nordisk/heimdall

crates/heimdall-probe/src/lib.rs

// SPDX-License-Identifier: AGPL-3.0-only
// Copyright (C) 2026 Ignalina ApS and Vetra Automation AB

//! heimdall-probe (spec §3): **Heimdall is a defensive sandbox.** The
//! software is probed while it runs, and its syscall allowlist is generated
//! from what it actually did.
//!
//! 1. [`learn`]: learning mode, seccomp USER_NOTIF "log and allow" in Rust
//!    (no strace, no ptrace), recording each call's number, arch and the
//!    argument facts of [`facts::SPECS`].
//! 2. [`observe::Observations`]: the union over all runs, each call with the
//!    tests that made it (`<arch>-<libc>.probe.json`).
//! 3. [`minimise::generate`]: the smallest rule set (exact values for small
//!    sets, masks for flag fields, bare allow where arguments vary) plus the
//!    review: near-miss calls (seen only on error paths), `W|X` mappings
//!    (left out), bare allows, fixed rules.
//! 4. [`codegen`]: `profiles/<workload>/<arch>-<libc>.rs` (a `const`
//!    table), `.json` and `.oci.json`, deterministic.
//! 5. [`check::check`]: the drift check; a failure names the new call and
//!    the test that made it.
//!
//! [`workload`] ties these to `profiles/<workload>/workload.toml`, as
//! `heimdall profile probe|gen|check` and a Build Thing step call them.

pub mod check;
pub mod codegen;
pub mod facts;
pub mod learn;
pub mod live;
pub mod minimise;
pub mod observe;
pub mod workload;

pub use check::{check, Violation};
pub use learn::{learn, ProbeRun, RunOutcome};
pub use live::{learn_live, record, Evidence, LiveRun};
pub use minimise::{generate, GenOptions, Generated, Review};
pub use observe::{Call, Observations};
pub use workload::{
    check_workload, gen_and_write, load_generated, probe_and_write, CheckReport, Paths, ProbeError,
    ProbeOptions, Workload,
};