package restricted

You can search for identifiers within the package.

in-package search v0.2.0

Limit which system operations and which parts of the filesystem your program can access

Install

dune-project

Dependency

codeberg.org Readme Changelog Edit opam file Versions (3)

Authors

R

Remove Wingman <ocaml@rw8.addy.io>

Maintainers

R

Remove Wingman <ocaml@rw8.addy.io>

Sources

ocaml-restricted-2.0.0.tar.gz

md5=6547cefcfc520d4fe31e1f254e53459b

sha512=3b48e8a135dd1b72549245e986ee7b03330a7eb97ca42e6acbb23dc8ef2319287e41953ee84954aa431530a8e8508a45596838e7dfa676c1859b5a131932dbdc

doc/restricted/Restricted/index.html

Module `Restricted`Source

Main entry point to restrict your program

Sourcemodule SystemOperation : sig ... end

System operation abstraction: OpenBSD: pledge(2)ndex-pledge man:pledge(2) Linux: seccomp(2)ndex-seccomp man:seccomp(2)

Sourcemodule PathAccess : sig ... end

Path Access abstraction: OpenBSD: unveil(2)ndex-pledge man:unveil(2) Linux: landlock(7)ndex-seccomp man:landlock(7)

Sourcemodule PathPermission : sig ... end

path permission: OpenBSD: unveil(2) Linux: landlock(7)

Source

val run : 
  system_operations:Restricted__.Types.SystemOperation.t list ->
  ?exec_system_operations:Restricted__.Types.SystemOperation.t list ->
  ?accesses:Restricted__.Types.PathAccess.t list ->
  (unit -> unit) ->
  unit

run ~system_operations ?exec_system_operations ?accesses f executes f with the given restrictions where f is the program to run.

parameter system_operations
allowed system calls

parameter exec_system_operations
allowed system calls after exec

parameter accesses
allowed filesystem view

raises Failure
if system_operations:SystemOperation or exec_system_operations:SystemOperation has same value twice or if accesses:PathAccess.permissions has same value twice or if accesses:PathAccess.permissions is empty.