Struct Syscalls 

pub struct Syscalls {
    pub allowed: HashSet<i64>,
    pub denied: HashSet<i64>,
}

Syscall filtering configuration.

By default, a strict whitelist of ~40 safe syscalls is allowed. Use this to customize the allowed syscalls for specific use cases.

Example

use evalbox_sandbox::Syscalls;

// Start with default whitelist, add specific syscalls
let syscalls = Syscalls::default()
    .allow(libc::SYS_openat)
    .allow(libc::SYS_socket);

// Or deny specific syscalls (removes from whitelist)
let syscalls = Syscalls::default()
    .deny(libc::SYS_clone);

Fields

allowed: HashSet<i64>

Additional syscalls to allow beyond the default whitelist.

denied: HashSet<i64>

Syscalls to deny (removes from whitelist).

Implementations

impl Syscalls

pub fn new() -> Self

Create a new Syscalls config (default whitelist).

pub fn allow(self, syscall: i64) -> Self

Allow a specific syscall.

pub fn deny(self, syscall: i64) -> Self

Deny a specific syscall (remove from whitelist).

pub fn allow_many(self, syscalls: impl IntoIterator<Item = i64>) -> Self

Allow multiple syscalls.

pub fn deny_many(self, syscalls: impl IntoIterator<Item = i64>) -> Self

Deny multiple syscalls.

Trait Implementations

impl Clone for Syscalls

fn clone(&self) -> Syscalls

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Syscalls

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Syscalls

fn default() -> Syscalls

Returns the “default value” for a type.