feat(permissions): LP4-1/LP4-2 — enforcer Landlock OS + consommation PTY du plan

LP4-1 : adaptateurs SandboxEnforcer concrets (LandlockSandbox Linux via le LSM
Landlock, NoopSandbox ailleurs) + default_enforcer() cfg-sélectionné, prêts à
être injectés au composition root (LP4-3). Aucun changement de comportement
runtime tant que rien n'est câblé : SpawnSpec.sandbox reste None.

LP4-2 : PortablePtyAdapter consomme SpawnSpec.sandbox via spawn_command_sandboxed
(thread jetable restreint par enforce() puis fork → le domaine Landlock est hérité
par l'enfant à travers execve ; les autres threads d'IdeA ne sont jamais sandboxés).
Builder additif with_sandbox_enforcer ; fail-closed si enforce() échoue.

Tests : domain + infrastructure verts (dont les tests Landlock réels de fencing
read-only/write-only et la confine-au-thread).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/infrastructure/src/sandbox/landlock.rs

@@ -0,0 +1,412 @@
+//! [`LandlockSandbox`] — the Linux [`SandboxEnforcer`] backed by the kernel
+//! Landlock LSM (lot LP4-1), via the `landlock` crate, **best-effort / ABI-compat**.
+//!
+//! # What it does
+//!
+//! [`SandboxEnforcer::enforce`] translates a domain [`SandboxPlan`] into a Landlock
+//! ruleset and restricts the **current thread** (the contract says `enforce` runs
+//! post-fork / pre-exec in the child, so the restriction is inherited by the exec'd
+//! program — Landlock domains survive `execve`).
+//!
+//! # Per-access-class handling (mirrors the LP4-0 compile invariant)
+//!
+//! Landlock works by *handling* a set of access rights — everything **not** granted
+//! is then denied **for those handled rights only**. We therefore handle a right
+//! class **only if the plan actually posed a grant of that class**:
+//!
+//! - some `RO` grant present ⇒ handle the **read** class (`from_read`): reads become
+//!   restricted to the granted roots;
+//! - some `RW` grant present ⇒ handle the **write** class (`from_write`): writes /
+//!   create / delete become restricted to the granted roots.
+//!
+//! A write-only policy thus leaves **reads globally unrestricted** (so the agent can
+//! still load `libc`, read `/etc`, …) and only fences writes — exactly the autonomy
+//! the per-access-class compile guarantees. The flip side: a policy that restricts
+//! reads governs *all* reads, so the compiled plan must include the system read
+//! paths the program needs; that enrichment is the launch-path's concern (LP4-2),
+//! not this adapter's — here we translate the plan faithfully.
+//!
+//! # Fallback policy
+//!
+//! On a kernel/ABI without (sufficient) Landlock, `restrict_self` reports
+//! [`RulesetStatus::NotEnforced`]. We then apply the product fallback: **fail-open**
+//! ([`SandboxStatus::Unsupported`]) for any posture **except** [`Posture::Deny`],
+//! where we **fail-closed** with [`SandboxError::KernelTooOld`] (a `Deny` posture
+//! cannot be silently dropped). Partial enforcement (older ABI missing some rights)
+//! maps to [`SandboxStatus::Degraded`].
+
+use domain::sandbox::{
+    PathAccess, SandboxEnforcer, SandboxError, SandboxKind, SandboxPlan, SandboxStatus,
+};
+use domain::Posture;
+
+// Leading `::` selects the extern `landlock` crate (this module is also named
+// `landlock`, so the disambiguation matters).
+use ::landlock::{
+    path_beneath_rules, AccessFs, BitFlags, CompatLevel, Compatible, Ruleset, RulesetAttr,
+    RulesetCreatedAttr, RulesetStatus, ABI,
+};
+
+/// The Landlock ABI we author rules against. `ABI::V1` (Linux ≥ 5.13) is the broad
+/// floor; `CompatLevel::BestEffort` lets newer kernels run it unchanged and older /
+/// absent support degrade rather than hard-error.
+const TARGET_ABI: ABI = ABI::V1;
+
+/// The Linux Landlock [`SandboxEnforcer`].
+#[derive(Debug, Default, Clone, Copy)]
+pub struct LandlockSandbox;
+
+impl LandlockSandbox {
+    /// Builds the Landlock enforcer.
+    #[must_use]
+    pub fn new() -> Self {
+        Self
+    }
+}
+
+/// The Landlock access rights a single grant opens, intersected later with the
+/// handled set. An `RW` grant also opens the read rights (writing a tree usually
+/// implies reading it) — harmless when reads are ungoverned, correct when they are.
