Enum SandboxPolicy 

#[non_exhaustive]
pub enum SandboxPolicy {
    Auto,
    Required,
    Disabled,
}

What to do with Chromium’s process sandbox.

Defaults to SandboxPolicy::Auto, which keeps the sandbox wherever the runtime can.

Windows does not have a sandbox here yet

Whatever this policy says, a Windows build currently runs unsandboxed. CEF wants a sandbox broker pointer that, since Chromium M138, only a binary built with Chromium’s own toolchain can create; CEF supplies prebuilt bootstrap.exe hosts for that, and they load the application as a DLL, which a Tauri application is not. Given a null broker CEF sets no_sandbox itself, so there is no configuration here that changes the outcome — only whether the runtime warns about it (Self::Auto) or refuses to start (Self::Required).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Auto

Keep the sandbox wherever it can be kept, and log a warning naming the reason wherever it cannot.

It cannot be kept in two situations: on Windows, always, for the reason above; and on Linux or BSD when the application runs from an AppImage on a system that has neither the setuid chrome-sandbox helper nor usable unprivileged user namespaces, where the alternative is not an unsandboxed application but no application at all, since Chromium aborts with “No usable sandbox!”.

macOS always keeps it.

Required

Never run without a sandbox: fail startup instead.

Pick this when running unsandboxed is not an acceptable outcome and a hard failure is preferable. On Linux the user can then install the setuid helper, point CHROME_DEVEL_SANDBOX at one, or re-enable unprivileged user namespaces; on Windows there is nothing they can do, so this always fails there.

Disabled

Always run without a sandbox, on every platform.

Every renderer then runs with the full privileges of the user, so a compromised renderer is a compromised account. Useful for containers and CI images that cannot provide a sandbox, not for shipped applications.

Trait Implementations

impl Clone for SandboxPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SandboxPolicy

impl Debug for SandboxPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxPolicy

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SandboxPolicy

impl PartialEq for SandboxPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SandboxPolicy