container: optionally isolate host abstract UNIX domain sockets via landlock

internal/app/app_pd_linux_test.go

@@ -62,6 +62,7 @@ var testCasesPd = []sealTestCase{
 				Remount(m("/"), syscall.MS_RDONLY),
 			SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyDevel,
 			HostNet:        true,
+			HostAbstract:   true,
 			RetainSession:  true,
 			ForwardCancel:  true,
 		},
@@ -203,6 +204,7 @@ var testCasesPd = []sealTestCase{
 				Remount(m("/"), syscall.MS_RDONLY),
 			SeccompPresets: seccomp.PresetExt | seccomp.PresetDenyDevel,
 			HostNet:        true,
+			HostAbstract:   true,
 			RetainSession:  true,
 			ForwardCancel:  true,
 		},

internal/app/container_linux.go

@@ -33,6 +33,7 @@ func newContainer(s *hst.ContainerConfig, os sys.State, prefix string, uid, gid
 		SeccompPresets: s.SeccompPresets,
 		RetainSession:  s.Tty,
 		HostNet:        s.Net,
+		HostAbstract:   s.Abstract,
 
 		// the container is canceled when shim is requested to exit or receives an interrupt or termination signal;
 		// this behaviour is implemented in the shim

internal/app/seal_linux.go

@@ -238,10 +238,11 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co
 		}
 
 		conf := &hst.ContainerConfig{
-			Userns:  true,
-			Net:     true,
-			Tty:     true,
-			AutoEtc: true,
+			Userns:   true,
+			Net:      true,
+			Abstract: true,
+			Tty:      true,
+			AutoEtc:  true,
 
 			AutoRoot:  container.AbsFHSRoot,
 			RootFlags: container.BindWritable,