+fn grant_access(access: PathAccess, abi: ABI) -> BitFlags<AccessFs> {
+    let mut acc = BitFlags::<AccessFs>::empty();
+    if access.contains(PathAccess::RO) {
+        acc |= AccessFs::from_read(abi);
+    }
+    if access.contains(PathAccess::RW) {
+        acc |= AccessFs::from_read(abi) | AccessFs::from_write(abi);
+    }
+    if access.contains(PathAccess::EXEC) {
+        // The domain never emits EXEC today; honoured for completeness.
+        acc |= AccessFs::Execute;
+    }
+    acc
+}
+
+impl SandboxEnforcer for LandlockSandbox {
+    fn kind(&self) -> SandboxKind {
+        SandboxKind::Landlock
+    }
+
+    fn enforce(&self, plan: &SandboxPlan) -> Result<SandboxStatus, SandboxError> {
+        let abi = TARGET_ABI;
+
+        // Handle a right class only if the plan posed a grant of that class, so an
+        // unposed class stays globally unrestricted (per-access-class autonomy).
+        let mut handled = BitFlags::<AccessFs>::empty();
+        for grant in &plan.allowed {
+            if grant.access.contains(PathAccess::RO) {
+                handled |= AccessFs::from_read(abi);
+            }
+            if grant.access.contains(PathAccess::RW) {
+                handled |= AccessFs::from_write(abi);
+            }
+            if grant.access.contains(PathAccess::EXEC) {
+                handled |= AccessFs::Execute;
+            }
+        }
+
+        if handled.is_empty() {
+            // No file restriction to apply (empty / bash-only plan): nothing for
+            // Landlock to enforce. A `Deny` posture's teeth, if any, then live only
+            // in the advisory LP3 projection — not this adapter's concern.
+            return Ok(SandboxStatus::Enforced);
+        }
+
+        let mut ruleset = Ruleset::default()
+            .set_compatibility(CompatLevel::BestEffort)
+            .handle_access(handled)
+            .and_then(Ruleset::create)
+            .map_err(|e| SandboxError::Ruleset(e.to_string()))?;
+
+        for grant in &plan.allowed {
+            let access = grant_access(grant.access, abi) & handled;
+            if access.is_empty() {
+                continue;
+            }
+            // `path_beneath_rules` silently skips a path it cannot open (a grant on
+            // a not-yet-existing root just adds no rule — best-effort, never fatal).
+            ruleset = ruleset
+                .add_rules(path_beneath_rules([grant.abs_root.as_str()], access))
+                .map_err(|e: ::landlock::RulesetError| SandboxError::Ruleset(e.to_string()))?;
+        }
+
+        let status = ruleset
+            .restrict_self()
+            .map_err(|e| SandboxError::Ruleset(e.to_string()))?;
+
+        status_from_ruleset(status.ruleset, plan.default_posture)
+    }
+}
+
+/// Maps the kernel's [`RulesetStatus`] (after `restrict_self`) plus the plan's
+/// fallback [`Posture`] to the domain outcome. **Pure** (no I/O, no kernel): the
+/// security-critical decision — including the *fail-closed only under `Deny`*
+/// branch — lives here so it is unit-testable without a Landlock-incapable kernel.
+///
+/// - [`RulesetStatus::FullyEnforced`] ⇒ `Ok(`[`SandboxStatus::Enforced`]`)`
+/// - [`RulesetStatus::PartiallyEnforced`] ⇒ `Ok(`[`SandboxStatus::Degraded`]`)`
+/// - [`RulesetStatus::NotEnforced`] + [`Posture::Deny`] ⇒
+///   `Err(`[`SandboxError::KernelTooOld`]`)` (fail-closed)
+/// - [`RulesetStatus::NotEnforced`] + any other posture ⇒
+///   `Ok(`[`SandboxStatus::Unsupported`]`)` (fail-open + warning)
+fn status_from_ruleset(
+    status: RulesetStatus,
+    posture: Posture,
+) -> Result<SandboxStatus, SandboxError> {
+    match status {
+        RulesetStatus::FullyEnforced => Ok(SandboxStatus::Enforced),
+        RulesetStatus::PartiallyEnforced => Ok(SandboxStatus::Degraded(
+            "landlock ABI compatibility reduced the enforced access rights (best-effort)"
+                .to_owned(),
+        )),
+        RulesetStatus::NotEnforced => {
+            if posture == Posture::Deny {
+                Err(SandboxError::KernelTooOld(
+                    "landlock unavailable on this kernel but the policy posture is Deny \
+                     (fail-closed)"
+                        .to_owned(),
+                ))
+            } else {
+                Ok(SandboxStatus::Unsupported)
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use domain::sandbox::{PathGrant, SandboxPlan};
+    use std::path::PathBuf;
+
+    /// A unique temp dir for one test (no external tempfile dep).
