cfg(target_os="linux")]
    capabilities::drop()?;

    #[cfg(target_os="linux")]
    seccomp::activate_tr1pd_stage2()?;

    #[cfg(target_os="openbsd")]
    pledge::activate_tr1pd_stage2()?;

    info!("stage 2/2 is active");

    Ok(())
}