Ensure a proto `SandboxPolicy` includes the baseline filesystem paths required by proxy-mode sandboxes and GPU runtimes. Paths are only added if missing; user-specified paths are never removed. Returns `true` if the policy was modified (caller may want to sync back).
(proto: &mut openshell_core::proto::SandboxPolicy)
| 895 | /// |
| 896 | /// Returns `true` if the policy was modified (caller may want to sync back). |
| 897 | fn enrich_proto_baseline_paths(proto: &mut openshell_core::proto::SandboxPolicy) -> bool { |
| 898 | let (ro, rw) = active_baseline_enrichment_paths(!proto.network_policies.is_empty()); |
| 899 | |
| 900 | // Baseline paths are system-injected, not user-specified. Skip paths |
| 901 | // that do not exist in this container image to avoid noisy warnings from |
| 902 | // Landlock and, more critically, to prevent a single missing baseline |
| 903 | // path from abandoning the entire Landlock ruleset under best-effort |
| 904 | // mode (see issue #664). |
| 905 | let modified = enrich_proto_baseline_paths_with(proto, &ro, &rw, |path| { |
| 906 | std::path::Path::new(path).exists() |
| 907 | }); |
| 908 | |
| 909 | if modified { |
| 910 | ocsf_emit!( |
| 911 | ConfigStateChangeBuilder::new(ocsf_ctx()) |
| 912 | .severity(SeverityId::Informational) |
| 913 | .status(StatusId::Success) |
| 914 | .state(StateId::Enabled, "enriched") |
| 915 | .message("Enriched policy with baseline filesystem paths for proxy mode") |
| 916 | .build() |
| 917 | ); |
| 918 | } |
| 919 | |
| 920 | modified |
| 921 | } |
| 922 | |
| 923 | fn strip_proto_provider_policy_entries(proto: &mut openshell_core::proto::SandboxPolicy) -> bool { |
| 924 | openshell_policy::strip_provider_rule_names(proto) |