egress_guard

Module: egress_guard

Contents

Structs

• AuditChannel - Where and how blocked attempts are reported for signed auditing — the
• EgressGuardHandle - Live handle to a running guard supervisor. Dropping it stops the supervisor
• SupervisorConfig - Inputs to [start].

Functions

• install_and_exec - Installs the guard filter, hands the listener fd to the host supervisor over

---

firma_run::egress_guard::AuditChannel

Struct

Where and how blocked attempts are reported for signed auditing — the firma run audit channel to the Sidecar.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> AuditChannel

firma_run::egress_guard::EgressGuardHandle

Struct

Live handle to a running guard supervisor. Dropping it stops the supervisor thread and removes the control socket.

Trait Implementations:

• Drop
  • fn drop(self: & mut Self)

firma_run::egress_guard::SupervisorConfig

Struct

Inputs to [start].

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> SupervisorConfig
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_run::egress_guard::install_and_exec

Function

Installs the guard filter, hands the listener fd to the host supervisor over socket_path, then execves the agent. Never returns on success.

Errors

Returns a [RunError] when the supervisor socket cannot be reached, the filter cannot be installed, the fd cannot be sent, or exec fails. The caller (the __egress-guarded-run subcommand) maps the error to a fail-closed non-zero exit.

fn install_and_exec(socket_path: &std::path::Path, argv: &[String]) -> Result<std::convert::Infallible, crate::error::RunError>