Struct SecurityConfig 

pub struct SecurityConfig {
    pub drop_all_caps: bool,
    pub keep_caps: Vec<LinuxCapability>,
    pub no_new_privs: bool,
    pub fail_on_cap_error: bool,
}

Declarative security policy.

Fields

drop_all_caps: bool

Drop all capabilities before exec.

Note: capability operations require CAP_SETPCAP or root. If the process lacks these privileges, the operation will log a warning and continue (unless fail_on_cap_error is set).

keep_caps: Vec<LinuxCapability>

Optional allowlist of capabilities to keep after drop_all_caps.

Only meaningful when drop_all_caps = true.

no_new_privs: bool

Enable no_new_privs for the child process.

This flag works without root privileges. Failures to set this flag are always fatal (spawn will fail).

fail_on_cap_error: bool

When true, capability drop failures abort the spawn instead of logging and continuing.

Default: false (best-effort - non-fatal).

Implementations

impl SecurityConfig

pub fn is_empty(&self) -> bool

Returns true if no security knobs are configured.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.