Enum EgressNamespaceBlocker 

pub enum EgressNamespaceBlocker {
    CapabilityGrantMissing,
    KernelSupportMissing,
    CreatorUnavailable,
}

Which remediation an EgressNamespaceFailure calls for.

Not an EnforcementTier variant and not tied to ContainmentClass: a network namespace is required for every Linux capsule that can spawn a subprocess, at every containment class, so hanging it off the class ladder would make advisory capsules silently exempt from this boundary.

Variants

CapabilityGrantMissing

The kernel implements unprivileged user namespaces and something on this host refused one to mur: AppArmor’s unprivileged-userns restriction, another AppArmor profile confining mur, a container runtime’s seccomp filter or capabilities, or another security module. The refusal came at unshare, or after it while the namespace was owned or configured.

KernelSupportMissing

The kernel does not provide the mechanism: unshare failed with ENOSPC (user.max_user_namespaces), EINVAL or ENOSYS (CONFIG_USER_NS=n), or EUSERS (the nesting limit).

CreatorUnavailable

The runtime could not run the namespace creator, or the creator stopped without reporting a step — a process or descriptor limit, memory, or a policy that killed it — so the host’s answer is unknown. Refused like the other two: a namespace nobody could create is a namespace the capsule does not get.

Trait Implementations

impl Clone for EgressNamespaceBlocker

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for EgressNamespaceBlocker

impl Debug for EgressNamespaceBlocker

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for EgressNamespaceBlocker

impl Hash for EgressNamespaceBlocker

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for EgressNamespaceBlocker

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for EgressNamespaceBlocker

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for EgressNamespaceBlocker