Ensure the policy has `run_as_user: sandbox` and `run_as_group: sandbox`. If the process section is missing, or either field is empty, this fills in the required `"sandbox"` value. Call this before validation so that policies without an explicit process section get the correct default.
(policy: &mut SandboxPolicy)
| 1073 | /// the required `"sandbox"` value. Call this before validation so that |
| 1074 | /// policies without an explicit process section get the correct default. |
| 1075 | pub fn ensure_sandbox_process_identity(policy: &mut SandboxPolicy) { |
| 1076 | let process = policy.process.get_or_insert_with(ProcessPolicy::default); |
| 1077 | if process.run_as_user.is_empty() { |
| 1078 | process.run_as_user = "sandbox".into(); |
| 1079 | } |
| 1080 | if process.run_as_group.is_empty() { |
| 1081 | process.run_as_group = "sandbox".into(); |
| 1082 | } |
| 1083 | } |
| 1084 | |
| 1085 | // --------------------------------------------------------------------------- |
| 1086 | // Policy safety validation |