Struct CapabilityManager 

pub struct CapabilityManager { /* private fields */ }

Security context that tracks capability state

Implementations

impl CapabilityManager

pub fn new() -> Self

pub fn drop_all(&mut self) -> Result<()>

Drop all capabilities

This implements the transition: Privileged -> CapabilitiesDropped in the security state machine (Nucleus_Security_SecurityEnforcement.tla)

pub fn drop_except(&mut self, keep: &[Capability]) -> Result<()>

Drop all capabilities except the specified ones

For most use cases, we drop ALL capabilities. This method is provided for special cases where specific capabilities are needed.

pub fn apply_sets(&mut self, sets: &CapabilitySets) -> Result<()>

Apply explicit capability sets.

Bounding is handled as a drop-only upper bound; the remaining sets are set exactly to the provided values.

pub fn is_dropped(&self) -> bool

Check if capabilities have been dropped

pub fn verify_no_namespace_caps(production: bool) -> Result<()>

Verify that namespace-creating capabilities are actually absent from the effective set. This is a runtime guard for the clone3 seccomp invariant: clone3 cannot be argument-filtered at the BPF level, so we rely on CAP_SYS_ADMIN (et al.) being dropped to prevent namespace creation. If the check fails in production mode, it returns an error; otherwise it emits a warning.

Trait Implementations

impl Default for CapabilityManager

fn default() -> Self

Returns the “default value” for a type.