container: optionally isolate host abstract UNIX domain sockets via landlock

The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging #1.

Signed-off-by: Ophestra <cat@gensokyo.uk>

# Conflicts:
#	test/sandbox/case/device.nix
#	test/sandbox/case/tty.nix

container/container.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"os"
 	"os/exec"
 	"runtime"
@@ -14,6 +15,7 @@ import (
 	. "syscall"
 	"time"
 
+	"hakurei.app/container/landlock"
 	"hakurei.app/container/seccomp"
 )
 
@@ -92,6 +94,8 @@ type (
 		RetainSession bool
 		// Do not [syscall.CLONE_NEWNET].
 		HostNet bool
+		// Scope abstract UNIX domain sockets using LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET.
+		ScopeAbstract bool
 		// Retain CAP_SYS_ADMIN.
 		Privileged bool
 	}
@@ -185,6 +189,12 @@ func (p *Container) Start() error {
 					"prctl(PR_SET_NO_NEW_PRIVS):")
 			}
 
+			if p.ScopeAbstract {
+				if err := landlock.ScopeAbstract(); err != nil {
+					log.Fatalf("could not scope abstract unix sockets: %v", err)
+				}
+			}
+
 			msg.Verbose("starting container init")
 			if err := p.cmd.Start(); err != nil {
 				return msg.WrapErr(err, err.Error())