Move require_run_user to lib.rs and make blacklist module private

src/blacklist.rs

@@ -42,10 +42,7 @@ pub fn resolve_overlays(ctx: &PathContext) -> Result<BlacklistOverlays, SandboxE
 
 pub fn resolve_path_context() -> Result<PathContext, SandboxError> {
     let home = crate::require_home()?;
-    let run_user = std::env::var("XDG_RUNTIME_DIR")
-        .ok()
-        .or_else(resolve_run_user_from_proc)
-        .ok_or(SandboxError::RunUserNotFound)?;
+    let run_user = crate::require_run_user()?;
     Ok(PathContext { home, run_user })
 }
 
@@ -88,17 +85,6 @@ fn is_under_tmpfs_dir(path: &Path, tmpfs_dirs: &[PathBuf]) -> bool {
     tmpfs_dirs.iter().any(|dir| path.starts_with(dir))
 }
 
-fn resolve_run_user_from_proc() -> Option<String> {
-    let status = fs::read_to_string("/proc/self/status").ok()?;
-    for line in status.lines() {
-        if let Some(rest) = line.strip_prefix("Uid:") {
-            let uid = rest.split_whitespace().next()?;
-            return Some(format!("/run/user/{uid}"));
-        }
-    }
-    None
-}
-
 // ---------------------------------------------------------------------------
 // Curated sensitive paths from firejail disable-common.inc + disable-programs.inc.
 // Goal: protect secrets, credentials, and session tokens from agentic access.