Struct SymlinkAwareSandbox 

pub struct SymlinkAwareSandbox { /* private fields */ }

Sandbox that follows symlinks in the root directory.

Like FsSandbox, but also allows access to targets of symlinks found directly under the root. This is designed for package managers (e.g. npm link / alc_pkg_link) where the root directory contains symlinks pointing to external source directories.

How it works

At construction time, scans the root for symlink entries and records their canonical targets as additional allowed roots. During read(), a file is permitted if its canonical path is under the root or under any of the recorded symlink targets.

If both checks fail, the root is rescanned once before the read is rejected, so symlinks created after construction (e.g. a later mlua-pkg install in a long-running host) are picked up without rebuilding the sandbox. The rescan runs only on the path that would otherwise return ReadError::Traversal; successful reads never touch the filesystem beyond the file itself.

Rejection is therefore no longer free: it costs one read_dir plus a canonicalize per root entry. Reads that miss because the file does not exist are unaffected (they return Ok(None) before the boundary check), so the cost falls only on names that resolve to a real file outside the root — which then fail anyway.

Security boundary

Same as FsSandbox: casual escape prevention for trusted directories. Note that the rescan widens the allowed set to whatever symlinks exist under the root at read time — the root directory itself must stay trusted.

Implementations

impl SymlinkAwareSandbox

pub fn new(root: impl Into<PathBuf>) -> Result<Self, InitError>

Trait Implementations

impl SandboxedFs for SymlinkAwareSandbox

fn read(&self, relative: &Path) -> Result<Option<FileContent>, ReadError>

Read a file by relative path.