Expose landlock API

[vlaci]

There is also a landlock package on PyPI implementing this, however I already implemented it by the time I found it

[qkaiser]

Made it working with the landlock branch in unblob (see onekey-sec/unblob#597).

Had to use the v2 ABI otherwise we get into these kinds of issues due to the absence of LANDLOCK_ACCESS_FS_REFER :

Traceback (most recent call last):
 File "/home/quentin/unblob/unblob/processing.py", line 639, in _extract_chunk
   if result := chunk.extract(inpath, extract_dir):
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/home/quentin/unblob/unblob/models.py", line 115, in extract
   return self.handler.extract(inpath, outdir)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/home/quentin/unblob/unblob/models.py", line 452, in extract
   return self.EXTRACTOR.extract(inpath, outdir)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File "/home/quentin/unblob/unblob/handlers/filesystem/romfs.py", line 312, in extract
   header.dump_fs()
 File "/home/quentin/unblob/unblob/handlers/filesystem/romfs.py", line 299, in dump_fs
   self.create_inode(inode)
 File "/home/quentin/unblob/unblob/handlers/filesystem/romfs.py", line 272, in create_inode
   self.create_hardlink(output_path, inode)
 File "/home/quentin/unblob/unblob/handlers/filesystem/romfs.py", line 263, in create_hardlink
   self.fs.create_hardlink(dst=output_path, src=target_path)
 File "/home/quentin/unblob/unblob/file_utils.py", line 594, in create_hardlink
   os.link(src, dst)
OSError: [Errno 18] Invalid cross-device link: '/tmp/pytest-of-quentin/pytest-2/test_all_handlers_filesystem_r0/fruits.romfs_extract/hlink_1_1' -> '/tmp/pytest-of-quentin/pytest-2/test_all_handlers_filesystem_r0/fruits.romfs_extract/dir_1/file_1.txt'

[qkaiser]

Two things to do before tagging as ready for review:

• solve the ModuleNotFoundError: No module named 'unblob_native.sandbox' error by properly exposing it
• add unit testing (unsupported platforms, different access checks)

[vlaci]

* [ ]  solve the `ModuleNotFoundError: No module named 'unblob_native.sandbox'` error by properly exposing it

I currently don't have any examples of it, but it worked for me by manually adding the submodule in sys.modules
This issue contains that workaround suggestion together with suggesting just adding an __init__.py
PyO3/pyo3#759

[qkaiser]

The module not found behavior is observed by pylance and pyright, but I confirmed that the module is actually in sys.module.

[qkaiser]

I have added a simple unit test that only runs on supported platforms (Linux x86-64). There is only one test because pytest runs all the test under the same process so calling restrict_access in one unit test would affect the behavior of all subsequent tests.

[vlaci]

The module not found behavior is observed by pylance and pyright, but I confirmed that the module is actually in sys.module.

To solve that, we can add a pyi type stub: https://www.maturin.rs/project_layout.html#adding-python-type-information

I have added a simple unit test that only runs on supported platforms (Linux x86-64). There is only one test because pytest runs all the test under the same process so calling restrict_access in one unit test would affect the behavior of all subsequent tests.

yeah, for separation a multiprocessing.Process or something alike is needed.

[qkaiser]

To solve that, we can add a pyi type stub: https://www.maturin.rs/project_layout.html#adding-python-type-information

I leave that to you, this is alien to me.

yeah, for separation a multiprocessing.Process or something alike is needed.

Do you think it's worth doing it ? I'd say the landlock Rust crate is probably well tested. Although we could add some tests on the Rust side of things.

[qkaiser]

@vlaci do you see anything blocking the merge of this PR ? Otherwise I'll approve it.

[vlaci]

@vlaci do you see anything blocking the merge of this PR ? Otherwise I'll approve it.

Looks fine by me