Struct LandlockRestrictFlags 

pub struct LandlockRestrictFlags(/* private fields */);

Drapeaux de landlock_restrict_self(2) (cf. linux/landlock.h).

Deux familles, deux natures

• les trois premiers ne changent aucune décision d’accès : ils disent au noyau ce qu’il doit tracer d’un refus (ABI v7). Utiles au diagnostic, ils appartiennent à l’appelant (ADR-156 D5) ;
• le quatrième, TSYNC, change ce qui est borné — et c’est le seul qui ferme quelque chose.

Ce que TSYNC répare

Sans lui, landlock_restrict_self ne borne que le fil appelant. Dans un processus multifil qui se met lui-même en cage, les fils frères restent hors du domaine : la cage se contourne en changeant de fil. Avec lui, la configuration s’applique atomiquement à tous les fils du processus.

Le noyau propage aussi no_new_privs aux fils frères quand le fil appelant le porte — ce qui évite l’incohérence d’un fil confiné et d’un fil qui peut encore élever ses privilèges.

Le noyau dit qu’il « écrase » la configuration des fils frères, quels que soient les domaines déjà établis sur eux. Ce que cela fait exactement d’un fil frère plus strictement confiné est vérifié par un test dédié plutôt que supposé — c’est la différence entre borner et croire borner.

Implementations

impl LandlockRestrictFlags

pub const LOG_SAME_EXEC_OFF: Self

Ne journalise pas les refus venant du fil qui crée le domaine, ni de ses enfants tant qu’ils exécutent le même code (ABI v7).

pub const LOG_NEW_EXEC_ON: Self

Journalise les refus après un execve dans le domaine créé (ABI v7).

pub const LOG_SUBDOMAINS_OFF: Self

Ne journalise pas les refus venant des sous-domaines créés par l’appelant ou ses descendants (ABI v7).

pub const TSYNC: Self

Applique la configuration à tous les fils du processus, atomiquement.

impl LandlockRestrictFlags

pub const fn empty() -> Self

Get a flags value with all bits unset.

pub const fn all() -> Self

Get a flags value with all known bits set.

pub const fn bits(&self) -> u32

Get the underlying bits value.

The returned value is exactly the bits set in this flags value.

pub const fn from_bits(bits: u32) -> Option<Self>

Convert from a bits value.

This method will return None if any unknown bits are set.

pub const fn from_bits_truncate(bits: u32) -> Self

Convert from a bits value, unsetting any unknown bits.

pub const fn from_bits_retain(bits: u32) -> Self

Convert from a bits value exactly.

pub fn from_name(name: &str) -> Option<Self>

Get a flags value with the bits of a flag with the given name set.

This method will return None if name is empty or doesn’t correspond to any named flag.

pub const fn is_empty(&self) -> bool

Whether all bits in self are unset.

pub const fn is_all(&self) -> bool

Whether all known bits in this flags value are set.

pub const fn intersects(&self, other: Self) -> bool

Whether any set bits in other are also set in self.

pub const fn contains(&self, other: Self) -> bool

Whether all set bits in other are also set in self.

pub fn insert(&mut self, other: Self)

The bitwise or (|) of the bits in self and other.

pub fn remove(&mut self, other: Self)

The intersection of self with the complement of other (&!).

This method is not equivalent to self & !other when other has unknown bits set. remove won’t truncate other, but the ! operator will.

pub fn toggle(&mut self, other: Self)

The bitwise exclusive-or (^) of the bits in self and other.

pub fn set(&mut self, other: Self, value: bool)

Call insert when value is true or remove when value is false.

pub const fn intersection(self, other: Self) -> Self

The bitwise and (&) of the bits in self and other.

pub const fn union(self, other: Self) -> Self

The bitwise or (|) of the bits in self and other.

pub const fn difference(self, other: Self) -> Self

The intersection of self with the complement of other (&!).

This method is not equivalent to self & !other when other has unknown bits set. difference won’t truncate other, but the ! operator will.

pub const fn symmetric_difference(self, other: Self) -> Self

The bitwise exclusive-or (^) of the bits in self and other.

pub const fn complement(self) -> Self

The bitwise negation (!) of the bits in self, truncating the result.

impl LandlockRestrictFlags

pub const fn iter(&self) -> Iter<LandlockRestrictFlags>

Yield a set of contained flags values.

Each yielded flags value will correspond to a defined named flag. Any unknown bits will be yielded together as a final flags value.

pub const fn iter_names(&self) -> IterNames<LandlockRestrictFlags>

Yield a set of contained named flags values.

This method is like iter, except only yields bits in contained named flags. Any unknown bits, or bits not corresponding to a contained flag will not be yielded.

Trait Implementations

impl Binary for LandlockRestrictFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl BitAnd for LandlockRestrictFlags

fn bitand(self, other: Self) -> Self

The bitwise and (&) of the bits in self and other.

type Output = LandlockRestrictFlags

The resulting type after applying the & operator.

impl BitAndAssign for LandlockRestrictFlags

fn bitand_assign(&mut self, other: Self)

The bitwise and (&) of the bits in self and other.

impl BitOr for LandlockRestrictFlags

fn bitor(self, other: LandlockRestrictFlags) -> Self

The bitwise or (|) of the bits in self and other.

type Output = LandlockRestrictFlags

The resulting type after applying the | operator.

impl BitOrAssign for LandlockRestrictFlags

fn bitor_assign(&mut self, other: Self)

The bitwise or (|) of the bits in self and other.

impl BitXor for LandlockRestrictFlags

fn bitxor(self, other: Self) -> Self

The bitwise exclusive-or (^) of the bits in self and other.

