class LittleGhost::Sandbox::Policy

Normalizes requested filesystem, process, environment, and child-network controls into one immutable policy. Policy is a declaration, not proof of isolation; the selected backend exposes #effective_policy and rejects controls it cannot enforce.

Attributes

environment [R]

Environment inheritance and explicit values.

files [R]

Named Workspace paths visible to tools and child processes.

network [R]

Network policy, or nil for a backend-specific secure default.

root_filesystem [R]

Requested host-root access: :isolated, :read_only, or :read_write.

runtime_paths [R]

Named workspace paths visible only to sandboxed processes.

Public Class Methods

coerce (value = nil, **options)

Source

# File lib/little_ghost/sandbox/policy.rb, line 16
def self.coerce(value = nil, **options)
  return value if value.is_a?(self) && options.empty?
  values = value.nil? ? {} : value
  raise PolicyError, "sandbox policy must be a Hash or Sandbox::Policy" unless values.is_a?(Hash)

  new(**values.transform_keys(&:to_sym).merge(options))
end

Returns an existing policy or builds one from a Hash and keyword options.

new (files: {root: :read_only}, runtime_paths: {}, root_filesystem: :isolated, environment: {}, network: nil)

Source

# File lib/little_ghost/sandbox/policy.rb, line 25
def initialize(
  files: {root: :read_only},
  runtime_paths: {},
  root_filesystem: :isolated,
  environment: {},
  network: nil
)
  @files = normalize_paths(files, "files")
  @runtime_paths = normalize_paths(runtime_paths, "runtime_paths")
  @root_filesystem = enum!(root_filesystem, ROOT_FILESYSTEM_MODES, "root filesystem")
  @environment = EnvironmentPolicy.coerce(environment)
  @network = NetworkPolicy.coerce(network)
  freeze
end

Builds a backend-independent policy from named Workspace paths.

Public Instance Methods

workspace_writable? ()

Source

# File lib/little_ghost/sandbox/policy.rb, line 51
def workspace_writable? = files.fetch(:root, :read_only) == :read_write

Whether the :root entry in files requests :read_write access.