+    fn fresh_dir(tag: &str) -> PathBuf {
+        let nanos = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        let p = std::env::temp_dir().join(format!("idea-landlock-{tag}-{nanos}"));
+        std::fs::create_dir_all(&p).unwrap();
+        p
+    }
+
+    /// Real-kernel integration test: a write-only plan that grants RW on one dir
+    /// must let writes there succeed and block writes elsewhere with EACCES, while
+    /// leaving reads unrestricted. Runs the enforcement on a dedicated thread (the
+    /// restriction is irreversible for that thread) and **skips** if the running
+    /// kernel has no Landlock (CI / old kernels), like the SSH/WSL gated tests.
+    #[test]
+    fn landlock_write_only_plan_fences_writes_to_the_grant() {
+        let allowed = fresh_dir("allowed");
+        let denied = fresh_dir("denied");
+        let allowed_for_thread = allowed.clone();
+        let denied_for_thread = denied.clone();
+
+        let plan = SandboxPlan {
+            allowed: vec![PathGrant {
+                abs_root: allowed.to_string_lossy().into_owned(),
+                access: PathAccess::RW,
+            }],
+            default_posture: Posture::Ask,
+        };
+
+        let outcome = std::thread::spawn(move || {
+            let status = LandlockSandbox::new()
+                .enforce(&plan)
+                .expect("enforce must not error under an Ask posture");
+            // The thread is now sandboxed: try a write inside and outside the grant.
+            let ok_write = std::fs::write(allowed_for_thread.join("inside.txt"), b"hi");
+            let ko_write = std::fs::write(denied_for_thread.join("outside.txt"), b"nope");
+            (status, ok_write, ko_write.map_err(|e| e.kind()))
+        })
+        .join()
+        .unwrap();
+
+        let (status, ok_write, ko_write) = outcome;
+
+        if status == SandboxStatus::Unsupported {
+            eprintln!("skipping: Landlock not available on this kernel");
+            // Clean up best-effort and bail (no enforcement happened).
+            let _ = std::fs::remove_dir_all(&allowed);
+            let _ = std::fs::remove_dir_all(&denied);
+            return;
+        }
+
+        assert!(
+            matches!(status, SandboxStatus::Enforced | SandboxStatus::Degraded(_)),
+            "expected an enforced/degraded sandbox, got {status:?}"
+        );
+        assert!(
+            ok_write.is_ok(),
+            "write inside the granted root must succeed, got {ok_write:?}"
+        );
+        assert_eq!(
+            ko_write,
+            Err(std::io::ErrorKind::PermissionDenied),
+            "write outside the granted root must be blocked (EACCES)"
+        );
+
+        let _ = std::fs::remove_dir_all(&allowed);
+        let _ = std::fs::remove_dir_all(&denied);
+    }
+
+    /// An empty plan (no file grant) has nothing to enforce ⇒ `Enforced`, no error.
+    #[test]
+    fn empty_plan_is_a_noop_enforced() {
+        let plan = SandboxPlan {
+            allowed: vec![],
+            default_posture: Posture::Ask,
+        };
+        // Run on a throwaway thread to avoid restricting the test runner thread.
+        let status = std::thread::spawn(move || LandlockSandbox::new().enforce(&plan))
+            .join()
+            .unwrap()
+            .unwrap();
+        assert_eq!(status, SandboxStatus::Enforced);
+    }
+
+    /// **Bash-only / empty plan under a `Deny` posture.** A bash-only policy compiles
+    /// (LP4-0) to an empty `allowed`; even combined with `Posture::Deny` the adapter
+    /// has no file right to *handle*, so it must early-return `Enforced` WITHOUT
+    /// restricting anything — and crucially WITHOUT `KernelTooOld`: the fail-closed
+    /// branch is only ever reached once a class was actually handled.
+    #[test]
+    fn empty_plan_under_deny_posture_is_enforced_without_restriction() {
+        let plan = SandboxPlan {
+            allowed: vec![],
+            default_posture: Posture::Deny,
+        };
+        let status = std::thread::spawn(move || LandlockSandbox::new().enforce(&plan))
+            .join()
+            .unwrap()
+            .expect("an empty plan never fails closed (nothing handled)");
+        assert_eq!(status, SandboxStatus::Enforced);
+    }
+
+    /// **CRITICAL SAFETY PROPERTY — IdeA is never sandboxed.** The adapter restricts
+    /// the *current thread*; the launch path runs it on a throwaway thread. This test
+    /// proves the Landlock domain is confined to that throwaway thread and does **not**
+    /// leak onto the thread that spawned it (which simulates the IdeA process): after
+    /// the child has sandboxed itself, the parent thread must still read/write OUTSIDE
+    /// the plan's roots. A leak here would be catastrophic (IdeA itself locked down).
