mxc 0.2.0-x86_64-linux → 0.4.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86bb54e129b48e32e469fa771293b5d887064fad5a98c1ed7d47e98c823288e2
-  data.tar.gz: 22054e5c8fe708cf11fcacfba0e1612a296716f7f7f7f8428d2786ba93ca9e18
+  metadata.gz: a67f6e03b5528954d3960d5ecee562df2477e4eb35cd2201be7587172f55fde7
+  data.tar.gz: 4fe1e1c493013e84c4db05042647a2bdf52f1fffce6bc0dd0848b56ade99fa64
 SHA512:
-  metadata.gz: 4db21a001399af4632811e84238a37b32d9d21b10fead1d87e62599385a5aa2fa661690fd182a35d9a0c6453981e4ad39970ca0262dccb2144a3b435b1f73e34
-  data.tar.gz: eef8f390ec961e9940660c10f2020820a7e341c8e53e584385b80571f8876d8291f6c94796ccb5da110705d1d33af045ac73f6e70b649a3e2119af48539fa61f
+  metadata.gz: dbbdf78fafbea341eb3ef4eaae54059456f89c376d12e836af77a89859726b397dfc67141305e5833c954958f73250442cfc700080c8346610a9d6487c2b3927
+  data.tar.gz: 41f99e3b573d98da712a2d63a86a4fb2754a81dac6106c9aa96dcef5d69b5ec2a11196ca7b9e32d41f27c29223688feae3ef774d04df4612bc776ea1868cdd25

data/NOTICE

@@ -6,8 +6,8 @@ endorsed by Microsoft.
 
 The native extension compiles and links the mxc-sdk crate
 (https://github.com/microsoft/mxc, https://crates.io/crates/mxc-sdk), from
-a fork at https://github.com/crmne/microsoft-mxc that adds resource limits,
-which is distributed under the MIT License:
+a fork at https://github.com/crmne/microsoft-mxc that adds resource limits
+and a Landlock backend, which is distributed under the MIT License:
 
 MIT License
 

data/README.md

@@ -22,7 +22,7 @@ result.stdout
 result.success?
 ```
 
-It is an unofficial Ruby binding to [Microsoft's MXC](https://github.com/microsoft/mxc), the MIT-licensed sandbox library. Not affiliated with or endorsed by Microsoft. Resource limits come from [a fork of MXC](https://github.com/crmne/microsoft-mxc) until they are [part of MXC itself](https://github.com/microsoft/mxc/issues/1498).
+It is an unofficial Ruby binding to [Microsoft's MXC](https://github.com/microsoft/mxc), the MIT-licensed sandbox library. Not affiliated with or endorsed by Microsoft. Resource limits and the Landlock backend come from [a fork of MXC](https://github.com/crmne/microsoft-mxc) until they are part of MXC itself ([resource limits](https://github.com/microsoft/mxc/issues/1498), [Landlock](https://github.com/microsoft/mxc/issues/1494)).
 
 ## Installation
 
@@ -36,6 +36,8 @@ Precompiled gems cover Linux (x86_64 and ARM64, glibc and musl), macOS (Intel an
 sudo apt-get install bubblewrap
 ```
 
+Where Bubblewrap cannot create its namespaces, as in a default Docker container or on Ubuntu with AppArmor's restriction, sandboxes run on Landlock instead (Linux 6.2 or newer), without network access.
+
 Commands that use the network also need `slirp4netns`, `iptables`, util-linux, and `/dev/net/tun`. macOS and Windows need nothing extra.
 
 ## Usage
@@ -117,15 +119,16 @@ MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
 
 ## Platforms
 
-| Platform | Backend | 0.2.0 |
+| Platform | Backend | 0.3.0 |
 | --- | --- | --- |
 | Linux | Bubblewrap | Supported and tested, without process limits |
+| Linux 6.2 and later | Landlock, where Bubblewrap cannot run or when asked for | Supported and tested, without network access or process limits |
 | macOS | Seatbelt | Supported and tested, without memory or process limits |
 | Windows 11 24H2 and later | ProcessContainer | Supported and tested, without host allow-lists |
 
 On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
 
-Docker blocks the namespaces Bubblewrap needs by default. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows the smallest set of changes that makes it work, with a seccomp profile and a Kamal configuration for a job role.
+Docker blocks the namespaces Bubblewrap needs by default, so a default container runs sandboxes on Landlock. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows what that gives up, and the smallest set of changes that makes Bubblewrap work, with a seccomp profile and a Kamal configuration for a job role.
 
