| 275 | } |
| 276 | |
| 277 | pub fn validate_sandbox_identity(&self) -> Result<(), String> { |
| 278 | let range = openshell_policy::MIN_SANDBOX_UID..=openshell_policy::MAX_SANDBOX_UID; |
| 279 | if let Some(uid) = self.sandbox_uid |
| 280 | && !range.contains(&uid) |
| 281 | { |
| 282 | return Err(format!( |
| 283 | "sandbox_uid {uid} is outside the allowed range [{}, {}]", |
| 284 | openshell_policy::MIN_SANDBOX_UID, |
| 285 | openshell_policy::MAX_SANDBOX_UID, |
| 286 | )); |
| 287 | } |
| 288 | if let Some(gid) = self.sandbox_gid |
| 289 | && !range.contains(&gid) |
| 290 | { |
| 291 | return Err(format!( |
| 292 | "sandbox_gid {gid} is outside the allowed range [{}, {}]", |
| 293 | openshell_policy::MIN_SANDBOX_UID, |
| 294 | openshell_policy::MAX_SANDBOX_UID, |
| 295 | )); |
| 296 | } |
| 297 | Ok(()) |
| 298 | } |
| 299 | |
| 300 | fn requires_tls_materials(&self) -> bool { |
| 301 | self.openshell_endpoint.starts_with("https://") |