Skip to main content

credential_backstop_match

capsule_runtime

Function credential_backstop_match 

Source 
pub fn credential_backstop_match(
    name: &str,
    extra_patterns: &[String],
) -> Option<BackstopMatch>
Expand description

The first credential backstop pattern that matches name, or None when the backstop keeps it — the one decision procedure behind [strip_credential_shaped_vars], credential_backstop_drops, W-SEC-024 and the E-CAP-016 staging refusal.

[CREDENTIAL_ENV_PATTERNS] is tried before extra_patterns, so a name both lists cover is attributed to the built-in pattern: that is the one no manifest edit can remove. extra_patterns is a policy’s shell_strip_env. Judges a name alone and never reads the host environment.