Documentation
¶
Index ¶
- func PolicyMounts(mounts []Mount) []pkgsandbox.Mount
- type Access
- func (a *Access) ProjectFiles(name string, files []pkgsandbox.ProjectedFile) error
- func (a *Access) ProjectTempFiles(name string, files []pkgsandbox.ProjectedFile) (string, error)
- func (a *Access) ReadDir(name string) ([]pkgsandbox.DirEntry, error)
- func (a *Access) ReadFile(name string) ([]byte, error)
- func (a *Access) Stat(name string) (pkgsandbox.FileInfo, error)
- func (a *Access) WriteFile(name string, content []byte, mode fs.FileMode) error
- type Mount
- type Resolved
- type Resolver
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func PolicyMounts ¶
func PolicyMounts(mounts []Mount) []pkgsandbox.Mount
PolicyMounts projects a provider-private mount plan into its public, process-visible authorized data view.
Types ¶
type Access ¶
type Access struct {
// contains filtered or unexported fields
}
Access implements sandbox.FileAccess through rooted capabilities. Path validation never produces a host string that a later os.* call can race.
func NewAccessWithTempDir ¶
func (*Access) ProjectFiles ¶
func (a *Access) ProjectFiles(name string, files []pkgsandbox.ProjectedFile) error
func (*Access) ProjectTempFiles ¶
func (a *Access) ProjectTempFiles(name string, files []pkgsandbox.ProjectedFile) (string, error)
type Mount ¶
type Mount struct {
HostPath string
SandboxPath string
ReadOnly bool
ResolveSymlinkAliases bool
// contains filtered or unexported fields
}
Mount is a provider-private mapping from one process-visible root to its physical backing directory.
type Resolved ¶
Resolved is a provider-private path resolution. Upper layers receive only mediated FileAccess operations and never this physical mapping.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver is one immutable provider-private mount plan. Canonical and physical roots are pairwise disjoint, so one rooted capability always owns an operation and a symlink cannot bypass a nested mount's access mode. Cross-mount symlinks intentionally fail closed.
func (*Resolver) Close ¶
Close releases the pinned directory capabilities. Provider Sessions call it exactly once when their filesystem view closes.
func (*Resolver) Resolve ¶
Resolve maps canonical process coordinates and provider-declared same-namespace symlink aliases. Physical paths supplied by upper layers are never accepted as an alternate coordinate system by remapping providers.
func (*Resolver) ResolveDirectory ¶
ResolveDirectory validates a process cwd through the same rooted capability used by FileAccess. It rejects missing paths, non-directories, and symlink traversal outside the selected mount before process setup. The provider's process view remains the final cwd authority: this preflight does not make a writable directory name immutable against concurrent agent changes.
func (*Resolver) ValidateBackingPaths ¶
ValidateBackingPaths verifies that every physical pathname still names the directory capability pinned when the resolver was created. Providers call this as a consistency preflight before process setup; it fails closed on ordinary deletion or replacement, but is not an atomic defense against a hostile host actor concurrently mutating provider-owned mount source paths.
Source Files