Ensure a `SandboxPolicy` (Rust type) includes the baseline filesystem paths required by proxy-mode sandboxes and GPU runtimes. Used for the local-file code path where no proto is available.
(policy: &mut SandboxPolicy)
| 941 | /// paths required by proxy-mode sandboxes and GPU runtimes. Used for the |
| 942 | /// local-file code path where no proto is available. |
| 943 | fn enrich_sandbox_baseline_paths(policy: &mut SandboxPolicy) { |
| 944 | let (ro, rw) = |
| 945 | active_baseline_enrichment_paths(matches!(policy.network.mode, NetworkMode::Proxy)); |
| 946 | if ro.is_empty() && rw.is_empty() { |
| 947 | return; |
| 948 | } |
| 949 | |
| 950 | let mut modified = false; |
| 951 | for path in &ro { |
| 952 | let p = std::path::PathBuf::from(path); |
| 953 | if !policy.filesystem.read_only.contains(&p) && !policy.filesystem.read_write.contains(&p) { |
| 954 | if !p.exists() { |
| 955 | debug!( |
| 956 | path, |
| 957 | "Baseline read-only path does not exist, skipping enrichment" |
| 958 | ); |
| 959 | continue; |
| 960 | } |
| 961 | policy.filesystem.read_only.push(p); |
| 962 | modified = true; |
| 963 | } |
| 964 | } |
| 965 | for path in &rw { |
| 966 | let p = std::path::PathBuf::from(path); |
| 967 | if policy.filesystem.read_only.contains(&p) || policy.filesystem.read_write.contains(&p) { |
| 968 | continue; |
| 969 | } |
| 970 | if !p.exists() { |
| 971 | debug!( |
| 972 | path, |
| 973 | "Baseline read-write path does not exist, skipping enrichment" |
| 974 | ); |
| 975 | continue; |
| 976 | } |
| 977 | policy.filesystem.read_write.push(p); |
| 978 | modified = true; |
| 979 | } |
| 980 | |
| 981 | if modified { |
| 982 | ocsf_emit!( |
| 983 | ConfigStateChangeBuilder::new(ocsf_ctx()) |
| 984 | .severity(SeverityId::Informational) |
| 985 | .status(StatusId::Success) |
| 986 | .state(StateId::Enabled, "enriched") |
| 987 | .message("Enriched policy with baseline filesystem paths for proxy mode") |
| 988 | .build() |
| 989 | ); |
| 990 | } |
| 991 | } |
| 992 | |
| 993 | #[cfg(test)] |
| 994 | #[allow( |