class LittleGhost::Sandbox::Policy

Normalizes requested filesystem, process, environment, and child-network controls into one immutable policy. Policy is a declaration, not proof of isolation; the selected backend reports the policy it actually enforces and rejects controls it cannot enforce.

When environment is omitted, child processes receive a scrubbed locale and path baseline without inheriting other host values. An explicit Hash or EnvironmentPolicy replaces that baseline, including an empty Hash. Workspace routing values are added separately when a process starts.

policy = LittleGhost::Sandbox::Policy.new(
  files: {root: :read_write},
  network: :none
)

policy.root_filesystem       # => :isolated
policy.environment.inherit?  # => false

Attributes

environment [R]

Environment inheritance and values requested for child processes.

files [R]

Named Workspace paths visible to tools and child processes.

network [R]

Network policy, or nil for the backend-specific default.

root_filesystem [R]

Requested host-root access: :isolated, :read_only, or :read_write.

runtime_paths [R]

Named workspace paths visible only to sandboxed processes.

Public Class Methods

coerce (value = nil, **options)

Source

# File lib/little_ghost/sandbox/policy.rb, line 30
def self.coerce(value = nil, **options)
  return value if value.is_a?(self) && options.empty?
  values = value.nil? ? {} : value
  raise PolicyError, "sandbox policy must be a Hash or Sandbox::Policy" unless values.is_a?(Hash)

  new(**values.transform_keys(&:to_sym).merge(options))
end

Returns an existing policy or builds one from a Hash and keyword options.

new(files: {root: :read_only}, runtime_paths: {}, root_filesystem: :isolated, network: nil)

new(files: {root: :read_only}, runtime_paths: {}, root_filesystem: :isolated, environment: value, network: nil)

Source

# File lib/little_ghost/sandbox/policy.rb, line 43
def initialize(
  files: {root: :read_only},
  runtime_paths: {},
  root_filesystem: :isolated,
  environment: DEFAULT_ENVIRONMENT,
  network: nil
)
  @files = normalize_paths(files, "files")
  @runtime_paths = normalize_paths(runtime_paths, "runtime_paths")
  @root_filesystem = enum!(root_filesystem, ROOT_FILESYSTEM_MODES, "root filesystem")
  @environment = if environment.equal?(DEFAULT_ENVIRONMENT)
    EnvironmentPolicy.default
  else
    EnvironmentPolicy.coerce(environment)
  end
  @network = NetworkPolicy.coerce(network)
  freeze
end

Builds a backend-independent policy from named Workspace paths.

Public Instance Methods

workspace_writable? ()

Source

# File lib/little_ghost/sandbox/policy.rb, line 73
def workspace_writable? = files.fetch(:root, :read_only) == :read_write

Whether the :root entry in files requests :read_write access.