add a per-agent egress log mode

swarmctl/src/permissions.rs

@@ -78,6 +78,7 @@ fn with_permissions(
     Ok(Permissions {
         permissions: Some(granted),
         unrestricted_internet,
+        internet_log: None,
     })
 }
 
@@ -121,10 +122,11 @@ fn render(p: &Permissions) -> String {
             .collect::<Vec<_>>()
             .join(", "),
     };
-    let internet = match p.unrestricted_internet {
-        None => "(not set; unrestricted)",
-        Some(true) => "unrestricted",
-        Some(false) => "restricted",
+    let internet = match (p.unrestricted_internet, p.internet_log) {
+        (None, _) => "(not set; unrestricted)",
+        (Some(true), _) => "unrestricted",
+        (Some(false), Some(true)) => "log (unlisted names are allowed and logged as would_deny)",
+        (Some(false), _) => "restricted",
     };
     format!("permissions: {caps}\nunrestricted_internet: {internet}\n")
 }
@@ -197,4 +199,17 @@ mod tests {
             r#"{"permissions":["web_tools"]}"#
         );
     }
+
+    /// A logging agent shows as such, not as plainly restricted.
+    #[test]
+    fn a_logging_agent_is_shown_as_logging() {
+        let log: Permissions =
+            serde_json::from_str(r#"{"unrestricted_internet":false,"internet_log":true}"#).unwrap();
+        assert!(render(&log).contains("unrestricted_internet: log ("));
+        let off: Permissions = serde_json::from_str(r#"{"unrestricted_internet":false}"#).unwrap();
+        assert!(
+            render(&off).ends_with("unrestricted_internet: restricted\n"),
+            "control"
+        );
+    }
 }