feat(sandbox): add landlock for sandboxing

Author: QaidVoid

Cargo.lock

@@ -34,6 +34,7 @@ diesel_migrations = { version = "2.3.1", features = ["sqlite"] }
 documented = "0.9.2"
 fast-glob = "1.0.0"
 image = { version = "0.25.9", default-features = false, features = ["png"] }
+landlock = "0.4.4"
 libsqlite3-sys = { version = ">=0.30.1,<0.36.0", features = [ "bundled" ]}
 miette = { version = "7.6.0", features = ["fancy"] }
 nix = { version = "0.30.1", features = ["ioctl", "term", "user"] }

Cargo.toml

@@ -135,6 +135,48 @@ pub enum SoarError {
     #[error(transparent)]
     #[diagnostic(code(soar::regex), help("Check your regex pattern syntax"))]
     RegexError(#[from] regex::Error),
+
+    #[error("Landlock is not supported on this system")]
+    #[diagnostic(
+        code(soar::sandbox::not_supported),
+        help("Landlock requires Linux kernel 5.13+. Hooks will run without sandboxing.")
+    )]
+    SandboxNotSupported,
+
+    #[error("Failed to create Landlock ruleset: {0}")]
+    #[diagnostic(
+        code(soar::sandbox::ruleset),
+        help("This may indicate a kernel or permission issue")
+    )]
+    SandboxRulesetCreation(String),
+
+    #[error("Failed to add sandbox rule for path '{path}': {reason}")]
+    #[diagnostic(
+        code(soar::sandbox::path_rule),
+        help("Check if the path exists and is accessible")
+    )]
+    SandboxPathRule { path: String, reason: String },
+
+    #[error("Failed to add sandbox network rule for port {port}: {reason}")]
+    #[diagnostic(
+        code(soar::sandbox::network_rule),
+        help("Network restrictions require Landlock V4+ (kernel 6.7+)")
+    )]
+    SandboxNetworkRule { port: u16, reason: String },
+
+    #[error("Failed to enforce Landlock sandbox: {0}")]
+    #[diagnostic(
+        code(soar::sandbox::enforcement),
+        help("This may indicate a kernel or permission issue")
+    )]
+    SandboxEnforcement(String),
+
+    #[error("Sandboxed command execution failed: {0}")]
+    #[diagnostic(
+        code(soar::sandbox::execution),
+        help("Check the command and sandbox configuration")
+    )]
+    SandboxExecution(String),
 }
 
 impl SoarError {

crates/soar-core/src/error.rs

@@ -4,6 +4,7 @@ pub mod constants;
 pub mod database;
 pub mod error;
 pub mod package;
+pub mod sandbox;
 pub mod utils;
 
 pub type SoarResult<T> = std::result::Result<T, SoarError>;