openmoat_core/lib.rs
1//! `openmoat-core`: the trusted decision core of OpenMoat.
2//!
3//! This crate is **pure**: it performs no I/O and makes no OS calls. Callers
4//! (the CLI, host adapters) read files, resolve the environment and pass
5//! everything in. That keeps the security-relevant logic small, testable and
6//! portable (it also builds for `wasm32`).
7//!
8//! Pipeline: an [`Action`] is classified into [`AtomicAction`]s, each atomic
9//! action is evaluated `deny → allow → ask → defaults` by a [`CompiledPolicy`],
10//! and the strictest verdict across them becomes the [`Decision`]. Facts that
11//! need the filesystem reach the engine through [`ProgramResolver`] and
12//! [`PathResolver`]. The policy compiler ([`ir::lower()`]) derives from the same
13//! policy what an operating-system layer can enforce (ADR-019).
14
15#![warn(missing_docs)]
16
17mod action;
18mod engine;
19mod expand;
20mod host;
21pub mod ir;
22mod kind;
23mod lexer;
24pub mod lint;
25mod paths;
26mod pattern;
27mod policy;
28mod programs;
29mod realpath;
30mod repo;
31mod secret;
32mod shell;
33mod taint;
34mod verdict;
35
36pub use action::{Action, AtomicAction};
37// The taint `Secret` (material a session read) is exported as `TaintSecret`, apart
38// from the policy's brokered `Secret`.
39pub use engine::{CompiledPolicy, EvalContext, Secret as TaintSecret, Taint, evaluate};
40pub use kind::{Kind, UnknownKind};
41pub use paths::resolve as resolve_path;
42pub use pattern::literal_shell_pattern;
43pub use policy::{Defaults, Policy, PolicyError, RuleGroup, SandboxSettings};
44pub use programs::{MapResolver, NoResolver, ProgramResolver};
45pub use realpath::{MapPathResolver, PathResolver};
46pub use repo::{REPO_RULE_PREFIX, RepoPolicy};
47pub use secret::{Secret, Source as SecretSource};
48pub use taint::TaintSettings;
49pub use verdict::{Decision, UnknownVerdict, Verdict};
50
51/// The shipped default policy, as YAML: what `moat init` installs and what the
52/// conformance suite pins. Parse it with [`Policy::parse`].
53pub const DEFAULT_POLICY: &str = include_str!("../policies/default-v1.yaml");