#bindings #ebpf #falco #linux #libscap

sys libscap-bindings

Bindings for Falco’s libscap eBPF monitoring backend C library

3 releases

Uses new Rust 2024

0.0.3 Jan 6, 2026
0.0.2 Nov 17, 2025
0.0.1 Nov 14, 2025

#775 in Unix APIs

Download history 78/week @ 2025-11-10 588/week @ 2025-11-17 265/week @ 2025-11-24 611/week @ 2025-12-01 413/week @ 2025-12-08 558/week @ 2025-12-15 134/week @ 2025-12-22 63/week @ 2025-12-29 250/week @ 2026-01-05 348/week @ 2026-01-12

805 downloads per month

Apache-2.0

76KB
2K SLoC

libscap-bindings

Basic bindgen types and glue generated against Falco's libscap C library.

Currently, only gnu and musl x86 targets are tested, and only Linux is supported.

Usage

This crate needs build tools and build libraries sufficient to compile Falco's libscap C lib, which is the bulk of what build.rs sets up.

Since quite often you don't need the full bindings when you take this crate as a dep, and don't wish to incur the build and local dependency cost for building all of Falco's libscap, this crate exposes the full_bindings feature flag, which is enabled by default.

If that feature flag is disabled, only the simple types (enums, consts) will be emitted and exported, using previously-generated and checked versions in src, (namely src/enums.rs and src/consts.rs) so no C build is necessary for anything that only needs the simple types:

libscap-bindings = { version = 0.0.1, default-features = false }

If that feature flag is enabled (as it is by default), the upstream libscap repo will be cloned, and a full C build will be performed, exposing function types and the full interop capability. This will also update/regen the checked-in simple types in /src.

libscap-bindings = { version = 0.0.1, features = ["full_bindings"]}

Dependencies

~0.3–5MB
~85K SLoC