Enum SealedBlocker 

pub enum SealedBlocker {
    NotLinux,
    AppArmorProfileMissing,
    NamespaceCreationDenied,
    IdMapDenied,
    MountDenied,
    PivotRootDenied,
    KernelUnsupported,
    LandlockUnavailable,
    NetworkNamespaceUnavailable,
    ProbeUnavailable,
}

The one mechanism that stands between this host and sealed, named specifically enough that the refusal carries a command the operator can run.

Deliberately a small closed enum rather than a free-form string: containment.rs renders it, sandbox.rs derives it from the probe, and the manual-verification document asserts the exact text of each rendering.

Variants

NotLinux

Not Linux. Mount namespaces do not exist here and never will — the same permanence EnforcementTier::EnvironmentOnly carries.

AppArmorProfileMissing

AppArmor’s unprivileged-user-namespace restriction is active and this binary is not confined by the shipped SEALED_APPARMOR_PROFILE_NAME profile.

NamespaceCreationDenied

unshare(CLONE_NEWUSER | CLONE_NEWNS) was refused outright — the container case: no CAP_SYS_ADMIN, or the container’s own seccomp filter blocking the syscall.

IdMapDenied

The namespace was created, but writing the identity uid_map/gid_map was refused, so the process cannot own it. Nothing to do with CAP_SYS_ADMIN or containers.

MountDenied

The namespace was created, but mount(2) inside it was refused. The signature of a confinement that permits userns_create and then denies CAP_SYS_ADMIN.

PivotRootDenied

The namespace was created and mount(2) inside it worked, but the pivot_root(2) sequence the composed root’s step 6 performs did not. A separate finding from Self::MountDenied because the two have separate remediations: mount is what an AppArmor profile grants, while pivot_root is a distinct rule in that profile and a distinct entry in a container runtime’s seccomp allowlist, so a host can grant one and refuse the other.

KernelUnsupported

The kernel has no unprivileged user namespace support at all (CONFIG_USER_NS=n, or user.max_user_namespaces=0).

LandlockUnavailable

Namespaces are available but Landlock is not, so the defence-in-depth layer sealed is required to keep would be missing. sealed is strictly stronger than scoped; a host that cannot back scoped cannot back sealed either.

NetworkNamespaceUnavailable

The composed root is built inside the capsule’s network namespace, and this host created the user namespace but could not finish the network namespace or enter it.

ProbeUnavailable

The probe itself could not run — a child could not be forked, waited for, or reported nothing — so whether this host can back sealed is unknown.

Implementations

impl SealedBlocker

pub const ALL: &'static [SealedBlocker]

Every variant, so a caller that has to reason about “which refusal did this host give” cannot silently miss one. Added because a hand-maintained list of the expected refusal texts in murmur-cli’s CLI test drifted the moment a variant was added, and the drift showed up as a failing assertion about the host rather than about the list.

pub fn reason(self) -> String

One sentence naming the missing mechanism, plus the exact remediation. Rendered into RuntimeError::ContainmentFloorUnmet’s reason, so this is the text an operator sees under E-CAP-003.

Trait Implementations

impl Clone for SealedBlocker

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SealedBlocker

impl Debug for SealedBlocker

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SealedBlocker

impl Hash for SealedBlocker

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for SealedBlocker

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SealedBlocker

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SealedBlocker