feat(sandbox-actions): add Landlock backend

bin/action_runner.ml

@@ -2,26 +2,42 @@ open Import
 
 let name = Action_runner_name.of_string "action-runner"
 
-let find_in_path_exn prog =
-  match Bin.which ~path:(Env_path.path Env.initial) prog with
-  | Some path -> path
-  | None -> User_error.raise [ Pp.textf "unable to find %s in PATH" prog ]
+module Sandbox_actions_backend = struct
+  type t =
+    | Auto
+    | Bwrap
+    | Landlock
+
+  let all = [ "auto", Auto; "bwrap", Bwrap; "landlock", Landlock ]
+  let equal = Poly.equal
+  let default = Auto
+end
+
+let dune_prog () = Util.resolve_program_path Sys.executable_name
+
+let bwrap_command worker_argv =
+  let { Bwrap.prog; argv } =
+    Bwrap.wrap ~cwd:(Path.to_absolute_filename Path.root) worker_argv
+  in
+  prog, argv
 ;;
 
-let has_directory_component prog =
-  String.exists prog ~f:(function
-    | '/' | '\\' -> true
-    | _ -> false)
+let landlock_command ~dune_prog worker_argv =
+  let { Landlock.prog; argv } = Landlock.wrap_exn ~dune_prog worker_argv in
+  prog, argv
 ;;
 
-let dune_prog () =
-  let prog = Sys.executable_name in
-  if Filename.is_relative prog && not (has_directory_component prog)
-  then find_in_path_exn prog
-  else Path.of_filename_relative_to_initial_cwd prog
+let sandbox_actions_command ~backend ~dune_prog worker_argv =
+  match (backend : Sandbox_actions_backend.t) with
+  | Auto ->
+    (match Landlock.wrap ~dune_prog worker_argv with
+     | Some { Landlock.prog; argv } -> prog, argv
+     | None -> bwrap_command worker_argv)
+  | Bwrap -> bwrap_command worker_argv
+  | Landlock -> landlock_command ~dune_prog worker_argv
 ;;
 
-let create rpc_server ~config ~sandbox_actions =
+let create rpc_server ~config ~sandbox_actions ~sandbox_actions_backend =
   let rpc = Dune_rpc_impl.Server.action_runner rpc_server in
   let dune_prog = dune_prog () in
   let worker_argv =
@@ -34,11 +50,7 @@ let create rpc_server ~config ~sandbox_actions =
   in
   let prog, argv =
     if sandbox_actions
-    then (
-      let { Bwrap.prog; argv } =
-        Bwrap.wrap ~cwd:(Path.to_absolute_filename Path.root) worker_argv
-      in
-      prog, argv)
+    then sandbox_actions_command ~backend:sandbox_actions_backend ~dune_prog worker_argv
     else Path.to_string dune_prog, worker_argv
   in
   let where =

bin/action_runner.mli

@@ -1,9 +1,21 @@
 open Import
 
+module Sandbox_actions_backend : sig
+  type t =
+    | Auto
+    | Bwrap
+    | Landlock
+
+  val all : (string * t) list
+  val equal : t -> t -> bool
+  val default : t
+end
+
 val create
   :  Dune_rpc_impl.Server.t
   -> config:Dune_config.t
   -> sandbox_actions:bool
+  -> sandbox_actions_backend:Sandbox_actions_backend.t
   -> Dune_engine.Action_runner.t
 
 val start_worker : name:string -> where:string -> trace_fd:string option -> unit Fiber.t

bin/bwrap.ml

@@ -5,15 +5,9 @@ type command =
   ; argv : string list
   }
 
-let find_in_path_exn prog =
-  match Bin.which ~path:(Env_path.path Env.initial) prog with
-  | Some path -> path
-  | None -> User_error.raise [ Pp.textf "unable to find %s in PATH" prog ]
-;;
-
 let prog () =
   match Platform.OS.value with
-  | Linux -> find_in_path_exn "bwrap"
+  | Linux -> Util.find_in_path_exn "bwrap"
   | _ ->
     User_error.raise [ Pp.text "--sandbox-actions is currently only supported on Linux" ]
 ;;

bin/common.ml

@@ -627,6 +627,7 @@ module Builder = struct
     ; target_exec : string option
     ; action_runner : bool
     ; sandbox_actions : bool
+    ; sandbox_actions_backend : Action_runner.Sandbox_actions_backend.t
     }
 
   let set_no_build t no_build = { t with no_build }
@@ -963,8 +964,24 @@ module Builder = struct
             ~docs
             ~doc:
               (Some
-                 "Run spawned build processes in an external dune action runner wrapped \
-                  with bubblewrap."))
+                 "Run spawned build processes in an external dune action runner with \
+                  shared-cache writes blocked."))
+    and+ sandbox_actions_backend =
+      Arg.(
+        value
+        & opt
+            (enum Action_runner.Sandbox_actions_backend.all)
+            Action_runner.Sandbox_actions_backend.default
+        & info
+            [ "sandbox-actions-backend" ]
+            ~docs
+            ~docv:"BACKEND"
+            ~doc:
+              (Some
+                 "Select the mechanism used by --sandbox-actions to block writes to the \
+                  shared cache. $(b,auto) uses Landlock on Linux when available, and \
+                  falls back to bubblewrap. $(b,landlock) requires Landlock. $(b,bwrap) \
+                  requires bubblewrap."))
     and+ action_runner =
       Arg.(
         value
@@ -1019,6 +1036,7 @@ module Builder = struct
     ; target_exec
     ; action_runner
     ; sandbox_actions
+    ; sandbox_actions_backend
     }
   ;;
 
@@ -1060,6 +1078,7 @@ module Builder = struct
         ; target_exec
         ; action_runner
         ; sandbox_actions
+        ; sandbox_actions_backend
         }
     =
     No_build.equal t.no_build no_build
@@ -1101,6 +1120,9 @@ module Builder = struct
     && Option.equal String.equal t.target_exec target_exec
     && Bool.equal t.action_runner action_runner
     && Bool.equal t.sandbox_actions sandbox_actions
+    && Action_runner.Sandbox_actions_backend.equal
+         t.sandbox_actions_backend
+         sandbox_actions_backend
   ;;
 end
 
@@ -1410,7 +1432,8 @@ let init_with_root_and_rpc ~(root : Workspace_root.t) ~rpc_build (builder : Buil
            (Action_runner.create
               rpc_server
               ~config
-              ~sandbox_actions:c.builder.sandbox_actions))
+              ~sandbox_actions:c.builder.sandbox_actions
+              ~sandbox_actions_backend:c.builder.sandbox_actions_backend))
        else None)
   in
   let c = { c with action_runner } in

bin/dune

@@ -7,6 +7,9 @@
  (enabled_if
   (<> %{profile} dune-bootstrap))
  (root_module root)
+ (foreign_stubs
+  (language c)
+  (names landlock_stubs))
  (libraries
   memo
   ocaml

bin/internal.ml

@@ -230,6 +230,7 @@ let group =
     ; Internal_digest_db.command
     ; Internal_action_runner.group
     ; Bwrap.With_bwrap.command
+    ; Landlock.With_landlock.command
     ; latest_lang_version
     ; bootstrap_info
     ; Sexp_pp.command