147         // Safe because TargetPolicyWrapper can only be constructed with a non-null pointer.  in drop()
171     // Safe because the returned raw pointer is a non-owning pointer and we are free  in is_sandbox_broker()
178     // Safe because the returned raw pointer is a non-owning pointer and we are  in is_sandbox_target()
191         // Safe because RESULT is only written once, and call_once will cause  in get()
216     /// Takes a &mut self because sbox_broker_init mutates the underlying broker
219         // Safe because BrokerServices can only be constructed with a non-null  in init()
231         // Safe because BrokerServices can only be constructed with a non-null pointer.  in create_policy()
242     /// Takes a `&mut self` because `sbox_spawn_target()` mutates the underlying
258         // Safe because the external arguments must be constructed in a safe  in spawn_target()
278         // Safe because we are adopting the process and thread handles here,  in spawn_target()
304     /// Takes a `&mut self` because `sbox_wait_for_all_targets()` mutates the
307         // Safe because BrokerServices can only be constructed with a non-null pointer.  in wait_for_all_targets()
325         // Safe because RESULT is only written once, and call_once will cause  in get()
352     /// Takes a `&mut self` because `sbox_target_init()` mutates the underlying
355         // Safe because TargetServices can only be constructed with a non-null pointer.  in init()
366     /// Takes a `&mut self` because `sbox_lower_token()` mutates the underlying
369         // Safe because TargetServices can only be constructed with a non-null pointer.  in lower_token()
377     /// Takes a `&mut self` because `sbox_set_token_level()` mutates the
380         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_token_level()
389         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in initial_token_level()
395         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in lockdown_token_level()
402     /// Takes a `&mut self` because `sbox_set_job_level()` mutates the
405         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_job_level()
414         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in job_level()
420     /// Takes a `&mut self` because `sbox_set_integrity_level()` mutates the
423         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_integrity_level()
432     /// Takes a `&mut self` because `sbox_set_delayed_integrity_level()` mutates the
435         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_delayed_integrity_level()
444         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in integrity_level()
452     /// Takes a `&mut self` because `sbox_set_alternate_desktop` mutates the
455         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_alternate_desktop()
464     /// Takes a `&mut self` because `sbox_create_alternate_desktop` mutates the
467         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in create_alternate_desktop()
478     /// Takes a `&mut self` because `sbox_destroy_alternate_desktop` mutates the
481         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in destroy_alternate_desktop()
488     /// Takes a `&mut self` because `sbox_set_lowbox` mutates the underlying
491         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_lowbox()
500     /// Takes a `&mut self` because `sbox_set_process_mitigations` mutates the
503         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_process_mitigations()
512         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in process_mitigations()
519     /// Takes a `&mut self` because `sbox_set_delayed_process_mitigations`
522         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_delayed_process_mitigations()
531         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in delayed_process_mitigations()
538     /// Takes a `&mut self` because `sbox_set_disconnect_csrss` mutates the
541         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_disconnect_csrss()
550     /// Takes a `&mut self` because `sbox_set_delayed_process_mitigations`
553         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_strict_interceptions()
569     /// Takes a `&mut self` because `sbox_set_stdout_handle()` mutates the underlying policy object.
571         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_stdout_handle()
597     /// Takes a `&mut self` because `sbox_set_stderr_handle` mutates the underlying policy object.
599         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_stderr_handle()
630     /// Takes a `&mut self` because `sbox_add_rule` mutates the underlying
638         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in add_rule()
656     /// Takes a `&mut self` because `sbox_add_dll_to_unload` mutates the
659         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in add_dll_to_unload()
673     /// Takes a `&mut self` because `sbox_add_kernel_object_to_close` mutates the
684         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in add_kernel_object_to_close()
701     /// Takes a `&mut self` because `sbox_add_handle_to_share()` mutates the underlying policy
704         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in add_handle_to_share()
714     /// Takes a `&mut self` because `sbox_set_lockdown_default_dacl()` mutates
717         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in set_lockdown_default_dacl()
726     /// Takes a `&mut self` because `sbox_add_restricting_random_sid()` mutates
729         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in add_restricting_random_sid()
742     /// Takes a `&mut self` because `sbox_add_dll_to_unload` mutates the
749         // Safe because TargetPolicy can only be constructed with a non-null policy pointer.  in add_app_container_profile()
765         // Safe because TargetPolicy can only be constructed with a non-null  in policy_info()
779         // Safe because PolicyInfo can only be constructed with a non-null  in json()