"extrasafe" 0.1 released - make your code extra safe with seccomp

Hi, I made a wrapper around libseccomp that provides some easy-to-use defaults.

Seccomp is a linux kernel feature that allows you to tell the kernel "my program isn't going to use these syscalls," providing an extra layer of security. Seccomp is used by chrome, systemd, docker, and other programs that handle untrusted input.

fn main() {
    println!("disabling syscalls...");

    extrasafe::SafetyContext::new()
        .enable(
           extrasafe::builtins::SystemIO::nothing()
              .allow_stdout()
              .allow_stderr()

\t ).unwrap()
\t .apply_to_all_threads().unwrap();

    // Opening files now fails!
    let res = File::create("should_fail.txt");
    assert!(res.is_err());
    
    println!("but printing to stdout still works!");
    eprintln!("and so does stderr!");
}

https://crates.io/crates/extrasafe
https://github.com/boustrophedon/extrasafe
Check it out if you have some time! (Also, I'm currently looking for a job if you want to hire me)