From a31c20111761b3431ae0d260c40bc1868f0f5ecf Mon Sep 17 00:00:00 2001
From: Abhisek Datta <abhisek.datta@gmail.com>
Date: Fri, 8 May 2026 19:48:57 +0530
Subject: [PATCH] chore: Add a landlock test for path deny (#247)

* chore: Add a landlock test for path deny

* fix: Make sure sandbox is available:
---
 cmd/setup/info.go                             | 15 +++++++++++++
 .../landlock_translator_linux_test.go         | 21 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/cmd/setup/info.go b/cmd/setup/info.go
index 8515d72..114269f 100644
--- a/cmd/setup/info.go
+++ b/cmd/setup/info.go
@@ -13,6 +13,7 @@ import (
 	"github.com/safedep/pmg/internal/analytics"
 	"github.com/safedep/pmg/internal/ui"
 	"github.com/safedep/pmg/internal/version"
+	"github.com/safedep/pmg/sandbox/platform"
 	"github.com/spf13/cobra"
 )
 
@@ -104,6 +105,7 @@ func executeSetupInfo() error {
 	sandboxEntries := make(map[string]string)
 	sandboxEntries["Enabled"] = strconv.FormatBool(sandboxCfg.Enabled)
 	sandboxEntries["Enforce Always"] = strconv.FormatBool(sandboxCfg.EnforceAlways)
+	sandboxEntries["Driver"] = resolveSandboxDriverName()
 
 	if len(sandboxCfg.Policies) > 0 {
 		pmNames := make([]string, 0, len(sandboxCfg.Policies))
@@ -145,6 +147,19 @@ func executeSetupInfo() error {
 	return nil
 }
 
+func resolveSandboxDriverName() string {
+	sb, err := platform.NewSandbox()
+	if err != nil {
+		return "unavailable"
+	}
+
+	if !sb.IsAvailable() {
+		return "unavailable"
+	}
+
+	return sb.Name()
+}
+
 // describeCloudCredentials reports whether SafeDep Cloud credentials can be
 // resolved, and from where. The resolution order matches NewSyncClientBundle:
 // keychain first, then environment variables. No network calls are made.
diff --git a/sandbox/platform/landlock_translator_linux_test.go b/sandbox/platform/landlock_translator_linux_test.go
index 9599aca..b32faff 100644
--- a/sandbox/platform/landlock_translator_linux_test.go
+++ b/sandbox/platform/landlock_translator_linux_test.go
@@ -4,9 +4,13 @@ package platform
 
 import (
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	llsyscall "github.com/landlock-lsm/go-landlock/landlock/syscall"
 	"github.com/safedep/dry/utils"
 	"github.com/safedep/pmg/sandbox"
@@ -298,6 +302,23 @@ func TestLandlockTranslatePolicy_MandatoryDenies(t *testing.T) {
 	}
 }
 
+func TestLandlockTranslatePolicy_AllowReadSuppression(t *testing.T) {
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+	cwdEnv := filepath.Clean(filepath.Join(cwd, ".env"))
+
+	policy := newTestPolicy()
+	policy.Filesystem.AllowRead = []string{cwdEnv}
+	abi := newLandlockABI(3)
+
+	ep, err := landlockTranslatePolicy(policy, abi)
+	require.NoError(t, err)
+
+	envEntry := findDenyPath(ep.DenyPaths, cwdEnv)
+	require.NotNil(t, envEntry)
+	assert.Equal(t, denyWrite, envEntry.Mode)
+}
+
 func TestLandlockTranslatePolicy_ImplicitRules(t *testing.T) {
 	policy := newTestPolicy()
 	policy.Filesystem.AllowRead = []string{"/usr"}