 ## Documentation
 

data/lib/mxc/availability.rb

@@ -16,9 +16,13 @@ module MXC
     # Returns a suggestion for making the host supported, or nil.
     attr_reader :remediation
 
+    # Returns the backend sandboxes run on, such as <tt>:bubblewrap</tt>, or <tt>:landlock</tt>
+    # when <tt>:auto</tt> falls back to it. Returns nil when no sandbox can start.
+    attr_reader :runs_on
+
     def self.probe(backend) # :nodoc:
       result = Sandbox.new(backend:, timeout: 10).run('exit 0')
-      return new(backend:, supported: true) if result.success?
+      return new(backend:, supported: true, runs_on: result.backend) if result.success?
 
       outcome = result.timed_out? ? 'timed out' : "exited with #{result.exit_code}"
       new(backend:, supported: false, reason: "A sandboxed `exit 0` #{outcome}: #{result.stderr.strip}")
@@ -26,8 +30,9 @@ module MXC
       new(backend:, supported: false, reason: e.message, remediation: e.remediation)
     end
 
-    def initialize(backend:, supported:, reason: nil, remediation: nil) # :nodoc:
+    def initialize(backend:, supported:, reason: nil, remediation: nil, runs_on: nil) # :nodoc:
       @backend = backend
+      @runs_on = runs_on
       @supported = supported
       @reason = reason
       @remediation = remediation
@@ -39,7 +44,8 @@ module MXC
     end
 
     def inspect # :nodoc:
-      "#<MXC::Availability backend=#{backend.inspect} supported=#{supported?} reason=#{reason.inspect}>"
+      "#<MXC::Availability backend=#{backend.inspect} supported=#{supported?} runs_on=#{runs_on.inspect} " \
+        "reason=#{reason.inspect}>"
     end
   end
 end

data/lib/mxc/configuration.rb

@@ -15,7 +15,8 @@ module MXC
       @timeout = nil
     end
 
-    # Sets the default backend: <tt>:auto</tt>, <tt>:bubblewrap</tt>, or <tt>:seatbelt</tt>.
+    # Sets the default backend: <tt>:auto</tt>, <tt>:bubblewrap</tt>, <tt>:landlock</tt>,
+    # <tt>:seatbelt</tt>, or <tt>:process_container</tt>.
     def backend=(name)
       @backend = Sandbox.backend_name(name)
     end

