chore(sandbox): remove unused capability dependency and refresh Landlock comments

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

Cargo.lock

@@ -73,7 +73,6 @@ russh-sftp = "3.0"
 uuid = { workspace = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-capctl = "0.2.4"
 landlock = "0.4"
 seccompiler = "0.5"
 socket2 = { workspace = true }

crates/openshell-sandbox/Cargo.toml

@@ -88,9 +88,10 @@ pub fn probe_availability() -> LandlockAvailability {
 
 /// A prepared Landlock ruleset ready to be enforced via `restrict_self()`.
 ///
-/// Created by [`prepare`] while running as root (so `PathFd::new()` can open
-/// any path regardless of DAC permissions). Enforced by [`enforce`] after
-/// `drop_privileges()` — `restrict_self()` does not require elevated privileges.
+/// Path FDs are opened before enforcement. The capability-free launch path
+/// prepares the baseline and user rules as the workload identity, then calls
+/// [`enforce`] in the child before exec. `restrict_self()` does not require
+/// elevated privileges.
 pub struct PreparedRuleset {
     ruleset: landlock::RulesetCreated,
     compatibility: LandlockCompatibility,
@@ -102,10 +103,11 @@ enum PathOpenMode {
     CurrentUser,
 }
 
-/// Phase 1: Open `PathFds` and build the Landlock ruleset **as root**.
+/// Phase 1: Open `PathFds` and build the Landlock ruleset with strict path opening.
 ///
-/// This must run before `drop_privileges()` so that `PathFd::new()` can open
-/// paths that are only accessible to root (e.g. mode 700 directories).
+/// Opens configured paths as the calling identity. Inaccessible paths fail in
+/// hard-requirement mode and are skipped in best-effort mode. Unlike
+/// [`prepare_current_user`], this does not always omit inaccessible paths.
 ///
 /// Returns `None` if there are no filesystem paths to restrict (no-op).
 /// Returns `Some(PreparedRuleset)` on success, or an error.
@@ -394,9 +396,9 @@ fn prepare_with_path_open_mode(
 
 /// Phase 2: Enforce a prepared Landlock ruleset by calling `restrict_self()`.
 ///
-/// This runs **after** `drop_privileges()`. The `restrict_self()` syscall does
-/// not require root — it only restricts the calling thread (and its future
-/// children), which is always permitted.
+/// The capability-free launch path calls this in the child before exec, already
+/// running as the workload identity. `restrict_self()` does not require root;
+/// it restricts the calling thread and its future children.
 ///
 /// Respects the same `best_effort` / `hard_requirement` compatibility as
 /// [`prepare`]: if `restrict_self()` fails and the policy is `best_effort`,

crates/openshell-sandbox/src/sandbox/linux/landlock.rs

@@ -18,10 +18,11 @@ pub struct PreparedSandbox {
     policy: SandboxPolicy,
 }
 
-/// Phase 1: Prepare sandbox restrictions **as root** (before `drop_privileges`).
+/// Phase 1: Prepare sandbox restrictions with strict path opening.
 ///
-/// Opens Landlock `PathFds` while the process still has root privileges,
-/// ensuring paths like mode-700 directories are accessible.
+/// Opens configured paths as the calling identity and handles failures according
+/// to the policy's Landlock compatibility mode.
+/// The capability-free launch path uses [`prepare_capability_free`] instead.
 pub fn prepare(policy: &SandboxPolicy, workdir: Option<&str>) -> Result<PreparedSandbox> {
     let landlock = landlock::prepare(policy, workdir)?;
     Ok(PreparedSandbox {
@@ -66,7 +67,7 @@ pub fn prepare_capability_free(
     })
 }
 
-/// Phase 2: Enforce prepared sandbox restrictions (after `drop_privileges`).
+/// Phase 2: Enforce prepared sandbox restrictions in the child before exec.
 ///
 /// Calls `restrict_self()` for Landlock and applies seccomp filters.
 /// Neither operation requires root privileges.