Crate openmoat_core

Expand description

openmoat-core: the trusted decision core of OpenMoat.

This crate is pure: it performs no I/O and makes no OS calls. Callers (the CLI, host adapters) read files, resolve the environment and pass everything in. That keeps the security-relevant logic small, testable and portable (it also builds for wasm32).

Pipeline: an Action is classified into AtomicActions, each atomic action is evaluated deny → allow → ask → defaults by a CompiledPolicy, and the strictest verdict across them becomes the Decision. Facts that need the filesystem reach the engine through ProgramResolver and PathResolver. The policy compiler (ir::lower()) derives from the same policy what an operating-system layer can enforce (ADR-019).

Modules§

ir: The policy compiler’s intermediate representation (ADR-019).
lint: Policy warnings: valid policies that probably do not mean what they say.
yaml: The one place OpenMoat reads and writes YAML (ADR-024).

Structs§

CompiledPolicy: A policy with all patterns compiled for one evaluation context.
Decision: A verdict with the rule ids and human-readable reasons that produced it.
EvalContext: Everything the engine needs from the environment. Supplied by the caller.
MapPathResolver: In-memory resolver for tests and conformance fixtures: symlink path → target, and the files that exist. The longest link that is the path itself or one of its ancestors is replaced by its target.
MapResolver: In-memory resolver for tests and conformance fixtures.
NoResolver: Resolver for callers without a search path (tests, policy check without state).
Policy: The policy document (policy.yaml), as written by users.
RepoPolicy: A repository policy. Only rules: defaults, executables and sandbox stay the user’s, so any other key is a parse error.
RuleGroup: One named group of patterns. A group matches when any of its patterns matches the atomic action of the corresponding kind.
SandboxSettings: The sandbox: section (ADR-018, ADR-019).
Secret: One brokered secret. Its Debug output names only the id: where the value lives and where it goes say which secrets exist.
Taint: What earlier calls of one session exposed it to.
TaintSecret: Where secret material in a session came from.
TaintSettings: The taint: section. Absent in policies written before it existed.
UnknownKind: A name that is not one of Kind::ALL.
UnknownVerdict: A name that is not allow, defer, ask or deny.

Enums§

Action: A tool call as seen from a host, before classification.
AtomicAction: The primitive operations an Action decomposes into.
Defaults: Fallback verdicts when no rule matches: one verdict for everything, or a map from action kind (shell, fs.read, fs.write, net, fetch, web.search, tool.unknown, env.read, env.set, mcp, or "*") to a verdict; a fetch without its own entry takes the net one. This is how “outbound network is deny-by-default” is expressed, because deny rules are absolute and cannot be punched through by allow rules (ADR-002).
Kind: One kind of atomic action. Ordered as policy files list them.
PolicyError: Why a policy file cannot be used. Any of these keeps guard from deciding.
SecretSource: Where OpenMoat reads a secret’s value. The agent should not be able to read it there; moat policy lint warns when no deny rule covers the source.
Verdict: Outcome of evaluating one or more atomic actions.

Constants§

DEFAULT_POLICY: The shipped default policy, as YAML: what moat init installs and what the conformance suite pins. Parse it with Policy::parse.
REPO_RULE_PREFIX: Prefix of every rule id a repository policy contributes, so decisions and the audit log say where a rule came from, and a repository rule can never pass for one of the user’s (kernel-self) or collide with it.

Traits§

PathResolver: Resolves symlinks in normalised, slash-separated absolute paths.
ProgramResolver: Resolves program names using a search path the kernel controls.

Functions§

evaluate: Compile policy for ctx and decide a single action.
literal_shell_pattern: A shell pattern that matches command token for token and nothing wider.
resolve_path: normalise for a word a shell will expand, against a working directory that may be unknown (None). None when the result depends on a directory that is not known: a relative path and an unknown cwd, ~-, or a ~name of another user (OpenMoat cannot know where other users’ homes live, so a cross-user path is unresolvable; a shell token with it asks through unparseable).