Enum AccessNet 

#[non_exhaustive]
#[repr(u64)]
pub enum AccessNet {
    BindTcp = 1,
    ConnectTcp = 2,
    BindUdp = 4,
    ConnectSendUdp = 8,
}

Network access right.

Each variant of AccessNet is an access right for the network. A set of access rights can be created with BitFlags<AccessNet>.

Example

use landlock::{ABI, Access, AccessNet, BitFlags, make_bitflags};

let bind = AccessNet::BindTcp;

let bind_set: BitFlags<AccessNet> = bind.into();

let bind_connect = make_bitflags!(AccessNet::{BindTcp | ConnectTcp});

let net_v4 = AccessNet::from_all(ABI::V4);

assert_eq!(bind_connect, net_v4);

Warning

To avoid unknown restrictions don’t use BitFlags::<AccessNet>::all() nor BitFlags::ALL, but use a version you tested and vetted instead, for instance AccessNet::from_all(ABI::V4). Direct use of the BitFlags API is deprecated. See ABI for the rationale and help to test it.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

BindTcp = 1

Bind to a TCP port.

ConnectTcp = 2

Connect to a TCP port.

BindUdp = 4

Bind to a UDP port.

This also covers the implicit bind to an ephemeral port performed by the kernel when setting the remote peer of a socket or sending a first datagram from an unbound socket. See AccessNet::ConnectSendUdp.

ConnectSendUdp = 8

Set the remote port of a UDP socket with connect(2), or send a datagram to an explicit remote port with e.g. sendto(2) or sendmsg(2), ignoring any destination already pre-set on the socket.

Because the kernel auto-binds an unbound UDP socket to an ephemeral local port when doing so, a ruleset handling both this right and AccessNet::BindUdp must also allow that bind: either grant AccessNet::BindUdp on port 0 (i.e. any ephemeral port), or grant it on a specific port and bind(2) that port first, or use a socket bound before the ruleset was enforced.

Note that sending a datagram to an AF_UNSPEC destination address family is not supported for IPv6 UDP sockets; a NULL address must be used instead.

Trait Implementations

impl Access for AccessNet

Warning

If ABI <= ABI::V3, AccessNet::from_all() returns an empty BitFlags<AccessNet>, which makes Ruleset::handle_access(AccessNet::from_all(ABI::V3)) return an error.

fn from_all(abi: ABI) -> BitFlags<Self>

Gets the access rights defined by a specific ABI.

impl BitAnd for AccessNet

type Output = BitFlags<AccessNet>

The resulting type after applying the & operator.

fn bitand(self, other: Self) -> Self::Output

Performs the & operation.

impl BitFlag for AccessNet

fn empty() -> BitFlags<Self>

Create a BitFlags with no flags set (in other words, with a value of 0).

fn all() -> BitFlags<Self>

Create a BitFlags with all flags set.

fn from_bits(bits: Self::Numeric) -> Result<BitFlags<Self>, FromBitsError<Self>>

Create a BitFlags if the raw value provided does not contain any illegal flags.

fn from_bits_truncate(bits: Self::Numeric) -> BitFlags<Self>

Create a BitFlags from an underlying bitwise value. If any invalid bits are set, ignore them.

unsafe fn from_bits_unchecked(bits: Self::Numeric) -> BitFlags<Self>

Create a BitFlags unsafely, without checking if the bits form a valid bit pattern for the type.

impl BitOr for AccessNet

type Output = BitFlags<AccessNet>

The resulting type after applying the | operator.

fn bitor(self, other: Self) -> Self::Output

Performs the | operation.

impl BitXor for AccessNet

type Output = BitFlags<AccessNet>

The resulting type after applying the ^ operator.

fn bitxor(self, other: Self) -> Self::Output

Performs the ^ operation.

impl Clone for AccessNet

fn clone(&self) -> AccessNet

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AccessNet

impl Debug for AccessNet

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AccessNet

impl HandledAccess for AccessNet

impl Not for AccessNet

type Output = BitFlags<AccessNet>

The resulting type after applying the ! operator.

fn not(self) -> Self::Output

Performs the unary ! operation.

impl PartialEq for AccessNet

fn eq(&self, other: &AccessNet) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl RawBitFlags for AccessNet

const EMPTY: <Self as RawBitFlags>::Numeric = 0

A value with no bits set.

const DEFAULT: <Self as RawBitFlags>::Numeric = 0

The value used by the Default implementation. Equivalent to EMPTY, unless customized.

const ALL_BITS: <Self as RawBitFlags>::Numeric

A value with all flag bits set.

const BITFLAGS_TYPE_NAME: &'static str = "BitFlags<AccessNet>"

The name of the type for debug formatting purposes.

type Numeric = u64

The underlying integer type.

fn bits(self) -> <Self as RawBitFlags>::Numeric

Return the bits as a number type.

impl Rule<AccessNet> for NetPort

impl StructuralPartialEq for AccessNet