Enum Policy 

pub enum Policy {
    Disabled,
    Permissive,
    Required,
}

How strictly a node enforces admission.

See the module docs for why Policy::Permissive is the default and why the nested-sandbox exception is unconditional.

Variants

Disabled

No admission checking at all — pre-R555-F4 behaviour. An escape hatch for a node debugging its own signing setup; it also disables the nested-sandbox exception, which is why it is not the default.

Permissive

A grant, if present, must verify. A workload with no grant runs, unless it requests the nested-sandbox widening.

Required

Every workload must carry a grant that verifies.

Implementations

impl Policy

pub fn parse(s: &str) -> Result<Self, String>

Parse a policy name. Accepts exactly the three spellings; anything else is an error rather than a silent fallback, because “I typoed the env var and admission quietly turned off” is the failure this whole module is about.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Policy

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Policy

Returns the “default value” for a type.

impl Eq for Policy

impl PartialEq for Policy

fn eq(&self, other: &Policy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Policy