| 826 | } |
| 827 | |
| 828 | fn enrich_proto_baseline_paths_with<F>( |
| 829 | proto: &mut openshell_core::proto::SandboxPolicy, |
| 830 | ro: &[String], |
| 831 | rw: &[String], |
| 832 | path_exists: F, |
| 833 | ) -> bool |
| 834 | where |
| 835 | F: Fn(&str) -> bool, |
| 836 | { |
| 837 | if ro.is_empty() && rw.is_empty() { |
| 838 | return false; |
| 839 | } |
| 840 | |
| 841 | let fs = proto |
| 842 | .filesystem |
| 843 | .get_or_insert_with(|| openshell_core::proto::FilesystemPolicy { |
| 844 | include_workdir: true, |
| 845 | ..Default::default() |
| 846 | }); |
| 847 | |
| 848 | let mut modified = false; |
| 849 | for path in ro { |
| 850 | if !fs.read_only.iter().any(|p| p == path) && !fs.read_write.iter().any(|p| p == path) { |
| 851 | if !path_exists(path) { |
| 852 | debug!( |
| 853 | path, |
| 854 | "Baseline read-only path does not exist, skipping enrichment" |
| 855 | ); |
| 856 | continue; |
| 857 | } |
| 858 | fs.read_only.push(path.clone()); |
| 859 | modified = true; |
| 860 | } |
| 861 | } |
| 862 | for path in rw { |
| 863 | if fs.read_write.iter().any(|p| p == path) { |
| 864 | continue; |
| 865 | } |
| 866 | if !path_exists(path) { |
| 867 | debug!( |
| 868 | path, |
| 869 | "Baseline read-write path does not exist, skipping enrichment" |
| 870 | ); |
| 871 | continue; |
| 872 | } |
| 873 | if fs.read_only.iter().any(|p| p == path) { |
| 874 | if path == "/proc" { |
| 875 | info!( |
| 876 | path, |
| 877 | "Promoting /proc from read-only to read-write for GPU runtime compatibility" |
| 878 | ); |
| 879 | fs.read_only.retain(|p| p != path); |
| 880 | fs.read_write.push(path.clone()); |
| 881 | modified = true; |
| 882 | } |
| 883 | continue; |
| 884 | } |
| 885 | fs.read_write.push(path.clone()); |