refactor(jail): extract availability check and ruleset application

Extracted the backend availability check into a separate function to allow testing fallback behaviour, and pulled the ruleset application logic into a reusable helper to simplify the pre_exec closure. This makes the backend selection testable with a mock availability predicate and reduces duplication in the landlock backend.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinybox-jail/src/detect.rs

@@ -28,26 +28,30 @@ impl JailBackend for UnsupportedBackend {
 /// Picks the strongest available backend, returning an unsupported backend
 /// when no OS sandbox works.
 pub fn pick_backend() -> Arc<dyn JailBackend> {
+    pick_backend_with(is_available)
+}
+
+fn pick_backend_with(mut is_available: impl FnMut(&str) -> bool) -> Arc<dyn JailBackend> {
     #[cfg(target_os = "linux")]
     {
         let lb = super::linux::LandlockBackend::new();
-        if lb.is_available() {
+        if is_available(lb.name()) {
             log::info!("[cwd_jail] backend=landlock");
             return Arc::new(lb);
         }
     }
     #[cfg(target_os = "macos")]
     {
         let sb = super::macos::SeatbeltBackend::new();
-        if sb.is_available() {
+        if is_available(sb.name()) {
             log::info!("[cwd_jail] backend=seatbelt");
             return Arc::new(sb);
         }
     }
     #[cfg(target_os = "windows")]
     {
         let ac = super::windows::AppContainerBackend::new();
-        if ac.is_available() {
+        if is_available(ac.name()) {
             log::info!("[cwd_jail] backend=appcontainer");
             return Arc::new(ac);
         }
@@ -56,6 +60,22 @@ pub fn pick_backend() -> Arc<dyn JailBackend> {
     Arc::new(UnsupportedBackend)
 }
 
+fn is_available(name: &str) -> bool {
+    #[cfg(target_os = "linux")]
+    if name == "landlock" {
+        return super::linux::LandlockBackend::new().is_available();
+    }
+    #[cfg(target_os = "macos")]
+    if name == "seatbelt" {
+        return super::macos::SeatbeltBackend::new().is_available();
+    }
+    #[cfg(target_os = "windows")]
+    if name == "appcontainer" {
+        return super::windows::AppContainerBackend::new().is_available();
+    }
+    false
+}
+
 #[cfg(test)]
 #[path = "detect_tests.rs"]
 mod tests;

crates/tinybox-jail/src/detect_tests.rs

@@ -17,3 +17,10 @@ fn unsupported_backend_reports_and_rejects_spawns() {
 fn backend_selection_returns_a_named_backend() {
     assert!(!pick_backend().name().is_empty());
 }
+
+#[test]
+fn backend_selection_falls_back_when_no_backend_is_available() {
+    let backend = pick_backend_with(|_| false);
+    assert_eq!(backend.name(), "unsupported");
+    assert!(!backend.is_available());
+}

crates/tinybox-jail/src/linux.rs

@@ -91,12 +91,13 @@ impl JailBackend for LandlockBackend {
 
             // SAFETY: the child callback only applies this prebuilt ruleset.
             unsafe {
-                cmd.pre_exec(move || match ruleset.take() {
-                    Some(ruleset) => match ruleset.restrict_self() {
-                        Ok(_) => Ok(()),
-                        Err(_) => Err(std::io::Error::from_raw_os_error(5)),
-                    },
-                    None => Err(std::io::Error::from_raw_os_error(22)),
+                cmd.pre_exec(move || {
+                    apply_ruleset(ruleset.take(), |ruleset| {
+                        ruleset
+                            .restrict_self()
+                            .map(|_| ())
+                            .map_err(|_| std::io::Error::from_raw_os_error(5))
+                    })
                 });
             }
 
@@ -110,6 +111,17 @@ impl JailBackend for LandlockBackend {
     }
 }
 
+#[cfg(feature = "landlock")]
+fn apply_ruleset<T>(
+    ruleset: Option<T>,
+    restrict: impl FnOnce(T) -> std::io::Result<()>,
+) -> std::io::Result<()> {
+    match ruleset {
+        Some(ruleset) => restrict(ruleset),
+        None => Err(std::io::Error::from_raw_os_error(22)),
+    }
+}
+
 #[cfg(test)]
 #[path = "linux_tests.rs"]
 mod tests;

crates/tinybox-jail/src/linux_tests.rs

@@ -3,6 +3,24 @@
 use super::*;
 use std::path::Path;
 
+#[cfg(feature = "landlock")]
+#[test]
+fn apply_ruleset_handles_success_failure_and_missing_ruleset() {
+    assert!(apply_ruleset(Some(()), |_| Ok(())).is_ok());
+    assert_eq!(
+        apply_ruleset(Some(()), |_| Err(std::io::Error::other("failed")))
+            .err()
+            .map(|error| error.kind()),
+        Some(std::io::ErrorKind::Other)
+    );
+    assert_eq!(
+        apply_ruleset::<()>(None, |_| Ok(()))
+            .err()
+            .map(|error| error.raw_os_error()),
+        Some(Some(22))
+    );
+}
+
 #[test]
 fn backend_reports_name_and_availability() {
     let backend = LandlockBackend::new();