+    #[test]
+    fn enforcement_is_confined_to_the_enforcing_thread_idea_is_never_sandboxed() {
+        let granted = fresh_dir("safety-granted");
+        let outside = fresh_dir("safety-outside");
+        let granted_t = granted.clone();
+        let outside_t = outside.clone();
+
+        let plan = SandboxPlan {
+            allowed: vec![PathGrant {
+                abs_root: granted.to_string_lossy().into_owned(),
+                access: PathAccess::RW,
+            }],
+            default_posture: Posture::Ask,
+        };
+
+        // Enforce on a dedicated thread, exactly as the launch path does, and report
+        // whether the sandbox was actually live there (write outside must be blocked).
+        let (status, child_outside_write) = std::thread::spawn(move || {
+            let status = LandlockSandbox::new()
+                .enforce(&plan)
+                .expect("enforce must not error under an Ask posture");
+            let _ = granted_t; // (writable in the child; not asserted here)
+            let child_outside =
+                std::fs::write(outside_t.join("from-child.txt"), b"x").map_err(|e| e.kind());
+            (status, child_outside)
+        })
+        .join()
+        .unwrap();
+
+        if status == SandboxStatus::Unsupported {
+            eprintln!("skipping: Landlock not available on this kernel");
+            let _ = std::fs::remove_dir_all(&granted);
+            let _ = std::fs::remove_dir_all(&outside);
+            return;
+        }
+
+        // Sanity: the sandbox really was active on the throwaway thread.
+        assert_eq!(
+            child_outside_write,
+            Err(std::io::ErrorKind::PermissionDenied),
+            "the throwaway thread must be sandboxed (write outside the grant blocked)"
+        );
+
+        // THE GUARANTEE: the parent thread (≈ the IdeA process) is not a descendant of
+        // the throwaway thread, so the domain must not have leaked onto it.
+        let idea_write = std::fs::write(outside.join("from-idea.txt"), b"idea");
+        assert!(
+            idea_write.is_ok(),
+            "SAFETY VIOLATION: IdeA's own thread was sandboxed — write outside the plan \
+             failed ({idea_write:?}); the Landlock domain leaked off the throwaway thread"
+        );
+        let idea_read = std::fs::read(outside.join("from-idea.txt"));
+        assert!(
+            idea_read.is_ok(),
+            "IdeA must still read outside the plan roots, got {idea_read:?}"
+        );
+
+        let _ = std::fs::remove_dir_all(&granted);
+        let _ = std::fs::remove_dir_all(&outside);
+    }
+
+    /// **READ (RO) dimension.** A plan with a single RO grant: from the sandboxed
+    /// child, reading a file UNDER the granted root succeeds, while reading a file
+    /// OUTSIDE is denied (EACCES). This also documents the behaviour DevBackend
+    /// flagged: as soon as *any* RO grant is posed the read class is handled, so
+    /// **every** read outside the granted roots is closed — a realistic read-restricted
+    /// plan must therefore include the needed system paths (an LP4-2 concern).
+    #[test]
+    fn read_only_plan_fences_reads_to_the_grant() {
+        let granted = fresh_dir("ro-granted");
+        let outside = fresh_dir("ro-outside");
+        // Files must exist before enforcement (creation is a write).
+        std::fs::write(granted.join("in.txt"), b"inside").unwrap();
+        std::fs::write(outside.join("out.txt"), b"outside").unwrap();
+        let granted_t = granted.clone();
+        let outside_t = outside.clone();
+
+        let plan = SandboxPlan {
+            allowed: vec![PathGrant {
+                abs_root: granted.to_string_lossy().into_owned(),
+                access: PathAccess::RO,
+            }],
+            default_posture: Posture::Ask,
+        };
+
+        let (status, ok_read, ko_read) = std::thread::spawn(move || {
+            let status = LandlockSandbox::new()
+                .enforce(&plan)
+                .expect("enforce must not error under an Ask posture");
+            let ok = std::fs::read(granted_t.join("in.txt"));
+            let ko = std::fs::read(outside_t.join("out.txt")).map_err(|e| e.kind());
+            (status, ok, ko)
+        })
+        .join()
+        .unwrap();
+
+        if status == SandboxStatus::Unsupported {
+            eprintln!("skipping: Landlock not available on this kernel");
+            let _ = std::fs::remove_dir_all(&granted);
+            let _ = std::fs::remove_dir_all(&outside);
+            return;
+        }
+
+        assert!(
+            matches!(status, SandboxStatus::Enforced | SandboxStatus::Degraded(_)),
+            "expected an enforced/degraded sandbox, got {status:?}"
+        );
+        assert!(
+            ok_read.is_ok(),
+            "read inside the granted RO root must succeed, got {ok_read:?}"
+        );
+        assert_eq!(
+            ko_read,
+            Err(std::io::ErrorKind::PermissionDenied),
+            "once a RO grant is posed, reads outside the granted roots are closed (EACCES)"
+        );
+
+        let _ = std::fs::remove_dir_all(&granted);
+        let _ = std::fs::remove_dir_all(&outside);
+    }
+}