chore: Add a landlock test for path deny (#247)

* chore: Add a landlock test for path deny

* fix: Make sure sandbox is available:

sandbox/platform/landlock_translator_linux_test.go

@@ -4,9 +4,13 @@ package platform
 
 import (
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	llsyscall "github.com/landlock-lsm/go-landlock/landlock/syscall"
 	"github.com/safedep/dry/utils"
 	"github.com/safedep/pmg/sandbox"
@@ -298,6 +302,23 @@ func TestLandlockTranslatePolicy_MandatoryDenies(t *testing.T) {
 	}
 }
 
+func TestLandlockTranslatePolicy_AllowReadSuppression(t *testing.T) {
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+	cwdEnv := filepath.Clean(filepath.Join(cwd, ".env"))
+
+	policy := newTestPolicy()
+	policy.Filesystem.AllowRead = []string{cwdEnv}
+	abi := newLandlockABI(3)
+
+	ep, err := landlockTranslatePolicy(policy, abi)
+	require.NoError(t, err)
+
+	envEntry := findDenyPath(ep.DenyPaths, cwdEnv)
+	require.NotNil(t, envEntry)
+	assert.Equal(t, denyWrite, envEntry.Mode)
+}
+
 func TestLandlockTranslatePolicy_ImplicitRules(t *testing.T) {
 	policy := newTestPolicy()
 	policy.Filesystem.AllowRead = []string{"/usr"}