assay-cli 3.19.0

CLI for Assay
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

use serde::Serialize;
use std::path::PathBuf;

#[derive(Debug, Serialize, Clone)]
pub struct DiagnosticReport {
    pub assay_version: String,
    pub platform: String,
    pub kernel: Option<String>,
    pub lsms: Vec<String>,
    pub landlock: LandlockStatus,
    pub bpf_lsm: BpfLsmStatus,
    pub helper: HelperStatus,
    pub backend: BackendSelection,
    pub sandbox_features: SandboxFeatures,
    pub metrics: std::collections::HashMap<String, u64>,
    pub status: SystemStatus,
    pub suggestions: Vec<String>,
}

#[derive(Debug, Serialize, Clone)]
pub struct LandlockStatus {
    pub available: bool,
    pub fs_enforce: bool,
    pub net_enforce: bool,
    pub abi_version: Option<u32>,
}

#[derive(Debug, Serialize, Clone)]
pub struct BpfLsmStatus {
    pub available: bool,
}

#[derive(Debug, Serialize, Clone)]
pub struct HelperStatus {
    pub path: PathBuf,
    pub exists: bool,
    pub version: Option<String>,
    pub socket: PathBuf,
    pub socket_exists: bool,
    // Future: caps status
}

#[derive(Debug, Serialize, Clone)]
pub struct BackendSelection {
    pub selected: String,
    pub mode: String,
    pub reason: String,
}

#[derive(Debug, Serialize, Clone, PartialEq)]
pub enum SystemStatus {
    Ready,
    Degraded,
    Unsupported,
}

/// Phase 5 sandbox hardening features status
#[derive(Debug, Serialize, Clone)]
pub struct SandboxFeatures {
    /// Environment variable scrubbing enabled
    pub env_scrubbing: bool,
    /// Scoped /tmp with proper permissions
    pub scoped_tmp: bool,
    /// Fork-safe pre_exec (no allocations)
    pub fork_safe_preexec: bool,
    /// Deny-wins conflict detection
    pub deny_conflict_detection: bool,
}

impl Default for SandboxFeatures {
    fn default() -> Self {
        Self {
            env_scrubbing: true,
            scoped_tmp: true,
            fork_safe_preexec: true,
            deny_conflict_detection: true,
        }
    }
}