Restricted - limit possible system operations and filesystem view of your program

Showcase
1

Hello,

I would like to announce a new package restricted.

This library lets you limit which system operations and which parts of the filesystem your program can access. Call it as early as possible in your program so that the rest of the code runs with reduced privileges. Currently, actual enforced restrictions are implemented for these operating systems:

  • OpenBSD

Even on other operating systems, you can still use restricted to document which privileges your program needs. Users can then test if your program respects these promises with tools such as pledge on Linux. Enjoy :slight_smile:

PS: Thanks for the awesome language and especially the simple tooling
PS 2: Thanks for trying to get rid off llvm in the long run, it is so annoying

2 Likes
2

2.0.0 - 2026-08-12

  • tested on:
    • x86_64 openbsd (16/16 Tests passed)
    • x86_64 alpine linux (0/0 Tests passed)

Changed

  • Update to latest Zig 0.17.0-dev version

Added

  • API: exec promises
  • OpenBSD: exec promises tests

Removed

  • SystemOperation.TmpPath (deprecated see: pledge (2))

Example for reading file:

const std = @import("std");
const restricted = @import("restricted");

const Error = error{WrongContent};

const file_name = "read_me.txt";

pub fn main(init: std.process.Init) !void {
    try restricted.restrict(
        &[_]restricted.SystemOperation{
            .StdinStdoutStderrAndBasicFunctionality,
            .ReadFromFilesystem,
        },
        &[_]restricted.SystemOperation{},
        &[_]restricted.PathAccess{.{ .path = file_name, .permissions = &[_]restricted.PathPermission{
            .Read,
        } }},
        init.gpa,
    );
    var stdin_buffer: [1024]u8 = undefined;
    const file_content = try std.Io.Dir.cwd().readFile(init.io, file_name, &stdin_buffer);
    const expected_content = "simplicity\n";
    if (!std.mem.eql(u8, expected_content, file_content)) {
        std.log.err("did read wrong content: {s}", .{file_content[0..]});
        return Error.WrongContent;
    }
}
1 Like