Module proc_view 

The /proc a capsule command sees: a private procfs of the session’s own PID namespace, or the host’s.

Every command on a Linux kernel tier runs inside its session’s PID namespace (crate::network_namespace creates it with the network namespace; each command’s relay enters it in sandbox::linux_enforce). Where the host lets a process of that namespace mount proc, the command mounts one over /proc in a private mount namespace, and on scoped and sealed Landlock grants ReadFile | ReadDir beneath it — never Execute, never a write right.

View	What a command reaches at /proc
ProcView::Private	the session’s own processes and the kernel’s world-readable files (cpuinfo, meminfo, stat, /proc/sys, …); no host process
ProcView::Host	the host’s /proc; on scoped and sealed every open beneath it is EACCES

[proc_view] is the one decision, made from the session’s crate::sandbox::HostProbe: the private view exactly when the probe’s private-procfs rehearsal mounted one (crate::namespace_probe::NamespaceReading::private_proc). A session’s [crate::sandbox::ShellEnforcement] carries the answer and its crate::containment::ScopeReport says it, both from the same probe.

hidepid masks, within the private view, every process the command may not ptrace-read: the namespace’s holder (pid 1, which holds capabilities the command does not) and, under Landlock, a process of another command, whose domain is not the reader’s.

Structs

ProcessViewReport

The /proc a session’s commands see — --explain-scope’s Process view block, session_start.effective_grants.process_view and mur doctor’s section, all from process_view_report. Field names are the JSON keys; every field is always serialized.

Enums

HostProcReason

Why a session’s commands see the host’s /proc.

ProcMountStep

One step of mounting the private /proc in a command’s pre_exec window.

ProcView

Which /proc a session’s commands see.

Constants

PID_NAMESPACE_MECHANISM

The mounted_by wire name of the private view.

PRIVATE_PROC_FAILURE_PREFIX

What every failure to mount the private /proc at spawn starts with.

Functions

describe_mount_failure

<prefix> <step> failed: <errno>, the spawn failure of a step. Allocates: called only on the failure path, as every other step’s message in the pre_exec window is.

process_view_report

The report of view. Pure.

render_process_view

The Process view block of --explain-scope and mur doctor. Ends with a newline.