Enum PreopenSurface 

pub enum PreopenSurface {
    WholeWorkdir,
    ScopedSubtree,
    Nothing,
    RecordsHooks,
}

The filesystem surface one artifact’s guest is preopened into, as a stable wire name.

The three values are the whole space: a WASI guest either holds a directory descriptor for the accessible workdir, holds one for a subtree of it, or holds none at all. Which one an entry resolves to is decided by its role and its capabilities.filesystem.scope in crate::network_policy::preopen_reports; the baselines the two roles start from are [crate::network_policy::ToolCapabilityGrant] and [crate::network_policy::HookCapabilityGrant].

Variants

WholeWorkdir

The entire accessible workdir, preopened as "." with FsPerms::ReadWrite. The wide default a runtime: tool or runtime: driver entry with no capabilities.filesystem.scope resolves to — see [crate::network_policy::ToolCapabilityGrant] for the threat that default is chosen against and the threat it is not.

ScopedSubtree

<accessible workdir>/<scope> and nothing above it, preopened as "." with the same rights. What a declared capabilities.filesystem.scope resolves to, whatever the role.

Nothing

No preopened directory of any kind, so the guest holds no wasi:filesystem descriptor. The default-deny baseline a runtime: hook entry with no capabilities.filesystem.scope resolves to — see [crate::network_policy::HookCapabilityGrant].

RecordsHooks

The session’s records directory’s hooks/ and nothing else, preopened as "." read-write: what a runtime: hook entry declaring capabilities.filesystem.records: true resolves to, in place of a workdir scope.

Trait Implementations

impl Clone for PreopenSurface

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PreopenSurface

impl Debug for PreopenSurface

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PreopenSurface

impl PartialEq for PreopenSurface

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PreopenSurface

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PreopenSurface