Struct HostProbe 

pub struct HostProbe { /* private fields */ }

The host facts the tier decision is made from, taken together as one reading.

A staged session takes exactly one of these and every consumer of that session reads it — the containment-floor refusal, the ScopeReport written to the trace, and the tier [ShellEnforcement::resolve] installs. Two readings of a host that changed between them would let the trace describe a session that never ran under what it claims.

Implementations

impl HostProbe

pub fn probe() -> HostProbe

Reads the host as it is right now: on Linux a real Landlock ruleset restriction attempt (RulesetStatus::FullyEnforced → Some(true), PartiallyEnforced/NotEnforced or any construction error → Some(false), no Landlock ABI → None) plus a real unshare(CLONE_NEWUSER | CLONE_NEWNS) and mount(2). Off Linux it probes nothing and claims nothing.

Taken once per staged session, not once per process. That is affordable because both halves do their work in a forked child and leave the calling process exactly as they found it — linux_enforce::probe_landlock_full_access forks so the runtime is never placed into a Landlock domain by a capability check, and [crate::sealed::probe_sealed_support] forks because unshare(CLONE_NEWUSER) is irreversible for the task that calls it. Neither is idempotency-sensitive, so a reading costs no more than the syscalls it makes: two fork/waitpid pairs and three small /proc reads.

The window this leaves open is one session wide. Between runtime::stage_session and the last subprocess that session spawns the host is not re-read; a change inside that window is caught by the mechanism installation itself failing closed, not by a second probe. A process that stages repeatedly — mur eval, which stages once per dataset case — judges each session against the host as it was when that session was staged.

pub fn sealed_blocker(&self) -> Option<SealedBlocker>

Which single mechanism keeps this reading below sealed, or None when nothing does.

pub fn userns_grant(&self) -> Option<UsernsGrant>

Where this host’s permission to create an unprivileged user namespace comes from, or None off Linux, where the question has no answer rather than a negative one.

pub fn probes_taken() -> u64

How many probes this process has taken, counting from zero at startup and never decreasing.

The observability hook the freshness tests assert against — that staging twice advances it by two, and that one stage_session advances it by one — and nothing else reads it. No runtime decision depends on the count.

Trait Implementations

impl Clone for HostProbe

fn clone(&self) -> HostProbe

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for HostProbe

impl Debug for HostProbe

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.