ci: add ubuntu-22.04 low-ABI job + end-to-end degrade test

The CI matrix only had v6-capable runners (ubuntu-latest, ubuntu-24.04-arm),
so the Protection opt-out path added in #71 — which lets a sandbox confine on
kernels below Landlock ABI 6 by degrading the scopes the host lacks — had no
automated coverage on a real low-ABI kernel.

Add a dedicated rust-low-abi job on ubuntu-22.04 (a 6.8 Azure kernel,
Landlock ABI v4). The default strict_all() suite hard-requires v6 and would
panic there, so the job runs the host-ABI-independent resolution tests plus a
new end-to-end test, and reports the runner's Landlock ABI for visibility.

degraded_policy_confines_and_runs_below_v6 builds a fully-degradable policy,
asserts every scope the host cannot provide resolves to Degraded (not
Unavailable), and runs a genuinely confined child — proving confinement still
works below v6. Verified on real kernels via multipass: ABI 1 (Ubuntu 22.04),
ABI 5 (Rocky 9.6), ABI 8 (host).

Also add a workflow_dispatch trigger for manual runs.

Author: dzerik

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   rust:
@@ -32,6 +33,36 @@ jobs:
       - name: Run integration tests
         run: cargo test --release --test integration -- --test-threads=1
 
+  rust-low-abi:
+    name: Rust low-ABI (ubuntu-22.04)
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+
+      - name: Build
+        run: cargo build --release
+
+      # The ubuntu-22.04 image runs a 6.8 Azure kernel (Landlock ABI v4),
+      # below the project's MIN_ABI = 6. Surface the host ABI so a future
+      # runner-image kernel bump that changes it is visible at a glance.
+      - name: Report Landlock ABI on this runner
+        run: ./target/release/sandlock check || true
+
+      # The default strict_all() suite (test_sandbox, test_network, ...)
+      # hard-requires v6 and would panic on this runner, so we run only the
+      # host-ABI-independent resolution tests plus the end-to-end degrade
+      # test. That degrade test is the point of having a sub-v6 runner: it
+      # proves a fully-degradable policy still builds and confines on v4,
+      # exercising the Protection opt-out path that the v6 runners cannot.
+      - name: Run host-ABI-independent and degrade tests
+        run: cargo test --release --test integration test_protection -- --test-threads=1
+
   rust-riscv64-cross:
     name: Rust cross-build (riscv64)
     runs-on: ubuntu-latest

crates/sandlock-core/tests/integration/test_protection.rs

@@ -1,9 +1,13 @@
 //! Integration tests for the per-protection availability resolution
 //! in `landlock::confine_inner`.
 //!
-//! These tests exercise the policy-driven resolution path directly via
-//! the `ProtectionStatus::resolve()` helper with synthetic ABI values,
-//! so they are independent of the host kernel's actual Landlock ABI.
+//! Most of these tests exercise the policy-driven resolution path
+//! directly via the `ProtectionStatus::resolve()` helper with synthetic
+//! ABI values, so they are independent of the host kernel's actual
+//! Landlock ABI. The one exception is
+//! `degraded_policy_confines_and_runs_below_v6`, which builds and runs a
+//! genuinely confined child to cover the end-to-end degrade path on a
+//! real low-ABI kernel; it self-skips where Landlock is unavailable.
 
 use sandlock_core::landlock::compute_fs_mask;
 use sandlock_core::{Protection, ProtectionPolicy, ProtectionState, ProtectionStatus};
@@ -460,3 +464,72 @@ fn disable_fsrefer_is_rejected_at_build() {
         .build()
         .expect("allow_degraded(FsRefer) must remain allowed");
 }
+
+// ----------------------------------------------------------------------
+// End-to-end degrade path: real confinement on a low-ABI host
+//
+// Unlike the synthetic resolve() tests above, this one builds and runs a
+// genuinely confined child. A *fully degradable* policy must build on
+// any Landlock-capable kernel and confine with whatever the host
+// supports, degrading (silently skipping) the scopes it lacks instead of
+// hard-failing the way the default `strict_all()` does below ABI 6.
+//
+// This is the test that gives the ubuntu-22.04 CI runner (a 6.8 Azure
+// kernel, Landlock ABI v4) its purpose: there, SignalScope /
+// AbstractUnixSocketScope (v6) and FsIoctlDev (v5) resolve to Degraded,
+// exercising the opt-out path end-to-end. On a v6 host the same scopes
+// resolve Active and the degrade assertion is skipped. Where Landlock is
+// unavailable entirely, the test self-skips rather than failing.
+// ----------------------------------------------------------------------
+
+#[tokio::test]
+async fn degraded_policy_confines_and_runs_below_v6() {
+    let abi = match sandlock_core::landlock_abi_version() {
+        Ok(v) => v,
+        Err(e) => {
+            eprintln!("Skipping: Landlock unavailable ({e})");
+            return;
+        }
+    };
+
+    let mut builder = sandlock_core::Sandbox::builder();
+    for p in Protection::all() {
+        builder = builder.allow_degraded(p);
+    }
+    let sandbox = builder
+        .fs_read("/usr")
+        .fs_read("/lib")
+        .fs_read_if_exists("/lib64")
+        .fs_read("/bin")
+        .fs_read("/etc")
+        .build()
+        .expect("a fully-degradable policy must build on any Landlock host");
+
+    // Below ABI 6, every scope the host cannot provide must resolve to
+    // Degraded — not Unavailable, which is what makes `confine` refuse.
+    if abi < 6 {
+        let states = sandbox
+            .active_protections()
+            .expect("resolve protections against host ABI");
+        for (p, status) in &states {
+            if p.min_abi() > abi {
+                assert_eq!(
+                    *status,
+                    ProtectionStatus::Degraded,
+                    "{p:?} (needs v{}) on a v{abi} host must degrade, not fail",
+                    p.min_abi()
+                );
+            }
+        }
+    }
+
+    let result = sandbox
+        .with_name("degraded")
+        .run(&["echo", "ok"])
+        .await
+        .expect("a confined child must run under a degraded policy");
+    assert!(
+        result.success(),
+        "degraded-mode confinement must still execute the child"
+    );
+}