Struct Sandbox 

pub struct Sandbox { /* private fields */ }

Linux backend wrapping Landlock + seccomp-bpf.

Implementations

impl LinuxSandbox

pub fn new() -> Result<Self, CoreError>

Probe the kernel and construct the backend. Returns CoreError::BackendUnavailable on kernels older than 5.13.

pub fn new_with_options(options: BackendOptions) -> Result<Self, CoreError>

Constructor with capability-specific runtime options.

pub fn probe(&self) -> &ProbeResult

Borrow the live probe — used by render_policy and exec.

Trait Implementations

impl Debug for LinuxSandbox

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl SandboxBackend for LinuxSandbox

fn name(&self) -> &'static str

Human-readable backend identifier, e.g. "sandbox-exec" or "landlock+seccomp". Surfaced in sbe inspect output and audit logs.

fn info(&self) -> &BackendInfo

What this backend can enforce on the current kernel/host. Populated during construction (Self::new performs the kernel probe); this accessor is infallible.

fn render_policy( &self, profile: &SandboxProfile, proxy_port: Option<u16>, ) -> Result<String, CoreError>

Render the resolved policy for --dry-run and sbe inspect. Output must be deterministic and platform-stable so tests can assert on substrings.

fn run( &self, profile: &SandboxProfile, proxy_port: Option<u16>, command: &[String], extra_env: &HashMap<String, String>, pid_tx: Option<Sender<u32>>, ) -> impl Future<Output = Result<ExitStatus, CoreError>> + Send

Run the user command under the sandbox and return its exit status.