JezK
Edit File: mount_config.cpython-311.pyc
� ������ � � d Z ddlZddlZddlmZmZ ddlmZ ddlm Z de de d e d efd�Ze G d� d � � � � Z dS )z� Mount configuration builder for website isolation. The code handles all standard behavior (docroot isolation, home overlay, etc). � N)� dataclass�field� )�validate_docroot_no_symlinks)� MountEntry�source� raw_prefix�resolved_prefix�returnc � � ||fD ]8}|� d� � dz }| |k s| � |� � r dS �9dS )a� Return True if the raw ``source`` string sits lexically under the tenant's home (as raw or resolved) and therefore counts as a tenant-writable bind source that must be revalidated at the mount sink. The classification is deliberately lexical, not realpath-based: a symlink swap that makes ``realpath(source)`` escape the home tree is exactly the case the sink revalidation must catch, so the classifier cannot itself dereference the symlink or the swapped-out source would be misclassified as operator-controlled and skipped. The subsequent validator run performs the safe fd-walked resolution. �/TF)�rstrip� startswith)r r r �prefix�markers �Yopt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/webisolation/mount_config.py�_source_looks_tenant_writabler s] � � #�J�/� � �����s�#�#�c�)���V���v�0�0��8�8���4�4� ��5� c � � e Zd ZU dZeed<