data/lib/mxc/libraries.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require 'open3'
+require 'shellwords'
+
+module MXC
+  # Finds the shared library files programs load, directly or through
+  # other libraries, so a sandbox can read them and nothing beside them. Only macOS needs this: Seatbelt
+  # sandboxes read the system's libraries but not those a package manager
+  # installs, such as Homebrew's, which a program like Ruby may link. The
+  # libraries come from the programs' load commands, read with otool from
+  # the Command Line Tools. Without them nothing is found, because
+  # /usr/bin/otool would offer to install them instead.
+  module Libraries # :nodoc:
+    OTOOL = '/usr/bin/otool'
+    XCODE_SELECT = '/usr/bin/xcode-select'
+    SYSTEM = %w[/usr/lib/ /System/ /Library/].freeze
+    TOKEN = %r{\A@(loader_path|executable_path|rpath)/}
+
+    @links = {}
+    @lock = Mutex.new
+
+    class << self
+      # Returns the real paths of the library files +binaries+ load outside
+      # the system's own, empty where none are needed or otool is missing.
+      # +executable+ is the program that loads them, for libraries named
+      # relative to it.
+      def files(binaries, executable: nil)
+        return [] if binaries.empty? || !available?
+
+        libraries(binaries, executable)
+      end
+
+      # Returns the path of the program +arguments+ start: the first argument, or the first
+      # word of a command for the shell, found on +path+ or under +directory+. Returns nil
+      # when there is none.
+      def program(arguments, path:, directory:)
+        name = program_name(arguments)
+        return if name.nil?
+        return File.expand_path(name, directory || '/') if name.include?('/')
+
+        path.to_s.split(File::PATH_SEPARATOR).map { |entry| File.join(entry, name) }
+            .find { |candidate| File.file?(candidate) && File.executable?(candidate) }
+      end
+
+      # Returns true when this host can list a program's libraries.
+      def available?
+        return @available if defined?(@available)
+
+        @available = RUBY_PLATFORM.include?('darwin') && File.executable?(OTOOL) && developer_tools?
+      end
+
+      private
+
+      def program_name(arguments)
+        arguments.one? ? Shellwords.split(arguments.first).first : arguments.first
+      rescue ArgumentError
+        nil
+      end
+
+      def libraries(binaries, executable)
+        roots = binaries.filter_map { |binary| real_path(binary) }
+        links_of(roots)
+        found = {}
+        roots.each { |root| visit(root, executable || root, [], found) }
+        found.keys
+      end
+
+      def visit(path, executable, inherited, found)
+        dependencies(path, links_of([path]).fetch(path), executable, inherited).each do |library, rpaths|
+          next if found.key?(library)
+
+          found[library] = true
+          visit(library, executable, rpaths, found)
+        end
+      end
+
+      def developer_tools?
+        system(XCODE_SELECT, '-p', out: File::NULL, err: File::NULL) == true
+      end
+
+      def dependencies(path, links, executable, inherited)
+        rpaths = links[:rpaths].filter_map { |rpath| expand(rpath, path, executable) } + inherited
+        links[:libraries].filter_map do |name|
+          next if system?(name)
+
+          library = locate(name, path, executable, rpaths)
+          [library, rpaths] if library && !system?(library)
+        end
+      end
+
+      def locate(name, loader, executable, rpaths)
+        relative = name.delete_prefix('@rpath/')
+        candidates = if relative == name
+                       [expand(name, loader, executable)]
+                     else
+                       rpaths.map { |rpath| File.join(rpath, relative) }
+                     end
+        candidates.compact.lazy.filter_map { |candidate| real_path(candidate) }.first
+      end
+
+      def expand(name, loader, executable)
+        token = name[TOKEN, 1]
+        return name unless token
+        return if token == 'rpath'
+
+        base = token == 'loader_path' ? loader : executable
+        File.expand_path(name.sub(TOKEN, ''), File.dirname(base))
+      end
+
+      def system?(path)
+        path.start_with?(*SYSTEM)
+      end
+
+      def real_path(path)
+        path = File.realpath(path)
+        path if File.file?(path)
+      rescue SystemCallError
+        nil
+      end
+
+      def links_of(paths)
+        @lock.synchronize do
+          missing = paths.reject { |path| @links.key?(path) }
+          @links.merge!(LoadCommands.parse(otool(missing), missing)) if missing.any?
+          @links.slice(*paths)
+        end
+      end
+
+      def otool(paths)
+        output, = Open3.capture2(OTOOL, '-l', *paths, err: File::NULL)
+        output
+      rescue SystemCallError
+        ''
+      end
+    end
+  end
+end

