()
| 1643 | |
| 1644 | #[test] |
| 1645 | fn validate_rejects_root_run_as_user() { |
| 1646 | let mut policy = restrictive_default_policy(); |
| 1647 | policy.process = Some(ProcessPolicy { |
| 1648 | run_as_user: "root".into(), |
| 1649 | run_as_group: "sandbox".into(), |
| 1650 | }); |
| 1651 | let violations = validate_sandbox_policy(&policy).unwrap_err(); |
| 1652 | assert!(violations.iter().any(|v| matches!( |
| 1653 | v, |
| 1654 | PolicyViolation::InvalidProcessIdentity { |
| 1655 | field: "run_as_user", |
| 1656 | .. |
| 1657 | } |
| 1658 | ))); |
| 1659 | } |
| 1660 | |
| 1661 | #[test] |
| 1662 | fn validate_rejects_uid_zero() { |
nothing calls this directly
no test coverage detected