Struct GlobalPolicyChecker

pub struct GlobalPolicyChecker { /* private fields */ }

Evaluates security policy globally across the entire Model and all components. This is used to enforce runtime capability routing restrictions across all components to prevent high privilleged capabilities from being routed to components outside of the list defined in the runtime security policy.

Implementations

impl GlobalPolicyChecker

pub fn new(policy: Arc<SecurityPolicy>) -> Self

Constructs a new PolicyChecker object configured by the SecurityPolicy.

pub fn can_route_capability<'a>( &self, capability_source: &'a CapabilitySource, target_moniker: &'a Moniker, ) -> Result<(), PolicyError>

Returns Ok(()) if the provided capability source can be routed to the given target_moniker, else a descriptive PolicyError.

pub fn can_register_debug_capability<'a>( &self, capability_type: CapabilityTypeName, name: &'a Name, env_moniker: &'a Moniker, env_name: &'a Name, ) -> Result<(), PolicyError>

Returns Ok(()) if the provided debug capability source is allowed to be routed from given environment.

pub fn reboot_on_terminate_allowed( &self, target_moniker: &Moniker, ) -> Result<(), PolicyError>

Returns Ok(()) if target_moniker is allowed to have on_terminate=REBOOT set.

Trait Implementations

impl Clone for GlobalPolicyChecker

fn clone(&self) -> GlobalPolicyChecker

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GlobalPolicyChecker

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for GlobalPolicyChecker

fn default() -> GlobalPolicyChecker

Returns the “default value” for a type.