feat(filesystem): add bind-mount deny lists to hide host files/paths

Cargo.toml

@@ -121,6 +121,7 @@ hex = "0.4"
 hickory-net = "0.26.1"
 hickory-proto = "0.26.1"
 httlib-hpack = "0.1.3"
+ignore = "0.4"
 indicatif = "0.18"
 ipnetwork = { version = "0.21.0", features = ["serde"] }
 libc = "0.2"

crates/cli/lib/commands/common.rs

@@ -604,6 +604,7 @@ struct CliMountOptions {
     host_permissions: Option<microsandbox::sandbox::HostPermissions>,
     size_mib: Option<u32>,
     quota_mib: Option<u32>,
+    deny: Vec<String>,
     named_kind: Option<VolumeKind>,
     fstype: Option<String>,
     format: Option<DiskImageFormat>,
@@ -617,6 +618,7 @@ struct CliMountOptionSupport {
     policies: bool,
     size: bool,
     quota: bool,
+    deny: bool,
     named_kind: bool,
     fstype: bool,
     format: bool,
@@ -1617,6 +1619,7 @@ pub fn apply_explicit_dir_mount(
             policies: true,
             quota: true,
             owner: true,
+            deny: true,
             ..CliMountOptionSupport::default()
         },
     )?;
@@ -1788,6 +1791,9 @@ fn apply_common_mount_options(mut mount: MountBuilder, options: CliMountOptions)
     if let (Some(uid), Some(gid)) = (options.override_uid, options.override_gid) {
         mount = mount.owner(uid, gid);
     }
+    if !options.deny.is_empty() {
+        mount = mount.deny(options.deny);
+    }
     mount
 }
 
@@ -1986,6 +1992,9 @@ fn parse_cli_mount_options(
                         parsed.quota_mib =
                             Some(ui::parse_size_mib(value).map_err(anyhow::Error::msg)?);
                     }
+                    "deny" if support.deny => {
+                        parsed.deny.push(value.to_string());
+                    }
                     "kind" if support.named_kind => {
                         if seen_named_kind {
                             anyhow::bail!("mount option `kind` specified more than once");
@@ -2034,7 +2043,7 @@ fn parse_cli_mount_options(
                             anyhow::anyhow!("invalid gid {value:?} (expected an unsigned integer)")
                         })?);
                     }
-                    "stat-virt" | "host-perms" | "size" | "quota" | "kind" | "fstype"
+                    "stat-virt" | "host-perms" | "size" | "quota" | "deny" | "kind" | "fstype"
                     | "format" | "uid" | "gid" => {
                         anyhow::bail!("mount option `{key}` is not valid here");
                     }
@@ -3937,6 +3946,65 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn test_apply_explicit_dir_mount_deny_single() {
+        let dir = make_temp_dir("msb-mount-dir-deny");
+        let spec = format!("{}:/work:deny=.env", dir.display());
+        let mount = build_explicit(&spec, apply_explicit_dir_mount).await;
+        match mount {
+            VolumeMount::Bind { deny, .. } => assert_eq!(deny, vec![".env".to_string()]),
+            other => panic!("expected Bind, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_apply_explicit_dir_mount_deny_repeatable_preserves_inner_equals() {
+        let dir = make_temp_dir("msb-mount-dir-deny-rep");
+        let spec = format!(
+            "{}:/work:deny=.env,deny=*.log,deny=sub/secret=file",
+            dir.display()
+        );
+        let mount = build_explicit(&spec, apply_explicit_dir_mount).await;
+        match mount {
+            VolumeMount::Bind { deny, .. } => {
+                assert_eq!(
+                    deny,
+                    vec![
+                        ".env".to_string(),
+                        "*.log".to_string(),
+                        "sub/secret=file".to_string()
+                    ]
+                );
+            }
+            other => panic!("expected Bind, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_apply_explicit_dir_mount_deny_default_empty() {
+        let dir = make_temp_dir("msb-mount-dir-deny-none");
+        let spec = format!("{}:/work:ro", dir.display());
+        let mount = build_explicit(&spec, apply_explicit_dir_mount).await;
+        match mount {
+            VolumeMount::Bind { deny, .. } => assert!(deny.is_empty()),
+            other => panic!("expected Bind, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_apply_explicit_file_mount_rejects_deny() {
+        let file = write_temp("fixture-deny");
+        let spec = format!("{}:/fixture:deny=.env", file.display());
+        let err = match apply_explicit_file_mount(SandboxBuilder::new("test"), &spec) {
+            Ok(_) => panic!("expected deny to be rejected for --mount-file"),
+            Err(e) => e.to_string(),
+        };
+        assert!(
+            err.contains("`deny` is not valid here"),
+            "expected deny rejection, got {err:?}"
+        );
+    }
+
     #[tokio::test]
     async fn test_apply_explicit_file_mount() {
         let file = write_temp("fixture");

crates/cli/lib/commands/inspect.rs

@@ -54,6 +54,18 @@ fn mount_flags_suffix(options: MountOptions) -> String {
     format!(" ({})", flags.join(","))
 }
 
+/// Render the deny-list suffix for a bind mount in `msb inspect` output.
+///
+/// Returns an empty string when there is no deny list so common mounts stay
+/// terse; otherwise renders `[deny=a, b]` with the patterns comma-joined.
+fn deny_suffix(deny: &[String]) -> String {
+    if deny.is_empty() {
+        String::new()
+    } else {
+        format!(" [deny={}]", deny.join(", "))
+    }
+}
+
 //--------------------------------------------------------------------------------------------------
 // Types
 //--------------------------------------------------------------------------------------------------
@@ -256,6 +268,7 @@ pub async fn run(args: InspectArgs) -> anyhow::Result<()> {
                         host_permissions,
                         follow_root_symlinks,
                         quota_mib,
+                        deny,
                     } => {
                         let flags = mount_flags_suffix(*options);
                         let suffix = mount_policy_suffix(
@@ -266,8 +279,9 @@ pub async fn run(args: InspectArgs) -> anyhow::Result<()> {
                         let quota = quota_mib
                             .map(|mib| format!(" [quota={mib}MiB]"))
                             .unwrap_or_default();
+                        let deny = deny_suffix(deny);
                         println!(
-                            "  {guest:<16}\u{2192} {}{flags}{suffix}{quota}",
+                            "  {guest:<16}\u{2192} {}{flags}{suffix}{quota}{deny}",
                             host.display()
                         );
                     }
@@ -464,4 +478,24 @@ mod tests {
 
         assert!(changes.is_empty());
     }
+
+    #[test]
+    fn deny_suffix_empty_list_is_terse() {
+        assert_eq!(deny_suffix(&[]), "");
+    }
+
+    #[test]
+    fn deny_suffix_single_pattern() {
+        assert_eq!(deny_suffix(&[".env".to_string()]), " [deny=.env]");
+    }
+
+    #[test]
+    fn deny_suffix_multiple_patterns_are_comma_joined() {
+        let patterns = vec![
+            ".env".to_string(),
+            "*.log".to_string(),
+            "sub/secret".to_string(),
+        ];
+        assert_eq!(deny_suffix(&patterns), " [deny=.env, *.log, sub/secret]");
+    }
 }

crates/filesystem/Cargo.toml

@@ -11,6 +11,7 @@ edition.workspace = true
 path = "lib/lib.rs"
 
 [dependencies]
+ignore.workspace = true
 libc.workspace = true
 microsandbox-utils.workspace = true
 msb_krun.workspace = true