Struct NetAccess 

pub struct NetAccess(/* private fields */);

A set of Landlock network access rights, granted on a TCP port by CageBuilder::landlock_net.

Landlock’s network control covers TCP alone: these rights govern TCP bind and connect and nothing else. UDP, raw sockets, and other socket families — AF_UNIX among them, including abstract sockets to host IPC — are outside a network grant’s reach, and a restriction that must deny them needs a seccomp filter or a cage’s network namespace instead.

The kernel keys network rights by port, so these are the network counterpart of FsAccess: the two primitives — BIND and CONNECT — combine with |, mask with &, and complement with ! (within the modeled rights):

use ferroday_cage::NetAccess;

let bind_connect = NetAccess::BIND | NetAccess::CONNECT;
assert!(bind_connect.contains(NetAccess::BIND));
assert_eq!(bind_connect & NetAccess::CONNECT, NetAccess::CONNECT);
assert_eq!(!NetAccess::BIND, NetAccess::CONNECT);

Implementations

impl NetAccess

pub const BIND: NetAccess

Bind a TCP socket to the port (LANDLOCK_ACCESS_NET_BIND_TCP).

pub const CONNECT: NetAccess

Connect a TCP socket to the port (LANDLOCK_ACCESS_NET_CONNECT_TCP).

pub const fn empty() -> NetAccess

The empty access set — no rights. Equivalent to NetAccess::default.

pub const fn all() -> NetAccess

Every modeled right: BIND and CONNECT.

pub const fn is_empty(self) -> bool

Returns true if no right is present.

pub const fn contains(self, other: NetAccess) -> bool

Returns true if every right in other is present.

Trait Implementations

impl BitAnd for NetAccess

type Output = NetAccess

The resulting type after applying the & operator.

fn bitand(self, rhs: NetAccess) -> NetAccess

Performs the & operation.

impl BitAndAssign for NetAccess

fn bitand_assign(&mut self, rhs: NetAccess)

Performs the &= operation.

impl BitOr for NetAccess

type Output = NetAccess

The resulting type after applying the | operator.

fn bitor(self, rhs: NetAccess) -> NetAccess

Performs the | operation.

impl BitOrAssign for NetAccess

fn bitor_assign(&mut self, rhs: NetAccess)

Performs the |= operation.

impl Clone for NetAccess

fn clone(&self) -> NetAccess

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for NetAccess

impl Debug for NetAccess

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetAccess

fn default() -> NetAccess

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NetAccess

Available on crate feature serde only.

fn deserialize<D: Deserializer<'de>>( deserializer: D, ) -> Result<NetAccess, D::Error>

Deserializes from the letter string, through FromStr.

impl Display for NetAccess

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Writes the rights as the letters b and c, in that order; the empty set writes nothing.

impl Eq for NetAccess

impl FromStr for NetAccess

fn from_str(s: &str) -> Result<NetAccess, ParseNetAccessError>

Parses an access set from the letters b and c, in any order and any case. A letter outside that set, or a letter given twice, is an error; the empty string is the empty set.

type Err = ParseNetAccessError

The associated error which can be returned from parsing.

impl Hash for NetAccess

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Not for NetAccess

fn not(self) -> NetAccess

The modeled rights this set does not hold; bits outside the modeled set are never produced.

type Output = NetAccess

The resulting type after applying the ! operator.

impl PartialEq for NetAccess

fn eq(&self, other: &NetAccess) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for NetAccess

Available on crate feature serde only.

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Serializes as the letter string, through Display.

impl StructuralPartialEq for NetAccess