#seal #exec #memfd-create #command #memfd

pentacle

Executes programs as sealed anonymous files on Linux

5 releases (2 stable)

1.1.0 Oct 3, 2024
1.0.0 Sep 30, 2020
0.2.0 Jun 23, 2020
0.1.1 Mar 16, 2020
0.1.0 Nov 15, 2019

#363 in Unix APIs

Download history 304/week @ 2024-08-21 220/week @ 2024-08-28 177/week @ 2024-09-04 170/week @ 2024-09-11 255/week @ 2024-09-18 270/week @ 2024-09-25 404/week @ 2024-10-02 249/week @ 2024-10-09 201/week @ 2024-10-16 161/week @ 2024-10-23 213/week @ 2024-10-30 149/week @ 2024-11-06 219/week @ 2024-11-13 175/week @ 2024-11-20 100/week @ 2024-11-27 214/week @ 2024-12-04

729 downloads per month
Used in 2 crates

MIT license

36KB
630 lines

pentacle

pentacle is a library for executing programs as sealed anonymous files on Linux, using memfd_create(2). It also has a lower-level interface for creating and sealing anonymous files with various flags.

This is useful for executing programs that execute untrusted programs with root permissions, or ensuring a cryptographically-verified program is not tampered with after verification but before execution.

This library is based on runc's cloned_binary.c.


lib.rs:

pentacle is a library for executing programs as sealed anonymous files on Linux, using memfd_create(2).

This is useful for executing programs that execute untrusted programs with root permissions, or ensuring a cryptographically-verified program is not tampered with after verification but before execution.

The library provides a wrapper around Command as well as two helper functions, ensure_sealed and is_sealed, for programs that execute sealed versions of themselves.

fn main() {
    pentacle::ensure_sealed().unwrap();

    // The rest of your code
}

Lower-level control over the creation and sealing of anonymous files is available via SealOptions.

Dependencies

~130KB