Struct SandboxPolicy 

pub struct SandboxPolicy {
    pub backends: BackendToggles,
    pub child_network: ChildNetworkPolicy,
    pub base_read_paths: PathList,
    pub bin_read_paths: PathList,
    pub device_sink_paths: PathList,
    pub loader_paths: PathList,
    pub loopback_hosts: Vec<String>,
    pub landlock_abi_floor: u32,
    pub landlock_net_abi_floor: u32,
}

Sandbox path lists + ABI floors (sandbox.rs constants).

Fields

backends: BackendToggles

Backend enable/require toggles.

child_network: ChildNetworkPolicy

Direct child network-socket confinement beyond the Landlock TCP rule (ChildNetworkPolicy). #[serde(default)] so configs written before this field existed keep parsing (they get LandlockOnly).

base_read_paths: PathList

Read base when fs_read restricted (BASE_READ_PATHS).

bin_read_paths: PathList

Executable dirs read-allowed only when exec is ambient (BIN_READ_PATHS).

device_sink_paths: PathList

Device sinks that are ALWAYS openable read+write inside the jail (#1220): discard/zero devices carry no authority, and tools open them as plumbing — git opens /dev/null O_RDWR and dies inside a confined child otherwise. Folded into every write ruleset/profile regardless of the granted fs_write scope. #[serde(default)] so configs written before this field existed keep parsing (they get the defaults).

loader_paths: PathList

Execute allow-list: the dynamic loader files only (LOADER_PATHS).

loopback_hosts: Vec<String>

Loopback identifiers for the net axis (LOOPBACK_HOSTS).

landlock_abi_floor: u32

Minimum Landlock ABI (ABI_FLOOR).

landlock_net_abi_floor: u32

Minimum Landlock ABI for TCP net rules (NET_ABI_FLOOR).

Trait Implementations

impl Clone for SandboxPolicy

fn clone(&self) -> SandboxPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SandboxPolicy

fn default() -> SandboxPolicy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SandboxPolicy

fn deserialize<__D>( __deserializer: __D, ) -> Result<SandboxPolicy, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SandboxPolicy

impl PartialEq for SandboxPolicy

fn eq(&self, other: &SandboxPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SandboxPolicy

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SandboxPolicy