feat(jail): enable the Landlock and Seatbelt backends (fail closed, no unsafe) - #23

Merged

senamakel merged 27 commits into

tinyhumansai:mainfrom

senamakel:tinybox-enable-jail-backends

Oct 3, 2026

Commits on Oct 3, 2026

fix(detect): handle missing os-release file gracefully

senamakel
and
medullabot
committed
e27501a
chore: files changed crates/tinybox-jail/src/detect.rs,crates/tinybox-jail/src/lib.rs,crates/tinybox

senamakel
and
medullabot
committed
f4f1d6d
test: add tests for jail detection and linux module

senamakel
and
medullabot
committed
20ae8d6
fix(jail): restore missing `use std::sync::Arc` import

senamakel
and
medullabot
committed
0099e92
fix(detect): handle missing os-release gracefully on Linux

senamakel
and
medullabot
committed
be3d687
fix(linux): handle empty cgroup path in jail setup

senamakel
and
medullabot
committed
618d9df
test: add test for landlock spawn being unsupported without feature flag

senamakel
and
medullabot
committed
224d147
fix(detect): handle missing sysfs on Linux without panicking

senamakel
and
medullabot
committed
183bfba
fix(macos): use writeln macro for profile rendering

senamakel
and
medullabot
committed
27d4efa
test(spawn): suppress unused_mut warning on non-Linux

senamakel
and
medullabot
committed
1c84e11
fix(tinybox-jail): add README with usage and design overview

senamakel
and
medullabot
committed
f73d050
fix(docs): correct jail backend table for Windows and Linux

senamakel
and
medullabot
committed
72ecb37
docs(tinybox-jail): format AppContainer name in documentation table

senamakel
and
medullabot
committed
e083e35
fix(landlock): add /run/systemd/resolve to system read paths

senamakel
and
medullabot
committed
c5520b0
fix(tests): reformat assertion to comply with line length

senamakel
and
medullabot
committed
87e0538
refactor(jail): split candidates into per-platform functions

senamakel
and
medullabot
committed
7d32aa3
fix(detect): backtick-quote AppContainer in doc comment

senamakel
and
medullabot
committed
2c62595
feat(jail): extract backend selection and launcher preparation for testability

senamakel
and
medullabot
committed
156d500
refactor(linux): extract enforcement check and injectable support flag

senamakel
and
medullabot
committed
ff43024
refactor(jail): make imp functions testable and move test module

senamakel
and
medullabot
committed
1d8c8a5
fix(linux): pass RulesetStatus by reference in check_enforcement

senamakel
and
medullabot
committed
a728127
test(linux_imp, macos): extract default-name assertion and add env-clear test

senamakel
and
medullabot
committed
ccbd30d
docs(macos): document environment forwarding and env_clear behaviour

senamakel
and
medullabot
committed
97115ef
test(macos): fix environment variable removal assertion

senamakel
and
medullabot
committed
5937232
test(linux_imp_tests): reject partially enforced rulesets in test

senamakel
and
medullabot
committed
34e8bd6
chore(tinybox-jail): fail closed on partially enforced Landlock rulesets

senamakel
and
medullabot
committed
8651b29
fix(landlock): restrict file grants to file-only access rights

senamakel
and
medullabot
committed
e5b868f

Navigation Menu

feat(jail): enable the Landlock and Seatbelt backends (fail closed, no unsafe) - #23

feat(jail): enable the Landlock and Seatbelt backends (fail closed, no unsafe)#23
senamakel merged 27 commits into
tinyhumansai:mainfrom
senamakel:tinybox-enable-jail-backends

Commits on Oct 3, 2026

fix(detect): handle missing os-release file gracefully

chore: files changed crates/tinybox-jail/src/detect.rs,crates/tinybox-jail/src/lib.rs,crates/tinybox

test: add tests for jail detection and linux module

fix(jail): restore missing `use std::sync::Arc` import

fix(detect): handle missing os-release gracefully on Linux

fix(linux): handle empty cgroup path in jail setup

test: add test for landlock spawn being unsupported without feature flag

fix(detect): handle missing sysfs on Linux without panicking

fix(macos): use writeln macro for profile rendering

test(spawn): suppress unused_mut warning on non-Linux

fix(tinybox-jail): add README with usage and design overview

fix(docs): correct jail backend table for Windows and Linux

docs(tinybox-jail): format AppContainer name in documentation table

fix(landlock): add /run/systemd/resolve to system read paths

fix(tests): reformat assertion to comply with line length

refactor(jail): split candidates into per-platform functions

fix(detect): backtick-quote AppContainer in doc comment

feat(jail): extract backend selection and launcher preparation for testability

refactor(linux): extract enforcement check and injectable support flag

refactor(jail): make imp functions testable and move test module

fix(linux): pass RulesetStatus by reference in check_enforcement

test(linux_imp, macos): extract default-name assertion and add env-clear test

docs(macos): document environment forwarding and env_clear behaviour

test(macos): fix environment variable removal assertion

test(linux_imp_tests): reject partially enforced rulesets in test

chore(tinybox-jail): fail closed on partially enforced Landlock rulesets

fix(landlock): restrict file grants to file-only access rights