Struct SecurityConfig 

pub struct SecurityConfig {
    pub userns: bool,
    pub drop_caps: Vec<String>,
    pub add_caps: Vec<String>,
    pub no_new_privileges: bool,
    pub read_only: bool,
    pub system_call_filter: Vec<String>,
    pub apparmor_profile: Option<String>,
}

Security configuration for containers.

All fields are optional; unset fields mean “use nspawn defaults”.

Examples

let sec = SecurityConfig {
    drop_caps: vec!["CAP_SYS_PTRACE".into()],
    no_new_privileges: true,
    ..Default::default()
};
assert!(!sec.is_empty());
assert!(SecurityConfig::default().is_empty());

Fields

userns: bool

Enable user namespace isolation (--private-users=pick).

drop_caps: Vec<String>

Capabilities to drop (e.g. CAP_SYS_PTRACE).

add_caps: Vec<String>

Capabilities to add back (e.g. CAP_NET_ADMIN).

no_new_privileges: bool

Prevent gaining privileges via setuid/file capabilities.

read_only: bool

Mount the rootfs read-only.

system_call_filter: Vec<String>

Seccomp system call filter (e.g. @system-service, ~@mount).

apparmor_profile: Option<String>

AppArmor profile name (applied as systemd unit directive).

Implementations

impl SecurityConfig

pub fn is_empty(&self) -> bool

Returns true if no security options are set.

pub fn from_state(state: &State) -> Self

Read security config from a container’s state file.

pub fn write_to_state(&self, state: &mut State)

Write security config into a container’s state file.

pub fn to_nspawn_args(&self, systemd_version: u32) -> Vec<String>

Generate systemd-nspawn arguments for security options.

systemd_version controls which --private-users-ownership mode is used: systemd >= 256 supports map (idmapped rootfs mount, zero-overhead), older versions fall back to auto (recursive chown on first boot).

Does NOT include AppArmor: that goes into the systemd unit drop-in as AppArmorProfile=, not as an nspawn flag.

pub fn validate(&self) -> Result<()>

Validate all security settings.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.

impl PartialEq for SecurityConfig

fn eq(&self, other: &SecurityConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for SecurityConfig