View Source Pledge (pledge v0.0.1)

This module provides an interface to the pledge(2) system call.

pledge(2) restricts operations the current operating system process (the BEAM) can perform. It is possible to crash the BEAM by restricting access to required resources.

Link to this section Summary

Types

A space separated string. See pledge(2) for details.

A space separated string. See pledge(2) for details.

Functions

Calls pledge with both promises and execpromises.

Calls pledge with specific execpromises.

Calls pledge with specific promises.

Link to this section Types

@type execpromises() :: String.t()

A space separated string. See pledge(2) for details.

@type pledge_result() ::
  :ok
  | {:error, :einval}
  | {:error, :eperm}
  | {:error, :efault}
  | {:error, :error}

The shape of the result for pledge/2, pledge_promises/1, and pledge_execpromises/1.

@type promises() :: String.t()

A space separated string. See pledge(2) for details.

Link to this section Functions

Link to this function

pledge(promises, execpromises)

View Source
@spec pledge(String.t(), String.t()) :: pledge_result()

Calls pledge with both promises and execpromises.

WARNING: Calling this with some promises can result in the BEAM being killed!

Basic usage:

:ok = pledge("stdio rpath wpath cpath vminfo ps error", "exec")

Errors defined in the manual are exposed via atoms.

{:error, :einval} = pledge("invalid_promise", "exec")
Link to this function

pledge_execpromises(execpromises)

View Source
@spec pledge_execpromises(String.t()) :: pledge_result()

Calls pledge with specific execpromises.

Link to this function

pledge_promises(promises)

View Source
@spec pledge_promises(String.t()) :: pledge_result()

Calls pledge with specific promises.