fix: resolve all clippy warnings

Author: fullzer4

crates/evalbox-sandbox/tests/common/mod.rs

@@ -4,17 +4,14 @@ use std::path::PathBuf;
 
 /// Load a pre-compiled C payload binary.
 ///
-/// Payloads are compiled by build.rs and stored in OUT_DIR/payloads/.
+/// Payloads are compiled by build.rs and stored in `OUT_DIR/payloads`/.
 pub fn payload(name: &str) -> Vec<u8> {
     if let Some(path) = find_payload(name) {
         return std::fs::read(&path)
             .unwrap_or_else(|e| panic!("Failed to read payload {}: {}", path.display(), e));
     }
 
-    panic!(
-        "Payload '{}' not found. Run `cargo build -p evalbox-sandbox` first.",
-        name
-    );
+    panic!("Payload '{name}' not found. Run `cargo build -p evalbox-sandbox` first.");
 }
 
 /// Find payload in cargo's build directory structure.
@@ -97,4 +94,5 @@ pub fn skip_if_no_namespaces() -> bool {
 pub const SIGSYS: i32 = 31;
 
 /// SIGKILL signal number.
+#[allow(dead_code)]
 pub const SIGKILL: i32 = 9;

crates/evalbox-sandbox/tests/security/cve.rs

@@ -15,11 +15,11 @@ use crate::common::{SIGSYS, payload, skip_if_no_namespaces};
 
 /// Test that CVE-2024-1086 attack vector is blocked.
 ///
-/// CVE-2024-1086 is a use-after-free in Linux kernel's nf_tables.
-/// The exploit requires AF_NETLINK socket access to nf_tables subsystem.
+/// CVE-2024-1086 is a use-after-free in Linux kernel's `nf_tables`.
+/// The exploit requires `AF_NETLINK` socket access to `nf_tables` subsystem.
 /// Actively exploited in ransomware campaigns (CISA Oct 2025).
 ///
-/// Reference: https://www.sysdig.com/blog/detecting-cve-2024-1086
+/// Reference: <https://www.sysdig.com/blog/detecting-cve-2024-1086>
 #[test]
 #[ignore]
 fn test_cve_2024_1086_nftables_blocked() {
@@ -49,11 +49,11 @@ fn test_cve_2024_1086_nftables_blocked() {
 
 /// Test that CVE-2022-0185 attack vector is blocked.
 ///
-/// CVE-2022-0185 is a heap overflow in fsconfig() syscall.
-/// Requires CAP_SYS_ADMIN in user namespace.
+/// CVE-2022-0185 is a heap overflow in `fsconfig()` syscall.
+/// Requires `CAP_SYS_ADMIN` in user namespace.
 /// Won $31,337 bounty for escaping Google's kCTF containers.
 ///
-/// Reference: https://www.willsroot.io/2022/01/cve-2022-0185.html
+/// Reference: <https://www.willsroot.io/2022/01/cve-2022-0185.html>
 #[test]
 #[ignore]
 fn test_cve_2022_0185_fsconfig_blocked() {
@@ -85,9 +85,9 @@ fn test_cve_2022_0185_fsconfig_blocked() {
 ///
 /// TIOCSTI ioctl injects characters into terminal input buffer.
 /// Allows sandbox escape by injecting commands into parent shell.
-/// Affected bubblewrap, SELinux sandbox, util-linux runuser.
+/// Affected bubblewrap, `SELinux` sandbox, util-linux runuser.
 ///
-/// Reference: https://github.com/containers/bubblewrap/issues/142
+/// Reference: <https://github.com/containers/bubblewrap/issues/142>
 #[test]
 #[ignore]
 fn test_cve_2017_5226_tiocsti_blocked() {
@@ -117,11 +117,11 @@ fn test_cve_2017_5226_tiocsti_blocked() {
 
 /// Test that CVE-2022-0492 cgroups escape is blocked.
 ///
-/// CVE-2022-0492 allows container escape via cgroup release_agent.
+/// CVE-2022-0492 allows container escape via cgroup `release_agent`.
 /// Requires user namespace + mount capability.
 /// CVSS 7.0 (High).
 ///
-/// Reference: https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/
+/// Reference: <https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups>/
 #[test]
 #[ignore]
 fn test_cve_2022_0492_cgroups_blocked() {
@@ -151,11 +151,11 @@ fn test_cve_2022_0492_cgroups_blocked() {
 
