Enum ABI

#[non_exhaustive]
pub enum ABI {
    Unsupported = 0,
    V1 = 1,
    V2 = 2,
    V3 = 3,
    V4 = 4,
    V5 = 5,
    V6 = 6,
}

Version of the Landlock ABI.

ABI enables getting the features supported by a specific Landlock ABI (without relying on the kernel version which may not be accessible or patched). For example, AccessFs::from_all(ABI::V1) gets all the file system access rights defined by the first version.

Without ABI, it would be hazardous to rely on the the full set of access flags (e.g., BitFlags::<AccessFs>::all() or BitFlags::ALL), a moving target that would change the semantics of your Landlock rule when migrating to a newer version of this crate. Indeed, a simple cargo update or cargo install run by any developer can result in a new version of this crate (fixing bugs or bringing non-breaking changes). This crate cannot give any guarantee concerning the new restrictions resulting from these unknown bits (i.e. access rights) that would not be controlled by your application but by a future version of this crate instead. Because we cannot know what the effect on your application of an unknown restriction would be when handling an untested Landlock access right (i.e. denied-by-default access), it could trigger bugs in your application.

This crate provides a set of tools to sandbox as much as possible while guaranteeing a consistent behavior thanks to the Compatible methods. You should also test with different relevant kernel versions, see landlock-test-tools and CI integration.

This way, we can have the guarantee that the use of a set of tested Landlock ABI works as expected because features brought by newer Landlock ABI will never be enabled by default (cf. Linux kernel compatibility contract).

In a nutshell, test the access rights you request on a kernel that support them and on a kernel that doesn’t support them.

Derived Debug formats are not stable.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Unsupported = 0

Kernel not supporting Landlock, either because it is not built with Landlock or Landlock is not enabled at boot.

V1 = 1

First Landlock ABI, introduced with Linux 5.13.

V2 = 2

Second Landlock ABI, introduced with Linux 5.19.

V3 = 3

Third Landlock ABI, introduced with Linux 6.2.

V4 = 4

Fourth Landlock ABI, introduced with Linux 6.7.

V5 = 5

Fifth Landlock ABI, introduced with Linux 6.10.

V6 = 6

Sixth Landlock ABI, introduced with Linux 6.12.

Trait Implementations

impl Clone for ABI

fn clone(&self) -> ABI

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ABI

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<i32> for ABI

Converting from an integer to an ABI should only be used for testing. Indeed, manually setting the ABI can lead to inconsistent and unexpected behaviors. Instead, just use the appropriate access rights, this library will handle the rest.

fn from(value: i32) -> ABI

Converts to this type from the input type.

impl Ord for ABI

fn cmp(&self, other: &ABI) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for ABI

fn eq(&self, other: &ABI) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for ABI

fn partial_cmp(&self, other: &ABI) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Copy for ABI

impl Eq for ABI

impl StructuralPartialEq for ABI