Struct SecurityProfile 

#[non_exhaustive]
pub struct SecurityProfile {
    pub standard: SecurityPreset,
    pub seccomp: SeccompProfile,
    pub capabilities: CapabilityConfig,
    pub no_new_privileges: bool,
    pub run_as_user: Option<u32>,
    pub run_as_group: Option<u32>,
}

Per-process security context applied by the sandbox.

The standard preset provides safe defaults; individual fields can be overridden for fine-grained control.

Expansion table:

Preset	no_new_privileges	seccomp	capabilities
Privileged	false	Unconfined	no drops
Baseline	true	RuntimeDefault	drop NET_RAW, SYS_PTRACE, SYS_ADMIN
Restricted	true	RuntimeDefault	drop ALL, no adds allowed

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

standard: SecurityPreset

High-level policy preset. Overrides other fields to safe defaults.

seccomp: SeccompProfile

Seccomp profile to apply before exec.

capabilities: CapabilityConfig

Linux capability adjustments.

no_new_privileges: bool

Set PR_SET_NO_NEW_PRIVS before exec, preventing privilege escalation via setuid binaries or file capabilities.

run_as_user: Option<u32>

Run as this UID. None = inherit from calling process.

run_as_group: Option<u32>

Run as this GID. None = inherit from calling process.

Trait Implementations

impl Clone for SecurityProfile

fn clone(&self) -> SecurityProfile

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityProfile

fn default() -> Self

Baseline preset: no_new_privileges, RuntimeDefault seccomp, drop NET_RAW / SYS_PTRACE / SYS_ADMIN.

impl<'de> Deserialize<'de> for SecurityProfile

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityProfile

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.