cageforge-policy-compose 0.7.0

Policy ceiling composition for Rust process sandboxes
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

// SPDX-License-Identifier: Apache-2.0

use std::path::PathBuf;

use cageforge_command::EnvironmentSpec;
use cageforge_policy::{NetworkMode, NetworkPolicy, SandboxPolicy};

use crate::environment::EffectiveEnvironment;
use crate::filesystem::EffectiveFilesystemPolicy;
use crate::ownership::ExternalOwner;

/// A neutral maximum policy supplied by the component that owns the outer
/// safety boundary.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct PolicyCeiling {
    pub(super) policy: SandboxPolicy,
    pub(super) environment: EnvironmentSpec,
    pub(super) workspace_roots: Option<Vec<PathBuf>>,
    pub(super) external_owner: Option<ExternalOwner>,
}

/// Inputs to a pure policy composition operation.
#[derive(Debug, Clone)]
pub struct CompositionRequest<'a> {
    pub(crate) requested_policy: &'a SandboxPolicy,
    pub(crate) requested_environment: &'a EnvironmentSpec,
    pub(crate) requested_workspace_roots: Option<Vec<PathBuf>>,
    pub(crate) ceiling: &'a PolicyCeiling,
    pub(crate) external_owner: Option<ExternalOwner>,
}

/// The effective policy constraints after composition.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct EffectiveSandbox {
    pub(super) filesystem: EffectiveFilesystemPolicy,
    pub(super) network: EffectiveNetworkPolicy,
    pub(super) environment: EffectiveEnvironment,
    pub(super) workspace_roots: Option<Vec<PathBuf>>,
    pub(super) workspace_root_limit: Option<Vec<PathBuf>>,
}

/// Network decisions constrained by both input policies.
///
/// The component policies remain private. Use the decision methods and
/// [`EffectiveNetworkRequirements`] for preflight, and [`Self::lowering`] for
/// native lowering. The lowering view contains both sides as mandatory
/// constraints rather than selecting one side.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct EffectiveNetworkPolicy {
    pub(super) requested: NetworkPolicy,
    pub(super) ceiling: NetworkPolicy,
}

/// The network features a backend must be able to enforce for one effective
/// composition.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct EffectiveNetworkRequirements {
    pub(super) mode: NetworkMode,
    pub(super) domain_rules: bool,
    pub(super) local_address_restrictions: bool,
    pub(super) resolved_targets: bool,
    pub(super) local_ipc_isolation: bool,
    pub(super) local_ipc_rules: bool,
    pub(super) local_ipc_deny_rules: bool,
    pub(super) windows_named_pipe_rules: bool,
}