Function enter_netns_and_sandbox

crates/openshell-supervisor-process/src/ssh.rs:1179–1226

(
        netns_fd: Option<RawFd>,
        policy: &SandboxPolicy,
        #[cfg(target_os = "linux")] supervisor_identity_mount: Option<
            &crate::process::SupervisorIdentityMountNamespace,

    }

    fn enter_netns_and_sandbox(
        netns_fd: Option<RawFd>,
        policy: &SandboxPolicy,
        #[cfg(target_os = "linux")] supervisor_identity_mount: Option<
            &crate::process::SupervisorIdentityMountNamespace,
        >,
        #[cfg(target_os = "linux")] prepared: Option<crate::sandbox::linux::PreparedSandbox>,
    ) -> std::io::Result<()> {
        // Enter network namespace before dropping privileges.
        // This ensures SSH shell processes are isolated to the same
        // network namespace as the entrypoint, forcing all traffic
        // through the veth pair and CONNECT proxy.
        #[cfg(target_os = "linux")]
        if let Some(fd) = netns_fd {
            #[allow(unsafe_code)]
            let result = unsafe { libc::setns(fd, libc::CLONE_NEWNET) };
            if result != 0 {
                return Err(std::io::Error::last_os_error());
            }
        }

        #[cfg(not(target_os = "linux"))]
        let _ = netns_fd;

        #[cfg(target_os = "linux")]
        if let Some(mount) = supervisor_identity_mount {
            mount.enter_for_child()?;
        }

        // Drop privileges. initgroups/setgid/setuid need /etc/group and
        // /etc/passwd which would be blocked if Landlock were already enforced.
        drop_privileges(policy).map_err(|err| std::io::Error::other(err.to_string()))?;
        crate::process::harden_child_process()
            .map_err(|err| std::io::Error::other(err.to_string()))?;

        // Phase 2: Enforce the prepared Landlock ruleset + seccomp.
        // restrict_self() does not require root.
        #[cfg(target_os = "linux")]
        if let Some(prepared) = prepared {
            crate::sandbox::linux::enforce(prepared)
                .map_err(|err| std::io::Error::other(err.to_string()))?;
        }

        #[cfg(not(target_os = "linux"))]
        sandbox::apply(policy, None).map_err(|err| std::io::Error::other(err.to_string()))?;

        Ok(())
    }
}

fn to_u16(value: u32) -> u16 {