Module checks 

Functions

check_hardlink_hazard

Detect hardlink hazard: returns Ok(true) when the target node has more than one hardlink (nlink > 1). Uses symlink_metadata to avoid following symlinks; callers may optionally resolve and re-check as needed.

check_immutable

Best-effort check for the immutable attribute via lsattr -d. Returns Err(String) only when the target itself is immutable. If lsattr is missing or fails, this returns Ok(()) (best-effort).

check_source_trust

Source trust checks. Returns Err(String) if untrusted and force is false. When force is true, returns Ok(()) and leaves it to callers to emit warnings.

check_suid_sgid_risk

Best-effort check for SUID/SGID risk on a target path. Returns Ok(true) when either SUID (04000) or SGID (02000) bit is set on the resolved file; Ok(false) otherwise. On errors reading metadata, returns Ok(false) to avoid spurious stops; callers may add an informational note if desired.

ensure_mount_rw_exec

Ensure the filesystem backing path is read-write and not mounted with noexec. Returns Ok(()) if suitable; Err(String) with a human message otherwise.