pub fn enforce(
policy: &SandboxPolicy,
argv: &[OsString],
) -> Result<Enforcement, Error>Expand description
Enforce policy for the command argv. Called from single-threaded
launcher code. Any Err means the requested confinement could not be
applied — the caller MUST fail closed (exit 126), never run unconfined.