Struct SeccompProfile 

pub struct SeccompProfile {
    pub blocked_syscalls: Vec<String>,
    pub allow_namespaces: bool,
    pub allow_network_sockets: bool,
    pub log_only: bool,
}

Seccomp profile configuration for Linux sandboxing.

Used alongside Landlock for defense-in-depth.

Fields

blocked_syscalls: Vec<String>

Syscalls to block entirely.

allow_namespaces: bool

Whether to allow new namespace creation (usually false for sandboxes).

allow_network_sockets: bool

Whether to allow network socket creation (controlled separately).

log_only: bool

Whether to log blocked syscalls instead of killing the process.

Implementations

impl SeccompProfile

pub fn strict() -> Self

Create a strict profile blocking all dangerous syscalls.

pub fn permissive() -> Self

Create a permissive profile for semi-trusted code.

pub fn logging() -> Self

Create a logging-only profile for debugging.

pub fn block_syscall(self, syscall: impl Into<String>) -> Self

Builder: add a syscall to block.

pub fn with_network(self) -> Self

Builder: allow network sockets.

pub fn with_logging(self) -> Self

Builder: enable log-only mode.

pub fn is_blocked(&self, syscall: &str) -> bool

Check if a syscall is blocked by this profile.

pub fn to_json(&self) -> Result<String, Error>

Generate a JSON representation for the sandbox helper.

Trait Implementations

impl Clone for SeccompProfile

fn clone(&self) -> SeccompProfile

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SeccompProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SeccompProfile

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SeccompProfile

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SeccompProfile

impl PartialEq for SeccompProfile

fn eq(&self, other: &SeccompProfile) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SeccompProfile

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SeccompProfile