feat: whitelist virtnodedevd

[luytan]

Description

Move the ALLOWED_PROGRAMS array to its own file and add virtnodedevd to the whitelisted programs

Checklist:

• My code follows the style guidelines of this project (cargo fmt)
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the mdBook documentation
• My changes generate no new warnings (clippy/clang)
• New and existing unit tests pass locally with my changes (either use nix flake check or wait for the ci)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3fad6892-7114-4a7e-975a-0050d1b86a86

📥 Commits

Reviewing files that changed from the base of the PR and between 644c63e and 449b5b4.

📒 Files selected for processing (3)

• crates/cardwire-daemon/src/core/mod.rs
• crates/cardwire-daemon/src/core/whitelist.rs
• crates/cardwire-daemon/src/manager.rs

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added a shared whitelist of recognized system and package-management programs.
  • Program filtering now consistently uses the centralized list of allowed programs.

Walkthrough

The daemon adds a public ALLOWED_PROGRAMS whitelist module. whitelist_programs now uses this shared constant instead of a local array. The existing blocker lock and communication loop remain unchanged.

Changes

Program whitelist

Layer / File(s)	Summary
Define and use the shared whitelist crates/cardwire-daemon/src/core/whitelist.rs, crates/cardwire-daemon/src/core/mod.rs, crates/cardwire-daemon/src/manager.rs	The core module exposes ALLOWED_PROGRAMS with recognized program names. whitelist_programs iterates over the shared constant while preserving its existing locking and allow_comm behavior.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: 🔵 Low · up to 449b5

This change allows virtnodedevd processes to bypass the same eBPF protections as other whitelisted programs. The exemption is based only on the process name, so owner awareness is warranted because another process using that name could receive the same broad access; the PR remains mergeable with that bounded security risk understood.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: adding virtnodedevd to the whitelist.
Description check	✅ Passed	The description summarizes the code changes and completes the checklist. It does not include a related issue or detailed feature motivation, but these omissions are non-critical because the change sum…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description summarizes the code changes and completes the checklist. It does not include a related issue or detailed feature motivation, but these omissions are non-critical because the change summary is clear.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}