 /// Test that fileless execution is blocked.
 ///
-/// memfd_create + execveat allows executing code without writing to filesystem.
+/// `memfd_create` + execveat allows executing code without writing to filesystem.
 /// Used by malware to evade detection.
 /// Bypasses filesystem-based security controls.
 ///
-/// Reference: https://www.aquasec.com/blog/intro-to-fileless-malware-in-containers/
+/// Reference: <https://www.aquasec.com/blog/intro-to-fileless-malware-in-containers>/
 #[test]
 #[ignore]
 fn test_fileless_memfd_blocked() {
@@ -212,7 +212,7 @@ fn test_ioctl_tioclinux_blocked() {
 /// Test that TIOCSETD ioctl is blocked.
 ///
 /// TIOCSETD loads TTY line disciplines which have had many vulnerabilities:
-/// - CVE-2017-2636: n_hdlc double-free
+/// - CVE-2017-2636: `n_hdlc` double-free
 /// - CVE-2019-11815: slip line discipline race
 /// - Multiple other line discipline bugs
 #[test]
@@ -246,7 +246,7 @@ fn test_ioctl_tiocsetd_blocked() {
 /// User namespaces are the prerequisite for most kernel exploits:
 /// - CVE-2024-1086, CVE-2022-0185, CVE-2022-0492, CVE-2021-22555
 ///
-/// Blocking clone(CLONE_NEWUSER) prevents a large class of kernel exploits.
+/// Blocking `clone(CLONE_NEWUSER)` prevents a large class of kernel exploits.
 #[test]
 #[ignore]
 fn test_userns_creation_blocked() {
@@ -280,7 +280,7 @@ fn test_userns_creation_blocked() {
 /// - Inject code
 /// - Bypass security controls in traced process
 ///
-/// CVE-2019-13272: ptrace PTRACE_TRACEME privilege escalation
+/// CVE-2019-13272: ptrace `PTRACE_TRACEME` privilege escalation
 #[test]
 #[ignore]
 fn test_ptrace_blocked() {
@@ -313,7 +313,7 @@ fn test_ptrace_blocked() {
 /// By putting garbage in upper 32 bits, attackers bypass filters while kernel
 /// processes only the lower 32 bits. Affected Flatpak < 1.0.8.
 ///
-/// Reference: https://github.com/flatpak/flatpak/security/advisories/GHSA-6qcp-mh39-cp53
+/// Reference: <https://github.com/flatpak/flatpak/security/advisories/GHSA-6qcp-mh39-cp53>
 #[test]
 #[ignore]
 fn test_cve_2019_10063_ioctl_bypass_blocked() {

crates/evalbox-sandbox/tests/security/filesystem.rs

@@ -26,8 +26,7 @@ fn test_cannot_read_etc_shadow() {
     let stderr = output.stderr_str();
     assert!(
         stderr.contains("No such file") || stderr.contains("Permission denied"),
-        "Expected 'No such file' or 'Permission denied', got: {}",
-        stderr
+        "Expected 'No such file' or 'Permission denied', got: {stderr}"
     );
 }
 
@@ -136,17 +135,12 @@ fn test_path_traversal_blocked() {
         assert!(
             !has_nixbld && !has_real_users && line_count <= 5,
             "Path traversal should not leak real /etc/passwd.\n\
-             Expected minimal sandbox passwd, got {} lines:\n{}",
-            line_count,
-            content
+             Expected minimal sandbox passwd, got {line_count} lines:\n{content}"
         );
 
         // If there's root: it should be the sandbox's nobody-only passwd
         if has_root {
-            panic!(
-                "Path traversal leaked real /etc/passwd with root entry:\n{}",
-                content
-            );
+            panic!("Path traversal leaked real /etc/passwd with root entry:\n{content}");
         }
     }
 }
@@ -190,8 +184,7 @@ fn test_proc_self_exe_safe() {
         let exe_path = output.stdout_str();
         assert!(
             !exe_path.contains("/home/") && !exe_path.contains("/usr/"),
-            "/proc/self/exe should not reveal host paths: {}",
-            exe_path
+            "/proc/self/exe should not reveal host paths: {exe_path}"
         );
     }
 }

