feat(sandbox): Landlock TCP port restriction in Platform mode

Add Landlock ABI v4 TCP connect restriction for Platform mode. When the
kernel supports ABI v4, only the proxy port (default 3128) is allowed
for outbound TCP connections. On older kernels, BestEffort compat level
silently degrades -- the rule has no effect but the proxy still works
cooperatively.

Both handle_access(ConnectTcp) and add_rule(NetPort) use the ? operator
since BestEffort guarantees they succeed on all kernel versions.

Signed-off-by: Ladislav Smola <lsmola@redhat.com>

Author: Ladas

crates/openshell-sandbox/src/sandbox/linux/landlock.rs

@@ -3,10 +3,10 @@
 
 //! Landlock filesystem sandboxing.
 
-use crate::policy::{LandlockCompatibility, SandboxPolicy};
+use crate::policy::{LandlockCompatibility, NetworkMode, SandboxPolicy};
 use landlock::{
-    ABI, Access, AccessFs, CompatLevel, Compatible, PathBeneath, PathFd, PathFdError, Ruleset,
-    RulesetAttr, RulesetCreatedAttr,
+    ABI, Access, AccessFs, AccessNet, CompatLevel, Compatible, NetPort, PathBeneath, PathFd,
+    PathFdError, Ruleset, RulesetAttr, RulesetCreatedAttr,
 };
 use miette::{IntoDiagnostic, Result};
 use std::path::{Path, PathBuf};
@@ -184,6 +184,15 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
             .handle_access(access_all)
             .into_diagnostic()?;
 
+        // Platform mode: declare intent to handle TCP connect access.
+        // BestEffort compat level: silently succeeds on kernels without
+        // ABI v4 (restriction has no effect but doesn't break anything).
+        if matches!(policy.network.mode, NetworkMode::Platform) {
+            ruleset = ruleset
+                .handle_access(AccessNet::ConnectTcp)
+                .into_diagnostic()?;
+        }
+
         let mut ruleset = ruleset.create().into_diagnostic()?;
         let mut rules_applied: usize = 0;
 
@@ -207,6 +216,28 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
             }
         }
 
+        if matches!(policy.network.mode, NetworkMode::Platform) {
+            let proxy_port = policy
+                .network
+                .proxy
+                .as_ref()
+                .and_then(|p| p.http_addr)
+                .map_or(3128_u16, |addr| addr.port());
+
+            // BestEffort compat level: add_rule silently succeeds even if
+            // ABI v4 is unavailable. The rule has no effect on older kernels,
+            // but the proxy still works cooperatively.
+            ruleset = ruleset
+                .add_rule(NetPort::new(proxy_port, AccessNet::ConnectTcp))
+                .into_diagnostic()?;
+            debug!(
+                port = proxy_port,
+                "Landlock TCP connect rule added (proxy port only, \
+                 effective on kernels with ABI v4+)"
+            );
+            rules_applied += 1;
+        }
+
         if rules_applied == 0 {
             return Err(miette::miette!(
                 "Landlock ruleset has zero valid paths — all {} path(s) failed to open. \
@@ -215,7 +246,7 @@ pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<Option<P
             ));
         }
 
-        let skipped = total_paths - rules_applied;
+        let skipped = total_paths.saturating_sub(rules_applied);
         openshell_ocsf::ocsf_emit!(
             openshell_ocsf::ConfigStateChangeBuilder::new(crate::ocsf_ctx())
                 .severity(openshell_ocsf::SeverityId::Informational)