Bump landlock from 0.3.1 to 0.4.0

[dependabot]

Bumps landlock from 0.3.1 to 0.4.0.

Release notes

Sourced from landlock's releases.

v0.4.0

See crate's metadata and related documentation.

What's Changed

See summary in CHANGELOG.md

• Improve PrivateRule trait by @​l0kod in landlock-lsm/rust-landlock#65
• Move from_read() and from_write() into AccessFs by @​l0kod in landlock-lsm/rust-landlock#66
• Update error priority and no_new_privs behavior by @​l0kod in landlock-lsm/rust-landlock#67
• Fix and test unsupported rule by @​l0kod in landlock-lsm/rust-landlock#68
• Add initial networking support by @​l0kod in landlock-lsm/rust-landlock#55
• Bump to 0.4.0 by @​l0kod in landlock-lsm/rust-landlock#69

Full Changelog: landlock-lsm/rust-landlock@v0.3.1...v0.4.0

Changelog

Sourced from landlock's changelog.

v0.4.0

New API

Add support for Landlock ABI 4: control TCP binding and connection according to specified network ports. This is now possible with the AccessNet rights and the NetPort rule ([PR #55](landlock-lsm/rust-landlock#55)).

Breaking change

The from_read() and from_write() methods moved from the Access trait to the AccessFs struct (commit 68f066eba571).

Compatibility management

Improve compatibility consistency and prioritize runtime errors against compatibility errors ([PR #67](landlock-lsm/rust-landlock#67)).

Fixed a corner case where a ruleset was created on a kernel not supporting Landlock, while requesting to add a rule with an access right handled by the ruleset (BestEffort). When trying to enforce this ruleset, this led to a runtime error (i.e. wrong file descriptor) instead of a compatibility error.

To simplify compatibility management, always call prctl(PR_SET_NO_NEW_PRIVS, 1) by default (see set_no_new_privs()). This was required to get a consistent compatibility management and it should not be an issue given that this feature is supported by all LTS kernels (commit d99f75155bec).

Commits

• 537d293 lib: Bump to v0.4.0
• 6deec9d cargo: Bump strum to v0.26
• d645052 sandboxer: Add TCP bind and connect support
• f112bf8 net: Add NetPort rule
• 5e8b4a4 net: Handle TCP bind and connect access rights
• c1fef29 src,ci: Handle Landlock ABI v4
• d8c4cad lib: Fix and test unsupported rule
• ccb5a58 compat: Prioritize error over incompatibility
• f0e55e2 fs: Test try_compat_children()
• d99f751 ruleset: Fix compatibility inconsistency
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)