Function prepare

crates/openshell-supervisor-process/src/sandbox/linux/mod.rs:25–31

Phase 1: Prepare sandbox restrictions **as root** (before `drop_privileges`). Opens Landlock `PathFds` while the process still has root privileges, ensuring paths like mode-700 directories are accessible.

(policy: &SandboxPolicy, workdir: Option<&str>)

/// Opens Landlock `PathFds` while the process still has root privileges,
/// ensuring paths like mode-700 directories are accessible.
pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<PreparedSandbox> {
    let landlock = landlock::prepare(policy, workdir)?;
    Ok(PreparedSandbox {
        landlock,
        policy: policy.clone(),
    })
}

/// Phase 2: Enforce prepared sandbox restrictions (after `drop_privileges`).
///