Enum PolicyParseError 

pub enum PolicyParseError {
    Yaml(String),
    InvalidCapability {
        raw: String,
        reason: String,
    },
    InvalidSyscall {
        raw: String,
        reason: String,
    },
    UnknownKey {
        path: String,
        key: String,
    },
    EmptyDocument,
    NoEnforcementSection,
}

Errors that can occur while parsing a PolicyDocument.

Variants

Yaml(String)

The YAML could not be deserialized.

InvalidCapability

A capability token was not recognised.

Fields

raw: String

The offending raw token.

reason: String

Why it was rejected.

InvalidSyscall

A syscall name in the syscalls.allow list was not recognised.

Fields

raw: String

The offending raw token.

reason: String

Why it was rejected.

UnknownKey

A structural key was not part of the known policy schema.

Raised when a security-relevant section or field is misspelled (e.g. dney: for deny:, allow_list: for allowlist:). Such typos would otherwise be silently dropped by #[serde(flatten)] — yielding an empty, permissive policy that parses successfully. Surfacing them keeps policy parsing fail-closed (AAASM-3874).

Fields

path: String

Dotted path to the mapping that contained the unknown key.

key: String

The unrecognised key.

EmptyDocument

The document was empty or null.

An empty / null / {} policy deserializes to an all-None document, which is fully permissive (no capability denials, no allowlist, no tool gating). A policy must positively declare its posture, so a blank document is rejected rather than silently defaulting open (AAASM-3997).

NoEnforcementSection

The document parsed but declared no enforcement dimension.

A metadata-only document (e.g. just apiVersion/kind/metadata, with no network, capabilities, tools, or syscalls) deserializes to a fully-permissive policy exactly like an empty one. It is rejected so a policy cannot become open by omission rather than by declaration (AAASM-4020, extending the AAASM-3997 empty/null floor).

Trait Implementations

impl Clone for PolicyParseError

fn clone(&self) -> PolicyParseError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyParseError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PolicyParseError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PolicyParseError

impl Error for PolicyParseError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for PolicyParseError

fn eq(&self, other: &PolicyParseError) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for PolicyParseError