Struct PolicyDocument 

pub struct PolicyDocument {
    pub name: Option<String>,
    pub network: Option<NetworkPolicy>,
    pub capabilities: Option<CapabilitySet>,
    pub tools: Vec<ToolRule>,
    pub syscall_allowlist: Option<SyscallAllowlist>,
}

The canonical policy document shared across enforcement layers.

Fields

name: Option<String>

Human-readable policy name (metadata.name).

network: Option<NetworkPolicy>

Network egress policy.

capabilities: Option<CapabilitySet>

Capability allow/deny floor for this policy scope.

tools: Vec<ToolRule>

Per-tool rules, in declaration order.

syscall_allowlist: Option<SyscallAllowlist>

Kernel syscall allowlist for this workload (AAASM-3624). When set, the eBPF enforcement probe default-denies any syscall not listed for a monitored PID. Lowered to SYSCALL_ALLOWLIST map entries by AAASM-3635.

Implementations

impl PolicyDocument

pub fn denied_capabilities(&self) -> Vec<&Capability>

Return the capability deny set, or an empty slice if unset.

pub fn egress_allowlist(&self) -> &[String]

Return the network egress allowlist, or an empty slice if unset.

pub fn allowed_syscalls(&self) -> Vec<Syscall>

Return the permitted syscalls, or an empty iterator if no syscall allowlist is set.

Trait Implementations

impl Clone for PolicyDocument

fn clone(&self) -> PolicyDocument

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyDocument

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PolicyDocument

fn default() -> PolicyDocument

Returns the “default value” for a type.

impl Eq for PolicyDocument

impl PartialEq for PolicyDocument

fn eq(&self, other: &PolicyDocument) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PolicyDocument