tiny.sandbox.Policy

1/// States what isolation a run has to have before the run starts: the policy2/// records what the caller asks of the filesystem, process, and network3/// dimensions, each judged on its own. A required dimension rejects an audit4/// weaker than isolated, returning `error.UnmetFilesystemIsolation` ,5/// `error.UnmetProcessIsolation` , or `error.UnmetNetworkIsolation` before the6/// child runs. By contrast, a preferred dimension records what the caller wants7/// and admits every audit, which backend selection reads to pick a runner. Both8/// filesystem values count as isolated, so requiring the filesystem dimension9/// admits every audit the package can produce. The environment dimension10/// appears in the audit and has no entry here, so a policy constrains it in no11/// way.12pub const Policy = struct {13    filesystem: Preference = .require_isolated,14    process: Preference = .allow_inherited,15    network: Preference = .allow_inherited,1617    pub fn validate(self: Policy, audit: audit_data.Audit) !void {18        if (self.filesystem == .require_isolated and !filesystemIsolated(audit.filesystem)) return error.UnmetFilesystemIsolation;19        if (self.process == .require_isolated and !processIsolated(audit.process)) return error.UnmetProcessIsolation;20        if (self.network == .require_isolated and !networkIsolated(audit.network)) return error.UnmetNetworkIsolation;21    }2223    pub fn prefersFilesystemIsolation(self: Policy) bool {24        return self.filesystem != .allow_inherited;25    }2627    pub fn prefersProcessIsolation(self: Policy) bool {28        return self.process != .allow_inherited;29    }3031    pub fn prefersNetworkIsolation(self: Policy) bool {32        return self.network != .allow_inherited;33    }34};

1pub const Policy = policy.Policy;