Struct HostProbe 

pub struct HostProbe { /* private fields */ }

The host facts the tier decision is made from, taken together as one reading.

A staged session takes exactly one of these and every consumer of that session reads it — the containment-floor refusal, the ScopeReport written to the trace, the /tmp mapping, the E-CAP-005 check at staging and at launch, and the tier [ShellEnforcement::resolve] installs. Two readings of a host that changed between them would let the trace describe a session that never ran under what it claims.

Implementations

impl HostProbe

pub fn probe() -> HostProbe

Reads the host as it is right now: on Linux a real Landlock ruleset restriction attempt (RulesetStatus::FullyEnforced → Some(true), PartiallyEnforced/NotEnforced or any construction error → Some(false), no Landlock ABI → None) plus crate::namespace_probe’s three attempts: the session’s network namespace, a command’s private mount namespace inside it, and the composed root’s nested namespace and pivot. Off Linux it probes nothing and claims nothing.

Taken once per staged session, not once per process. That is affordable because both halves do their work in a forked child and leave the calling process exactly as they found it — linux_enforce::probe_landlock_full_access forks so the runtime is never placed into a Landlock domain by a capability check, and the namespace probe forks because unshare(CLONE_NEWUSER) is irreversible for the task that calls it. Neither is idempotency-sensitive, so a reading costs no more than the syscalls it makes: four fork/waitpid pairs and three small /proc reads.

The window this leaves open is one session wide. Between runtime::stage_session and the last subprocess that session spawns the host is not re-read; a change inside that window is caught by the mechanism installation itself failing closed, not by a second probe. A process that stages repeatedly — mur eval, which stages once per dataset case — judges each session against the host as it was when that session was staged.

pub fn namespaces(&self) -> &NamespaceReading

What the namespace probe attempted, and the readings it took with the attempts.

pub fn egress_namespace_failure(&self) -> Option<EgressNamespaceFailure>

The E-CAP-005 failure this reading’s network attempt is, or None when it created the namespace (and always off Linux).

pub fn sealed_shortfall(&self) -> Option<SealedShortfall>

Why this reading cannot back sealed, or None when nothing keeps it below. None exactly when Self::tier is KernelSealed.

pub fn userns_grant(&self) -> Option<UsernsGrant>

Where this host’s permission to create an unprivileged user namespace comes from, or None off Linux, where the question has no answer rather than a negative one.

pub fn landlock_kernel_abi(&self) -> Option<u8>

The kernel’s Landlock ABI version, or None when the kernel has no Landlock (off Linux always). The ABI the session’s ruleset is built at is [ruleset_landlock_abi] of this.

pub fn probes_taken() -> u64

How many probes this process has taken, counting from zero at startup and never decreasing.

The observability hook the freshness tests assert against — that staging twice advances it by two, and that one stage_session advances it by one — and nothing else reads it. No runtime decision depends on the count.

Trait Implementations

impl Clone for HostProbe

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HostProbe

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.