Struct secmem_proc::config::Config

pub struct Config { /* private fields */ }

Configuration for the hardening procedure. The configuration allows to enable or disable certain features, such as filesystem access (e.g. for procfs), anti-tracing methods and to use a custom DACL on windows.

Implementations

impl Config

pub const DEFAULT: Self = _

Default configuration.

pub const fn new_with_anti_tracing(anti_tracing: bool) -> Self

Create new default configuration, with anti-tracing set to anti_tracing.

pub fn set_anti_tracing(&mut self, b: bool)

Set anti-tracing to b (true means enabled).

pub fn set_fs(&mut self, b: bool)

Set filesystem access to b (true means enabled).

pub fn fs_mut(&mut self) -> &mut Fs

Get mutable reference to filesystem access configuration, allowing to modify it.

pub fn set_fs_procfs(&mut self, b: bool)

Set procfs access to b (true means enabled).

pub fn set_unstable(&mut self, b: bool)

Set unstable hardening methods to b (true means enabled).

Default is disabled (false). Note that the unstable crate feature is required for this configuration to have any effect. Without that crate feature, the value of this configuration is silently ignored, and unstable hardening is not performed.

pub fn unstable_mut(&mut self) -> &mut Unstable

Get mutable reference to unstable hardening configuration, allowing to modify it.

pub fn set_unstable_win_ntapi(&mut self, b: bool)

Set use of unstable windows native API to b (true means enabled).

Default is disabled (false). Note that the unstable crate feature is required for this configuration to have any effect. Without that crate feature, the value of this configuration is silently ignored, and unstable hardening is not performed.

pub fn set_unstable_win_kernelmem(&mut self, b: bool)

Set use of unstable windows hardening relying on shared kernel memory to b (true means enabled).

Default is disabled (false). Note that the unstable crate feature is required for this configuration to have any effect. Without that crate feature, the value of this configuration is silently ignored, and unstable hardening is not performed.

pub fn set_win_dacl(&mut self, dacl: WinDacl)

Configure a custom windows DACL dacl (for the process).

pub fn set_win_dacl_default(&mut self)

Configure the windows DAC (for the process)L as the default.

pub fn set_win_dacl_empty(&mut self)

Configure the windows DACL (for the process) as an empty DACL. This means giving no access to any user at all. This is extremely strict. Use with caution.

pub fn set_win_dacl_custom_user_perm(&mut self, access: WinDaclProcessAccess)

Configure the windows DACL (for the process) as a DACL which gives precisely the accesses specified by access to the current user, and no access to any other user.

pub fn set_win_dacl_custom_fn(&mut self, fnptr: fn() -> Result)

Configure to, instead of setting a DACL (for the process) on windows, call the function fnptr. This callback function fnptr can then be used to set a custom DACL yourself, using the API in crate::win_acl.

pub fn harden_process(self) -> Result

Use the configuration self to harden the current process.

Trait Implementations

impl Default for Config

fn default() -> Self

Returns the “default value” for a type.