Struct Capabilities 

pub struct Capabilities { /* private fields */ }

The capabilities a spec grants a job.

v1 has exactly one kind, filesystem reads under named roots. An empty set grants nothing — deny-by-default is the whole posture, so “no capabilities declared” must never read as “unrestricted”.

Implementations

impl Capabilities

pub fn new(read_roots: Vec<PathBuf>) -> Self

Grant read access beneath each of read_roots.

pub fn allows_read(&self, path: &Path) -> bool

Whether path may be read.

Both sides are canonicalized before comparison, and that is the entire substance of this function. The tempting implementation — path.starts_with(root) on the raw strings — admits two escapes:

• Traversal. /granted/inner/../../secret has /granted/inner as a string prefix while naming a file outside it.
• Symlinks. A path genuinely under the granted root can name a file anywhere on the system.

canonicalize resolves .. and follows symlinks, so the comparison is between the real locations rather than the spellings. Comparing with Path::starts_with rather than string prefixes additionally means /data-secret is not treated as nested inside /data.

A path that cannot be canonicalized — because it does not exist — is denied. That is deliberate on two counts: a nonexistent path cannot be proven inside the grant, and refusing it here means the decision cannot be made against a file that only appears afterwards.

Note the residual limitation: this resolves the path once, and the caller opens it separately. A sufficiently determined attacker who can swap a symlink between those two steps still has a window. Closing it properly needs the caller to pass an already-open descriptor; see the transport discussion in the cuttlefishd crate docs.

pub fn read_roots(&self) -> &[PathBuf]

The granted read roots, as configured.

Trait Implementations

impl Clone for Capabilities

fn clone(&self) -> Capabilities

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Capabilities

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Capabilities

fn default() -> Capabilities

Returns the “default value” for a type.