Struct Sandbox 

pub struct Sandbox { /* private fields */ }

Builder for creating sandbox policies mirroring systemd.exec options.

Example

use std::path::Path;
use sandbox_run::{Sandbox, ProtectSystem, ProtectHome};

let sandbox = Sandbox::new()
    .protect_system(ProtectSystem::Strict)
    .protect_home(ProtectHome::Yes)
    .read_write_paths([Path::new("/tmp/myapp")])
    .no_new_privileges(true)
    .limit_nofile(256)
    .build()
    .unwrap();

Implementations

impl Sandbox

pub fn new() -> Self

Create a new sandbox builder with default settings (no restrictions).

pub fn protect_system(self, level: ProtectSystem) -> Self

Set system directory protection level (systemd: ProtectSystem=)

• No: No protection
• Yes: /usr, /boot, /efi read-only
• Full: + /etc read-only
• Strict: Entire filesystem read-only except API filesystems

pub fn protect_home(self, level: ProtectHome) -> Self

Set home directory protection level (systemd: ProtectHome=)

• No: No protection
• Yes: /home, /root, /run/user inaccessible
• ReadOnly: /home, /root, /run/user read-only

pub fn read_only_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: AsRef<Path>,

Make paths read-only (systemd: ReadOnlyPaths=)

Writing to these paths will be denied.

pub fn read_write_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: AsRef<Path>,

Allow read-write access to paths (systemd: ReadWritePaths=)

Use this to create exceptions within ProtectSystem=strict.

pub fn inaccessible_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: AsRef<Path>,

Make paths completely inaccessible (systemd: InaccessiblePaths=)

Neither reading nor writing will be possible.

pub fn exec_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: AsRef<Path>,

Allow execution only from these paths (systemd: ExecPaths=)

Binaries outside these paths cannot be executed.

pub fn no_exec_paths<I, P>(self, paths: I) -> Self

where I: IntoIterator<Item = P>, P: AsRef<Path>,

Deny execution from these paths (systemd: NoExecPaths=)

Binaries in these paths cannot be executed.

pub fn private_network(self, enable: bool) -> Self

Isolate network access (systemd: PrivateNetwork=)

When enabled, all network access is blocked.

pub fn no_new_privileges(self, enable: bool) -> Self

Prevent privilege escalation (systemd: NoNewPrivileges=)

When enabled, the process cannot gain new privileges through setuid/setgid bits or file capabilities.

pub fn limit_nofile(self, limit: u64) -> Self

Max open file descriptors (systemd: LimitNOFILE=)

pub fn limit_nproc(self, limit: u64) -> Self

Max number of processes (systemd: LimitNPROC=)

pub fn limit_core(self, limit: u64) -> Self

Max core dump size in bytes (systemd: LimitCORE=)

Set to 0 to disable core dumps.

pub fn limit_fsize(self, limit: u64) -> Self

Max file size in bytes (systemd: LimitFSIZE=)

pub fn limit_data(self, limit: u64) -> Self

Max data segment size in bytes (systemd: LimitDATA=)

pub fn limit_stack(self, limit: u64) -> Self

Max stack size in bytes (systemd: LimitSTACK=)

pub fn limit_cpu(self, limit: u64) -> Self

Max CPU time in seconds (systemd: LimitCPU=)

pub fn limit_memlock(self, limit: u64) -> Self

Max locked memory in bytes (systemd: LimitMEMLOCK=)

pub fn build(self) -> Result<SandboxPolicy, SandboxError>

Build the sandbox policy.

This validates the configuration and prepares platform-specific data needed to apply the sandbox.

Trait Implementations

impl Clone for Sandbox

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sandbox

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Sandbox

fn default() -> Self

Returns the “default value” for a type.