Enum IdentityMap 

#[non_exhaustive]
pub enum IdentityMap {
    Single,
    #[non_exhaustive]
    Ranges {
        uid: Vec<IdRange>,
        gid: Vec<IdRange>,
    },
    Subordinate,
}

How the sandbox’s user namespace maps identities to the host’s.

Selected with CageBuilder::identity_map. The single-identity map is established by the sandbox itself; every range map is established from outside the new namespace by an IdMapper, because the kernel does not permit a process to write its own multi-id map — not even a process that was privileged before it unshared.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Single

Root inside is the calling user outside, and no other id exists. This is the default.

Reads of host ids outside the map present the overflow id (nobody), and changing a file’s ownership to any other id fails with EINVAL, because the namespace cannot represent the id at all.

#[non_exhaustive]

Ranges

Explicit ranges, written verbatim.

Both lists must be non-empty, map inside-id 0, stay within the kernel’s 340-extent ceiling, and contain no overlapping extents. The configured IdMapper decides whether the outside ids are available to it.

Construct this variant with IdentityMap::ranges. It is #[non_exhaustive] so that a further extent list — the kernel has projid_map alongside uid_map and gid_map — can be added without breaking callers; match it with a trailing ...

Fields

Non-exhaustive enum variants could have additional fields added in future. Therefore, non-exhaustive enum variants cannot be constructed in external crates and cannot be matched against.

uid: Vec<IdRange>

The uid extents.

gid: Vec<IdRange>

The gid extents.

Subordinate

Root plus the caller’s whole subordinate allocation, as the delegate reports it.

The composed map is 0 to the caller’s own id, then inside ids from 1 onward covering each allocated range in order. Requires a delegate that can report an allocation; the bundled one is SubidMapper, behind the subid feature.

Implementations

impl IdentityMap

pub fn ranges(uid: Vec<IdRange>, gid: Vec<IdRange>) -> IdentityMap

Returns an explicit range map of the given uid and gid extents.

The constructor for IdentityMap::Ranges, which is #[non_exhaustive] so it can gain a further extent list later.

Example

use ferroday_cage::{IdRange, IdentityMap};

let root = IdRange { inside: 0, outside: 1000, count: 1 };
let rest = IdRange { inside: 1, outside: 100_000, count: 65_536 };
let map = IdentityMap::ranges(vec![root, rest], vec![root, rest]);

Trait Implementations

impl Clone for IdentityMap

fn clone(&self) -> IdentityMap

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IdentityMap

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for IdentityMap

fn default() -> IdentityMap

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for IdentityMap

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for IdentityMap

impl PartialEq for IdentityMap

fn eq(&self, other: &IdentityMap) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for IdentityMap

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for IdentityMap