restricted

This library lets you limit which system operations and which parts of the filesystem your program can access. Call it as early as possible in your program so that the rest of the code runs with reduced privileges. Currently, actual enforced restrictions are implemented for these operating systems:

• OpenBSD
• Linux (only filesystem view)

Even on other operating systems, you can still use restricted to document which privileges your program needs. Users can then test if your program respects these promises with tools such as pledge on Linux. Enjoy :)

Usage and Examples

opam install restricted

API Documentation

• basic functionality example
• file reading and writing example
  • file reading and writing example linux
• networking example
• calling other process

Contribute

Feel free to open issues and pull requests, especially tests are more than welcome.

Dependencies

• for build and installation: OCaml, Dune
• for development: OCaml, Dune, ppx_inline_test, ocamlformat, make, shellcheck, shfmt

inspired by

• https://codeberg.org/semarie/ocaml-openbsd
• https://www.openbsd.org/

Thanks.

LICENSE

This work is licensed only under the GNU Affero General Public License version 3 (AGPLv3). See the LICENSE file for details.