Leucite

A wrapper crate around rust-landlock that provides useful abstractions and utilities

Example

let rules = Rules::new()
    .add_read_only("/usr")
    .add_read_only("/etc")
    .add_read_only("/dev")
    .add_read_only("/bin")
    .add_read_write("/tmp/foo");

let mut child = Command::new("bash")
    .arg("-i")
    .current_dir("/tmp/foo")
    .env_clear()
    .spawn_restricted(rules)?;

child.wait()?;

lib.rs:

Leucite

A wrapper crate around rust-landlock that provides useful abstractions and utilities

Example

let rules = Rules::new()
    .add_read_only("/usr")
    .add_read_only("/etc")
    .add_read_only("/dev")
    .add_read_only("/bin")
    .add_read_write("/tmp/foo");

// Execute `bash -i` in the `/tmp/foo` directory using the provided rules
Command::new("bash")
    .arg("-i")
    .current_dir("/tmp/foo")
    .env_clear()
    .spawn_restricted(rules)?
    .wait()?;