Struct Command 

pub struct Command { /* private fields */ }

A sandboxed process builder, providing fine-grained control over how a new process should be spawned.

This mirrors the API of std::process::Command but adds the ability to apply a sandbox policy that restricts filesystem access.

Example

use std::path::Path;
use sandbox_run::{Command, Sandbox, ProtectSystem};

let sandbox = Sandbox::new()
    .protect_system(ProtectSystem::Strict)
    .read_write_paths([Path::new("/tmp")])
    .build()
    .unwrap();

let output = Command::new("ls")
    .arg("/usr")
    .sandbox(sandbox)
    .output()
    .expect("failed to execute process");

Implementations

impl Command

pub fn new<S: AsRef<OsStr>>(program: S) -> Self

Constructs a new Command for launching the program at path program.

pub fn arg<S: AsRef<OsStr>>(self, arg: S) -> Self

Adds an argument to pass to the program.

pub fn args<I, S>(self, args: I) -> Self

where I: IntoIterator<Item = S>, S: AsRef<OsStr>,

Adds multiple arguments to pass to the program.

pub fn env<K, V>(self, key: K, val: V) -> Self

where K: AsRef<OsStr>, V: AsRef<OsStr>,

Inserts or updates an environment variable mapping.

pub fn envs<I, K, V>(self, vars: I) -> Self

where I: IntoIterator<Item = (K, V)>, K: AsRef<OsStr>, V: AsRef<OsStr>,

Adds or updates multiple environment variable mappings.

pub fn env_remove<K: AsRef<OsStr>>(self, key: K) -> Self

Removes an environment variable mapping.

pub fn env_clear(self) -> Self

Clears the entire environment map for the child process.

pub fn current_dir<P: AsRef<Path>>(self, dir: P) -> Self

Sets the working directory for the child process.

pub fn stdin<T: Into<Stdio>>(self, cfg: T) -> Self

Configuration for the child process’s standard input (stdin) handle.

pub fn stdout<T: Into<Stdio>>(self, cfg: T) -> Self

Configuration for the child process’s standard output (stdout) handle.

pub fn stderr<T: Into<Stdio>>(self, cfg: T) -> Self

Configuration for the child process’s standard error (stderr) handle.

pub fn sandbox(self, policy: SandboxPolicy) -> Self

Apply a sandbox policy to this command.

The sandbox will be applied to the child process after fork but before exec, restricting the process according to the policy.

pub fn spawn(self) -> Result<Child>

Executes the command as a child process, returning a handle to it.

pub fn output(self) -> Result<Output>

Executes the command as a child process, waiting for it to finish and collecting all of its output.

pub fn status(self) -> Result<ExitStatus>

Executes a command as a child process, waiting for it to finish and collecting its status.