sbe_core/error.rs
1use std::path::PathBuf;
2
3/// Errors that can occur in sbe-core.
4#[derive(Debug, thiserror::Error)]
5pub enum CoreError {
6 /// Failed to determine the user's home directory.
7 #[error("could not determine home directory")]
8 NoHomeDir,
9
10 /// Failed to read or parse a configuration file.
11 #[error("failed to load config from {path}: {source}")]
12 ConfigLoad {
13 path: PathBuf,
14 source: Box<dyn std::error::Error + Send + Sync>,
15 },
16
17 /// A syntactically valid configuration violates SBE's trust or size
18 /// policy.
19 #[error("configuration policy rejected {path}: {reason}")]
20 ConfigPolicy { path: PathBuf, reason: String },
21
22 /// An extended profile references a base that does not exist.
23 #[error("profile '{child}' extends unknown profile '{base}'")]
24 UnknownBaseProfile { child: String, base: String },
25
26 /// No ecosystem could be detected and no --profile was given.
27 #[error(
28 "could not detect ecosystem from command '{command}' or working directory; use --profile"
29 )]
30 DetectionFailed { command: String },
31
32 /// The backend cannot be constructed on this host (e.g., missing kernel
33 /// feature, missing binary). The orchestrator surfaces this directly.
34 #[error("sandbox backend unavailable: {reason}")]
35 BackendUnavailable { reason: String },
36
37 /// The requested profile cannot be enforced on the current kernel.
38 /// `detail` names any narrowly scoped compatibility option, when one is
39 /// safe and available; there is no general-purpose degradation bypass.
40 #[error("sandbox backend cannot enforce '{capability}' on this kernel: {detail}")]
41 BackendDegraded {
42 capability: &'static str,
43 detail: String,
44 },
45
46 /// A backend-time lint rejected the resolved profile (e.g., an exec
47 /// allowlist subpath that would re-enable `sudo`).
48 #[error("profile lint failed: {0}")]
49 ProfileLint(String),
50
51 /// I/O failure while preparing or running the sandboxed process.
52 #[error("sandbox I/O: {0}")]
53 Io(#[from] std::io::Error),
54
55 /// Backend-specific error from `landlock`, `seccompiler`, or similar.
56 #[error("sandbox backend error: {0}")]
57 Backend(String),
58}