data/lib/mxc/load_commands.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module MXC
+  # Reads the libraries and run paths of Mach-O files from the load
+  # commands <tt>otool -l</tt> lists, with every architecture of a
+  # universal file together.
+  module LoadCommands # :nodoc:
+    LOAD = /\A\s*cmd LC_(?:LOAD_DYLIB|LOAD_WEAK_DYLIB|REEXPORT_DYLIB|LAZY_LOAD_DYLIB|LOAD_UPWARD_DYLIB)\z/
+    RPATH = /\A\s*cmd LC_RPATH\z/
+    COMMAND = /\A\s*cmd /
+    VALUE = /\A\s*(?:name|path) (.+) \(offset \d+\)\z/
+    ARCHITECTURE = / \(architecture [^)]+\)\z/
+
+    class << self
+      # Returns, for each of +paths+, the install names of the libraries it
+      # loads and its run paths, as <tt>{ libraries: [...], rpaths: [...] }</tt>.
+      def parse(output, paths)
+        links = paths.to_h { |path| [path, { libraries: [], rpaths: [] }] }
+        current = kind = nil
+        output.each_line(chomp: true) do |line|
+          if links.key?(header = header_path(line))
+            current = links[header]
+            kind = nil
+          elsif current
+            kind = record(current, kind, line)
+          end
+        end
+        links
+      end
+
+      private
+
+      def record(links, kind, line)
+        return :libraries if line.match?(LOAD)
+        return :rpaths if line.match?(RPATH)
+        return if line.match?(COMMAND)
+
+        value = line[VALUE, 1] if kind
+        return kind unless value
+
+        links[kind] << value
+        nil
+      end
+
+      def header_path(line)
+        line.delete_suffix(':').sub(ARCHITECTURE, '') if line.end_with?(':') && !line.start_with?(' ', "\t")
+      end
+    end
+  end
+end

data/lib/mxc/native.rb

@@ -13,6 +13,9 @@ module MXC
     MISSING_BUBBLEWRAP = /bwrap\) is not installed/
     INSTALL_BUBBLEWRAP = 'Install Bubblewrap 0.5.0 or newer (Debian/Ubuntu: apt-get install bubblewrap; ' \
                          'Fedora: dnf install bubblewrap; Arch: pacman -S bubblewrap)'
+    LANDLOCK_REFUSAL = /\ALandlock: /
+    LANDLOCK_POLICY = 'Change the policy as the message says, or run on Bubblewrap: a sandbox with backend :auto ' \
+                      'runs on Landlock only where Bubblewrap cannot create its namespaces'
 
     def self.backend_attributes
       backends.map { |attributes| attributes.merge(name: BACKEND_NAMES.fetch(attributes[:name], attributes[:name])) }
@@ -21,8 +24,12 @@ module MXC
     def self.error(message, code: nil, remediation: nil, **)
       if message.match?(MISSING_BUBBLEWRAP)
         UnsupportedError.new(message, code: :backend_unavailable, remediation: remediation || INSTALL_BUBBLEWRAP, **)
+      elsif message.match?(LANDLOCK_REFUSAL)
+        UnsupportedError.new(message, code:, remediation: remediation || LANDLOCK_POLICY, **)
+      elsif UNSUPPORTED_CODES.include?(code)
+        UnsupportedError.new(message, code:, remediation: remediation || StartupFailure.hint(message), **)
       else
-        (UNSUPPORTED_CODES.include?(code) ? UnsupportedError : Error).new(message, code:, remediation:, **)
+        Error.new(message, code:, remediation:, **)
       end
     end
   end

data/lib/mxc/preflight.rb

@@ -16,16 +16,27 @@ module MXC
                    'Linux and Windows support it'
     PROCESS_LIMIT = 'Leave processes out of the limits. Only Windows can count the processes of one sandbox; ' \
                     'in a container, limit them with docker run --pids-limit'
+    LANDLOCK_NETWORK = 'Use network: false, or the :bubblewrap backend on a host that allows unprivileged user ' \
+                       'namespaces. Landlock cannot tell one address from another, so it could only allow the ' \
+                       "whole host network, the host's loopback and inbound connections included"
 
     module_function
 
-    def check!(network:, denied: [], resources: nil)
-      error = problem(network:, denied:, resources:)
+    def check!(network:, denied: [], resources: nil, backend: :auto)
+      error = problem(network:, denied:, resources:, backend:)
       raise error if error
     end
 
