Function restrictive_default_policy

crates/openshell-policy/src/lib.rs:1043–1068

Return a restrictive default policy suitable for sandboxes that have no explicit policy configured. This policy grants filesystem access to standard system paths, runs as the `sandbox` user, enables Landlock in best-effort mode, and **blocks all network access** (no network policies, no inference routing).

()

/// `sandbox` user, enables Landlock in best-effort mode, and **blocks all
/// network access** (no network policies, no inference routing).
pub fn restrictive_default_policy() -> SandboxPolicy {
    SandboxPolicy {
        version: 1,
        filesystem: Some(FilesystemPolicy {
            include_workdir: true,
            read_only: vec![
                "/usr".into(),
                "/lib".into(),
                "/proc".into(),
                "/dev/urandom".into(),
                "/app".into(),
                "/etc".into(),
                "/var/log".into(),
            ],
            read_write: vec!["/sandbox".into(), "/tmp".into(), "/dev/null".into()],
        }),
        landlock: Some(LandlockPolicy {
            compatibility: "best_effort".into(),
        }),
        process: Some(ProcessPolicy {
            run_as_user: "sandbox".into(),
            run_as_group: "sandbox".into(),
        }),
        network_policies: HashMap::new(),
    }
}

/// Ensure the policy has `run_as_user: sandbox` and `run_as_group: sandbox`.
///