#sandbox #landlock #utilities #rules #dev #bin #add-read-only

leucite

A wrapper crate around rust-landlock that provides useful abstractions and utilities

2 unstable releases

0.2.0 Jan 14, 2025
0.1.0 Dec 18, 2024

#20 in #bin

Download history 124/week @ 2024-12-16 7/week @ 2025-01-06 157/week @ 2025-01-13 10/week @ 2025-01-20 103/week @ 2025-01-27 86/week @ 2025-02-03 70/week @ 2025-02-10 136/week @ 2025-02-17 63/week @ 2025-02-24 10/week @ 2025-03-03 15/week @ 2025-03-10 28/week @ 2025-03-17

123 downloads per month

Apache-2.0

17KB
232 lines

leucite

Crates.io Documentation Dependency status

A wrapper crate around rust-landlock that provides useful abstractions and utilities

Example

let rules = Rules::new()
    .add_read_only("/usr")
    .add_read_only("/etc")
    .add_read_only("/dev")
    .add_read_only("/bin")
    .add_read_write("/tmp/foo");

// Execute `bash -i` in the `/tmp/foo` directory using the provided rules
Command::new("bash")
    .arg("-i")
    .current_dir("/tmp/foo")
    .env_clear()
    .restrict(rules.into())
    .max_memory(MemorySize::from_mb(100))
    .spawn()?
    .wait()?;

lib.rs:

A wrapper crate around rust-landlock that provides useful abstractions and utilities

Example

let rules = Rules::new()
    .add_read_only("/usr")
    .add_read_only("/etc")
    .add_read_only("/dev")
    .add_read_only("/bin")
    .add_read_write("/tmp/foo");

// Execute `bash -i` in the `/tmp/foo` directory using the provided rules
Command::new("bash")
    .arg("-i")
    .current_dir("/tmp/foo")
    .env_clear()
    .restrict(rules.into())
    .max_memory(MemorySize::from_mb(100))
    .spawn()?
    .wait()?;

Dependencies

~0.5–9MB
~82K SLoC