Codex Handbook
sandboxing/src/landlock_tests.rs 95 lines
use super::*;use pretty_assertions::assert_eq;#[test]fn legacy_landlock_flag_is_included_when_requested() {    let command = vec!["/bin/true".to_string()];    let command_cwd = Path::new("/tmp/link");    let cwd = Path::new("/tmp");    let default_bwrap = create_linux_sandbox_command_args(        command.clone(),        command_cwd,        cwd,        /*use_legacy_landlock*/ false,        /*allow_network_for_proxy*/ false,    );    assert_eq!(        default_bwrap.contains(&"--use-legacy-landlock".to_string()),        false    );    let legacy_landlock = create_linux_sandbox_command_args(        command,        command_cwd,        cwd,        /*use_legacy_landlock*/ true,        /*allow_network_for_proxy*/ false,    );    assert_eq!(        legacy_landlock.contains(&"--use-legacy-landlock".to_string()),        true    );}#[test]fn proxy_flag_takes_precedence_over_legacy_landlock() {    let command = vec!["/bin/true".to_string()];    let command_cwd = Path::new("/tmp/link");    let cwd = Path::new("/tmp");    let permission_profile = PermissionProfile::read_only();    let args = create_linux_sandbox_command_args_for_permission_profile(        command,        command_cwd,        &permission_profile,        cwd,        /*use_legacy_landlock*/ true,        /*allow_network_for_proxy*/ true,    );    assert_eq!(        args.contains(&"--allow-network-for-proxy".to_string()),        true    );    assert_eq!(args.contains(&"--use-legacy-landlock".to_string()), false);}#[test]fn permission_profile_flag_is_included() {    let command = vec!["/bin/true".to_string()];    let command_cwd = Path::new("/tmp/link");    let cwd = Path::new("/tmp");    let permission_profile = PermissionProfile::read_only();    let args = create_linux_sandbox_command_args_for_permission_profile(        command,        command_cwd,        &permission_profile,        cwd,        /*use_legacy_landlock*/ true,        /*allow_network_for_proxy*/ false,    );    assert_eq!(        args.windows(2)            .any(|window| { window[0] == "--permission-profile" && !window[1].is_empty() }),        true    );    assert_eq!(        args.windows(2)            .any(|window| window[0] == "--command-cwd" && window[1] == "/tmp/link"),        true    );}#[test]fn proxy_network_requires_managed_requirements() {    assert_eq!(        allow_network_for_proxy(/*enforce_managed_network*/ false),        false    );    assert_eq!(        allow_network_for_proxy(/*enforce_managed_network*/ true),        true    );}