Struct ProtectedPaths 

pub struct ProtectedPaths {
    pub paths: Vec<PathBuf>,
}

Host paths no runner or job may reach, which the operator names with host protect-path.

On Linux the systemd unit lists them in InaccessiblePaths=, so inside the unit the kernel replaces each with a node of mode 000: no runner or job, in any pool account, reaches it, whatever its own permissions. Measured on Ubuntu 26.04: rm-runner-1 reads such a file on the host and gets Permission denied inside the unit. The list is read when the service is registered, so a change takes effect when it is registered again. Windows and macOS have no equivalent the installer can set, so there it is refused rather than written and silently ignored.

Fields

paths: Vec<PathBuf>

Implementations

impl ProtectedPaths

pub const FILE: &'static str = "protected-paths.json"

The file in the configuration directory.

pub const fn supported() -> bool

Whether this platform can enforce protected paths.

pub fn load(config_dir: &Path) -> Result<Self>

The list in config_dir, empty when there is none.

Errors

When the file cannot be read or does not parse.

pub fn save(&self, config_dir: &Path) -> Result<()>

Writes the list into config_dir.

Errors

When the file cannot be written.

pub fn refusal(path: &Path, own: &[PathBuf]) -> Option<String>

Why path cannot be protected, or None when it can.

The paths every job needs to run at all, and the service’s own directories, are refused: hiding them would stop every runner rather than keep jobs out of something.

Trait Implementations

impl Clone for ProtectedPaths

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProtectedPaths

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ProtectedPaths

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ProtectedPaths

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ProtectedPaths

impl PartialEq for ProtectedPaths

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ProtectedPaths

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ProtectedPaths