# cargo: the "write" policy, with crates.io and cargo's registry cache.
# Build scripts and procedural macros run here, which is the point: they
# reach nothing but crates.io. The toolchains are read-only, as they run
# outside the sandbox later: install one outside blinker. The registry
# cache is writable: a crate that is not yours can put things there that
# later builds outside the sandbox use. policies/commands/cargo.policy in
# blinker's config directory comes first.

# type  access  pattern
include write
file    write   ${CARGO_HOME:-~/.cargo}/
file    read    ${RUSTUP_HOME:-~/.rustup}
file    write   ${CARGO_TARGET_DIR:-target}/

host    allow   index.crates.io
host    allow   static.crates.io
host    allow   github.com
host    allow   codeload.github.com
host    allow   *.githubusercontent.com

env     allow   CARGO_HOME
env     allow   RUSTUP_HOME
env     allow   RUSTUP_TOOLCHAIN
env     allow   RUSTFLAGS
env     allow   CARGO_TARGET_DIR