Struct UninitializedSandbox

pub struct UninitializedSandbox { /* private fields */ }

A preliminary Sandbox, not yet ready to execute guest code.

Prior to initializing a full-fledged Sandbox, you must create one of these UninitializedSandboxes with the new function, register all the host-implemented functions you need to be available to the guest, then call evolve to transform your UninitializedSandbox into an initialized Sandbox.

Implementations

impl UninitializedSandbox

pub fn new<'a, 'b>( env: impl Into<GuestEnvironment<'a, 'b>>, cfg: Option<SandboxConfiguration>, ) -> Result<Self>

Create a new sandbox configured to run the binary at path bin_path.

The instrument attribute is used to generate tracing spans and also to emit an error should the Result be an error. The skip attribute is used to skip the guest binary from being printed in the tracing span. The name attribute is used to name the tracing span. The err attribute is used to emit an error should the Result be an error, it uses the std::fmt::Debug trait to print the error.

pub fn set_max_guest_log_level(&mut self, log_level: LevelFilter)

Set the max log level to be used by the guest. If this is not set then the log level will be determined by parsing the RUST_LOG environment variable. If the RUST_LOG environment variable is not set then the max log level will be set to LevelFilter::Error.

pub fn register<Args: ParameterTuple, Output: SupportedReturnType>( &mut self, name: impl AsRef<str>, host_func: impl Into<HostFunction<Output, Args>>, ) -> Result<()>

Register a host function with the given name in the sandbox.

pub fn register_with_extra_allowed_syscalls<Args: ParameterTuple, Output: SupportedReturnType>( &mut self, name: impl AsRef<str>, host_func: impl Into<HostFunction<Output, Args>>, extra_allowed_syscalls: impl IntoIterator<Item = ExtraAllowedSyscall>, ) -> Result<()>

Register the host function with the given name in the sandbox. Unlike register, this variant takes a list of extra syscalls that will allowed during the execution of the function handler.

pub fn register_print( &mut self, print_func: impl Into<HostFunction<i32, (String,)>>, ) -> Result<()>

Register a host function named “HostPrint” that will be called by the guest when it wants to print to the console. The “HostPrint” host function is kind of special, as we expect it to have the FnMut(String) -> i32 signature.

pub fn register_print_with_extra_allowed_syscalls( &mut self, print_func: impl Into<HostFunction<i32, (String,)>>, extra_allowed_syscalls: impl IntoIterator<Item = ExtraAllowedSyscall>, ) -> Result<()>

Register a host function named “HostPrint” that will be called by the guest when it wants to print to the console. The “HostPrint” host function is kind of special, as we expect it to have the FnMut(String) -> i32 signature. Unlike register_print, this variant takes a list of extra syscalls that will allowed during the execution of the function handler.

Trait Implementations

impl Debug for UninitializedSandbox

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl EvolvableSandbox<UninitializedSandbox, MultiUseSandbox, Noop<UninitializedSandbox, MultiUseSandbox>> for UninitializedSandbox

fn evolve( self, _: Noop<UninitializedSandbox, MultiUseSandbox>, ) -> Result<MultiUseSandbox>

Evolve self to a MultiUseSandbox without any additional metadata.

impl Registerable for UninitializedSandbox

fn register_host_function<Args: ParameterTuple, Output: SupportedReturnType>( &mut self, name: &str, hf: impl Into<HostFunction<Output, Args>>, ) -> Result<()>

Register a primitive host function

fn register_host_function_with_syscalls<Args: ParameterTuple, Output: SupportedReturnType>( &mut self, name: &str, hf: impl Into<HostFunction<Output, Args>>, eas: Vec<ExtraAllowedSyscall>, ) -> Result<()>

Register a primitive host function whose worker thread has extra permissive seccomp filters installed

impl Sandbox for UninitializedSandbox

fn check_stack_guard(&self) -> Result<bool>

Check to ensure the current stack cookie matches the one that was selected when the stack was constructed.

impl UninitializedSandbox for UninitializedSandbox

fn get_uninitialized_sandbox(&self) -> &UninitializedSandbox

Retrieves reference to strongly typed UninitializedSandbox

fn get_uninitialized_sandbox_mut(&mut self) -> &mut UninitializedSandbox

Retrieves mutable reference to strongly typed UninitializedSandbox