Struct NamespaceReading 

pub struct NamespaceReading {
    pub network: Result<(), NamespaceAttemptError>,
    pub mount: MountAttempt,
    pub sealed_root: MountAttempt,
    pub private_proc: MountAttempt,
    pub userns_grant: UsernsGrant,
    pub attachment: ProfileAttachment,
}

The host’s namespaces as one probe found them: the three attempts, in the order a session makes them, and the two readings a refusal is worded from.

Off Linux nothing is attempted and nothing fails: network is Ok(()) because no attempt failed — there is no network namespace to create — and both mount attempts are MountAttempt::NotAttempted. Every question asked of the reading therefore answers that no namespace was created and none was refused: Self::mount_namespace_created and Self::sealed_root_created are false and Self::egress_namespace_failure is None.

Fields

network: Result<(), NamespaceAttemptError>

The session’s network namespace creation.

mount: MountAttempt

The private mount namespace a command’s /tmp mapping builds, inside the network namespace.

sealed_root: MountAttempt

The composed root’s nested user+mount namespace and pivot_root(2), inside the network namespace.

private_proc: MountAttempt

A private procfs mounted over /proc by a process forked into the session’s PID namespace, in its own mount namespace: what decides [crate::proc_view::proc_view].

userns_grant: UsernsGrant

AppArmor’s unprivileged-userns restriction as read with the attempts. Words a refusal; decides nothing.

attachment: ProfileAttachment

The profile the kernel reports as confining this process, read with the attempts. Words a refusal; decides nothing.

Implementations

impl NamespaceReading

pub fn not_linux() -> Self

The reading of a host that is not Linux. See the type’s documentation.

pub fn egress_namespace_failure(&self) -> Option<EgressNamespaceFailure>

The E-CAP-005 failure the network attempt is, or None when it created the namespace (or, off Linux, when there was none to create).

pub fn mount_namespace_created(&self) -> bool

Whether a command can get a private mount namespace inside the session’s user namespace, which is what maps its literal /tmp.

pub fn private_proc_created(&self) -> bool

Whether a command can mount a private procfs of the session’s PID namespace over /proc.

pub fn sealed_root_created(&self) -> bool

Whether the composed root sealed runs in was built: the nested user+mount namespace, its mounts and pivot_root(2).

pub fn user_mount_namespace_usable(&self) -> bool

Whether a user+mount namespace, its identity maps and private propagation can be created inside the session’s namespace — the sealed-root rehearsal got past MountStep::MakePrivateNested. What a test that builds a bind mount in its own user+mount namespace needs to ask.

pub fn first_failure(&self) -> Option<String>

The first attempt that failed, as <call> failed with <ERRNO> or the runtime’s account, or None when none did.

Trait Implementations

impl Clone for NamespaceReading

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NamespaceReading

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for NamespaceReading

impl PartialEq for NamespaceReading

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for NamespaceReading