-    def problem(network:, denied: [], resources: nil, path: ENV.fetch('PATH', ''), tun: TUN)
-      resource_problem(resources) || host_problem(network, denied, path, tun)
+    def problem(network:, denied: [], resources: nil, backend: :auto, path: ENV.fetch('PATH', ''), tun: TUN)
+      resource_problem(resources) || landlock_problem(network, backend) || host_problem(network, denied, path, tun)
+    end
+
+    def landlock_problem(network, backend)
+      return unless network && backend == :landlock
+
+      kind = network.is_a?(Hash) ? 'Host allow-lists are' : 'Network access is'
+      UnsupportedError.new("#{kind} not supported on Landlock", code: :backend_unavailable,
+                                                                remediation: LANDLOCK_NETWORK)
     end
 
     def resource_problem(resources)

data/lib/mxc/sandbox.rb

@@ -28,8 +28,10 @@ module MXC
   #
   #   SkillSandbox.new.run("python3 app/skills/build.py")
   class Sandbox
-    BACKENDS = %i[auto bubblewrap seatbelt process_container].freeze # :nodoc:
-    OPTIONS = %i[readable writable denied network env directory timeout backend limits priority].freeze # :nodoc:
+    BACKENDS = %i[auto bubblewrap landlock seatbelt process_container].freeze # :nodoc:
+    LANDLOCK_FALLBACK = /runs on Landlock instead/ # :nodoc:
+    OPTIONS = %i[readable writable denied libraries libraries_of network env directory timeout backend limits
+                 priority].freeze # :nodoc:
     HOST_RESOLVER_SOCKETS = %w[/run/systemd/resolve].freeze # :nodoc:
     WINDOWS_ENV = %w[SYSTEMROOT WINDIR SYSTEMDRIVE COMSPEC PATHEXT PATH LOCALAPPDATA TEMP TMP
                      PROCESSOR_ARCHITECTURE NUMBER_OF_PROCESSORS OS].freeze # :nodoc:
@@ -39,8 +41,8 @@ module MXC
     PRIORITIES = { normal: nil, low: 'low', lowest: 'idle' }.freeze # :nodoc:
     MEGABYTE = 1024 * 1024 # :nodoc:
     DEFAULTS = {
-      readable: [], writable: [], denied: [], env: {}, network: false, directory: nil, timeout: nil, backend: nil,
-      limits: {}, priority: nil
+      readable: [], writable: [], denied: [], libraries: true, libraries_of: [], env: {}, network: false,
+      directory: nil, timeout: nil, backend: nil, limits: {}, priority: nil
     }.freeze # :nodoc:
 
     class << self
@@ -53,6 +55,13 @@ module MXC
       # Adds paths every instance hides, even inside readable or writable paths.
       def denied(*paths) = configure { |sandbox| sandbox.with_denied(*paths) }
 
+      # Adds programs and libraries whose shared libraries every instance can load.
+      # Takes the same arguments as #with_libraries_of.
+      def libraries_of(*paths) = configure { |sandbox| sandbox.with_libraries_of(*paths) }
+
+      # Sets whether every instance can read the libraries its programs load. See #with_libraries.
+      def libraries(enabled) = configure { |sandbox| sandbox.with_libraries(enabled) }
+
       # Sets every instance's network access. Takes the same arguments as #with_network.
       def network(...) = configure { |sandbox| sandbox.with_network(...) }
 
@@ -134,6 +143,12 @@ module MXC
     # Returns the paths hidden from the command, as given.
     def denied = @settings[:denied].dup.freeze
 
+    # Returns the programs and libraries whose shared libraries the command can load, as given.
+    def libraries_of = @settings[:libraries_of].dup.freeze
+
+    # Returns true when the command can read the libraries its program loads, the default.
+    def libraries = @settings[:libraries]
+
     # Returns the environment variables set for the command.
     def env = @settings[:env].dup.freeze
 
