The unsafe code uses libc API. All FFI functions are unsafe because they do not have compiler-enforced memory safety and other invariants (by definition of not

The unsafe code uses libc API. All FFI functions are unsafe because they do not have compiler-enforced memory safety and other invariants (by definition of not being written in Rust themselves). It is the onus of the caller to read their docs and ensure that their Rust calling code does maintain those invariants before exiting the unsafe block. The crate also has a nice design decision to have a dedicated module for using these FFI functions, and unsafe is only allowed in this module. The rest of the crate errors if it has any unsafe code.