Function validate_sandbox_policy

crates/openshell-policy/src/lib.rs:1204–1323

Validate that a sandbox policy does not contain unsafe content. Returns `Ok(())` if the policy is safe, or `Err(violations)` listing all safety violations found. Callers decide how to handle violations (hard error vs. logged warning). Checks performed: - `run_as_user` / `run_as_group` must be "sandbox" - Filesystem paths must be absolute (start with `/`) - Filesystem paths must not contain `..`

(
    policy: &SandboxPolicy,
)

/// - Total path count must not exceed [`MAX_FILESYSTEM_PATHS`]
/// - Network endpoint hosts must not use TLD wildcards (e.g. `*.com`)
pub fn validate_sandbox_policy(
    policy: &SandboxPolicy,
) -> std::result::Result<(), Vec<PolicyViolation>> {
    let mut violations = Vec::new();

    // Check process identity — must be "sandbox" or a numeric UID/GID
    // within the acceptable sandbox range.
    // `ensure_sandbox_process_identity` should be called before this to
    // fill in defaults; any invalid value is rejected.
    if let Some(ref process) = policy.process {
        if !is_valid_sandbox_identity(&process.run_as_user) {
            violations.push(PolicyViolation::InvalidProcessIdentity {
                field: "run_as_user",
                value: process.run_as_user.clone(),
            });
        }
        if !is_valid_sandbox_identity(&process.run_as_group) {
            violations.push(PolicyViolation::InvalidProcessIdentity {
                field: "run_as_group",
                value: process.run_as_group.clone(),
            });
        }
    }

    // Check filesystem paths
    if let Some(ref fs) = policy.filesystem {
        let total_paths = fs.read_only.len() + fs.read_write.len();
        if total_paths > MAX_FILESYSTEM_PATHS {
            violations.push(PolicyViolation::TooManyPaths { count: total_paths });
        }

        for path_str in fs.read_only.iter().chain(fs.read_write.iter()) {
            if path_str.len() > MAX_PATH_LENGTH {
                violations.push(PolicyViolation::FieldTooLong {
                    path: truncate_for_display(path_str),
                    length: path_str.len(),
                });
                continue;
            }

            let path = Path::new(path_str);

            if !path.has_root() {
                violations.push(PolicyViolation::RelativePath {
                    path: path_str.clone(),
                });
            }

            if path
                .components()
                .any(|c| matches!(c, std::path::Component::ParentDir))
            {
                violations.push(PolicyViolation::PathTraversal {
                    path: path_str.clone(),
                });
            }
        }