Function is_valid_sandbox_identity

crates/openshell-policy/src/lib.rs:946–953

Validate whether a process identity field value is acceptable. Accepts either the literal `"sandbox"` or a numeric UID/GID parsed as `u32` within the range `[MIN_SANDBOX_UID, MAX_SANDBOX_UID]`. Rejects: - The empty string (callers should use `ensure_sandbox_process_identity` to fill defaults before validation) - UID 0 or values below `MIN_SANDBOX_UID` - Values above `MAX_SANDBOX_UID` - Non-numer

(value: &str)

/// - Values above `MAX_SANDBOX_UID`
/// - Non-numeric strings other than `"sandbox"` (e.g. `"root"`, `"nobody"`)
pub fn is_valid_sandbox_identity(value: &str) -> bool {
    if value == SANDBOX_NAME {
        return true;
    }
    value
        .parse::<u32>()
        .is_ok_and(|uid| (MIN_SANDBOX_UID..=MAX_SANDBOX_UID).contains(&uid))
}

// ---------------------------------------------------------------------------
// Public API