nono 0.65.1

Capability-based sandboxing library using Landlock (Linux) and Seatbelt (macOS)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

//! Structured context attached to session diagnostics.

use super::records::DenialReason;
use serde::{Deserialize, Serialize};

/// Origin and structured context for a session diagnostic entry.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
pub enum NonoDiagnosticDetail {
    /// Path denial recorded by the supervised session.
    SupervisedDenial { reason: DenialReason },
    /// Unix socket denial recorded by IPC mediation.
    IpcDenial {
        operation: String,
        target: String,
        ipc_reason: String,
    },
    /// macOS Seatbelt violation that is not expressible as a path grant.
    SeatbeltViolation {
        operation: String,
        target: Option<String>,
    },
    /// From stderr parsing in `nono-cli`.
    StderrObservation {
        observation_kind: StderrObservationKind,
    },
}

/// Kind of stderr-derived observation encoded as a structured diagnostic.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum StderrObservationKind {
    LikelySandboxPath,
    MissingPath,
    ApplicationFailure,
    ProtectedFileWrite,
    NetworkBlocked,
}