@@ -172,6 +187,32 @@ module MXC
       add_paths(:denied, paths)
     end
 
+    # Adds programs and libraries whose shared libraries the command loads, such as the
+    # extensions an interpreter opens. On macOS, the command can read those library files,
+    # and the libraries they load in turn, when they are not the system's own. The program
+    # the command runs needs no entry: #run grants its libraries already. Elsewhere, on a
+    # Mac without the Command Line Tools, and with <tt>with_libraries(false)</tt>, this
+    # grants nothing.
+    #
+    #   sandbox.with_libraries_of(*Dir[File.join(RbConfig::CONFIG["archdir"], "**", "*.bundle")])
+    def with_libraries_of(*paths)
+      add_paths(:libraries_of, paths)
+    end
+
+    # Sets whether the command can read the shared libraries its program and #libraries_of
+    # load, on macOS. +true+ is the default; +false+ grants no library, so the command reads
+    # only the system's and those under #readable. +nil+ resets it to +true+.
+    #
+    #   sandbox.with_libraries(false)
+    def with_libraries(enabled)
+      unless [true, false, nil].include?(enabled)
+        raise ArgumentError, "libraries must be true, false or nil, got #{enabled.inspect}"
+      end
+
+      @settings[:libraries] = enabled != false
+      self
+    end
+
     # Sets network access. The default, +false+, gives the command no network at all.
     # +true+ allows any destination. <tt>allow:</tt> takes a list of hosts the command
     # may reach over HTTP and HTTPS: <tt>"pypi.org"</tt>, <tt>"*.pythonhosted.org"</tt>
@@ -218,8 +259,12 @@ module MXC
     end
 
     # Sets the backend: <tt>:auto</tt> (Bubblewrap on Linux, Seatbelt on macOS,
-    # ProcessContainer on Windows), <tt>:bubblewrap</tt>, <tt>:seatbelt</tt>, or
-    # <tt>:process_container</tt>.
+    # ProcessContainer on Windows), <tt>:bubblewrap</tt>, <tt>:landlock</tt>, <tt>:seatbelt</tt>,
+    # or <tt>:process_container</tt>.
+    #
+    # On Linux, <tt>:auto</tt> runs on Landlock when Bubblewrap cannot create its namespaces,
+    # and says so in Result#warnings. <tt>:bubblewrap</tt> never does. <tt>:landlock</tt>
+    # needs Linux 6.2 or newer and runs without network access.
     def with_backend(name)
       @settings[:backend] = name && self.class.backend_name(name)
       self
@@ -268,6 +313,12 @@ module MXC
     #
     # With a block, yields each Chunk of output as it arrives.
     #
+    # On macOS, the command can read the shared library files its program links outside
+    # the system's own, such as Homebrew's, so programs built against them start. The
+    # program is the first argument, or the first word of a command for the shell, found
+    # on the +PATH+ of #env. See #with_libraries_of for libraries the program opens later,
+    # and #with_libraries to turn this off.
+    #
     #   sandbox.run("python3 build.py && ls dist")
     #   sandbox.run("python3", "convert.py", params[:filename])
     #   sandbox.run("python3", "build.py") { |chunk| print chunk.content }
@@ -278,8 +329,9 @@ module MXC
     def run(*command, &)
       return stream(*command, &) if block_given?
 
-      outcome = StartupFailure.check!(Native.run(command_line(command), request))
-      Result.new(**outcome, backend: resolved_backend)
+      arguments = command_arguments(command)
+      outcome = StartupFailure.check!(Native.run(command_line(arguments), request(arguments)))
+      Result.new(**outcome, backend: resolved_backend(outcome[:warnings]))
     end
 
     # Starts +command+ and returns its Process without waiting for it. Takes the command
@@ -287,7 +339,9 @@ module MXC
     #
     #   sandbox.spawn("python3", "-i", "-q")
     def spawn(*command)
-      Process.new(Native.spawn(command_line(command), request), backend: resolved_backend)
+      arguments = command_arguments(command)
+      native = Native.spawn(command_line(arguments), request(arguments))
+      Process.new(native, backend: resolved_backend(native.warnings))
     end
 
     # Returns true when this host can run this sandbox, including its network policy.
@@ -298,8 +352,10 @@ module MXC
     # Returns the Availability of this sandbox on this host, with the reason and
     # remediation when it cannot run.
     def availability
-      problem = Preflight.problem(network:, denied:, resources:)
-      return MXC.availability(backend:) unless problem
+      problem = Preflight.problem(network:, denied:, resources:, backend:)
+      host = MXC.availability(backend:) unless problem
+      problem ||= Preflight.problem(network:, backend: :landlock) if host&.runs_on == :landlock
+      return host unless problem
 
