Move require_run_user to lib.rs and make blacklist module private

src/lib.rs

@@ -1,5 +1,5 @@
 mod agents;
-pub mod blacklist;
+mod blacklist;
 mod errors;
 mod preflight;
 mod sandbox;
@@ -8,6 +8,7 @@ pub use errors::SandboxError;
 
 use std::env;
 use std::ffi::OsString;
+use std::fs;
 use std::os::unix::process::CommandExt;
 use std::path::PathBuf;
 
@@ -35,6 +36,24 @@ pub fn require_home() -> Result<String, SandboxError> {
         .ok_or(SandboxError::HomeNotSet)
 }
 
+pub fn require_run_user() -> Result<String, SandboxError> {
+    env::var("XDG_RUNTIME_DIR")
+        .ok()
+        .or_else(resolve_run_user_from_proc)
+        .ok_or(SandboxError::RunUserNotFound)
+}
+
+fn resolve_run_user_from_proc() -> Option<String> {
+    let status = fs::read_to_string("/proc/self/status").ok()?;
+    for line in status.lines() {
+        if let Some(rest) = line.strip_prefix("Uid:") {
+            let uid = rest.split_whitespace().next()?;
+            return Some(format!("/run/user/{uid}"));
+        }
+    }
+    None
+}
+
 pub fn run(config: SandboxConfig) -> Result<(), SandboxError> {
     preflight::check(&config)?;