lib/sandbox/src/audit.zig

daab053ee43316e1809a84551d573ddd1e5bf3d2

 1 const std = @import("std");
 2 
 3 pub const Runner = enum {
 4     staging,
 5     bubblewrap_overlay,
 6     macos_staging,
 7     windows_staging,
 8 };
 9 
10 pub const Filesystem = enum {
11     copied,
12     overlay,
13 };
14 
15 pub const Process = enum {
16     host,
17     bubblewrap_namespace,
18 };
19 
20 pub const Network = enum {
21     inherited,
22     bubblewrap_namespace,
23 };
24 
25 pub const Environment = enum {
26     inherited,
27     replaced,
28 };
29 
30 /// Describes the backend configuration that supported an execution result,
31 /// reported across filesystem, process, network, and environment dimensions.
32 /// The backend constructs this record directly from the selected runner and run
33 /// plan rather than from runtime measurements.
34 ///
35 /// Callers evaluate each dimension independently because one configuration
36 /// choice implies nothing about another. For example, a Linux Bubblewrap run
37 /// can establish a private process namespace while still sharing the host
38 /// network namespace.
39 pub const Audit = struct {
40     runner: Runner = .staging,
41     filesystem: Filesystem = .copied,
42     process: Process = .host,
43     network: Network = .inherited,
44     environment: Environment = .inherited,
45 };
46 
47 test "audit records effective staging isolation" {
48     const audit = Audit{};
49     try std.testing.expectEqual(Runner.staging, audit.runner);
50     try std.testing.expectEqual(Filesystem.copied, audit.filesystem);
51     try std.testing.expectEqual(Process.host, audit.process);
52     try std.testing.expectEqual(Network.inherited, audit.network);
53     try std.testing.expectEqual(Environment.inherited, audit.environment);
54 }