session-wrapper: support explicit sudo-capable privilege elevation mode

[Rod-Persky]

Parent epic: #152

session-wrapper: support explicit sudo-capable privilege elevation mode

Objective

Support users who are allowed to run sudo for specific commands without weakening the Landlock model for ordinary sessions.

Breaking changes are allowed. Sudo support must be explicit profile behavior, not an accidental consequence of leaving setuid behavior available.

Profile Contract

Default sessions use:

landlock-privilege-elevation=none

Sudo-capable sessions use:

landlock-privilege-elevation=sudo

Required Semantics

• none mode sets no_new_privs before Landlock, so later execs cannot gain privilege through setuid binaries.
• sudo mode does not set no_new_privs, because that would prevent setuid sudo from elevating later.
• In sudo mode, Landlock and seccomp must be installed while the wrapper is still trusted and privileged enough to do so, then the wrapper drops to the login user before shell exec.
• Local sudoers/PAM remains the final local privilege-elevation policy. The TACACS+ Landlock profile does not grant sudo by itself.
• The TACACS+ profile must include the sudo binary path, sudo runtime/policy dependencies, and sudo timestamp/state paths if the platform needs them.
• Sudo target commands must also be inside the Landlock execution profile.
• If sudoers allows a command but Landlock does not, the command must fail with EACCES.
• Root processes launched through sudo inherit Landlock and seccomp restrictions.

Authorization and Audit

• Per-exec TACACS+ authorization remains required initially.
• The supervisor should authorize both the /usr/bin/sudo ... exec and the later target command exec.
• Authorization should use the original login/session principal, not treat the sudo-launched process as a generic root session.
• Audit/accounting records should include original session user and effective UID/GID at exec time.

Security Notes

• Do not authorize generic root shells, interpreters, package managers, or command runners through sudo unless that broad privilege is intentional and documented in the TACACS+ role.
• Landlock is mainly a filesystem access-control boundary. Privileged effects through IPC, network sockets, kernel APIs, or privileged daemons must be controlled by sudoers, TACACS+ per-command authorization, existing seccomp denies, and future service-specific controls.

Acceptance Criteria

• Parser supports landlock-privilege-elevation=none|sudo and rejects unknown values.
• Default sessions set no_new_privs.
• Sudo sessions skip no_new_privs and still install Landlock/seccomp before shell exec.
• A sudoers-allowed command inside the Landlock profile can run.
• A sudoers-allowed command outside the Landlock profile fails with EACCES.
• Audit/authorization records preserve the original session user and effective UID/GID.