       Availability.new(backend:, supported: false, reason: problem.message, remediation: problem.remediation)
     end
@@ -307,7 +363,8 @@ module MXC
     def inspect # :nodoc:
       resources = " limits=#{limits.inspect} priority=#{priority.inspect}" if self.resources
       "#<#{self.class.name || 'MXC::Sandbox'} backend=#{backend.inspect} network=#{network.inspect} " \
-        "readable=#{readable.inspect} writable=#{writable.inspect} timeout=#{timeout.inspect}#{resources}>"
+        "readable=#{readable.inspect} writable=#{writable.inspect} timeout=#{timeout.inspect}#{resources}" \
+        "#{libraries_inspect}>"
     end
 
     protected
@@ -322,7 +379,7 @@ module MXC
 
     def apply(name, value)
       case name
-      when :readable, :writable, :denied then public_send(:"with_#{name}", *Array(value))
+      when :readable, :writable, :denied, :libraries_of then public_send(:"with_#{name}", *Array(value))
       when :network then value.is_a?(Hash) ? with_network(**value) : with_network(value)
       when :limits then value.nil? ? with_limits(nil) : with_limits(**value)
       else public_send(:"with_#{name}", value)
@@ -376,8 +433,7 @@ module MXC
       process&.kill unless finished
     end
 
-    def command_line(command)
-      arguments = command_arguments(command)
+    def command_line(arguments)
       return command_line_for_windows(arguments) if Preflight.windows?
 
       arguments.one? ? arguments.first : Shellwords.join(arguments)
@@ -404,17 +460,18 @@ module MXC
       arguments.map { |argument| WindowsArguments.quote(argument) }.join(' ')
     end
 
-    def resolved_backend
+    def resolved_backend(warnings)
       return backend unless backend == :auto
       return :process_container if Preflight.windows?
+      return :seatbelt unless Preflight.linux?
 
-      Preflight.linux? ? :bubblewrap : :seatbelt
+      warnings.any?(LANDLOCK_FALLBACK) ? :landlock : :bubblewrap
     end
 
-    def request
-      Preflight.check!(network:, denied:, resources:)
+    def request(arguments)
+      Preflight.check!(network:, denied:, resources:, backend:)
       {
-        readonly: expand(readable),
+        readonly: expand(readable) | library_files(arguments),
         readwrite: expand(writable),
         denied: expand(denied) | hidden_resolver_sockets,
         environment:,
@@ -465,6 +522,17 @@ module MXC
       system.reject { |name, _| env.keys.any? { |own| own.casecmp?(name) } }.merge(env)
     end
 
+    def libraries_inspect
+      libraries ? (" libraries_of=#{libraries_of.inspect}" if libraries_of.any?) : ' libraries=false'
+    end
+
+    def library_files(arguments)
+      return [] unless libraries && Libraries.available?
+
+      program = Libraries.program(arguments, path: env['PATH'], directory: working_directory)
+      Libraries.files([*program, *expand(libraries_of)], executable: program)
+    end
+
     def hidden_resolver_sockets
       return [] if network == true
 

data/lib/mxc/startup_failure.rb

@@ -7,7 +7,8 @@ module MXC
                               /setting up uid map/i, /unshare.*Operation not permitted/i)
     PROC = /Can't mount proc|mount proc on/i
     HOST_PROBLEMS = {
-      NAMESPACES => 'Unprivileged user namespaces are blocked. On a host, enable kernel.unprivileged_userns_clone=1 ' \
+      NAMESPACES => 'Unprivileged user namespaces are blocked. Use backend :auto or :landlock to run on Landlock ' \
+                    'instead, or allow them for Bubblewrap: on a host, enable kernel.unprivileged_userns_clone=1 ' \
                     'and, on Ubuntu 23.10 and later, allow bwrap in AppArmor ' \
                     '(kernel.apparmor_restrict_unprivileged_userns). ' \
                     "In Docker, run with a seccomp profile that allows namespaces: #{DOCKER_GUIDE}",
@@ -15,23 +16,27 @@ module MXC
               "In Docker, see #{DOCKER_GUIDE}"
     }.freeze
     CHDIR = /Can't chdir/i
+    BWRAP_LINE = /^bwrap: .*$/
 
     module_function
 
     def detect(outcome)
-      return unless outcome[:exit_code] == 1 && outcome[:stdout].to_s.empty?
+      failure = outcome[:failure] or return
+      reason = outcome[:stderr].to_s.scan(BWRAP_LINE).last
+      return Error.new(failure, code: :backend_error) unless reason
 
