host: delete the sandbox accessors that only tests use (SL6.6c) - #1538

Leaving code only. This PR changes only code that this effort removes from NVX: twelve items of host::sandbox that no NVX program calls, MountAccess::from_name, MountOwner::from_name and MountKind::from_name with their helper setting_from_name, SandboxMount::{guest_target, access, policy, owner, kind, absolute, absolute_policy_paths}, and SandboxOptions::new, with the edits that remove references to them. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Part of #1122 (SL6.6c, "the sandbox accessors that only tests use are gone", recorded on #1122). Parent #1087, umbrella #1076.

It needs SL6.4 (#1533), which has merged; it starts from 55f44aa4607, the tip after SL4.4d (#1545). SL6.7b (#1124) stacks on this one and makes host::sandbox and host::network::policy private to the CLI, which would leave these twelve items dead.

What and why

SL6.7b makes host::sandbox crate-private. Twelve of its items have no caller in any NVX program, only in the public API and in the module's own tests, so the warning-denied builds of every feature set would find them dead once private, on Windows, Linux and the macOS check. As SL6.6b did for SL6.4, this PR deletes them first, so that SL6.7b stays visibility-only. One commit, host: delete the sandbox accessors that only tests use (eed421f9):

• MountAccess::from_name, MountOwner::from_name, MountKind::from_name and setting_from_name, which read a share's settings by name, "as a recorded share gives it". The CLI maps the choices of --mount-owner itself, and records a sandbox's export plan, not its shares' settings. The imports that only they used, super::refused and crate::error::Result in mount/mod.rs, go with them.
• SandboxMount::{guest_target, access, policy, owner, kind}, which nothing outside the tests read: plan_mounts, validate_mounts and the checks of host paths read the fields within the mount module, and host_path, which options::sandbox_mounts calls, stays. SandboxMount::{absolute, absolute_policy_paths} called the crate-private absolute_with and absolute_policy_paths_with with paths::current_dir; plan_mounts and the checks of host paths call those variants, whose docs now say what the wrappers' said.
• SandboxOptions::new, the options of an operation with the defaults of nvx-rs sandbox. The CLI builds its SandboxOptions field by field from what it parsed.
• plan_mounts' docs no longer link to the deleted SandboxMount::absolute, and say instead how making a host path absolute fails, Io for an unreadable current directory or a drive-relative path that Windows cannot qualify.

The public API snapshots lose 21 lines on each platform: the eleven public methods at both of their paths, nvx::host::sandbox:: and nvx::host::sandbox::mount::, and nvx::host::sandbox::options::SandboxOptions::new. Nothing is added. README.md, doc/ and the case matrix name none of the items.

Size

Measured against 55f44aa4607, the tip after SL4.4d (#1545), by #1076's rules: leaving code only, no limit. The measuring script counts 0 added or changed code lines: production code only loses the items and their two imports (105 non-blank lines). Counted files: 3, src/host/sandbox/mount/{mod, request}.rs and src/host/sandbox/options.rs; src/host/sandbox/mount/aggregate.rs changes only its docs. 10 files change: +168 and −230 lines, tests and snapshots included.

Old tests of the area

• Retired, with what they checked: the three assertions of from_name's refusals, "unsupported sandbox mount owner \"root\"; choose vmm or caller" and "unsupported sandbox mount mode \"rx\"; choose ro or rw" in host::sandbox::mount::tests::mount_owner_defaults_to_vmm_and_forwards_caller, and "unsupported sandbox mount kind \"socket\"; choose directory or file" in host::sandbox::tests::file_shares_take_no_policy_paths_or_reserved_targets. The rest of both tests stays.
• Rewritten, checking what they checked of the code that stays: the 24 tests in Test changes, below.
• Kept: every other test of host::sandbox, the CLI's tests, and the integration and doc tests.

