session-wrapper: implement Landlock ABI detection and ruleset application

[Rod-Persky]

Parent epic: #152

session-wrapper: implement Landlock ABI detection and ruleset application

Objective

Add the Linux Landlock implementation that turns a validated TACACS+ ExecutionProfile into a kernel-enforced filesystem access boundary for the shell and all descendants.

Breaking changes are allowed. The implementation should target the production security model, not preserve monitor-only proof-of-concept semantics.

Core Requirements

• Add a Linux-only Landlock module, likely executables/session_wrapper/src/landlock.rs.
• Query Landlock support at runtime with LANDLOCK_CREATE_RULESET_VERSION.
• Fail closed in enforce mode if Landlock is missing, disabled at boot, or too old for the requested profile rights.
• Build handled_access_fs explicitly. Landlock allows rights that are not handled by the ruleset, so omitted rights can silently widen the profile.
• Build the widest tested handled-right set supported by the detected ABI, then reject profiles that require rights outside that set.
• Do not use Landlock network rules or LANDLOCK_SCOPE_* in the first implementation. Those can break IPC, terminals, signals, and job control and have no per-resource exceptions.

Rights Mapping

• exec_allow: LANDLOCK_ACCESS_FS_EXECUTE, plus explicitly modeled read/list rights required by runtime behavior.
• read_allow: LANDLOCK_ACCESS_FS_READ_FILE and LANDLOCK_ACCESS_FS_READ_DIR.
• write_allow: normal file-oriented user work without execute, including WRITE_FILE, TRUNCATE when available, MAKE_REG, MAKE_DIR, MAKE_SOCK, MAKE_FIFO, MAKE_SYM, REMOVE_FILE, and REMOVE_DIR.
• Do not grant MAKE_CHAR or MAKE_BLOCK by default.
• Grant REFER only when a future profile version explicitly enables cross-directory rename/link behavior.
• staging_exec_dirs: same write rights plus EXECUTE, only for explicit landlock-staging-exec paths.

ABI Requirements

• ABI v1 is required for basic execute/read/write/create/remove behavior.
• ABI v2 REFER is required only if the profile explicitly needs cross-directory rename/link behavior.
• ABI v3 TRUNCATE is required for production write profiles. Without it, truncate/overwrite behavior cannot be fully constrained; reject writable profiles in enforce mode.

Path Rule Requirements

• Use file descriptors opened with O_PATH | O_CLOEXEC for LANDLOCK_RULE_PATH_BENEATH.
• Close Landlock rule fds after ruleset application.
• Do not leave descriptors that grant access outside the profile available to the shell.
• The implementation may prepare path fds in the parent, child, or split across both, but it must respect fork safety and descriptor hygiene.

Enforcement Modes

• enforce: create and apply the ruleset. Fail startup on any missing support or application error.
• audit: do not apply Landlock, but report that no kernel boundary was installed and let audit-mode shadow evaluation operate elsewhere.
• disabled: explicit unsafe mode for tests/recovery. Do not imply security.

Acceptance Criteria

• Unit tests or focused Linux tests cover ABI detection and rights-set construction.
• Writable profiles are rejected when truncate restriction is unavailable.
• Missing/disabled Landlock fails startup in enforce mode.
• Audit/disabled mode logs clearly that no kernel Landlock boundary was installed.
• A profile allowing /usr/bin/id but not /tmp/payload lets /usr/bin/id run and denies /tmp/payload with EACCES on a supported Linux kernel.