Struct Threads 

pub struct Threads { /* private fields */ }

Allows clone and sleep syscalls, which allow creating new threads and processes, and pausing them.

Security

This is in the danger zone not because it’s dangerous but because it can be misused: Threads do not provide isolation from each other. You can still access other threads’ memory and potentially get them to do operations that are not allowed in the current thread’s seccomp context.

Implementations

impl Threads

pub fn nothing() -> Threads

Create a new Threads ruleset with nothing allowed by default.

pub fn allow_create(self) -> Threads

Allow creating new threads and processes.

pub fn allow_sleep(self) -> YesReally<Threads>

Allow sleeping on the current thread

Security considerations

An attacker with arbitrary code execution and access to a high resolution timer can mount timing attacks (e.g. spectre).

Trait Implementations

impl RuleSet for Threads

fn simple_rules(&self) -> Vec<Sysno>

A simple rule is a seccomp rule that just allows the syscall without restriction.

fn conditional_rules(&self) -> HashMap<Sysno, Vec<SeccompRule>>

A conditional rule is a seccomp rule that uses a condition to restrict the syscall, e.g. only specific flags as parameters.

fn name(&self) -> &'static str

The name of the profile.