pub fn path_beneath_rules<I, P, A>(
    paths: I,
    access: A
) -> impl Iterator<Item = Result<PathBeneath<PathFd>, RulesetError>>
where I: IntoIterator<Item = P>, P: AsRef<Path>, A: Into<BitFlags<AccessFs>>,
Expand description

Helper to quickly create an iterator of PathBeneath rules.

Silently ignores paths that cannot be opened, and automatically adjust access rights according to file types when possible.


use landlock::{
    ABI, Access, AccessFs, Ruleset, RulesetAttr, RulesetCreatedAttr, RulesetStatus, RulesetError,

fn restrict_thread() -> Result<(), RulesetError> {
    let abi = ABI::V1;
    let status = Ruleset::default()
        // Read-only access to /usr, /etc and /dev.
        .add_rules(path_beneath_rules(&["/usr", "/etc", "/dev"], AccessFs::from_read(abi)))?
        // Read-write access to /home and /tmp.
        .add_rules(path_beneath_rules(&["/home", "/tmp"], AccessFs::from_all(abi)))?
    match status.ruleset {
        // The FullyEnforced case must be tested by the developer.
        RulesetStatus::FullyEnforced => println!("Fully sandboxed."),
        RulesetStatus::PartiallyEnforced => println!("Partially sandboxed."),
        // Users should be warned that they are not protected.
        RulesetStatus::NotEnforced => println!("Not sandboxed! Please update your kernel."),