sbe-core 0.4.0

Core library for sbe — cross-platform sandbox executor for supply chain defense
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

use std::path::PathBuf;

/// Errors that can occur in sbe-core.
#[derive(Debug, thiserror::Error)]
pub enum CoreError {
    /// Failed to determine the user's home directory.
    #[error("could not determine home directory")]
    NoHomeDir,

    /// Failed to read or parse a configuration file.
    #[error("failed to load config from {path}: {source}")]
    ConfigLoad {
        path: PathBuf,
        source: Box<dyn std::error::Error + Send + Sync>,
    },

    /// A syntactically valid configuration violates SBE's trust or size
    /// policy.
    #[error("configuration policy rejected {path}: {reason}")]
    ConfigPolicy { path: PathBuf, reason: String },

    /// An extended profile references a base that does not exist.
    #[error("profile '{child}' extends unknown profile '{base}'")]
    UnknownBaseProfile { child: String, base: String },

    /// No ecosystem could be detected and no --profile was given.
    #[error(
        "could not detect ecosystem from command '{command}' or working directory; use --profile"
    )]
    DetectionFailed { command: String },

    /// The backend cannot be constructed on this host (e.g., missing kernel
    /// feature, missing binary). The orchestrator surfaces this directly.
    #[error("sandbox backend unavailable: {reason}")]
    BackendUnavailable { reason: String },

    /// The requested profile cannot be enforced on the current kernel.
    /// `detail` names any narrowly scoped compatibility option, when one is
    /// safe and available; there is no general-purpose degradation bypass.
    #[error("sandbox backend cannot enforce '{capability}' on this kernel: {detail}")]
    BackendDegraded {
        capability: &'static str,
        detail: String,
    },

    /// A backend-time lint rejected the resolved profile (e.g., an exec
    /// allowlist subpath that would re-enable `sudo`).
    #[error("profile lint failed: {0}")]
    ProfileLint(String),

    /// I/O failure while preparing or running the sandboxed process.
    #[error("sandbox I/O: {0}")]
    Io(#[from] std::io::Error),

    /// Backend-specific error from `landlock`, `seccompiler`, or similar.
    #[error("sandbox backend error: {0}")]
    Backend(String),
}