Skip to main content

requires_process_bounding

capsule_runtime

Function requires_process_bounding 

Source 
pub fn requires_process_bounding(
    policy: &CapabilityPolicy,
    has_native_artifact: bool,
) -> bool
Expand description

Does this policy give the capsule any way to run a native subprocess at all?

The exact condition the Linux fail-closed launch refusal keys on: every route crate::runtime::has_subprocess_route_at_staging counts (capabilities.shell.allow, capabilities.spawn.allow, and capabilities.install.tool, whose pattern can match a native tool a pull installs), or a declared artifact whose implementation is native (passed in by the caller, which is the only place the installed-artifact list is in hand). The same routes the E-CAP-005 egress refusal counts, from the same function.

An unconfined session (a containment_floor of murmur_artifact::ContainmentClass::Unconfined) additionally requires a cgroup_* field in capabilities.resources: it bounds only what the manifest declares.