Struct SeccompRules 

pub struct SeccompRules { /* private fields */ }

A caller-authored seccomp policy: a default action for unlisted syscalls, and the opposite action for a named list.

The two shapes cover the common cases. An allowlist names the syscalls the command may make and denies the rest — the strict posture, which must include every syscall the command needs (execve among them, since it is the first syscall the filter governs). A denylist names the syscalls to refuse and allows the rest.

Syscalls are named by their kernel number for the host architecture; the syscalls crate or libc provides them.

A listed syscall may carry argument conditions through rule, so the listed action applies only to invocations whose arguments match — an allowlist that permits ioctl only for a specific request, a denylist that refuses socket only for AF_INET. A syscall listed both plainly and with conditions matches unconditionally: the broader listing wins.

A seccomp filter governs syscalls, not the operations an asynchronous submission interface performs on their behalf. An allowlist that permits io_uring_enter therefore permits the file opens, connects, and reads submitted through the ring, even where it denies openat, connect, or read directly. Do not allowlist the io_uring syscalls unless the command genuinely needs them; the curated policy denies them for this reason.

Implementations

impl SeccompRules

pub fn denying<I: IntoIterator<Item = i64>>(syscalls: I) -> SeccompRules

A denylist: syscalls fail with EPERM, everything else is allowed.

pub fn allowing<I: IntoIterator<Item = i64>>(syscalls: I) -> SeccompRules

An allowlist: syscalls are allowed, everything else fails with EPERM.

pub fn rule<I: IntoIterator<Item = SeccompArg>>( self, syscall: i64, conditions: I, ) -> SeccompRules

Lists syscall with argument conditions: the listed action applies only when every condition in conditions holds (an AND). Call this more than once for the same syscall to accept any of several condition sets (an OR).

Passing no conditions lists the syscall unconditionally, the same as naming it in denying or allowing. If a syscall is listed both unconditionally and with conditions, the unconditional listing wins.

pub fn default_action(self, action: SeccompAction) -> SeccompRules

Sets the action for unlisted syscalls (the default is Allow for a denylist, Errno(EPERM) for an allowlist).

pub fn listed_action(self, action: SeccompAction) -> SeccompRules

Sets the action for the listed syscalls.

Trait Implementations

impl Clone for SeccompRules

fn clone(&self) -> SeccompRules

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SeccompRules

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.