type Output = LandlockRestrictFlags

The resulting type after applying the ^ operator.

impl BitXorAssign for LandlockRestrictFlags

fn bitxor_assign(&mut self, other: Self)

The bitwise exclusive-or (^) of the bits in self and other.

impl Clone for LandlockRestrictFlags

fn clone(&self) -> LandlockRestrictFlags

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for LandlockRestrictFlags

impl Debug for LandlockRestrictFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LandlockRestrictFlags

fn default() -> LandlockRestrictFlags

Returns the “default value” for a type.

impl Eq for LandlockRestrictFlags

impl Extend<LandlockRestrictFlags> for LandlockRestrictFlags

fn extend<T: IntoIterator<Item = Self>>(&mut self, iterator: T)

The bitwise or (|) of the bits in each flags value.

fn extend_one(&mut self, item: A)

🔬This is a nightly-only experimental API. (extend_one)

Extends a collection with exactly one element.

fn extend_reserve(&mut self, additional: usize)

🔬This is a nightly-only experimental API. (extend_one)

Reserves capacity in a collection for the given number of additional elements.

impl Flags for LandlockRestrictFlags

const FLAGS: &'static [Flag<LandlockRestrictFlags>]

The set of defined flags.

type Bits = u32

The underlying bits type.

fn bits(&self) -> u32

Get the underlying bits value.

fn from_bits_retain(bits: u32) -> LandlockRestrictFlags

Convert from a bits value exactly.

fn empty() -> Self

Get a flags value with all bits unset.

fn all() -> Self

Get a flags value with all known bits set.

fn known_bits(&self) -> Self::Bits

Get the known bits from a flags value.

fn unknown_bits(&self) -> Self::Bits

Get the unknown bits from a flags value.

fn contains_unknown_bits(&self) -> bool

This method will return true if any unknown bits are set.

fn from_bits(bits: Self::Bits) -> Option<Self>

Convert from a bits value.

fn from_bits_truncate(bits: Self::Bits) -> Self

Convert from a bits value, unsetting any unknown bits.

fn from_name(name: &str) -> Option<Self>

Get a flags value with the bits of a flag with the given name set.

fn iter(&self) -> Iter<Self>

Yield a set of contained flags values.

fn iter_names(&self) -> IterNames<Self>

Yield a set of contained named flags values.

fn iter_defined_names() -> IterDefinedNames<Self>

Yield a set of all named flags defined by [Self::FLAGS].

fn is_empty(&self) -> bool

Whether all bits in this flags value are unset.

fn is_all(&self) -> bool

Whether all known bits in this flags value are set.

fn intersects(&self, other: Self) -> bool

where Self: Sized,

Whether any set bits in other are also set in self.

fn contains(&self, other: Self) -> bool

where Self: Sized,

Whether all set bits in other are also set in self.

fn truncate(&mut self)

where Self: Sized,

Remove any unknown bits from the flags.

fn insert(&mut self, other: Self)

where Self: Sized,

The bitwise or (|) of the bits in self and other.

fn remove(&mut self, other: Self)

where Self: Sized,

The intersection of self with the complement of other (&!).

fn toggle(&mut self, other: Self)

where Self: Sized,

The bitwise exclusive-or (^) of the bits in self and other.

fn set(&mut self, other: Self, value: bool)

where Self: Sized,

Call [Flags::insert] when value is true or [Flags::remove] when value is false.

fn clear(&mut self)

where Self: Sized,

Unsets all bits in the flags.

fn intersection(self, other: Self) -> Self

The bitwise and (&) of the bits in self and other.

fn union(self, other: Self) -> Self

The bitwise or (|) of the bits in self and other.

fn difference(self, other: Self) -> Self

The intersection of self with the complement of other (&!).

fn symmetric_difference(self, other: Self) -> Self

The bitwise exclusive-or (^) of the bits in self and other.

fn complement(self) -> Self

The bitwise negation (!) of the bits in self, truncating the result.

impl FromIterator<LandlockRestrictFlags> for LandlockRestrictFlags

fn from_iter<T: IntoIterator<Item = Self>>(iterator: T) -> Self

The bitwise or (|) of the bits in each flags value.

impl Hash for LandlockRestrictFlags

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl IntoIterator for LandlockRestrictFlags

type Item = LandlockRestrictFlags

The type of the elements being iterated over.

type IntoIter = Iter<LandlockRestrictFlags>

Which kind of iterator are we turning this into?

fn into_iter(self) -> Self::IntoIter

Creates an iterator from a value.

impl LowerHex for LandlockRestrictFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Not for LandlockRestrictFlags

fn not(self) -> Self

The bitwise negation (!) of the bits in self, truncating the result.

type Output = LandlockRestrictFlags

The resulting type after applying the ! operator.

impl Octal for LandlockRestrictFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for LandlockRestrictFlags

fn eq(&self, other: &LandlockRestrictFlags) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PublicFlags for LandlockRestrictFlags

type Primitive = u32

The type of the underlying storage.

type Internal = InternalBitFlags

The type of the internal field on the generated flags type.

impl StructuralPartialEq for LandlockRestrictFlags

impl Sub for LandlockRestrictFlags

fn sub(self, other: Self) -> Self

The intersection of self with the complement of other (&!).

This method is not equivalent to self & !other when other has unknown bits set. difference won’t truncate other, but the ! operator will.

type Output = LandlockRestrictFlags

The resulting type after applying the - operator.

impl SubAssign for LandlockRestrictFlags

fn sub_assign(&mut self, other: Self)

The intersection of self with the complement of other (&!).

This method is not equivalent to self & !other when other has unknown bits set. difference won’t truncate other, but the ! operator will.

impl UpperHex for LandlockRestrictFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.