Struct CorePathPolicy 

pub struct CorePathPolicy { /* private fields */ }

Path-level policy for filesystem-touching tools.

Lives in heartbit-core (not in the umbrella) so all filesystem builtins (bash, patch, edit, write, read) can share enforcement. The umbrella’s SandboxPolicy (landlock-backed on Linux) will compose a CorePathPolicy for the path-allowlist piece. Until Task 5 lands, the two are independent.

Implementations

impl CorePathPolicy

pub fn builder() -> CorePathPolicyBuilder

pub fn allowed_dirs(&self) -> &[PathBuf]

Returns the canonicalized allowed directories. Used by SandboxPolicy::from_path_policy to derive Landlock read/write path lists.

pub fn check_path(&self, path: &Path) -> Result<(), Error>

Returns Ok(()) if path is allowed, Err(Error::Sandbox(...)) otherwise. Canonicalizes the input so symlinks pointing outside allowed_dirs are rejected.

pub fn check_path_for_create(&self, path: &Path) -> Result<PathBuf, Error>

Like [check_path] but for files that don’t exist yet (about to be created or overwritten). Canonicalizes the parent directory then recomposes parent.canonicalize() + file_name to produce a path that is bound to the real parent (not a symlink to elsewhere). The returned PathBuf is the canonical target the caller should write to.

SECURITY (F-FS-1): the previous pattern of “walk up to first existing ancestor, then check_path on it” left a TOCTOU window: between the check and the write, an attacker (or another tool call dispatched in parallel via tokio::JoinSet) could replace an intermediate component with a symlink pointing outside the workspace, and the write would follow the symlink. Combine this method with O_NOFOLLOW on the open syscall to close the race window entirely.

Trait Implementations

impl Clone for CorePathPolicy

fn clone(&self) -> CorePathPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorePathPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.