add landlock sandbox

CHANGELOG.md

@@ -23,6 +23,7 @@ Categories Used:
 - Add `--here` flag to unpack into current directory (https://github.com/ouch-org/ouch/pull/962).
 - List: show symlink targets (for tar and zip) (https://github.com/ouch-org/ouch/pull/934)
 - Add aliases for ebooks (`.epub`) (https://github.com/ouch-org/ouch/pull/981)
+- Add a Landlock sandbox on Linux for `compress`/`decompress`/`list` that restricts filesystem access and, where the kernel supports it, blocks new TCP connections, abstract-socket use, and signals to processes outside the sandbox (disable with `--no-sandbox` or the `OUCH_NO_SANDBOX` environment variable) (https://github.com/ouch-org/ouch/pull/995)
 
 ### Improvements
 

Cargo.toml

@@ -49,6 +49,9 @@ zip = { version = "8.6.0", default-features = false, features = [
 ] }
 zstd = { version = "0.13.3", default-features = false, features = ["zstdmt"] }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+landlock = "0.4.4"
+
 [dev-dependencies]
 anyhow = "1.0.102"
 assert_cmd = "2.2.1"

src/archive/tar.rs

@@ -70,11 +70,11 @@ pub fn unpack_archive(reader: impl Read, output_folder: &Path) -> Result<u64> {
                 if cfg!(unix) && is_writeable.not() {
                     // We unpacked a read-only directory, make it writeable so that we can
                     // create the files inside of it, by the end, restore the original mode
-                    let original_path = entry.path()?.to_path_buf();
-                    let unpacked = output_folder.join(&original_path);
+                    let unpacked = output_folder.join(entry.path()?);
                     set_permission_mode(&unpacked, original_mode | 0o200)?;
 
-                    read_only_dirs_and_modes.push((original_path, original_mode));
+                    // Store the absolute path because the restore loop runs without changing directory.
+                    read_only_dirs_and_modes.push((unpacked, original_mode));
                 }
             }
             _ => continue,

src/cli/args.rs

@@ -50,6 +50,10 @@ pub struct CliArgs {
     #[arg(short = 'c', long, global = true)]
     pub threads: Option<usize>,
 
+    /// Disable the process sandbox.
+    #[arg(long, global = true)]
+    pub no_sandbox: bool,
+
     // Ouch and claps subcommands
     #[command(subcommand)]
     pub cmd: Subcommand,
@@ -156,6 +160,7 @@ mod tests {
             // This is usually replaced in assertion tests
             password: None,
             threads: None,
+            no_sandbox: false,
             cmd: Subcommand::Decompress {
                 // Put a crazy value here so no test can assert it unintentionally
                 files: vec!["\x00\x11\x22".into()],