Struct Container 

pub struct Container { /* private fields */ }

The policy for one realm, plus the hook and audit the host attached.

Every check goes through here. The policy can only ever get narrower: Container::revoke intersects it with what remains, and nothing widens it except the Hook, case by case.

Implementations

impl Container

pub fn new(policy: Permissions) -> Container

pub fn with_hook(self, hook: Arc<dyn Hook>) -> Container

pub fn with_audit(self, audit: Arc<dyn Audit>) -> Container

pub fn permissions(&self) -> Arc<Permissions>

The policy in force. A snapshot: a later Self::revoke does not change the Arc handed out.

pub fn revoke(&self, remaining: &Permissions)

Narrow the policy to what it and remaining both grant. Irreversible: there is no call that widens.

pub fn deny(&self, kind: Kind, resource: &str) -> Result<(), String>

Carve resource out of kind for good. resource is a path for read / write, a host rule for net, a name for env, a SysInfo name for sys.

Errors

A net rule or sys name that does not parse.

pub fn check_read(&self, path: &Path) -> Result<(), Denied>

Errors

Denied when neither the policy nor the hook grants it.

pub fn check_write(&self, path: &Path) -> Result<(), Denied>

Errors

Denied when neither the policy nor the hook grants it.

pub fn check_net(&self, host: &str, port: Option<u16>) -> Result<(), Denied>

Errors

Denied when neither the policy nor the hook grants it.

pub fn check_env(&self, name: &str) -> Result<(), Denied>

Errors

Denied when neither the policy nor the hook grants it.

pub fn check_sys(&self, item: SysInfo) -> Result<(), Denied>

Errors

Denied when neither the policy nor the hook grants it.

pub fn has(&self, kind: Kind, resource: Option<&str>) -> Result<bool, String>

Whether kind covers resource right now, without consulting the hook or the audit: what a has()-style query answers. None asks about the kind as a whole (granted in full).

Errors

A net rule or sys name that does not parse.

Trait Implementations

impl Debug for Container

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl NetPolicy for Container

fn check(&self, host: &str, port: Option<u16>) -> Result<(), Denied>

Errors