crates/evalbox-sandbox/tests/security/network.rs

@@ -74,9 +74,7 @@ fn test_external_dns_blocked() {
     let has_ip = stdout.contains('.') && stdout.chars().any(|c| c.is_ascii_digit());
     assert!(
         !has_ip || !output.success(),
-        "External DNS should not resolve. stdout: {}, stderr: {}",
-        stdout,
-        stderr
+        "External DNS should not resolve. stdout: {stdout}, stderr: {stderr}"
     );
 }
 

crates/evalbox-sandbox/tests/security/resources.rs

@@ -28,8 +28,7 @@ fn test_timeout_enforced() {
     assert_eq!(output.status, Status::Timeout, "Status should be Timeout");
     assert!(
         elapsed < Duration::from_secs(2),
-        "Should timeout quickly, took {:?}",
-        elapsed
+        "Should timeout quickly, took {elapsed:?}"
     );
 }
 
@@ -50,7 +49,7 @@ fn test_infinite_loop_timeout() {
     assert_eq!(output.status, Status::Timeout, "Status should be Timeout");
 }
 
-/// Test that max_pids limit is enforced.
+/// Test that `max_pids` limit is enforced.
 #[test]
 #[ignore]
 fn test_max_pids_enforced() {
@@ -97,8 +96,7 @@ fn test_output_limit_enforced() {
 
     assert!(
         total_output <= 1024 * 4, // Allow some buffer for implementation
-        "Output should be limited to ~1KB, got {} bytes",
-        total_output
+        "Output should be limited to ~1KB, got {total_output} bytes"
     );
 
     // Either output was truncated or process was killed when limit exceeded
@@ -140,9 +138,7 @@ fn test_memory_limit_set() {
     // Just verify the command ran - actual memory enforcement depends on system config
     assert!(
         output.exit_code.is_some(),
-        "Should get exit code. stdout: {}, stderr: {}",
-        stdout,
-        stderr
+        "Should get exit code. stdout: {stdout}, stderr: {stderr}"
     );
 }
 
@@ -167,8 +163,7 @@ fn test_fd_limit_set() {
             // Verify limit is set to a reasonable value (not unlimited)
             assert!(
                 limit < 1000000,
-                "FD limit should be reasonable, got {}",
-                limit
+                "FD limit should be reasonable, got {limit}"
             );
         }
     }

crates/evalbox-sandbox/tests/security/seccomp.rs

@@ -109,7 +109,7 @@ fn test_reboot_blocked() {
     );
 }
 
-/// Test that clone(CLONE_NEWUSER) is blocked.
+/// Test that `clone(CLONE_NEWUSER)` is blocked.
 /// Creating new namespaces inside sandbox could allow escape.
 #[test]
 #[ignore]
@@ -134,8 +134,8 @@ fn test_clone_newuser_blocked() {
     );
 }
 
-/// Test that AF_NETLINK sockets are blocked.
-/// Netlink gives access to kernel interfaces like nf_tables (CVE-2024-1086).
+/// Test that `AF_NETLINK` sockets are blocked.
+/// Netlink gives access to kernel interfaces like `nf_tables` (CVE-2024-1086).
 #[test]
 #[ignore]
 fn test_socket_netlink_blocked() {
@@ -159,7 +159,7 @@ fn test_socket_netlink_blocked() {
     );
 }
 
-/// Test that SOCK_RAW sockets are blocked.
+/// Test that `SOCK_RAW` sockets are blocked.
 /// Raw sockets allow crafting arbitrary packets.
 #[test]
 #[ignore]

crates/evalbox/examples/full_test.rs

@@ -18,7 +18,7 @@ fn main() {
                 output.stdout_str().lines().next().unwrap_or("")
             );
         }
-        Err(e) => eprintln!("   Error: {}", e),
+        Err(e) => eprintln!("   Error: {e}"),
     }
 
     // Python test
@@ -32,7 +32,7 @@ fn main() {
             );
             println!("   Output: {}", output.stdout_str().trim());
         }
-        Err(e) => eprintln!("   Error: {}", e),
+        Err(e) => eprintln!("   Error: {e}"),
     }
 
     // Go test
@@ -49,7 +49,7 @@ fn main() {
             );
             println!("   Output: {}", output.stdout_str().trim());
         }
-        Err(e) => eprintln!("   Error: {}", e),
+        Err(e) => eprintln!("   Error: {e}"),
     }
 
     println!("\n=== All tests completed ===");

crates/evalbox/src/probe.rs

@@ -1,4 +1,4 @@
-//! Probe trait and RuntimeInfo types.
+//! Probe trait and `RuntimeInfo` types.
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};