bux-jail 0.2.0

Process isolation for the bux-shim (bwrap / seatbelt / pre_exec)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

//! Security layer outcomes reported after a jail spawn.

/// Status of one isolation layer after spawn.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub enum LayerStatus {
    /// Layer was requested and is active on the child process.
    Enforced,
    /// Layer was requested, unavailable, and [`crate::JailConfig::allow_degraded_security`]
    /// allowed continue.
    Degraded,
    /// Layer was not requested.
    Disabled,
    /// Layer does not apply on this platform (e.g. Landlock off Linux).
    NotApplicable,
}

/// Isolation stack used for the shim process.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[non_exhaustive]
pub enum SandboxKind {
    /// Linux bubblewrap namespaces.
    Bwrap,
    /// macOS `sandbox-exec` seatbelt.
    Seatbelt,
    /// No platform sandbox (`pre_exec` hardening only).
    Noop,
}

impl SandboxKind {
    /// Stable string for logs / inspect.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Bwrap => "bwrap",
            Self::Seatbelt => "seatbelt",
            Self::Noop => "noop",
        }
    }
}

/// Actual security posture for a spawned shim (for `VmInfo` / inspect).
#[derive(Debug, Clone, PartialEq, Eq)]
#[non_exhaustive]
pub struct SecurityReport {
    /// Platform sandbox in use.
    pub sandbox: SandboxKind,
    /// Landlock LSM (Linux).
    pub landlock: LayerStatus,
    /// Seatbelt / MAC layer status (macOS seatbelt is covered by [`Self::sandbox`]).
    pub mac: LayerStatus,
}