Skip to main content
FsCapability represents a single filesystem permission grant. It’s a read-only view returned by CapabilitySet.fs_capabilities().
You don’t create FsCapability objects directly. They’re created internally when you call allow_path() or allow_file() on a CapabilitySet.

​
Properties

​
original

@property
original: str
The original path as specified by the user. 
from nono_py import CapabilitySet, AccessMode

caps = CapabilitySet()
caps.allow_path("/tmp", AccessMode.READ)

cap = caps.fs_capabilities()[0]
print(cap.original)  # "/tmp"

​
resolved

@property
resolved: str
The canonicalized absolute path after resolving symlinks. 
cap = caps.fs_capabilities()[0]
print(cap.resolved)  # "/private/tmp" (on macOS, /tmp -> /private/tmp)
On macOS, common paths like /tmp, /var, and /etc are symlinks to /private/tmp, /private/var, and /private/etc respectively.

​
access

@property
access: AccessMode
The access mode granted for this path. 
cap = caps.fs_capabilities()[0]
print(cap.access)  # AccessMode.READ

​
is_file

@property
is_file: bool
True if this capability grants access to a single file, False for a directory (recursive access). 
caps = CapabilitySet()
caps.allow_path("/tmp", AccessMode.READ)
caps.allow_file("/etc/hosts", AccessMode.READ)

for cap in caps.fs_capabilities():
    kind = "file" if cap.is_file else "directory"
    print(f"{cap.resolved}: {kind}")
# /private/tmp: directory
# /private/etc/hosts: file

​
source

@property
source: CapabilitySource
The origin of this capability (user, group, or system). 
cap = caps.fs_capabilities()[0]
print(cap.source)  # CapabilitySource(user)
See CapabilitySource for details.

​
String Representation

cap = caps.fs_capabilities()[0]

print(str(cap))   # "/private/tmp (read, directory)"
print(repr(cap))  # "FsCapability(path='/private/tmp', access=read, is_file=False)"

​
Example: Listing Capabilities

from nono_py import CapabilitySet, AccessMode

caps = CapabilitySet()
caps.allow_path("/tmp", AccessMode.READ_WRITE)
caps.allow_path("/data", AccessMode.READ)
caps.allow_file("/etc/hosts", AccessMode.READ)
caps.allow_file("/var/log/app.log", AccessMode.WRITE)

print("Filesystem Capabilities:")
print("-" * 60)

for cap in caps.fs_capabilities():
    kind = "file" if cap.is_file else "dir "
    print(f"  [{kind}] {cap.resolved}")
    print(f"         access: {cap.access}")
    print(f"         source: {cap.source}")
    print()
Output: 
Filesystem Capabilities:
------------------------------------------------------------
  [dir ] /private/tmp
         access: AccessMode.READ_WRITE
         source: CapabilitySource(user)

  [dir ] /data
         access: AccessMode.READ
         source: CapabilitySource(user)

  [file] /private/etc/hosts
         access: AccessMode.READ
         source: CapabilitySource(user)

  [file] /private/var/log/app.log
         access: AccessMode.WRITE
         source: CapabilitySource(user)