(policy: &SandboxPolicy, workdir: Option<&str>)
| 19 | #[cfg_attr(target_os = "linux", allow(dead_code))] |
| 20 | #[cfg_attr(not(target_os = "linux"), allow(clippy::unnecessary_wraps))] |
| 21 | pub fn apply(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<()> { |
| 22 | #[cfg(target_os = "linux")] |
| 23 | { |
| 24 | linux::apply(policy, workdir) |
| 25 | } |
| 26 | |
| 27 | #[cfg(not(target_os = "linux"))] |
| 28 | { |
| 29 | let _ = (policy, workdir); |
| 30 | openshell_ocsf::ocsf_emit!( |
| 31 | openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) |
| 32 | .activity(openshell_ocsf::ActivityId::Open) |
| 33 | .severity(openshell_ocsf::SeverityId::Medium) |
| 34 | .finding_info(openshell_ocsf::FindingInfo::new( |
| 35 | "platform-sandbox-unavailable", |
| 36 | "Platform Sandboxing Not Implemented", |
| 37 | ).with_desc("Sandbox policy provided but platform sandboxing is not yet implemented on this OS")) |
| 38 | .message("Platform sandboxing not yet implemented") |
| 39 | .build() |
| 40 | ); |
| 41 | Ok(()) |
| 42 | } |
| 43 | } |
| 44 | |
| 45 | /// Apply seccomp hardening for the long-lived supervisor process itself. |
| 46 | #[cfg_attr(not(target_os = "linux"), allow(clippy::unnecessary_wraps))] |
no outgoing calls
no test coverage detected