Struct UnixSocketCapability 

pub struct UnixSocketCapability {
    pub original: PathBuf,
    pub resolved: PathBuf,
    pub scope: SocketScope,
    pub mode: UnixSocketMode,
    pub source: CapabilitySource,
}

A capability granting AF_UNIX socket access on a filesystem path.

Only pathname sockets (filesystem-backed) are grantable through this type. Abstract-namespace sockets (sun_path[0] == '\0') and unnamed sockets are never covered by a grant — see issue #685 for the design note. Those kinds are denied by the sandbox’s decide_network_notification policy on Linux and have no analog on macOS.

Invariants:

• path-canonicalize: canonicalised at construction. For ConnectBind grants where the socket itself doesn’t yet exist, we canonicalise the parent directory and re-append the final component (bind creates the socket file).
• lib-policy-free: this is a pure data type. Policy coupling (e.g. auto-granting an implied FsCapability) lives in nono-cli.

Fields

original: PathBuf

Original path as specified by the caller, pre-canonicalisation. Retained for diagnostic output and for macOS dual-path emission (/tmp/foo.sock vs /private/tmp/foo.sock).

resolved: PathBuf

Canonical absolute path.

scope: SocketScope

Path matching scope for this grant.

mode: UnixSocketMode

Which socket operations are permitted.

source: CapabilitySource

Where this capability originated.

Implementations

impl UnixSocketCapability

pub fn new_file(path: impl AsRef<Path>, mode: UnixSocketMode) -> Result<Self>

Grant for a single socket file.

If mode == Connect, the path must already exist and must not be a directory.

If mode == ConnectBind, the path may not yet exist (bind creates it). In that case the parent directory must exist; canonicalisation resolves the parent and re-appends the final path component.

pub fn new_dir(path: impl AsRef<Path>, mode: UnixSocketMode) -> Result<Self>

Grant for any pathname socket directly within a directory.

Non-recursive: a socket one level deeper (e.g. <dir>/subdir/foo.sock) is not covered. The directory itself must already exist.

Rejects the filesystem root (/) as defence-in-depth against accidental grants that would cover sockets anywhere at top level (cf. [validate_platform_rule]’s rejection of root-level subpath grants for filesystem rules). Use explicit subdirectory paths.

pub fn new_dir_subtree( path: impl AsRef<Path>, mode: UnixSocketMode, ) -> Result<Self>

Grant for any pathname socket within a directory subtree.

Recursive: sockets in nested subdirectories are covered. The directory itself must already exist.

pub fn covers(&self, sockaddr_path: &Path) -> bool

True if sockaddr_path is covered by this grant.

• File grants: sockaddr_path == resolved exactly.
• Direct-child directory grants: sockaddr_path’s parent equals resolved, component-wise (non-recursive).
• Subtree directory grants: sockaddr_path starts with resolved, component-wise.

Uses Path component semantics; never string prefix (path-component-compare invariant).

pub fn is_directory(&self) -> bool

Whether this grant is directory-backed.

Trait Implementations

impl Clone for UnixSocketCapability

fn clone(&self) -> UnixSocketCapability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UnixSocketCapability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for UnixSocketCapability

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for UnixSocketCapability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for UnixSocketCapability

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.