Enum EgressNamespaceBlocker 

pub enum EgressNamespaceBlocker {
    CapabilityGrantMissing,
    KernelSupportMissing,
}

Why this host cannot give a capsule its own network namespace.

Exactly two variants, because they are the two things an operator can act on and their remediations do not overlap: one is a permission this host withholds from the mur binary, the other is a kernel that does not implement the mechanism at all. Collapsing them would send half the readers to the wrong fix.

Deliberately not an EnforcementTier variant and deliberately not tied to ContainmentClass: a network namespace is required for every Linux capsule that can spawn a subprocess, at every containment class, so hanging it off the class ladder would make advisory capsules silently exempt from this boundary.

Variants

CapabilityGrantMissing

The kernel implements unprivileged user namespaces, but this host withholds them from this binary: AppArmor’s restrict_unprivileged_userns is on and the shipped profile is not confining mur, or unshare was refused outright (the container case), or the namespace was created and could not then be owned or configured.

KernelSupportMissing

The kernel does not provide the mechanism at all — CONFIG_USER_NS=n, or user.max_user_namespaces=0.

Implementations

impl EgressNamespaceBlocker

pub const ALL: &'static [EgressNamespaceBlocker]

Every variant, so a caller reasoning about refusal text cannot silently miss one. Same convention as SealedBlocker::ALL, which was added there after a hand-maintained list drifted the moment a variant appeared.

pub fn reason(self) -> String

One sentence naming the missing mechanism, plus the exact remediation. Rendered into crate::errors::RuntimeError::EgressNamespaceUnavailable, so this is the text an operator sees under E-CAP-005.

Trait Implementations

impl Clone for EgressNamespaceBlocker

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for EgressNamespaceBlocker

impl Debug for EgressNamespaceBlocker

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for EgressNamespaceBlocker

impl Hash for EgressNamespaceBlocker

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for EgressNamespaceBlocker

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for EgressNamespaceBlocker

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for EgressNamespaceBlocker