Crates.io | casper-sys |
lib.rs | casper-sys |
version | 0.1.1 |
source | src |
created_at | 2023-02-16 13:35:55.144143 |
updated_at | 2023-08-07 17:27:42.588091 |
description | FFI bindings for FreeBSD's libcasper |
homepage | |
repository | https://github.com/dlrobertson/capsicum-rs |
max_upload_size | |
id | 786774 |
size | 23,765 |
Rust bindings for the FreeBSD capsicum framework for OS capability and sandboxing
Note: This currently only compiles on FreeBSD
git clone https://github.com/danlrobertson/capsicum-rs
cd capsicum-rs
cargo build
capsicum-rs
use capsicum::{enter, sandboxed};
use std::fs::File;
use std::io::Read;
let mut ok_file = File::open("/tmp/foo").unwrap();
let mut s = String::new();
enter().expect("enter failed!");
assert!(sandboxed(), "application is not sandboxed!");
match File::create("/tmp/cant_touch_this") {
Ok(_) => panic!("application is not properly sandboxed!"),
Err(e) => println!("properly sandboxed: {:?}", e)
}
match ok_file.read_to_string(&mut s) {
Ok(_) => println!("This is okay since we opened the descriptor before sandboxing"),
Err(_) => panic!("application is not properly sandboxed!")
}
use capsicum::{CapRights, Right, RightsBuilder};
use std::fs::File;
use std::io::Read;
let x = rand::random::<bool>();
let mut ok_file = File::open("/tmp/foo").unwrap();
let mut s = String::new();
let mut builder = RightsBuilder::new(Right::Seek);
if x {
builder.add(Right::Read);
}
let rights = builder.finalize().unwrap();
rights.limit(&ok_file).unwrap();
match ok_file.read_to_string(&mut s) {
Ok(_) if x => println!("Allowed reading: x = {} ", x),
Err(_) if !x => println!("Did not allow reading: x = {}", x),
_ => panic!("Not properly sandboxed"),
}