Module containment 

Containment classes: what an operator declares versus what a host actually achieves.

The two directions are deliberately kept apart:

• The declared floor (murmur_artifact::ContainmentClass) is a requirement, combined from the manifest, the workspace config and --containment by taking the strongest (see murmur_artifact::effective_containment_floor).
• The achieved class starts from [EnforcementTier], which is host-probed at launch time. [achieved_class_for_tier] takes nothing else — not the manifest, not the grant set — so no declaration can ever talk a host into reporting a class it cannot back. Exactly one manifest property may then talk a capsule down from that ceiling, and only downwards: capabilities.filesystem.workdir_exec: true caps the result at ContainmentClass::Advisory (see [achieved_containment_class]), because a capsule whose own workdir is executable has given up the claim scoped makes. The cap is applied in a separate wrapper rather than inside [achieved_class_for_tier] precisely so the “no declaration raises a class” property stays a property of one small, pure function.

ContainmentClass::Sealed is reachable exactly when [EnforcementTier::KernelSealed] is: a Linux host with a usable Landlock ABI, AppArmor out of the way of unprivileged user namespaces, and a namespace probe that really created one. See crate::sealed for the mechanism and for the SealedBlocker taxonomy that turns “not sealed here” into a specific command an operator can run.

The shortfall reason for sealed is therefore mechanism-specific, not a fixed string: a host missing the AppArmor profile and a container missing CAP_SYS_ADMIN both fail to reach sealed, but they are fixed in completely different places, and a refusal that cannot tell them apart is a refusal an operator cannot act on.

Structs

ExportsFilesReport

The declared exports.files block as it appears in a ScopeReport — and therefore in mur run --explain-scope --json and in trace.jsonl’s session_start.effective_grants.

FilesystemBoundaryReport

What the filesystem mechanism this session installs does not protect, in words an operator can act on.

PeerFilesReport

The declared exports.peer_files block as it appears in a ScopeReport.

PreopenReport

One artifact’s resolved WASI preopen as it appears in a ScopeReport — and therefore in mur run --explain-scope, in mur doctor, and in trace.jsonl’s session_start.effective_grants.

ScopeReport

Read-only answer to “what would this capsule actually be allowed to do on this host?”.

StateStoreReport

One artifact’s durable state grant as it appears in a ScopeReport.

Enums

FilesystemRestriction

What the filesystem mechanism this session installs restricts, as a stable wire name.

PreopenSurface

The filesystem surface one artifact’s guest is preopened into, as a stable wire name.

Functions

check_containment_floor

The refusal gate: Ok(()) when the host’s achieved class meets or exceeds the declared floor, RuntimeError::ContainmentFloorUnmet otherwise.

containment_shortfall_reason

Why achieved falls short of declared, naming the missing mechanism rather than the missing class. None when the floor is met.

detect_achieved_containment

Probes this host and reports the strongest class it can actually provide.

detect_sealed_blocker

Which single mechanism keeps this host below sealed, or None when nothing does, from a reading taken here.

detect_userns_grant

Where this host’s unprivileged-user-namespace permission comes from, or None off Linux, where the question has no answer rather than a negative one.

explain_scope

Builds a ScopeReport for policy against this host, with declared as the already- combined floor. Takes one crate::sandbox::HostProbe, so the tier, the blocker and the grant it reports all describe one host at one moment.

read_only_advisory_for

The allowlisted binaries a declared capabilities.filesystem.read_only is only advisory against: those whose own file I/O the dispatch-time write-intent analyser cannot read, in shell_allow order.

render_read_only

The read_only block of the scope report: the declared paths, then one line saying whether the protection is enforced for every readable call or advisory against a named binary.