-      stderr = outcome[:stderr].to_s
-      return unless stderr.match?(/\Abwrap: [^\n]*\n?\z/)
-
-      message = "Bubblewrap could not start the sandbox: #{stderr.strip}"
-      _, hint = HOST_PROBLEMS.find { |pattern, _| stderr.match?(pattern) }
+      message = "Bubblewrap could not start the sandbox: #{reason}"
+      hint = hint(reason)
       return UnsupportedError.new(message, code: :backend_unavailable, remediation: hint, operation: 'bwrap') if hint
 
-      remediation = 'Make the directory readable or writable in the sandbox' if stderr.match?(CHDIR)
+      remediation = 'Make the directory readable or writable in the sandbox' if reason.match?(CHDIR)
       Error.new(message, code: :backend_error, remediation:, operation: 'bwrap')
     end
 
+    def hint(message)
+      HOST_PROBLEMS.find { |pattern, _| message.match?(pattern) }&.last
+    end
+
     def check!(outcome)
       error = detect(outcome)
       raise error if error

data/lib/mxc/version.rb

@@ -2,5 +2,5 @@
 
 module MXC
   # The gem version.
-  VERSION = '0.2.0'
+  VERSION = '0.4.0'
 end

data/lib/mxc.rb

@@ -12,6 +12,8 @@ require 'mxc/backend'
 require 'mxc/availability'
 require 'mxc/process'
 require 'mxc/windows_arguments'
+require 'mxc/load_commands'
+require 'mxc/libraries'
 require 'mxc/sandbox'
 
 # Runs commands in sandboxes through Microsoft's MXC.
@@ -87,7 +89,8 @@ module MXC
       Native.backend_attributes.map { |attributes| Backend.new(**attributes) }
     end
 
-    # Returns true when this host supports +capability+ with the configured backend.
+    # Returns true when this host supports +capability+ with the configured backend. Where
+    # sandboxes run on Landlock, there is no <tt>:network</tt> or <tt>:network_policy</tt>.
     #
     # +capability+ is <tt>:network</tt> for unrestricted network access,
     # <tt>:network_policy</tt> for host allow-lists, <tt>:cpu_time_limit</tt>,
@@ -100,8 +103,8 @@ module MXC
       return false unless supported?
 
       case capability
-      when :network then Preflight.problem(network: true).nil?
-      when :network_policy then Preflight.problem(network: { allow: [] }).nil? && proxy_enforcement?
+      when :network then Preflight.problem(network: true, backend: runs_on).nil?
+      when :network_policy then Preflight.problem(network: { allow: [] }, backend: runs_on).nil? && proxy_enforcement?
       when *RESOURCE_CAPABILITIES.keys then Preflight.resource_problem(RESOURCE_CAPABILITIES[capability]).nil?
       else configured_backends.any? { |backend| backend.supports?(capability) }
       end
@@ -109,6 +112,10 @@ module MXC
 
     private
 
+    def runs_on
+      availability.runs_on
+    end
+
     def proxy_enforcement?
       !Preflight.linux? || configured_backends.any? { |backend| backend.supports?(:proxy_enforcement) }
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mxc
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: x86_64-linux
 authors:
 - Carmine Paolino
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-14 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies: []
 description: An unofficial Ruby binding to Microsoft's MXC. Run commands in Bubblewrap,
   Seatbelt or Windows ProcessContainer sandboxes with filesystem, network, environment
@@ -32,6 +32,8 @@ files:
 - lib/mxc/chunk.rb
 - lib/mxc/configuration.rb
 - lib/mxc/error.rb
+- lib/mxc/libraries.rb
+- lib/mxc/load_commands.rb
 - lib/mxc/native.rb
 - lib/mxc/preflight.rb
 - lib/mxc/process.rb