feat: Add support for Landlock based Sandbox for Linux (#238)

* feat: Initial implementation of landlock based sandbox driver

* fix: Handle seccom probe failure

* fix: Remove unnecessary seccomp probe

* fix: Use file based policy load

* fix: Keep bpf filter in memory

* fix: Use TSYNC for seccom filter

* fix: Use TSYNC for seccom filter

* fix: Update landlock translator

* fix: Landlock sandbox implementation

* fix: Landlock + seccomp based sandboxing on Linux

* fix: Misc fixes

* fix: Cleanup sandbox files

* fix: Handle mandatory deny API change post merge

* fix: Landlock write access translation

* chore: Fix linter issues

* ci: Use /tmp for npm cache for landlock

cmd/landlock/landlock_sandbox_exec_linux.go

@@ -0,0 +1,33 @@
+//go:build linux
+
+package landlock
+
+import (
+	"github.com/safedep/pmg/sandbox/platform"
+	"github.com/spf13/cobra"
+)
+
+// NewLandlockSandboxExecCommand returns the hidden Cobra command used as the
+// helper process entry point for the Landlock sandbox driver.
+func NewLandlockSandboxExecCommand() *cobra.Command {
+	var policyFile string
+	var auditSocket string
+
+	cmd := &cobra.Command{
+		Use:    "__landlock_sandbox_exec",
+		Hidden: true,
+		// Skip parent pmg initialization (config, event log, analytics) —
+		// RunLandlockHelper sets up its own minimal logger.
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return platform.RunLandlockHelper(policyFile, auditSocket, args)
+		},
+	}
+
+	cmd.Flags().StringVar(&policyFile, "policy-file", "", "Path to policy JSON file")
+	cmd.Flags().StringVar(&auditSocket, "audit-socket", "", "Path to audit unix socket")
+	_ = cmd.MarkFlagRequired("policy-file")
+	_ = cmd.MarkFlagRequired("audit-socket")
+
+	return cmd
+}