#openbsd #unveil #pledge


Rust bindings for OpenBSD’s pledge(2) and unveil(2)

4 releases

0.1.2 Nov 19, 2021
0.1.1 Nov 19, 2021
0.1.0 Dec 9, 2020
0.0.0 Dec 7, 2020

#92 in Operating systems

42 downloads per month

ISC license

142 lines


Rust bindings for OpenBSD's pledge(2) and unveil(2).



Macro syntax

use openbsd::pledge;

pledge!("stdio rpath exec")?; // only make promises
pledge!(_, "stdio rpath")?; // only make execpromises
pledge!("stdio", "stdio")?; // make both

assert!(pledge!("wpath").is_err()); // cannot increase permissions

Function syntax

use openbsd::pledge::{pledge, pledge_promises, pledge_execpromises};

pledge_promises("stdio rpath exec")?; // only make promises
pledge_execpromises("stdio rpath")?; // only make execpromises
pledge("stdio", "stdio")?; // make both

assert!(pledge_promises("wpath").is_err()); // cannot increase permissions


Macro syntax

use openbsd::unveil;

unveil!("/path/to/file", "rw")?;
unveil!("/path/to/another/file", "r")?;

unveil!(); // disable further calls to unveil
assert!(unveil!("/", "rwxc").is_err());

Function syntax

use openbsd::unveil;

unveil("/path/to/file", "rw")?;
unveil("/path/to/another/file", "r")?;

unveil::disable(); // disable further calls to unveil
assert!(unveil("/", "rwxc").is_err());

No runtime deps