platform

Module: backend::platform

Contents

Enums

• WslKind - Characterises the WSL environment, if any, detected at runtime.

Functions

• detect_wsl - Detect whether the process is running inside WSL by reading
• nested_userns_restricted - Returns true when nested user-namespace creation (bwrap inside bwrap) is blocked.
• userns_restricted - Check whether unprivileged user namespace creation is blocked by a kernel

---

firma_run::backend::platform::WslKind

Enum

Characterises the WSL environment, if any, detected at runtime.

Variants:

• NotWsl - Not running inside WSL; native Linux or another OS.
• Wsl - Running inside WSL (version indeterminate or WSL 1).
• Wsl2 - Running inside WSL 2 specifically.

Methods:

• fn is_wsl(self: Self) -> bool - Returns true for any WSL environment.

Traits: Eq, Copy

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> WslKind
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &WslKind) -> bool

firma_run::backend::platform::detect_wsl

Function

Detect whether the process is running inside WSL by reading /proc/sys/kernel/osrelease.

Fails open: if the file cannot be read the function returns [WslKind::NotWsl] so non-Linux or restricted environments do not produce false positives.

fn detect_wsl() -> WslKind

firma_run::backend::platform::nested_userns_restricted

Function

Returns true when nested user-namespace creation (bwrap inside bwrap) is blocked.

Probes by running the exact nesting codex performs inside firma’s outer sandbox, catching AppArmor sysctls, per-binary profiles, setuid bwrap restrictions, and any other mechanism. Always returns false on non-Linux.

fn nested_userns_restricted() -> bool

firma_run::backend::platform::userns_restricted

Function

Check whether unprivileged user namespace creation is blocked by a kernel sysctl.

Returns Some(sysctl_path) naming the restricting knob when user namespaces are disabled, None when they appear to be available or the check is inconclusive (file absent ⟹ restriction not applicable on this kernel).

Two knobs are probed in order:

• /proc/sys/kernel/unprivileged_userns_clone — Debian/Ubuntu explicit disable flag; value "0" means disabled.
• /proc/sys/user/max_user_namespaces — generic Linux (≥ 4.15); value "0" means disabled.

fn userns_restricted() -> Option<String>