Canonical immutable security-policy snapshots and their model-facing view.
A snapshot is created once for a root environment, inherited unchanged by child environments, and replaced only by an explicit environment rebuild. Enforcement and context both derive from this value.
Canonical immutable security-policy snapshots and their model-facing view. A snapshot is created once for a root environment, inherited unchanged by child environments, and replaced only by an explicit environment rebuild. Enforcement and context both derive from this value.
(access-view policy workspace-roots)Build the string-keyed model context from the exact enforcement snapshot.
workspace-roots are the live session overlay; configured grants remain
immutable. Paths under HOME render as ~/… without changing enforcement.
Build the string-keyed model context from the exact enforcement snapshot. `workspace-roots` are the live session overlay; configured grants remain immutable. Paths under HOME render as `~/…` without changing enforcement.
(home-relative path)(home-relative path home)Render an absolute path under HOME as ~ / ~/…; leave other paths absolute.
Render an absolute path under HOME as `~` / `~/…`; leave other paths absolute.
(no-search-roots policy)Roots excluded from the DEFAULT rg/find_files sweep; explicit paths still reach them. With the jail disabled, host filesystem roots are excluded so granting unrestricted explicit access does not make an unscoped grep crawl the machine.
Roots excluded from the DEFAULT rg/find_files sweep; explicit paths still reach them. With the jail disabled, host filesystem roots are excluded so granting unrestricted explicit access does not make an unscoped grep crawl the machine.
(read-write-roots policy)Filesystem roots available read/write to common model tools. When the jail is
disabled, every host filesystem root is available; otherwise this is the
configured allowlist. allow-write remains readable under the process-jail
contract, so it belongs here too.
Filesystem roots available read/write to common model tools. When the jail is disabled, every host filesystem root is available; otherwise this is the configured allowlist. `allow-write` remains readable under the process-jail contract, so it belongs here too.
(snapshot config)(snapshot config
{:keys [base-dir home]
:or {base-dir (System/getProperty "user.dir")
home (System/getProperty "user.home")}})Build the immutable canonical security policy from validated string-keyed configuration. Relative and home-relative paths become absolute; symlinks are resolved at this boundary.
Build the immutable canonical security policy from validated string-keyed configuration. Relative and home-relative paths become absolute; symlinks are resolved at this boundary.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |