Skip to main content

ensure_default_root

runner_manager_platform::runner_root_access

Function ensure_default_root 

Source 
pub fn ensure_default_root(
    paths: &AppPaths,
    admission: &RootAdmission,
) -> Result<RootAccessChange, RootAccessError>
Expand description

Creates or reconciles the platform default runner root.

Takes no path, and that is the design: there is no argument through which a caller could aim this at an operator’s configured directory. See this module’s documentation.

The order is the contract:

  1. resolve the platform default;
  2. run b1’s operational preflight, which mutates nothing;
  3. if the leaf is missing, create it with its descriptor applied by the call that creates it, so there is no window in which it exists carrying the volume’s inherited grants;
  4. if it is already there, read its DACL and refuse if ordinary local users can write inside it;
  5. otherwise reconcile the descriptor to admit exactly SY, BA and the selected account, skipping the write when it already does.

§Errors

Any RootAccessError. In particular RootAccessError::BroadExistingAccess when the directory is already open, which is a refusal rather than a repair.