Function enforce

crates/openshell-supervisor-process/src/sandbox/linux/mod.rs:37–43

Phase 2: Enforce prepared sandbox restrictions (after `drop_privileges`). Calls `restrict_self()` for Landlock and applies seccomp filters. Neither operation requires root privileges.

(prepared: PreparedSandbox)

/// Calls `restrict_self()` for Landlock and applies seccomp filters.
/// Neither operation requires root privileges.
pub fn enforce(prepared: PreparedSandbox) -> Result<()> {
    if let Some(ruleset) = prepared.landlock {
        landlock::enforce(ruleset)?;
    }
    seccomp::apply(&prepared.policy)?;
    Ok(())
}

/// Apply the supervisor seccomp prelude after privileged bootstrap completes.
pub fn apply_supervisor_prelude() -> Result<()> {