Struct Confinement 

pub struct Confinement {
    pub filesystem: Enforcement,
    pub network: Enforcement,
    pub process: Enforcement,
    pub environment: Enforcement,
    pub secret: Enforcement,
}

What a tier actually enforces, per domain, on this host.

Per host, not per tier in the abstract: the subprocess tier confines a filesystem grant with a preopened directory everywhere, and confines a network grant only where the operating system will give it a network namespace. Reporting the abstract answer would be reporting the answer for somebody else’s machine.

Fields

filesystem: Enforcement

fs:* — reading, listing, writing files.

network: Enforcement

net:* — reaching anything off this machine.

process: Enforcement

proc:* — starting other programs.

environment: Enforcement

env:* — reading the environment.

secret: Enforcement

secret:* — using a credential.

Implementations

impl Confinement

pub const NONE: Self

A tier that enforces nothing. The floor to build from, so a tier claims enforcement only by saying so.

pub const fn of(&self, domain: &str) -> Enforcement

How this tier confines the given grant domain.

An unknown domain is Enforcement::None. The grant vocabulary is meant to grow (KNOWN_DOMAINS says so), and a tier that treated a domain it had never heard of as confined would be guessing in the one direction that is unsafe.

pub const fn domains(&self) -> [(&'static str, Enforcement); 5]

Each domain and how it is confined, weakest-enforced domains included.

pub fn enforces_nothing(&self) -> bool

Whether nothing at all is enforced.

Not the same as saying nothing: a tier that reports this has been asked and has answered “none”, which is exactly the fact a reviewer of a Profile C run came looking for.

pub fn unenforceable<'g>(&self, grants: &'g GrantSet) -> Option<&'g GrantAtom>

The first atom of grants this tier cannot enforce, if there is one.

What a tier refuses a capability set on: a grant nothing enforces is an advisory permission, and handing one over would make the compiler’s proof false at run time.

Trait Implementations

impl Clone for Confinement

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Confinement

impl Debug for Confinement

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Confinement

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for Confinement

fn fmt(&self, f: &mut Formatter<'_>) -> Result

fs=kernel net=none proc=interposed env=kernel secret=interposed.

Every domain, every time, including the ones enforcing nothing. A rendering that omitted them would make “not confined” and “not mentioned” look the same, which is the distinction this type exists to keep.

impl Eq for Confinement

impl PartialEq for Confinement

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Confinement

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Confinement