Struct SandboxManager 

pub struct SandboxManager { /* private fields */ }

Userspace sandbox validator. See the module docs for the threat model.

Implementations

impl SandboxManager

pub fn new(profile: SandboxProfile, workspace: PathBuf) -> Self

Create a new manager for the given profile rooted at workspace.

pub fn set_allow_network(&mut self, allow: bool)

Allow or deny network tools checked via Self::validate_network.

pub fn from_config(config: SandboxConfig) -> Self

Create a manager from a full SandboxConfig.

pub fn is_active(&self) -> bool

Returns true when the sandbox is actively enforced.

pub fn deactivate(&mut self)

Deactivate the sandbox (e.g. for trusted local sessions).

pub fn activate(&mut self)

Reactivate the sandbox.

pub fn workspace_root(&self) -> &Path

The workspace root this sandbox is confined to.

pub fn validate_path( &self, path: &Path, write: bool, ) -> Result<(), SandboxError>

Validate that path may be accessed, with write indicating whether the caller intends to mutate it.

pub fn validate_command(&self, cmd: &str) -> Result<(), SandboxError>

Validate that cmd is not on the sandbox command blocklist.

pub fn validate_network(&self) -> Result<(), SandboxError>

Validate that network access is permitted by the sandbox.

pub fn validate_env(&self, vars: &[(String, String)]) -> Vec<(String, String)>

Filter vars down to the set of env vars the sandbox permits.

pub fn log_violation(&self, violation: &SandboxViolation)

Record a violation in the in-memory log.

pub fn violations(&self) -> Vec<SandboxViolation>

Return a snapshot of all recorded violations.

Trait Implementations

impl Debug for SandboxManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.