nvx-rs: share the sandbox tests' policy and native helpers

nvx-rs/src/host/sandbox/mount/tests.rs

@@ -5,15 +5,7 @@ use std::fs;
 use super::*;
 use crate::ErrorKind;
 use crate::host::python::fs::cwd;
-
-fn policy(denied: &[&str], allowed: &[&str], writable: &[&str]) -> MountPolicy {
-    let owned = |paths: &[&str]| paths.iter().map(|&path| path.to_owned()).collect();
-    MountPolicy {
-        denied: owned(denied),
-        allowed: owned(allowed),
-        writable: owned(writable),
-    }
-}
+use crate::host::sandbox::tests::{native, policy};
 
 fn parse(value: &str, policy: MountPolicy) -> Result<SandboxMount> {
     SandboxMount::parse(value, policy, MountOwner::Vmm, MountKind::Directory)
@@ -25,10 +17,6 @@ fn message<T: std::fmt::Debug>(result: Result<T>) -> String {
     error.to_string()
 }
 
-fn native(path: &str) -> String {
-    PurePath::native(path).as_str().to_owned()
-}
-
 #[test]
 fn mount_parser_defaults_to_read_only_and_accepts_rw() {
     let default = parse("/workspace,host-dir", MountPolicy::default()).unwrap();

nvx-rs/src/host/sandbox/tests.rs

@@ -13,7 +13,9 @@ fn distro() -> SandboxLayer {
     SandboxLayer::parse(DISTRO).unwrap()
 }
 
-fn policy(denied: &[&str], allowed: &[&str], writable: &[&str]) -> MountPolicy {
+/// Returns the access policy of a share that hides `denied`, exposes `allowed` inside them again,
+/// and lets the workload modify only `writable`. The share tests use it too.
+pub(super) fn policy(denied: &[&str], allowed: &[&str], writable: &[&str]) -> MountPolicy {
     let owned = |paths: &[&str]| paths.iter().map(|&path| path.to_owned()).collect();
     MountPolicy {
         denied: owned(denied),
@@ -47,7 +49,8 @@ fn message<T: std::fmt::Debug>(result: Result<T>) -> String {
     result.unwrap_err().to_string()
 }
 
-fn native(path: &str) -> String {
+/// Returns `str(pathlib.Path(path))` on this host. The share tests use it too.
+pub(super) fn native(path: &str) -> String {
     PurePath::native(path).as_str().to_owned()
 }