Test changes

python scripts/check_test_changes.py --base 55f44aa4607 lists 25 changes to existing tests and 2 added helpers, hence tests-modified:

• nvx-rs/src/host/sandbox/mount/tests.rs (6), with a new helper share, the directory share that parse returns for a value with its target, host path, access and policy:
  • mount_parser_defaults_to_read_only_and_accepts_rw compares the parsed shares with whole shares, so it still checks the target, the read-only and read-write access and the policy, and now also the owner and kind that parse took, instead of reading the accessors.
  • mount_parser_accepts_host_paths_with_commas and mount_owner_defaults_to_vmm_and_forwards_caller read the access and owner fields, which the mount module's tests see; the second also loses the two from_name assertions (Retired, above).
  • mount_access_policy_is_validated_and_forwarded compares the share that absolute_with(&paths::current_dir) returns with the whole share, its absolute host path and its whole policy, instead of reading its allowed and writable paths; its refusals don't change.
  • mount_absolute_path_keeps_symbolic_link_components and mount_absolute_path_keeps_a_link_on_the_host call absolute_with(&paths::current_dir), what absolute called.
• nvx-rs/src/host/sandbox/options/tests.rs (15), with a new helper defaults, which holds what SandboxOptions::new did:
  • the helper launching and the 9 tests that built options with SandboxOptions::new build them with defaults: sandbox_rejects_systemd_entrypoint, sandbox_managed_operations_reject_dry_run_before_state_access, sandbox_exec_forwards_explicit_empty_environment_and_cwd, sandbox_exec_forwards_environment_inheritance, sandbox_run_and_exec_alone_take_the_execution_options, sandbox_environment_is_validated_before_state_access, managed_non_launch_operations_reject_network_policy_options, sandbox_launches_take_the_scratch_image_that_their_upper_needs and sandbox_command_rejects_misplaced_mount_options;
  • policy_paths_need_a_preceding_mount_only_with_several_shares, policy_paths_attach_to_their_shares, sandbox_command_attributes_policy_paths_to_the_preceding_mount and sandbox_command_attributes_mount_deny_to_the_preceding_mount compare the shares of sandbox_mounts with whole shares, their policies included, instead of reading policy(), guest_target(), owner() and kind();
  • sandbox_mounts_take_the_kind_of_each_host_path tells the shared file by its host path instead of its target, and compares both shares, their kinds and the caller owner included, with whole shares.
• nvx-rs/src/host/sandbox/tests.rs (1): file_shares_take_no_policy_paths_or_reserved_targets (Retired, above).
• nvx-rs/src/host/sandbox/tests/specification.rs (3): windows_drive_relative_and_unc_paths, windows_drive_relative_policy_paths_become_absolute and the proptest host_paths_become_absolute call absolute_with and absolute_policy_paths_with with paths::current_dir, what the deleted wrappers called.

doc/acceptance-case-matrix.md names none of these tests, so it doesn't change.

Validation

local_gates.py --files (from dev) selects test-changes, markdown-links, test-layout, the check-nvx-rs steps and nvx-cli; I ran them from this branch's action definitions, with Rust 1.95.0, on Windows and on nvx-mshv-test (Azure Linux 3, kernel 6.18, linux-mshv, virtual machine), in a temporary worktree. Nothing here changes what a VM shows: no NVX program called these items. Before this merge turn, the branch was rebased onto 5715bb6d709, after SL7.8c, SL6.14, SL4.4a to SL4.4c, SL6.11b, SL6.11d and SL6.13b, with no conflicts, and the checks below ran on that rebase, a63fbd07b56. At this turn it was rebased onto 55f44aa4607, after SL4.4d (#1545), with no conflicts: public_api.py --update leaves the snapshots as they are, and git range-diff shows = against the reviewed e757a1872ed, so this head, 8abb8f7f031, carries the same change. On a63fbd07b56:

A code-review subagent reviewed the whole diff and found no issue. The validate-nvx unittest list is unaffected: this PR changes no script.

Left to CI: the microVM scenarios, as for any change, and openvmm-ci, for the unchanged pin.