Module containment 

Containment classes: what an operator declares versus what a host actually achieves.

The two directions are deliberately kept apart:

• The declared floor (murmur_artifact::ContainmentClass) is a requirement, combined from the manifest, the workspace config and --containment by taking the strongest (see murmur_artifact::effective_containment_floor).
• The achieved class starts from [EnforcementTier], which is host-probed at launch time. [achieved_class_for_tier] takes nothing else — not the manifest, not the grant set — so no declaration can ever talk a host into reporting a class it cannot back. Exactly one manifest property may then talk a capsule down from that ceiling, and only downwards: capabilities.filesystem.workdir_exec: true caps the result at ContainmentClass::Advisory (see [achieved_containment_class]), because a capsule whose own workdir is executable has given up the claim scoped makes. The cap is applied in a separate wrapper rather than inside [achieved_class_for_tier] precisely so the “no declaration raises a class” property stays a property of one small, pure function.

ContainmentClass::Sealed is reachable exactly when [EnforcementTier::KernelSealed] is: a Linux host with a usable Landlock ABI, AppArmor out of the way of unprivileged user namespaces, and a namespace probe that really created one. See crate::sealed for the mechanism and for the SealedBlocker taxonomy that turns “not sealed here” into a specific command an operator can run.

The shortfall reason for sealed is therefore mechanism-specific, not a fixed string: a host missing the AppArmor profile and a container missing CAP_SYS_ADMIN both fail to reach sealed, but they are fixed in completely different places, and a refusal that cannot tell them apart is a refusal an operator cannot act on.

Structs

DoctorDirReports

What doctor_runtime_dir reports.

ExportsFilesReport

The declared exports.files block as it appears in a ScopeReport — and therefore in mur run --explain-scope --json and in trace.jsonl’s session_start.effective_grants.

FilesystemBoundaryReport

What the filesystem mechanism this session installs does not protect, in words an operator can act on.

PeerFilesReport

The declared exports.peer_files block as it appears in a ScopeReport.

PreopenReport

One artifact’s resolved WASI preopen as it appears in a ScopeReport — and therefore in mur run --explain-scope, in mur doctor, and in trace.jsonl’s session_start.effective_grants.

RuntimeDirReport

What the session’s runtime directory, or its records directory, is to the capsule’s commands — --explain-scope’s Runtime directory and Records directory blocks, session_start.effective_grants.runtime_dir and .records_dir and mur doctor’s sections, all from [runtime_dir_report] and [records_dir_report].

ScopeReport

Read-only answer to “what would this capsule actually be allowed to do on this host?”.

StateStoreReport

One artifact’s durable state grant as it appears in a ScopeReport.

Enums

FilesystemRestriction

What the filesystem mechanism this session installs restricts, as a stable wire name.

PreopenSurface

The filesystem surface one artifact’s guest is preopened into, as a stable wire name.

RuntimeDirReach

How one artifact reaches the runtime directory, as PreopenReport::runtime_dir_reach carries it.

ShortfallCause

Why a containment floor is unmet, which decides what an operator is told to change: a host that cannot back the class, or one of the two capsule-side causes no host can fix.

Functions

applied_mechanism

The wire name of the tier a native tool of a capsule declaring declared runs under on this host: the probed tier capped by the declared floor, which is what ShellEnforcement::resolve installs for every subprocess. Spelled as ScopeReport::enforcement_tier spells a tier.

check_containment_floor

The refusal gate: Ok(()) when the host’s achieved class meets or exceeds the declared floor, RuntimeError::ContainmentFloorUnmet otherwise.

containment_shortfall_reason

Why achieved falls short of declared, naming the missing mechanism rather than the missing class. None when the floor is met.

detect_achieved_containment

Probes this host and reports the strongest class it can actually provide.

detect_sealed_blocker

Which single mechanism keeps this host below sealed, or None when nothing does, from a reading taken here.

detect_userns_grant

Where this host’s unprivileged-user-namespace permission comes from, or None off Linux, where the question has no answer rather than a negative one.

doctor_runtime_dir

mur doctor’s Runtime directory and Records directory sections for a capsule declaring declared, run from workdir: the same [runtime_dir_report] and [records_dir_report] on this host’s applied tier and ruleset ABI, or why HOME cannot hold either.

explain_scope

Builds a ScopeReport for policy against this host, with declared as the already- combined floor. Takes one crate::sandbox::HostProbe, so the tier, the blocker and the grant it reports all describe one host at one moment.

install_from_places

ScopeReport::install_from for policy: empty without an install grant.

read_only_advisory_for

The allowlisted binaries a declared capabilities.filesystem.read_only is only advisory against: those whose own file I/O the dispatch-time write-intent analyser cannot read, in shell_allow order.

render_install

The install skill, install tool and install from lines of the scope report: which skills and tools a pull may install, <none> for a list the capsule left empty, and the places it may install them from (install from: stores or install from: stores, sources), printed only for a capsule holding an install grant.

render_read_only

The read_only block of the scope report: the declared paths, then one line saying whether the protection is enforced for every readable call or advisory against a named binary.

render_records_dir

The Records directory block of --explain-scope and mur doctor, on render_runtime_dir’s terms. Ends with a newline.

render_runtime_dir

The Runtime directory block of --explain-scope and mur doctor: its path, and whether the capsule’s commands can change it. Ends with a newline.

resolve_runtime_dir_reach

reach once the artifact’s implementation is known: native reaches the runtime directory through its environment, WASM through its preopen, and an unknown implementation stays unresolved. No reach stays none.

resolve_runtime_dir_reaches

Every report’s PreopenReport::runtime_dir_reach resolved through implementation_of, the implementation of the artifact a report names, or None where it is not known.