Module security 

Re-exports

pub use crate::oci::*;

Structs

CapabilityManager

Security context that tracks capability state

CapabilitySets

CapsPolicy

Parsed capability policy from a TOML file.

GVisorOciRunOptions

Options for running an OCI bundle with gVisor.

GVisorRuntime

GVisor runtime manager

LandlockManager

Landlock filesystem access-control manager

LandlockPolicy

Parsed Landlock policy from a TOML file.

SeccompDenyLogger

Reads /dev/kmsg for SECCOMP deny records and emits WARN-level logs.

SeccompManager

Seccomp filter manager

SeccompProfile

OCI-format seccomp profile (subset).

SeccompTraceReader

Reads /dev/kmsg for SECCOMP audit records and collects unique syscalls.

Enums

GVisorNetworkMode

Network mode for gVisor runtime.

GVisorPlatform

Platform backend for gVisor’s Sentry.

SecurityState

Security state machine matching Nucleus_Security_SecurityEnforcement.tla

Functions

generate_from_trace

Generate a minimal seccomp profile from a trace file.

load_json_policy

Load and parse a JSON policy file with optional SHA-256 verification.

load_toml_policy

Load and parse a TOML policy file with optional SHA-256 verification.

sha256_hex

Compute the SHA-256 hex digest of a byte slice.