setcred

A Rust interface to FreeBSD's setcred(2) syscall for atomic credential management.

Ported from: 0x1eef/bsd by 0x1eef

Usage

FreeBSD only. Requires elevated privileges.

use setcred::Creds;
use std::io;
use std::net::TcpListener;

fn main() -> io::Result<()> {
    // Bind to a privileged port as root
    let listener = TcpListener::bind(("127.0.0.1", 80))?;

    // Drop all privileges atomically (recommended)
    Creds::drop_priv(1000, 1000, &[1000]).apply()?;

    // Carry on without privileges
    Ok(())
}

The drop_priv() method sets all six IDs atomically to prevent privilege escalation.

Example

See examples/daemon.rs for a complete daemon implementation with verification.

cargo run --example daemon  # Requires FreeBSD + root

Documentation

https://docs.rs/setcred

License

BSD Zero Clause License (0BSD)

Copyright (C) Shannon Skipper

Copyright (C) 0x1eef 0x1eef@proton.me