- Landlock needs no separate executable, installation or `sysctl`
configuration, so use it as the only Linux sandbox implementation
rather than an opt-in behind `$HOMEBREW_SANDBOX_LINUX_LANDLOCK`.
- Delete `Sandbox::Bubblewrap`, the `brew setup-sandbox` command and
the implicit `bubblewrap` dependency, none of which Landlock needs.
- Remove the Bubblewrap-era `Sandbox` API (`ensure_sandbox_installed!`,
`configure!`, `configuration_commands`, `sandbox_install_command`)
and its call sites now that no backend needs installing or
configuring.
- Simplify `brew doctor`'s `check_linux_sandbox` to report the
Landlock failure reason with the `$HOMEBREW_NO_SANDBOX_LINUX`
workaround.
- Amazon Fargate's kernel 6.1 only provides Landlock ABI 2, which the
previous `MINIMUM_ABI` of 3 rejected outright.
- ABI 2 can still permit cross-directory renames via `ACCESS_FS_REFER`;
it only lacks `ACCESS_FS_TRUNCATE`, noted on `MINIMUM_TRUNCATE_ABI`
as truncation has no profile rule that could gate a warning.
- Mask device path rules with `handled_access_fs` so the `/dev/full`
truncate bit no longer makes `landlock_add_rule(2)` fail with
`EINVAL` on ABI 2.
- Warn that network access cannot be restricted at all below ABI 4
rather than implying partial restrictions were applied.
- Make every statically-poked method public and call it directly,
keeping `public_send` only for dynamically-named public methods.
- Read and write state through public `attr_*` accessors instead of
instance variable reflection.
- Enable `Homebrew/NoSendInTests` and
`Homebrew/NoInstanceVariableAccessInTests` now the test suite is
clean, so neither pattern creeps back in.
- Keep rare justified disables, e.g. `Module#remove_const` is
private core Ruby and raw memoisation state has no accessor.
- Sandboxed glibc tests open POSIX queues for reading and fail with
`EACCES` when Landlock handles read restrictions.
- Limit the extra right to read-restricted profiles because Landlock
rejects rights omitted from the ruleset's handled mask.
- permit standard terminal and ENOSPC device operations
- permit POSIX shared memory and message queues
- select Landlock without installing Bubblewrap in Linux tests
- Landlock is a kernel ABI with no user-visible version so there was
no easy way to see what a given system supports.
- `Sandbox::Landlock.kernel_abi_version` probes the kernel even when
`HOMEBREW_NO_SANDBOX_LINUX` is set so `brew config` reports what
the system provides rather than what Homebrew will use.
Mike McQuaid