Native Rust crate for libseccomp library
This is a set of projects (high-level bindings, low-level bindings and tool for generating low-level bindings automatically) that enables developers to use the libseccomp API in Rust easily.
- libseccomp: High-level safe API
- libseccomp-sys: Low-level unsafe API (automatically generated)
- tool: Tool for generating low-level bindings using bindgen
use libseccomp::*;
// new_filter creates and returns a new filter context.
let mut filter = ScmpFilterContext::new_filter(ScmpAction::Allow).unwrap();
// add_arch adds an architecture to the filter.
filter.add_arch(ScmpArch::Native).unwrap();
// get_syscall_from_name returns the number of a syscall by name for a given
// architectures's ABI.
// If arch argument is None, the function returns the number of a syscall
// on the kernel's native architecture.
let syscall = get_syscall_from_name("dup2", None).unwrap();
// add_rule adds a single rule for an unconditional or conditional action on a syscall.
filter.add_rule(ScmpAction::Errno(111), syscall, None).unwrap();
// load loads the filter context into the kernel.
filter.load().unwrap();
// The dup2 fails by the seccomp rule.
assert_eq!(unsafe { libc::dup2(1, 2) } as i32, -libc::EPERM);
assert_eq!(std::io::Error::last_os_error().raw_os_error().unwrap(), 111);
Before using the libseccomp-rs
, you must install the libseccomp library for your system.
The libseccomp version 2.4 or newer is required.
$ sudo apt install libseccomp-dev
If you want to build the libseccomp library from an official release tarball instead of the package, you should follow the quick step.
$ wget https://github.com/seccomp/libseccomp/releases/download/v2.5.1/libseccomp-2.5.1.tar.gz
$ tar xvf libseccomp-2.5.1.tar.gz
$ cd libseccomp-2.5.1
$ ./configure
$ make
$ sudo make install
For more details, see the libseccomp library repository.
If you use the libseccomp crate with dynamically linked the libseccomp library, you do not need additional settings about environment variables.
However, if you want to use the crate with statically linked the library,
you have to set the LIBSECCOMP_LINK_TYPE
and LIBSECCOMP_LIB_PATH
environment variable
like below.
$ export LIBSECCOMP_LINK_TYPE=static
$ export LIBSECCOMP_LIB_PATH="the path of libseccomp.a"
Now, add the following to your Cargo.toml
to start building the crate.
[dependencies]
libseccomp = "0.1.3"
A number of tests are provided in the Makefile, if you want to run the standard regression tests, you can execute the following command.
$ make test
Anyone is welcome to join and contribute code, documentation and use cases.
- Change or add something
- Make sure you're using the latest Rust version
- Run
rustfmt
to guarantee code style conformance
$ rustup component add rustfmt
$ cargo fmt
- Open a pull request in Github
This crate is licensed under:
- MIT License (see LICENSE-MIT); or
- Apache 2.0 License (see LICENSE-APACHE),
at your option.