Struct CapabilityPolicy 

pub struct CapabilityPolicy {

    pub network_allow: Vec<String>,
    pub unix_sockets_allowed: bool,
    pub filesystem_scope: Option<String>,
    pub workdir_exec_allowed: bool,
    pub shell_allow: Vec<String>,
    pub spawn_allow: Vec<String>,
    pub shell_strip_env: Vec<String>,
    pub shell_baseline_env: Vec<String>,
    pub shell_interpreter_runtime: Vec<InterpreterRuntimeGrant>,
    pub shell_staged_runtime: Vec<StagedRuntimeGrant>,
    pub env_allow: Vec<String>,
    pub limits: ExecutionLimits,
    pub resources: HostResourceLimits,
    pub containment_floor: ContainmentClass,
    pub declared_deadline_seconds: Option<u64>,
}

Fields

network_allow: Vec<String>

unix_sockets_allowed: bool

From capabilities.network.unix_sockets. false by default, which makes the shell subprocess tree’s socket(AF_UNIX, ...) calls fail with EACCES at the kernel level on both Linux tiers — network_allow above governs IP destinations only and would otherwise leave a local daemon socket (/var/run/docker.sock — host root) completely unmediated. true simply omits that seccomp rule; it is capsule-wide, not per-socket-path. See sandbox::denied_socket_domains.

filesystem_scope: Option<String>

workdir_exec_allowed: bool

From capabilities.filesystem.workdir_exec. false by default, which withholds the Landlock Execute right from the workdir’s own PathBeneath rule — see sandbox::linux_enforce::workdir_access_rights. With it withheld the kernel refuses to exec anything under the workdir on the resolved path itself, so shell_allow is enforced completely: a binary copied or compiled into the workdir cannot run under any name.

true gives the right back for compile-and-run workflows and accepts, explicitly, that shell_allow is then unenforceable for anything inside the workdir. That is why this field is the one grant in this struct that also lowers the session’s achieved containment class (see crate::containment::achieved_containment_class) — nothing else here can.

shell_allow: Vec<String>

spawn_allow: Vec<String>

shell_strip_env: Vec<String>

shell_baseline_env: Vec<String>

shell_interpreter_runtime: Vec<InterpreterRuntimeGrant>

Typed interpreter-runtime grants from capabilities.shell.interpreter_runtime: each names an already-allowlisted binary and the exact host directories outside the workdir its import machinery needs, with a per-directory list_dir enumerability flag. Empty unless the manifest declares them. Consumed on KernelFull to add narrow Landlock grants (see sandbox::resolve_interpreter_runtime_grants) and to fire W-SEC-009.

shell_staged_runtime: Vec<StagedRuntimeGrant>

Typed staged-runtime grants from capabilities.shell.staged_runtime: each names an already-allowlisted binary, the absolute host path of a pinned runtime tree, and the pin identifying that tree’s build. Empty unless the manifest declares them.

Consumed at staging to enforce that declaring one requires an effective sealed floor (see crate::staged_runtime::check_staged_runtime_floor) and to render the staged runtime section of --explain-scope. Per-binary mutually exclusive with Self::shell_interpreter_runtime, which the manifest parser already guarantees.

env_allow: Vec<String>

Host env var names a WASM guest may observe, from capabilities.env.allow. Empty by default: a guest sees only the runtime’s own MURMUR_* injection unless the manifest names a variable here. shell_strip_env and the credential patterns still apply on top, so a credential-shaped name declared here is stripped anyway.

limits: ExecutionLimits

Execution limits applied to every guest store in the session. Always fully resolved — capability_policy_from_runtime_manifest substitutes a default for each field capabilities.limits omits, so there is no “unset” state here and a silent manifest yields ExecutionLimits::default rather than no limits.

resources: HostResourceLimits

OS-level bounds applied to every native subprocess the session spawns — rlimits, the Linux cgroup v2 scope, and the workdir-size ceiling. Resolved on exactly the same terms as limits above (each omitted capabilities.resources field replaced by its default, no “unset” state), but a completely different subject: limits bounds a WASM guest inside its wasmtime store, this bounds the processes the host forks. See crate::resources.

containment_floor: ContainmentClass

The containment class this capsule asked for, from capabilities.containment.

Unlike every other field here it is a requirement, not a grant — and unlike StageRequest::declared_containment_floor it is only the manifest’s own vote, before the workspace config and --containment are folded in. stage_session overwrites it with the combined floor as soon as that is known, so anything reading it off a StagedSession sees the effective value; the manifest-only value exists so a CapabilityPolicy built straight from a manifest is still self-consistent.

Read by sandbox::ShellEnforcement::resolve to decide whether a sealed-capable host actually installs a composed root for this session — a capsule that declared scoped must keep getting scoped’s mechanism. See sandbox::applied_tier.

declared_deadline_seconds: Option<u64>

capabilities.limits.deadline_seconds exactly as the manifest declared it — None when it declared nothing. Retained undefaulted alongside the fully-resolved limits above purely so hook calls can apply their own, lower default without mistaking an explicit 600 for silence. See Self::hook_limits.

Implementations

impl CapabilityPolicy

pub fn hook_limits(&self) -> ExecutionLimits

Execution limits for hook lifecycle calls — Self::limits with the hook-specific deadline default substituted when the manifest declared none.

A hook call is one bounded piece of work, so it does not inherit the capsule-wide ten-minute budget that exists for a capsule’s whole run: a wedged hook would otherwise stall the session for most of that, every event. An explicitly declared deadline_seconds still wins, for hooks as for every other guest.

Trait Implementations

impl Clone for CapabilityPolicy

fn clone(&self) -> CapabilityPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CapabilityPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CapabilityPolicy

fn default() -> CapabilityPolicy

Returns the “default value” for a type.

impl Eq for CapabilityPolicy

impl PartialEq for CapabilityPolicy

fn eq(&self, other: &CapabilityPolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CapabilityPolicy