Struct PolicyMatcherSet 

pub struct PolicyMatcherSet { /* private fields */ }

A set of staged, active policies with their glob predicates compiled.

Implementations

impl PolicyMatcherSet

pub fn empty() -> Self

Create an empty matcher set.

pub fn from_records(records: &[Record]) -> Result<Self>

Compile active, non-off policy records from universal store records.

pub fn from_records_lenient(records: &[Record]) -> Self

Compile active, non-off policy records while isolating bad records.

A malformed policy must not prevent the daemon from evaluating every other policy at boot or after a live refresh.

pub fn from_policies<I>(policies: I) -> Result<Self>

where I: IntoIterator<Item = (String, PolicyRecord)>,

Compile keyed policy payloads. This is useful to pure callers that have already separated the universal record envelope.

pub fn matches(&self, action: &Action) -> Vec<MatchedPolicy<'_>>

Return every policy whose present predicates all match the action.

pub fn detect_unclassified_literal_bypass( &self, action: &Action, raw_command: &str, ) -> Option<&str>

Detect a record-only signal when an unclassified command mentions a meaningful literal from an active host/path trigger; this is intentionally false-positive because raw text alone cannot prove use.